type
status
date
slug
summary
tags
category
icon
password
虚拟机配置信息收集爆破PHPMyAdmin/MySQL密码尝试写入shell写Shell另一种方法布置木马使用MSF生成被控端并上线提权至system转移进程获取密码搭建代理允许远程桌面并关闭防火墙扫描内网使用kiwi 提取信息利用永恒之蓝漏洞新增用户启用本机3389启动内网其他机器的3389端口使用Cobalt Strike来横向使用 Metasploit 联动(CS→Metasploit)frp保活不出网上线CS扫描内网其他机器尝试上线不出网的内网主机参考资料靶场下载其他工具
虚拟机配置
一开始不知道怎么配置网络,直到参考了别人的文档,发现得特意配置,其中Win7负责连接内网和外网,Win2003和Win2008负责连接内网作为域成员,具体网络配置参考参考资料一,也就是Windows 7、Windows Server 2008、Windows Server 2003的网络适配器1都配置为仅主机模式,而Windows 7的网络适配器2配置为NAT模式,允许连接外网,其中网络适配器1的网段修改为192.168.52.0/24
登录后提示密码已过期,修改为 Qwer1234!
Windows 7 的密码又过期了,改为 Qwer1234!@
Windows Server 2003是受Windows Server 2008域控的,所以修改完Windows Server 2008的密码以后,登录2003就会自动变更密码
启用phpstudy,可正常访问,环境搭建完毕。
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F352dcc8d-e3fb-4cc9-a8c7-2c5270d8e244%2FUntitled.png?table=block&id=11093f12-7d85-45bb-a788-8563addbcd48&t=11093f12-7d85-45bb-a788-8563addbcd48&width=951&cache=v2)
由于我的攻击机有Hyper-V也有VMWare,所以在Hyper-V共享一下网络,也就是在这里设置一下外部网络然后选上VMware VMNet8,虽然有点诡异但是能用
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F75479c5d-a9df-422f-a7de-b44e6ef4f59d%2FUntitled.png?table=block&id=b64a7e81-2cb5-48a7-913a-90da7cdcdefa&t=b64a7e81-2cb5-48a7-913a-90da7cdcdefa&width=903&cache=v2)
信息收集
按照目前我所能了解到的收集信息的方法,先进行一波扫描,使用的工具分别为:Goby、fscan
goby扫描以后,发现有MySQL的3306端口打开了,同时发现有一个80端口提供的HTTP服务
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F2e5ba9ca-9e55-4e13-81e1-20965fd5ed0c%2FUntitled.png?table=block&id=b0ad7b4e-1f07-4ad3-8ee1-296652e31193&t=b0ad7b4e-1f07-4ad3-8ee1-296652e31193&width=1428&cache=v2)
使用超级弱口令检查工具进行扫描,发现很快啊,一个没检查出
使用dbeaver进行连接检查,发现无法连接到MySQL服务,看来是白名单ip了
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fa90b9176-7dd4-490f-90d1-85474dc454d6%2FUntitled.png?table=block&id=49f92b69-1214-417c-b7ca-e157fb987c06&t=49f92b69-1214-417c-b7ca-e157fb987c06&width=750&cache=v2)
使用 dirsearch 进行扫描,发现存在有phpinfo.php,还有phpmyAdmin暴露
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fb4625d97-77d7-4d7d-b522-54c334026ad4%2FUntitled.png?table=block&id=e9bbcac1-b02d-4c30-b31c-3587ec0da248&t=e9bbcac1-b02d-4c30-b31c-3587ec0da248&width=895&cache=v2)
爆破PHPMyAdmin/MySQL密码
发现了PHPMyAdmin以后,可以进行爆破,
想通过PHPMyAdmin爆破,但是PHPMyAdmin似乎有token之类的东西不允许多次使用,但是探针可以多次尝试,所以用探针尝试爆破
查看这个的长度确实和其他不一样,密码就是它了
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fce942239-0382-4302-b222-0e7b80fc8312%2FUntitled.png?table=block&id=4b43ae8a-1a0c-4c4a-8066-d036b78ff9dc&t=4b43ae8a-1a0c-4c4a-8066-d036b78ff9dc&width=927&cache=v2)
发现账号密码为root/root,进入后台
尝试写入shell
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F342e6329-0ed8-4ef8-be73-bbd44f07fcf7%2FUntitled.png?table=block&id=b4d2e415-e666-449c-886e-587811fde9b9&t=b4d2e415-e666-449c-886e-587811fde9b9&width=1097&cache=v2)
