有关于psExec的使用

psExec是微软pstools工具包中最常用的一个工具，也是在内网渗透中的免杀渗透利器。

psExec能够在命令行下在对方没有开启telnet服务的时候返回一个半交互的命令行，像telnet客户端一样。非常方便我们的工作，之所以叫半交互是因为这个命令行不能够执行一条命令中有交互的回显，比如runas的密码输入。

使用方法如下：

PsExec v2.11 - Execute processes remotely
Copyright (C) 2001-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

PsExec executes a program on a remote system, where remotely executed console
applications execute interactively.

Usage: psexec [\\computer[,computer2[,...] | @file]][-u user [-p psswd][-n s][-r
 servicename][-h][-l][-s|-e][-x][-i [session]][-c [-f|-v]][-w directory][-d][-<p
riority>][-a n,n,...] cmd [arguments]
     -a         Separate processors on which the application can run with
                commas where 1 is the lowest numbered CPU. For example,
                to run the application on CPU 2 and CPU 4, enter:
                "-a 2,4"
     -c         Copy the specified program to the remote system for
                execution. If you omit this option the application
                must be in the system path on the remote system.
     -d         Don't wait for process to terminate (non-interactive).
     -e         Does not load the specified account's profile.
     -f         Copy the specified program even if the file already
                exists on the remote system.
     -i         Run the program so that it interacts with the desktop of the
                specified session on the remote system. If no session is
                specified the process runs in the console session.
     -h         If the target system is Vista or higher, has the process
                run with the account's elevated token, if available.
     -l         Run process as limited user (strips the Administrators group
                and allows only privileges assigned to the Users group).
                On Windows Vista the process runs with Low Integrity.
     -n         Specifies timeout in seconds connecting to remote computers.
     -p         Specifies optional password for user name. If you omit this
                you will be prompted to enter a hidden password.
     -r         Specifies the name of the remote service to create or interact.
                with.
     -s         Run the remote process in the System account.
     -u         Specifies optional user name for login to remote
                computer.
     -v         Copy the specified file only if it has a higher version number
                or is newer on than the one on the remote system.
     -w         Set the working directory of the process (relative to
                remote computer).
     -x         Display the UI on the Winlogon secure desktop (local system
                only).
     -priority  Specifies -low, -belownormal, -abovenormal, -high or
                -realtime to run the process at a different priority. Use
                -background to run at low memory and I/O priority on Vista.
     computer   Direct PsExec to run the application on the remote
                computer or computers specified. If you omit the computer
                name PsExec runs the application on the local system,
                and if you specify a wildcard (\\*), PsExec runs the
                command on all computers in the current domain.
     @file      PsExec will execute the command on each of the computers listed
                in the file.
     cmd            Name of application to execute.
     arguments  Arguments to pass (note that file paths must be
                absolute paths on the target system).
     -accepteula This flag supresses the display of the license dialog.

You can enclose applications that have spaces in their name withquotation marks e.g. psexec \\marklap "c:\long name app.exe".
Input is only passed to the remote system when you press the enterkey, and typing Ctrl-C terminates the remote process.

If you omit a user name the process will run in the context of youraccount on the remote system, but will not have access to networkresources (because it is impersonating). Specify a valid user namein the Domain\User syntax if the remote process requires accessto network resources or to run in a different account. Note thatthe password and command is encrypted in transit to the remote system.

 

最常用的命令就是如下图所示

 

但这个工具也有一些缺点，首先原理是基于IPC共享的所以要目标打开445端口（没有测试）。另外最致命的是，在启动这个psExec建立连接之后对方机器上会被安装一个服务

 

 

这样就很容易被管理员发现，但是在psExec安全退出之后这个服务会自动删除（在命令行下使用exit命令退出），但网络上的资料也有碰到过这个服务概率性不能删除的说法，这样就会留下一些痕迹，很容易被管理员发现，所以还是慎用。

另外在附上pstool的其他11个工具的一些作用，还是非常方便的。

◆PsExec - 远程执行进程

◆PsFile - 显示远程打开的文件

◆PsGetSid - 显示计算机或用户的 SID

◆PsKill - 按名称或进程 ID 终止进程

◆PsInfo - 列出有关系统的信息

◆PsList - 列出有关进程的详细信息

◆PsLoggedOn - 查看在本地通过资源共享（包含所有资源）登录的用户

◆PsLogList - 转储事件日志记录

◆PsPasswd － 更改帐户密码

◆PsService - 查看和控制服务

◆PsShutdown - 关闭并重新启动（可选）计算机

◆PsSuspend - 暂停进程