msf使用自查

本文最后更新于：8 个月前

https://www.secpulse.com/archives/136847.html

伪造时间戳：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
meterpreter > timestomp c://

Usage: timestomp <file(s)> OPTIONS

OPTIONS:

    -a   Set the "last accessed" time of the file
    -b   Set the MACE timestamps so that EnCase shows blanks
    -c   Set the "creation" time of the file
    -e   Set the "mft entry modified" time of the file
    -f   Set the MACE of attributes equal to the supplied file
    -h   Help banner
    -m   Set the "last written" time of the file
    -r   Set the MACE timestamps recursively on a directory
    -v   Display the UTC MACE values of the file
    -z   Set all four attributes (MACE) of the file
1
2
timestomp -v C://2.txt   #查看时间戳
timestomp C://2.txt -f C://1.txt #将1.txt的时间戳复制给2.txt