有关于psExec的使用

psExec是微软pstools工具包中最常用的一个工具，也是在内网渗透中的免杀渗透利器。psExec能够在命令行下在对方没有开启telnet服务的时候返回一个半交互的命令行，像telnet客户端一样 psExec是微软pstools工具包中最常用的一个工具，也是在内网渗透中的免杀渗透利器。psExec能够在命令行下在对方没有开启telnet服务的时候返回一个半交互的命令行，像telnet客户端一样。非常方便我们的工作，之所以叫半交互是因为这个命令行不能够执行一条命令中有交互的回显，比如runas的密码输入。使用方法如下：PsExec v2.11 - Execute processes remotelyCopyright (C) 2001-2014 Mark RussinovichSysinternals - www.sysinternals.comPsExec executes a program on a remote system, where remotely executed consoleapplications execute interactively.Usage: psexec [\\computer[,computer2[,...] | @file]][-u user [-p psswd][-n s][-r servicename][-h][-l][-s|-e][-x][-i [session]][-c [-f|-v]][-w directory][-d][-

][-a n,n,...] cmd [arguments] -a Separate processors on which the application can run with commas where 1 is the lowest numbered CPU. For example, to run the application on CPU 2 and CPU 4, enter: "-a 2,4" -c Copy the specified program to the remote system for execution. If you omit this option the application must be in the system path on the remote system. -d Don't wait for process to terminate (non-interactive). -e Does not load the specified account's profile. -f Copy the specified program even if the file already exists on the remote system. -i Run the program so that it interacts with the desktop of the specified session on the remote system. If no session is specified the process runs in the console session. -h If the target system is Vista or higher, has the process run with the account's elevated token, if available. -l Run process as limited user (strips the Administrators group and allows only privileges assigned to the Users group). On Windows Vista the process runs with Low Integrity. -n Specifies timeout in seconds connecting to remote computers. -p Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password. -r Specifies the name of the remote service to create or interact. with. -s Run the remote process in the System account. -u Specifies optional user name for login to remote computer. -v Copy the specified file only if it has a higher version number or is newer on than the one on the remote system. -w Set the working directory of the process (relative to remote computer). -x Display the UI on the Winlogon secure desktop (local system only). -priority Specifies -low, -belownormal, -abovenormal, -high or -realtime to run the process at a different priority. Use -background to run at low memory and I/O priority on Vista. computer Direct PsExec to run the application on the remote computer or computers specified. If you omit the computer name PsExec runs the application on the local system, and if you specify a wildcard (\\*), PsExec runs the command on all computers in the current domain. @file PsExec will execute the command on each of the computers listed in the file. cmd Name of application to execute. arguments Arguments to pass (note that file paths must be absolute paths on the target system). -accepteula This flag supresses the display of the license dialog.You can enclose applications that have spaces in their name withquotation marks e.g. psexec \\marklap "c:\long name app.exe".Input is only passed to the remote system when you press the enterkey, and typing Ctrl-C terminates the remote process.If you omit a user name the process will run in the context of youraccount on the remote system, but will not have access to networkresources (because it is impersonating). Specify a valid user namein the Domain\User syntax if the remote process requires accessto network resources or to run in a different account. Note thatthe password and command is encrypted in transit to the remote system.最常用的命令就是如下图所示但这个工具也有一些缺点，首先原理是基于IPC共享的所以要目标打开445端口（没有测试）。另外最致命的是，在启动这个psExec建立连接之后对方机器上会被安装一个服务这样就很容易被管理员发现，但是在psExec安全退出之后这个服务会自动删除（在命令行下使用exit命令退出），但网络上的资料也有碰到过这个服务概率性不能删除的说法，这样就会留下一些痕迹，很容易被管理员发现，所以还是慎用。另外在附上pstool的其他11个工具的一些作用，还是非常方便的。◆PsExec - 远程执行进程◆PsFile - 显示远程打开的文件◆PsGetSid - 显示计算机或用户的 SID◆PsKill - 按名称或进程 ID 终止进程◆PsInfo - 列出有关系统的信息◆PsList - 列出有关进程的详细信息◆PsLoggedOn - 查看在本地通过资源共享（包含所有资源）登录的用户◆PsLogList - 转储事件日志记录◆PsPasswd － 更改帐户密码◆PsService - 查看和控制服务◆PsShutdown - 关闭并重新启动（可选）计算机◆PsSuspend - 暂停进程特别提示：psexec在第一次运行的时候会弹出框框，让用户选择是否允许此软件运行。如果在命令行模式下面，防止弹框，第一次运行时需要带参数： /accepteula，此参数未公开。菜鸟言论，仅供娱乐！