exploit/windows/smb/ms17_010_eternalblue 这个只能针对x64系统,Arch 写了 x64。
对32位(x86)的只能用 exploit/windows/smb/ms17_010_psexec。
后者要求option指定 named pipe(有默认的字典文件)。
一番尝试,发现后者必须要改target的组策略(改完exploit能连上默认字典文件第一个 named pipe "\netlogon"):
gpedit.msc → Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options
Network access: Restrict anonymous access to Named Pipes and Shares = Disabled
这个默认为 Enabled,必须要改成 Disabled
查一下该组策略的文档:
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares
Enabling this policy setting restricts null session access to unauthenticated users to all server pipes and shared folders except those server pipes and shared folders listed in the NullSessionPipes and NullSessionShares registry entries.
所以这个不改成Disabled也行,但是要改另外两个组策略,而且host要猜对pipe名字:
Network access: Shares that can be accessed anonymously
Network access: Named Pipes that can be accessed anonymously