search

rapid7 / metasploit-framework

Metasploit Framework
https://www.metasploit.com/
Other
34.13k stars 13.97k forks source link

Add support for Windows 10 Enterprise LTSB 14393 x64 in 'windows/smb/ms17_010_eternalblue' and for x86 based processors #19335

Open Admin9961 opened 3 months ago

Admin9961 commented 3 months ago

The pinned build 'LTSB 14393 x64' is vulnerable to MS17-010, however the Metasploit module doesn't support it. Nor has support for x86 variants. I have old release of msf (6.3.44) but I'm pretty sure that module is still weak even in the last release.

Additionally, we could set the module to default to payload 'windows/x64/shell/reverse_tcp' rather than the Meterpreter variants: that's becouse I observed the default Meterpreter has a very high chance of crashing the target system.

image_2024-07-22_114315625

Admin9961 commented 3 months ago

PS. Note 192.168.59.128 is my private subnet LAN IP and not a Public one.

bwatters-r7 commented 2 months ago

Adding x86 support for eternalblue is not a trivial endeavor- I have not looked at the code in a long time, but offhand, the kernel to userland shellcode is all in 64-bits and several other aspects will have to be completely rewritten to accommodate the heap overflow and grooming in 32-bit address space. Our understanding is that x86 Windows 10 is rare in the wild and Windows 10 as a whole has just over one year of support from Microsoft, so spending time supporting this feature is not a priority for the Metasploit team right now. That said, if a community member wanted to tackle this, we would certainly be happy to have it!