load powershell            #加载powershell功能
powershell_import /root/PowerView.ps1      #导入powershell脚本，提前将该powershell脚本放到指定目录
powershell_execute Get-NetDomain     #执行该脚本下的功能模块Get-domain，该模块用于获取域信息，一个脚本下通常有多个功能模块
powershell_execute Invoke-UserHunter  #该功能模块用于定位域管理员登录的主机
powershell_execute Get-NetForest      #该模块用于定位域信息

​

​

加载stdapi

有时候虽然我们获取到了meterpreter，但是执行一些命令会显示没有该命令，这时我们可以执行：load stdapi来加载，这样我们就可以执行命令了。

​

升级Session

有时候，当我们收到的不是 meterpreter 类型的 session 的话，可能不好操作。我们可以执行命令  sessions -u  id 来升级session。执行该命令，默认调用的是   post/multi/manage/shell_to_meterpreter  模块。

​

Meterpreter的更多用法

Core Commands   核心命令
=============

    Command                   Description
    -------                   -----------
    ?                            Help menu
    background         Backgrounds the current session
    bgkill                     Kills a background meterpreter script
    bglist                     Lists running background scripts
    bgrun                      Executes a meterpreter script as a background thread
    channel                   Displays information or control active channels
    close                      Closes a channel
    disable_unicode_encoding   Disables encoding of unicode strings
    enable_unicode_encoding   Enables encoding of unicode strings
    exit                         Terminate the meterpreter session
    get_timeouts              Get the current session timeout values
    help                       Help menu
    info                        Displays information about a Post module
    irb                          Drop into irb scripting mode
    load                       Load one or more meterpreter extensions
    machine_id                Get the MSF ID of the machine attached to the session
    migrate                   Migrate the server to another process
    quit                      Terminate the meterpreter session
    read                      Reads data from a channel
    resource                  Run the commands stored in a file
    run                       Executes a meterpreter script or Post module
    set_timeouts              Set the current session timeout values
    sleep                     Force Meterpreter to go quiet, then re-establish session.
    transport                 Change the current transport mechanism
    use                       Deprecated alias for 'load'
    uuid                      Get the UUID for the current session
    write                     Writes data to a channel

Stdapi: File system Commands 文件系统命令
============================

    Command       Description
    -------       -----------
    cat           Read the contents of a file to the screen
    cd            Change directory
    dir           List files (alias for ls)
    download      Download a file or directory
    edit          Edit a file
    getlwd        Print local working directory
    getwd         Print working directory
    lcd           Change local working directory
    lpwd          Print local working directory
    ls            List files
    mkdir         Make directory
    mv            Move source to destination
    pwd           Print working directory
    rm            Delete the specified file
    rmdir         Remove directory
    search        Search for files
    show_mount    List all mount points/logical drives
    upload        Upload a file or directory

Stdapi: Networking Commands 网络命令
===========================

    Command       Description
    -------       -----------
    arp                Display the host ARP cache
    getproxy       Display the current proxy configuration
    ifconfig        Display interfaces
    ipconfig      Display interfaces
    netstat       Display the network connections
    portfwd        Forward a local port to a remote service
    route          View and modify the routing table

Stdapi: System Commands 系统命令
=======================
 
    Command       Description
    -------       -----------
    clearev       Clear the event log
    drop_token    Relinquishes any active impersonation token.
    execute       Execute a command
    getenv        Get one or more environment variable values
    getpid        Get the current process identifier
    getprivs      Attempt to enable all privileges available to the current process
    getsid        Get the SID of the user that the server is running as
    getuid        Get the user that the server is running as
    kill          Terminate a process
    ps            List running processes
    reboot        Reboots the remote computer
    reg           Modify and interact with the remote registry
    rev2self      Calls RevertToSelf() on the remote machine
    shell         Drop into a system command shell
    shutdown      Shuts down the remote computer
    steal_token   Attempts to steal an impersonation token from the target process
    suspend       Suspends or resumes a list of processes
    sysinfo       Gets information about the remote system, such as OS

Stdapi: User interface Commands 用户界面命令
===============================

    Command        Description
    -------        -----------
    enumdesktops       List all accessible desktops and window stations
    getdesktop             Get the current meterpreter desktop
    idletime                    Returns the number of seconds the remote user has been idle
    keyscan_dump       Dump the keystroke buffer
    keyscan_start        Start capturing keystrokes
    keyscan_stop        Stop capturing keystrokes
    screenshot           Grab a screenshot of the interactive desktop
    setdesktop              Change the meterpreters current desktop
    uictl                       Control some of the user interface components

Stdapi: Webcam Commands 摄像头命令
=======================

    Command        Description
    -------        -----------
    record_mic           Record audio from the default microphone for X seconds
    webcam_chat       Start a video chat
    webcam_list       List webcams
    webcam_snap    Take a snapshot from the specified webcam
    webcam_stream   Play a video stream from the specified webcam

Priv: Elevate Commands 提权命令
======================
    Command       Description
    -------       -----------
    getsystem     Attempt to elevate your privilege to that of local system.

Priv: Password database Commands 密码
================================
    Command       Description
    -------       -----------
    hashdump      Dumps the contents of the SAM database

Priv: Timestomp Commands 时间戳命令
========================
    Command       Description
    -------       -----------
    timestomp     Manipulate file MACE attributes

          如果想跟我一起讨论的话，就快加入我的知识星球吧。星球里有一千多位同样爱好安全技术的小伙伴一起交流！

​