From&thx2:
http://badishi.com/poison-ivy-exploit-metasploit-module/
https://twitter.com/badishi
这个Exploit已经集成在最新版本的Msf中了,老外的文章里也有源文件,可以修改后单独提出来.

首先为了模拟完整的环境,第一步是抓到已经成为肉鸡的电脑上反向连接的IP,这里顺便介绍下简单ARK工具的使用及手工查马的方法吧.
PI的反向连接配置,这里填的静态IP

启动项及释放目录等,同时设定的插默认浏览器和svchost.exe.

完整的配置信息如下:
- Connection
Connect to: 92.168.124.134:3460:0,
ID: test
Group:
Password: admin
Connect through proxy: No
- Install
ActiveX Startup: Yes
ActiveX Key: {344D13DD-52AF-DD3F-2A33-ED4792414430}
Copy File: Yes
File Name: svchost.exe
Copy File To: System Folder
Melt File: Yes
- Advanced
Process Mutex: )!VoqA.I4
Inject Server: Yes
Persistence: No
Inject into running process: Yes
Inject into: svchost.exe
Key Logger: No
Format: PE
File Alignment: 512
- Build
Icon: No
Execute Third-party Applications: No