发现secure_file_priv为NULL,不能写入
执行
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Ffd2ce0d3-9604-4afb-bc65-66f4ec5985e7%2FUntitled.png?table=block&id=d4b3402b-09e9-4678-abb7-f973ef5a9b7b&t=d4b3402b-09e9-4678-abb7-f973ef5a9b7b&width=985&cache=v2)
我们刚刚还扫到一个phpinfo,那肯定就有php的目录,看看去
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fd4c7bf28-3cd7-428e-9133-9b7c19e39d38%2FUntitled.png?table=block&id=631857f4-91ca-4ab3-b9c0-d2331e0c155b&t=631857f4-91ca-4ab3-b9c0-d2331e0c155b&width=796&cache=v2)
很明显这个就是目录
我们打开日志目录,并且改变日志的路径
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F507286d5-3485-4e0b-b08b-c6d4e61fe0cb%2FUntitled.png?table=block&id=d973041b-f294-45f3-a1f0-4f0cfe0c262c&t=d973041b-f294-45f3-a1f0-4f0cfe0c262c&width=1213&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F5de0fc3d-e7c7-43e6-a228-f669a1796ee0%2FUntitled.png?table=block&id=b17169ae-5e31-4a26-bfca-590947e72671&t=b17169ae-5e31-4a26-bfca-590947e72671&width=1132&cache=v2)
已经安排成功了捏,访问一下试试
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F00034d0c-920f-4df1-b11a-3eb630e47421%2FUntitled.png?table=block&id=9e16d6e6-0c28-4222-9fe6-5169894be53a&t=9e16d6e6-0c28-4222-9fe6-5169894be53a&width=1031&cache=v2)
雀食
写Shell
打开AntSword,写Shell试试
访问一下 /test2.php (因为test.php写的时候忘记写分号了,写坏一个文件,上面改一下test2就行
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F64763064-2b59-41fe-8b77-7e667794ed87%2FUntitled.png?table=block&id=dc726558-3430-45e7-8b7e-5ec4e91766f6&t=dc726558-3430-45e7-8b7e-5ec4e91766f6&width=742&cache=v2)
antsword添加一下,测试成功连接
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fa18765ae-8ca7-4a89-ab26-a5b15d0980c4%2FUntitled.png?table=block&id=15d9df1d-0cfb-48ae-ac52-ba15db328805&t=15d9df1d-0cfb-48ae-ac52-ba15db328805&width=1319&cache=v2)
虚拟终端看一下,发现用户是Administrator
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fa2ede342-825c-4b7f-b0d5-d98aeb3093d0%2FUntitled.png?table=block&id=b353c910-6c95-48fd-b759-6bbc1dd28383&t=b353c910-6c95-48fd-b759-6bbc1dd28383&width=905&cache=v2)
另一种方法
不过看了一下别人的做法,发现自己用dirsearch并没有扫出备份文件,上去看了一下人家叫beifen.rar,也怪自己字典不够充足,于是下了个御剑扫描试了一下
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F75723bad-9709-4a34-aaa0-8fede5813771%2FUntitled.png?table=block&id=8844ecee-e74f-4851-a2df-9a162ae941d7&t=8844ecee-e74f-4851-a2df-9a162ae941d7&width=853&cache=v2)
但是用御剑没扫出phpinfo.php,哪位有比较好用的字典可以推荐一下(逃
在config.php里面可以看到密码是root
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F0a7f640e-906e-4597-b4d0-c6e08a146ce1%2FUntitled.png?table=block&id=f35ea3ce-657c-4bf2-989b-0382e753e7e4&t=f35ea3ce-657c-4bf2-989b-0382e753e7e4&width=680&cache=v2)
不过看到这个cms名称,可以尝试一下访问 /yxcms ,发现雀食有点东西(虽然我完全没想到
