使用exploit-db搜索特定平台漏洞的使用方法

# 搜索windows平台下smb漏洞
[root@kalibook 09:52:26 ~]# searchsploit windows smb
----------------------------------------------------------------------------------------------- ----------------------------------
 Exploit Title                                                                                 |  Path
                                                                                               | (/usr/share/exploitdb/platforms)
----------------------------------------------------------------------------------------------- ----------------------------------
Microsoft Windows SMB - Authentication Remote Exploit                                          | ./windows/remote/20.txt
Microsoft Windows - (SMB) Transaction Response Handling Exploit (MS05-011)                     | ./windows/dos/1065.c
Microsoft Windows 2000/XP - (Mrxsmb.sys) Privilege Escalation PoC (MS06-030)                   | ./windows/local/1911.c
Microsoft Windows - WRITE_ANDX SMB command handling Kernel DoS (meta)                          | ./windows/dos/6463.rb
SmbRelay3 NTLM Replay Attack Tool/Exploit (MS08-068)                                           | ./windows/remote/7125.txt
VideoLAN VLC Media Player 0.9.9 smb:// URI Stack BoF PoC                                       | ./windows/dos/9029.rb
VLC Media Player 0.8.6f smb:// URI Handling Remote BoF Exploit                                 | ./windows/remote/9303.c
VLC Media Player 0.8.6f smb:// URI Handling Remote BoF Exploit (univ)                          | ./windows/remote/9318.py
VLC Media Player 1.0.0/1.0.1 smb:// URI Handling BoF PoC                                       | ./windows/dos/9427.py
Windows Vista/7 SMB2.0 Negotiate Protocol Request Remote BSOD Vuln                             | ./windows/dos/9594.txt
VLC Media Player 1.0.2 smb:// URI Stack Overflow PoC                                           | ./windows/remote/9816.py
VLC Media Player 1.0.3 smb:// URI Handling Remote Stack Overflow PoC                           | ./windows/dos/10333.py
Windows - SMB Client-Side Bug Proof of Concept (MS10-006)                                      | ./windows/dos/12258.py
Windows 7/2008R2 SMB Client Trans2 - Stack Overflow 10-020 PoC                                 | ./windows/dos/12273.py
Windows SMB2 Negotiate Protocol (0x72) Response DoS                                            | ./windows/dos/12524.py
Microsoft SMB Server Trans2 Zero Size Pool Alloc (MS10-054)                                    | ./windows/dos/14607.py
Microsoft Windows - SRV2.SYS SMB Negotiate ProcessID Function Table Dereference (MS09-050)     | ./windows/remote/14674.txt
VLC Media Player < 1.1.4 - (.xspf) smb:// URI Handling Remote Stack Overflow PoC               | ./windows/dos/14892.py
Microsoft Windows SMB Relay Code Execution                                                     | ./windows/remote/16360.rb
Microsoft Windows SRV2.SYS SMB Negotiate ProcessID Function Table Dereference                  | ./windows/remote/16363.rb
Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB)                                   | ./windows/remote/16366.rb
VideoLAN Client (VLC) Win32 smb:// URI Buffer Overflow                                         | ./windows/local/16678.rb
Microsoft Windows NT <= 4.0 SP5_Terminal Server 4.0 - _Pass the Hash_ with Modified SMB Client | ./windows/remote/19197.txt
Microsoft Windows 95/WfW smbclient Directory Traversal Vulnerability                           | ./windows/remote/20371.txt
Microsoft Windows 2000/NT 4/XP - Network Share Provider SMB Request Buffer Overflow (1)        | ./windows/dos/21746.c
Microsoft Windows 2000/NT 4/XP - Network Share Provider SMB Request Buffer Overflow (2)        | ./windows/dos/21747.txt
Microsoft SMB Driver Local Denial of Service Vulnerability                                     | ./windows/dos/28001.c
----------------------------------------------------------------------------------------------- ----------------------------------

source: //www.securityfocus.com/bid/5556/info

Microsoft Windows operating systems use the Server Message Block (SMB) protocol to support services such as file and printer sharing. A buffer overflow vulnerability has been reporting in the handling of some malformed SMB requests.

An attacker may send a malformed SMB request packet in order to exploit this condition. It has been reported possible to corrupt heap memory, leading to a crash of the underlying system.

It may prove possible to exploit this vulnerability to execute arbitrary code and gain local access to the vulnerable system. This possibility has not, however, been confirmed.

Reportedly, this vulnerability may be exploited both as an authenticated user, and with anonymous access to the service.

It has been reported, by "Fabio Pietrosanti \(naif\)" <[email protected]>, that disabling the NetBIOS Null Session will prevent exploitation of this vulnerablity.

https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/21747.zip