Hello and welcome back.
Time to get our first exploit on the Windows machine.
And we will go first with the famous Eternalblue exploit.
It is the NSA exploit that got stolen and leaked and that was used for the famous WannaCry ransomware
attack in 2017.
If you want to read more about it, you can Google it right here.
And it has a very interesting story, as we can see right here.
You will undoubtedly recall the name Shadow Brokers who back in 2017 were dumping software exploits
widely believed to be stolen from the US National Security Agency and WannaCry, the notorious ransomware
attack that struck only a few months later.
You can also read some other information about the exploit, like what is Eternalblue and we can see
its vulnerability name.
CVE 2017 0.320148.
And as it says, this is a family of critical vulnerabilities in Microsoft.
SMB version one server used in Windows seven, Windows Server 2008, Windows XP and even Windows ten
running on Port four, four, five.
You can read some other information as well if you want to.
And right here, it also tells us that even after two years of this exploit being patched, there are
millions of machines on the Internet.
They're still vulnerable to this attack.
And what this exploit does basically is it exploits a mathematical error inside the S&P.
And luckily, we got that exploit right here inside of our MSFT console.
So for now, what they got right here is the scan of my Windows seven machine, and your scan should
look similarly to mine.
Now, these ports right here are not important.
What is important is that you have these ports right here, open support, four, four, five and port
one three, nine.
Also, make sure that your windows machine is up and running.
And if I open my MKV console right here.
We're going to try to find that exploit and test it on our Windows seven machine.
One more thing is that besides this exploit that we have in our Metasploit framework, we also get the
auxiliary module for this exploit.
What does this mean?
Well, it means that we can test the machine to see whether it is vulnerable before we actually exploit
it.
Let me show you what they mean.
If I type right here, search and then Eternal Blue, I will get six results, two auxiliary modules
and four different exploits.
This is the one that we're currently interested in.
Exploit Windows for the SDB and it is called MSS 17 Eternal Blue.
But before we use it, we can use the auxiliary scanner for the SDB and for the same vulnerability as
you can compare these names right here to see whether our target is vulnerable.
So let's test this auxiliary module first.
If I type right here, use and then base the auxiliary module.
Clear the screen and show my options.
There are a few different things that we need to set up, but the only required things is the our hosts.
So let's set our hosts to be the IP address of our Windows seven machine.
In my case, it is this one and if I type show info so we can also read what this module does.
It uses information disclosure to determine whether the ETERNALBLUE has been patched or not.
And here it describes you.
How exactly does it do it?
So if I triple check our options, everything seems to be set.
You don't want to change this named pipes and you also do not want to change the output.
So only thing you need to set up is this our host right here and let us type run.
It'll finish in just a few seconds and it will tell me host is likely vulnerable to the eternalblue
attack.
It even gives us the version when the seven ultimate 7601 service pack 164 bit crate.
Our target seems to be vulnerable.
Let us now perform the exploit and you will see how easy it is.
So if I search Eternalblue once again, I copy the exploit name, which is this one.
Clear the screen type use.
It will by default set the payload to be windows reverse interpreter shell for the 64 bit machine.
Now, since it will set this by default, you must consider changing this in case your Windows seven
machine is a 32 bit machine.
If it is a 64 bit, you can simply just leave this to the Windows 64 bit method to reverse DHCP.
If it is not, then you want to set the payload to be equal to windows slash interpreter slash reverse
TCP.
And you will notice the only difference between this payload and this payload right here is this 64.
So this just indicates that this is a 64 bit payload.
Now, I will not run this command because my Windows seven machine is 64, but I will just type show
info and here we can see the exact definition and description of the exploit.
This module is a port of the equation group eternalblue exploit.
Part of this toolkit right here released by Shadow Brokers.
There is a buffer overflow operation in this function right here.
The size is calculated in this.
So I'm not going to read this, of course, with mathematical error where a word is abstracted into
a word.
So since our target is vulnerable, at least the auxiliary module told us, let us check out the options
and let's run the exploit.
So here as well, we got a few things that we need to set up.
My payload is automatically set right here to the IP address and the port.
These two.