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F23f12316-7dad-40eb-8d81-9c9f819ee60f%2FUntitled.png?table=block&id=2f11c036-53f3-4576-ac9c-e64c0f9bf49c&t=2f11c036-53f3-4576-ac9c-e64c0f9bf49c&width=328&cache=v2)
同时有默认账号密码,输入 http://172.16.250.130/yxcms/index.php?r=admin/index/login 进入后台
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F3e31f77c-56b2-48fe-a164-13cf15f1d5ed%2FUntitled.png?table=block&id=d8502745-1419-49e5-b8e0-e0ce2ed49758&t=d8502745-1419-49e5-b8e0-e0ce2ed49758&width=1392&cache=v2)
这里也有SQL执行功能,也可以改到shell上
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fec6c9f90-0f78-4744-abd8-1e32b37bebe3%2FUntitled.png?table=block&id=4062aefa-e7c1-48a6-8690-c316e542a6f2&t=4062aefa-e7c1-48a6-8690-c316e542a6f2&width=1392&cache=v2)
或者使用模板编辑功能插入shell
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F4809d2a7-9bea-4ceb-a075-0021cfebd2d4%2FUntitled.png?table=block&id=0ab399c2-e211-4069-aeab-b41ed0c7636d&t=0ab399c2-e211-4069-aeab-b41ed0c7636d&width=616&cache=v2)
经过和备份文件的比对,可以确定文件夹应该在 \yxcms\protected\apps\default\view,访问
/yxcms/protected/apps/default/view/default/test.php
拿到shell文件地址
布置木马
这一块其实我也不是很懂,但是以学习为目的,就参考别人的教程跟着一起试试
使用MSF生成被控端并上线
安装好metasploit后,生成密码并通过antsword放上去
连接好了以后,就可以依葫芦画瓢地执行一下了
将刚才生成的木马放到目录种,然后再执行一下
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Ff9506a0a-3211-402f-b7ee-cbc99bd8dcb6%2FUntitled.png?table=block&id=41302b3f-28c2-4487-a555-ec5a00b32d12&t=41302b3f-28c2-4487-a555-ec5a00b32d12&width=289&cache=v2)
上线了
提权至system
执行sessions 1恢复到session,然后使用getsystem看看能不能提权到system
转移进程
由于所使用的kiwi默认加载32位,需要先查看系统进程列表,再迁移到64位进程中,这里我们转移到PID位396的进程csrss.exe中
获取密码
输入creds_all,获取到密码是Qwer1234
搭建代理
可以使用自动路由,也可以指定路由添加,不过这里注意要使用route add来添加路由的话,确保自己处于msfconsole而不是meterpreter
然后我们来创建一个socks代理服务器
允许远程桌面并关闭防火墙
然后尝试进行连接,注意域写 GOD\Administrator ,密码写 Qwer1234
然后就成功登录了
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fdea864d5-faf4-439a-b697-e736e772fc09%2FUntitled.png?table=block&id=24f0e720-b73e-46cd-b3c8-67d9c26db121&t=24f0e720-b73e-46cd-b3c8-67d9c26db121&width=1591&cache=v2)
扫描内网
使用 arp_scanner 来使用ARP扫描内网,先search再use,然后options查属性
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F872af5b4-1de8-4bc9-b54f-68288e4dce1d%2FUntitled.png?table=block&id=1f371e77-8d77-4e8a-ba19-09a58faa8029&t=1f371e77-8d77-4e8a-ba19-09a58faa8029&width=1624&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fd58d3b06-0052-469a-b204-91e2f3054c5d%2FUntitled.png?table=block&id=3569fbf4-39dd-4e82-8eb1-2feecdc194f5&t=3569fbf4-39dd-4e82-8eb1-2feecdc194f5&width=1366&cache=v2)
udp sweep也可以用来扫描
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F88e545c3-4de8-422d-a3fa-381d8ff290ee%2FUntitled.png?table=block&id=06600144-343f-4ecc-b3e9-22e76c065bcb&t=06600144-343f-4ecc-b3e9-22e76c065bcb&width=1618&cache=v2)
