Opisywa\u0142em jak z drukarki dosta\u0107 si\u0119 do sieci wewn\u0119trznej naszej instytucji<\/a>.<\/p>\nOczywi\u015bcie w ten spos\u00f3b dostanie si\u0119 na podatne serwery Windows w naszej sieci.<\/p>\n
<\/p>\n
Najprostszy i najszybszy spos\u00f3b na znalezienie otwartych RDP w naszej sieci:<\/p>\n
nmap 192.168.1.0\/24 -p 3389 –open<\/p>\n
<\/p>\n
Poni\u017cej listing jak sprawdzi\u0107 przy pomocy Metasploit czy nasze maszyny s\u0105 podatne.<\/p>\n
<\/p>\n
msf5 > search BlueKeep\r\n\r\nMatching Modules\r\n================\r\n\r\n# Name Disclosure Date Rank Check Description\r\n- ---- --------------- ---- ----- -----------\r\n0 auxiliary\/scanner\/rdp\/cve_2019_0708_bluekeep 2019-05-14 normal Yes CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE Check\r\n\r\n\r\nmsf5 > use auxiliary\/scanner\/rdp\/cve_2019_0708_bluekeep\r\nmsf5 auxiliary(scanner\/rdp\/cve_2019_0708_bluekeep) > show options\r\n\r\nModule options (auxiliary\/scanner\/rdp\/cve_2019_0708_bluekeep):\r\n\r\nName Current Setting Required Description\r\n---- --------------- -------- -----------\r\nRDP_CLIENT_IP 192.168.0.100 yes The client IPv4 address to report during connect\r\nRDP_CLIENT_NAME rdesktop no The client computer name to report during connect, UNSET = random\r\nRDP_DOMAIN no The client domain name to report during connect\r\nRDP_USER no The username to report during connect, UNSET = random\r\nRHOSTS yes The target address range or CIDR identifier\r\nRPORT 3389 yes The target port (TCP)\r\nTHREADS 1 yes The number of concurrent threads\r\n\r\n\r\nAuxiliary action:\r\n\r\nName Description\r\n---- -----------\r\nScan Scan for exploitable targets\r\n\r\n\r\nmsf5 auxiliary(scanner\/rdp\/cve_2019_0708_bluekeep) > set rhosts 192.168.1.82\r\nrhosts => 192.168.1.82\r\nmsf5 auxiliary(scanner\/rdp\/cve_2019_0708_bluekeep) > run\r\n\r\n[*] 192.168.1.82:3389 - The target service is running, but could not be validated.\r\n[*] 192.168.1.82:3389 - Scanned 1 of 1 hosts (100% complete)\r\n[*] Auxiliary module execution completed\r\nmsf5 auxiliary(scanner\/rdp\/cve_2019_0708_bluekeep) > set rhosts 192.168.1.248\r\nrhosts => 192.168.1.248\r\nmsf5 auxiliary(scanner\/rdp\/cve_2019_0708_bluekeep) > run\r\n\r\n[+] 192.168.1.248:3389 - The target is vulnerable.\r\n[*] 192.168.1.248:3389 - Scanned 1 of 1 hosts (100% complete)\r\n[*] Auxiliary module execution completed\r\nmsf5 auxiliary(scanner\/rdp\/cve_2019_0708_bluekeep) ><\/pre>\n","protected":false},"excerpt":{"rendered":"Po sieci panosz\u0105 si\u0119 ju\u017c robaki, kt\u00f3re wykorzystuj\u0105c t\u0105 podatno\u015b\u0107 buduj\u0105 botnety z\u0142o\u017cone z serwer\u00f3w Windows. Oczywi\u015bcie robaki te szukaj\u0105 maszyn z wystawionym RDP na zewn\u0105trz, wbrew logice jest takich maszyn bardzo du\u017co. A co je\u015bli kto\u015b uzyska dost\u0119p do naszej np. drukarki? Opisywa\u0142em jak z drukarki dosta\u0107 si\u0119 do sieci wewn\u0119trznej naszej instytucji. Oczywi\u015bcie […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[94,3],"tags":[],"class_list":["post-635","post","type-post","status-publish","format-standard","hentry","category-pentatesty","category-uslugi"],"_links":{"self":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/635","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/comments?post=635"}],"version-history":[{"count":5,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/635\/revisions"}],"predecessor-version":[{"id":641,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/posts\/635\/revisions\/641"}],"wp:attachment":[{"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/media?parent=635"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/categories?post=635"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.antynet.pl\/index.php\/wp-json\/wp\/v2\/tags?post=635"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"http:\/\/www.antynet.pl\/domains\/www.antynet.pl\/public_html\/wp-content\/uploads\/2019\/08\/Bez-nazwy.png\" "\\"\\"")
<\/p>\n