Vulnerability introduction:

The MS08-067 vulnerability will affect all Windows systems except Windows Server 2008 Core, including: Windows 2000/XP/Server 2003/Vista/Server 2008 versions, and even Windows 7 Pro in the testing phase-Beta. (From Baidu Encyclopedia)

harm:

Hackers can use this vulnerability to send remote specially crafted RPC requests to computers on the network, and can execute remote codes on the computer without authentication. This means that even if your computer has an administrator password, you can only be at the mercy of hackers. (From Baidu Encyclopedia)

For details of the vulnerability, please refer to: Microsoft Security BulletinKB958644

As a classic vulnerability, MS08-067 is very suitable for beginners, so this article mainly introduces how to use Metasploit to reproduce the vulnerability.

This experiment is done in a virtual machine, the virtual machine uses VirtualBox, and the virtual machine network uses the Host-Only network.

Target machine: 192.168.56.101 (WindowsXP)

Attacker: 192.168.56.102 (Kali Linux)

First open msfconsole under Kali, and then enter the vulnerability query command: search 08-067

Start calling that vulnerability:

Open the options and view the options that need to be set:

It is found that the IP address of the target machine needs to be set, and the target IP address is set

Start querying the payload to be used

Call the required payload

Check the options to be set by the payload

Found that you need to set your own host IP, set it

Set the host IP and check whether the setting is successful:

Use Nmap to scan the target machine to view its version information:

Check the version that the payload is adapted to

Set the payload of the corresponding version of the target machine, where the target machine corresponds to the seventh one, choose according to the actual situation

carried out:

Found that the execution is successful, enter the shell to obtain the target machine permissions:

It is found that the permission obtained is a system

Get the username of the target machine:

Perform permission verification, try to add a user, user name: hahaha

Enter the target machine to check and find that there is a newly added user hahaha

Delete the hahaha user of the target machine in the host:

successfully deleted

Use the target machine to check whether the deletion is successful:

Found that the delete check was successful!

This recurrence is complete!