设置自动路由
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F6ea3846e-78c3-428f-b6f7-5f9364ac6895%2FUntitled.png?table=block&id=80b923a1-dfaa-46db-afcb-f83bc3b06d1e&t=80b923a1-dfaa-46db-afcb-f83bc3b06d1e&width=1582&cache=v2)
搜索ms17_010,设置RHOSTS为192.168.52.0/24,将THREADS设大一点
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F68883832-84f6-47e4-91ba-ea920fb2eb1d%2FUntitled.png?table=block&id=3510ccec-6e4c-4e12-9757-ad298b8432fb&t=3510ccec-6e4c-4e12-9757-ad298b8432fb&width=1446&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F9eb0eb28-d3b9-4102-b462-b095e1ea8695%2FUntitled.png?table=block&id=f5ab0e2b-a13f-4571-835f-32ca0a2151a5&t=f5ab0e2b-a13f-4571-835f-32ca0a2151a5&width=1604&cache=v2)
搜索到两台其他机器
使用kiwi 提取信息
在session中,可以使用 load kiwi 来加载kiwi,然后使用 creds_all 拿到凭据
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F5f4b3bc8-89aa-48e0-a52c-28bac27a644e%2FUntitled.png?table=block&id=ef093dd3-adaf-4bd5-a60e-61a27f015d11&t=ef093dd3-adaf-4bd5-a60e-61a27f015d11&width=2086&cache=v2)
目前我们可以拿到这些信息
利用永恒之蓝漏洞新增用户
不知道为啥用 ms17_010 的漏洞没办法新增sessions,但是可以执行命令,没办法,直接进行命令执行吧
先给存在漏洞的机器新增一个用户,明确一下命令先
set RHOSTS 192.168.52.138,set COMMAND whoami,看看权限
nt authority\system ,很好,可以继续玩
启用本机3389
直接 search enable_rdp,然后show options 看一下选项设置一下,直接run就行
启动内网其他机器的3389端口
3389端口都没有开起来,需要用命令给它开起来
奇怪的是,我使用了下面的几种方法都没有开起来,使用netstat -an还是没有开启3389端口
解决了。。。解决方法很弱智,加个单引号就好了。。。
因为使用了msf的代理以后不能用反向代理,所以我们只能用 ms17_010_command。
但下面说了,可以使用windows/meterpreter/bind_tcp 用作正向,可以试试,但是我怎么横都横不过去,算了,还是直接暴力上传木马手动打开吧=_=
(由于一段时间没搞了,密码改了 Qwer233!)
好有年代感的跨年代会和
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fff2d9632-6706-48d7-97fd-ae43c6837cd3%2FUntitled.png?table=block&id=e3f0d0e5-c887-49b7-88e5-63f2d25a0376&t=e3f0d0e5-c887-49b7-88e5-63f2d25a0376&width=1366&cache=v2)
使用Cobalt Strike来横向
有时候使用Cobalt Strike这种可视化工具会比较方便,所以可以使用这种工具来横向。
但是这样用不了VPN模式,可以用socks模式
使用 Metasploit 联动(CS→Metasploit)
输入msfconsole启动,然后进行如下设置
在 Cobalt Strike 中进行设置,注意要设置Foreign HTTP
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F42b689ad-0319-41c7-9c9f-1ab929f1285a%2FUntitled.png?table=block&id=5c91e115-1381-494b-95d1-7eb205691415&t=5c91e115-1381-494b-95d1-7eb205691415&width=1640&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F4debf865-9505-4ff6-a951-734bebe5fbe2%2FUntitled.png?table=block&id=5a498269-e91d-4391-ab4d-4d03f77bf599&t=5a498269-e91d-4391-ab4d-4d03f77bf599&width=1046&cache=v2)
在beacon中输入 spawn msf,然后在msfconsole这里收到消息