We do not want to change the airport.
We do not want to change.
And our hosts, we need to set to the IP address of Windows seven machine.
Once everything is done, we can type run and this will start our exploit.
And in just a few seconds, I should get the interpreter reverse shell open on the Windows seven machine.
And here it is.
Down here, it will print out this win, which means the exploit worked successfully.
And I got my.
Windows seven machine.
If I type the command, get you ID, which stands for get user ID.
It will tell me the time currently on that machine as the system count.
And this is the highest level account on a Windows machine.
Great.
We successfully exploited our first vulnerability inside the Windows seven machine.
And by the way, since we haven't really covered the interpreter yet, remember that we can run the
Help Command and here we can execute all of these commands that the interpreter Shell gives us.
But for now we are not going to do that.
We're going to cover these commands and a bunch of other commands that we don't have here in the Post
Exploitation Module, which is coming soon.
For now, we just want to gain access to that target.
And in this video, we successfully did it.
But I want to show you one more thing.
So don't worry.
I know that you're impatiently waiting for us to actually do something on the target, but for now,
the goal is to only gain access to it.
If you want, you can test these commands by yourself.
You can just simply type screenshot, for example, just to show you how it works.
And it will take the screenshot of the target's desktop.
It will save it in the slash home slash.
Mr. Hacker.
So let's check out that directory.
If I lower my terminal right here and go to the slash home, slash Mr. Hacker, open the folder.
Here is the screenshot that we took of the target's desktop.
It is saved on our machine and that is just one of the cool commands that we can do with the metal shell.
Others we will cover later.
For now, let me show you one more thing.
If I exit out of the shell, I just want to show you.
If I open the second Windows seven machine that I got right here.
And there is no difference between these two machines.
Just one is a 32 bit and the other one is a 64 bit machine.
I just want to show you that on this one, which is the 32 bit one, the exploit will not work.
Even though the auxiliary module will tell us that the machine is vulnerable.
So I will just wait for this machine to open up.
Matter of fact, if I remember correctly, the exploit will crash this Windows seven machines.
It will not manage to gain the interpreter shell, but instead this Windows machine will get the blue
screen of death.
And then it will crash.
Let's see what happens.
So I will log in to this machine.
I will check two things out.
Once it opens up, I will check the IP address.
So it is 192 that won 68 that won the 13.
And one more thing I will check is whether the firewall is disabled.
So go to control panel system and security and then Windows Firewall, it is open.
So I'll just close the Windows Firewall.
And now if I perform the same exploit, just change the IP address to the IP address of these new Windows
seven machine and they try to run it.
It will start the same just after a few seconds.
This machine right here should crash.
It even tells us right here host is likely vulnerable to the may 17, which is the eternalblue exploit.
So let's see what happens.
And here it is.
You can see that the windows machine crashed and now it is restarting.
Also here, we can see that the exploit failed.
Remember that we got the win message once we exploited the previous Windows seven target, but right
now the exploit failed.
Matter of fact, in the second attempt of it exploiting the Windows seven machine, it crashed the machine.
So this is just an example that sometimes an exploit will not work.
In the first one, we managed to gain the access to the Windows ten machine with the method shell,
but in the second one we only managed to crash it.
However, even if you manage to only crash it, this is something that you will 100% right on our report.
This is a vulnerability.
You should never be able to crash a target computer just like this.
Imagine if this Windows seven machine was doing something important and just us knowing its IP address
and running this exploit we managed to crash it.
That could cause a lot of problem.
Now, if you really want to get this exploit to work, you can try to find a different Windows seven
ISO file and try with it to see if it might work on that one.
I would also advise you that if you can, you try to install a Windows 764 bit version and in the next
video we are going to see how we can perform a slightly different version of this exploit using Eternalblue
double pulsar attack.
In my personal experience, this one works a little bit better than the Metasploit version of Eternalblue.
And another interesting thing is that we don't have it inside of our Metasploit framework.
So what are we going to do?
Well, not only are we going to run it in the next video, but I will also show you how we can add the
internal Blue Double Pulsar module to the Metasploit framework by ourselves.
See you in the next video.