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F457531f3-3c3f-490d-8a6d-e3de33920a87%2FUntitled.png?table=block&id=01d57154-7cd4-48e1-992b-6a8161dde8f3&t=01d57154-7cd4-48e1-992b-6a8161dde8f3&width=1578&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F89b9d40d-8c90-490b-a55f-e96b8bf53d9d%2FUntitled.png?table=block&id=a6683d4c-85b6-4cc6-a78a-b46af9aaa551&t=a6683d4c-85b6-4cc6-a78a-b46af9aaa551&width=1594&cache=v2)
CS可以在beacon前面加shell来执行shell,写入hashdump可以读内存密码,logonpasswords可以读注册表密码
frp保活
下好frp丢上去保活,一看已经上线了
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F829b3577-de16-4031-8415-22d684f1ef2f%2FUntitled.png?table=block&id=b3af10ed-c9a7-422a-b8d5-cf7154f5d99b&t=b3af10ed-c9a7-422a-b8d5-cf7154f5d99b&width=1421&cache=v2)
不出网上线CS
由于其他两台机器是不出网的,而我们只能拿到一台机器mimikatz的哈希密码,我们可以尝试用这凭据来进行喷洒对其他主机进行链接上线。
扫描内网其他机器
由于我们之前已经拿到了域GOD.ORG的哈希密码,可以先进行一波portscan,看看其他主机是否在域控范围内。
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fa3ebd463-e77c-4ea2-87f0-0e48d9f8a955%2FUntitled.png?table=block&id=3cf88432-54f5-47a5-bf01-716db14e775e&t=3cf88432-54f5-47a5-bf01-716db14e775e&width=271&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F295fbd70-fe4b-4bf8-9d4b-0e6098737a10%2FUntitled.png?table=block&id=88564fe3-2016-48fa-9bcd-d074cab1bc23&t=88564fe3-2016-48fa-9bcd-d074cab1bc23&width=392&cache=v2)
选择特定的内网,然后进行内网扫描,就能在Target Table看到对应的主机,接下来就可以用获取到的密码进行喷洒上线了
尝试上线不出网的内网主机
首先新建一个监听器
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F1f503ad7-e132-4d87-a9a9-2aa1baf0fed0%2FUntitled.png?table=block&id=269dfc0e-bb71-4946-a61f-72eecc2d5d18&t=269dfc0e-bb71-4946-a61f-72eecc2d5d18&width=496&cache=v2)
然后切换视图
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F2fc31ec0-908d-402c-b2c6-e42a5bab17b8%2FUntitled.png?table=block&id=76756d4a-d1e5-4b48-aabb-66621f79e0a9&t=76756d4a-d1e5-4b48-aabb-66621f79e0a9&width=240&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2Fd74df206-1d93-409b-bf32-0827310c05ea%2FUntitled.png?table=block&id=83e15492-b31f-414b-90c9-91eaa29bf9dd&t=83e15492-b31f-414b-90c9-91eaa29bf9dd&width=328&cache=v2)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F7278f45d-bfa5-4266-b38c-4f1f6fc55295%2FUntitled.png?table=block&id=b4d18560-8619-465d-85de-9977c9310b7a&t=b4d18560-8619-465d-85de-9977c9310b7a&width=624&cache=v2)
重复操作,三台主机都可上线~(注意32位的Windows Server 2003不能用psexec64,要记得换回去)
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F5878d5d7-f524-4838-b5c5-9ab25a5d5399%2FUntitled.png?table=block&id=48b1d668-a531-4e09-9061-a52e7e7cc383&t=48b1d668-a531-4e09-9061-a52e7e7cc383&width=1356&cache=v2)
最终的上线图
![notion image](https://www.notion.so/image/https%3A%2F%2Fs3-us-west-2.amazonaws.com%2Fsecure.notion-static.com%2F479677ac-9b2a-4889-97a0-4d5073f541ec%2FUntitled.png?table=block&id=d6b52082-602f-4b4b-b967-9e7de7fff561&t=d6b52082-602f-4b4b-b967-9e7de7fff561&width=759&cache=v2)