Hello and welcome back.
Time to get our first exploit on the
Windows machine.
And we will go first with the famous
Eternal Blue exploit.
It is the NSA exploit that got stolen and
leaked and that was used for the famous WannaCry ransomware attack in 2017.
If you want to read more about it, you can google it right here and it has a
very interesting story.
As we can see right here, you will
undoubtedly recall the names Shadow Brokers who back in 2017 were dumping
software exploits widely believed to be stolen from the USA National Security
Agency and WannaCry the notorious ransomware attack that struck only a few
months later.
You can also read some other information
about the exploit, like what is Eternal Blue and we can see its vulnerability
name CVE -2017 -0 .3 -20148 and as it says this is a family of critical
vulnerabilities in Microsoft SMB v1, server used in Windows 7, Windows Server
2008, Windows XP and even Windows 10 running on port 445.
You can read some other information as well if you want to and right here it
also tells us that even after 2 years of this exploit being patched, there are
millions of machines on the internet that are still vulnerable to this attack.
And what this exploit does basically is it exploits a mathematical error inside
the SMB.
And luckily we got that exploit right
here inside of our MSF console.
So for now what I got right here is the
scan of my Windows 7 machine and your scan should look similarly to mine.
Now these ports right here are not important, what is important is that you
have these ports right here open.
So port 445 and port 139.
Also make sure that your Windows machine is up and running and if I open my MSF
console right here, we're going to try to find that exploit and test it on our
Windows 7 machine.
One more thing is that besides this
exploit that we have in our Metasploit framework, we also get the auxiliary
module for this exploit.
What does this mean?
Well, it means that we can test the machine to see whether it is vulnerable
before we actually exploit it.
Let me show you what I mean.
If I type right here search and then eternal blue, I will get 6 results.
2 auxiliary modules and 4 different exploits.
This is the one that we're currently
interested in.
Exploit Windows for the SMB and it is
called MS17 Eternal Blue.
But before we use it, we can use the
auxiliary scanner for the SMB and for the same vulnerability as you can compare
these names right here, to see whether our target is vulnerable.
So let's test this auxiliary module first.
If I type right here use and then paste
the auxiliary module, clear the screen and show my options.
There are a few different things that we need to set up, but the only required
thing is the RHOSTS.
So let's set RHOSTS to be the IP address
of our Windows 7 machine.
In my case, it is this one.
And if I type show info so we can also read what this module does, it uses
information disclosure to determine whether the eternal blue has been patched
or not.
And here it describes you how exactly
does it do it.
So if I triple check our options,
everything seems to be set.
You don't want to change this named pipes
and you also do not want to change the R port.
So only thing you need to set up is this
RHOSTS right here.
And let us type run.
It will finish in just a few seconds and it will tell me host is likely vulnerable
to the eternal blue attack.
It even gives us the version.
Windows 7 Ultimate 7601, Service Pack 1, 64bit .
Great, our target seems to be vulnerable.
Let us now perform the exploit.
And you will see how easy it is.
So if I search eternal blue once again, I
copy the exploit name, which is this one, clear the screen, type use.
It will by default set the payload to be Windows reverse meterpreter shell for the
64bit machine.
Now since it will set this by default,
you must consider changing this in case your Windows 7 machine is a 32bit machine.
If it is a 64bit, you can simply just leave this to be Windows 64bit
meterpreter reverse TCP.
If it is not, then you want to set
payload to be equal to Windows slash meterpreter slash reverse TCP.
And you will notice the only difference between this payload and this payload
right here is this 64.
So this just indicates that this is a
64bit payload.
Now I will not run this command because
my Windows 7 machine is 64bit.
I will just type show info.
And here we can see the exact definition and description of the exploit.
This module is a part of the equation group eternalblue exploit, part of this
toolkit right here, released by Shadow Brokers.
There is a buffer overflow operation in
this function right here.
The size is calculated in this, so I'm
not going to read this of course, with mathematical error where a DWORD is
subtracted into a word.
Ok so since our target is vulnerable, at
least the auxiliary module told us, let us check out the options and let's run
the exploit.
So here as well we got few things that we
need to set up.
My payload is automatically set right
here, to the IP address and the port.
These two we do not want to change.
The R port we do not want to change and the R hosts we need to set to the IP
address of Windows 7 machine.
Once everything is done we can type run
and this will start our exploit .
And in just a few seconds I should get the meterpreter reverse shell open on the
Windows 7 machine.
And here it is.
Down here it will print out this win which means the exploit worked successfully.
And I got my Windows 7 machine.
If I type the command getuid, which
stands for get user ID, it will tell me the time currently on that machine as the
system account.
And this is the highest level account on
a Windows machine.
Great, we successfully exploited our
first vulnerability inside of Windows 7 machine.
And by the way, since we haven't really
covered the meterpreter yet, remember that we can run the help command and here
we can execute all of these commands that the meterpreter shell gives us.
But for now we are not going to do that.
We are going to cover these commands and
bunch of other commands that we don't have here in the post exploitation module
which is coming soon.
For now we just want to gain access to
the target and in this video we successfully did it.
But I want to show you one more thing.
So don't worry, I know that you are
impatiently waiting for us to actually do something on the target but for now the
goal is to only gain access to it.
If you want you can test these commands
by yourself.
You can just simply type screenshot for
example, just to show you how it works.
And it will take the screenshot of the
target's desktop.
It will save it in the slash home slash mrhacker.
So let's check out that directory if I lower my terminal right here.
And go to the slash home slash mrhacker.
Open the folder.
Here is the screenshot that we took of the target's desktop.
It is saved on our machine.
And that is just one of the cool commands
that we can do with the meterpreter shell.
Others we will cover later.
For now let me show you one more thing.
If I exit out of this shell.
I just want to show you if I open the second Windows 7 machine that I got right here.
And there is no difference between these two machines.
Just one is a 32 bit and the other one is a 64 bit machine.
I just want to show you that on this one, which is the 32 bit one, the exploit will
not work.
Even though the auxiliary module will
tell us that the machine is vulnerable.
So I will just wait for this machine to
open up.
Matter of fact, if I remember correctly,
the exploit will crash this Windows 7 machine.
It will not manage to gain the
meterpreter shell, but instead this Windows machine will get the blue screen
of death and then it will crash.
Let's see what happens.
So I will log in to this machine.
I will check two things out.
Once it opens up, I will check the IP address.
So it is 192 .168 .1 .13.
And one more thing I will check is whether the firewall is disabled.
So I will go to control panel, system and security and then Windows firewall.
It is open, so I will just close the Windows firewall.
And now if I perform the same exploit, just change the IP address to the IP
address of this new Windows 7 machine and I try to run it, it will start the same,
just after a few seconds this machine right here should crash.
It even tells us right here host is likely vulnerable to the MS17, which is
the eternal blue exploit.
So let's see what happens.
And here it is.
You can see that the Windows machine
crashed and now it is restarting.
Also here we can see that the exploit failed.
Remember that we got the win message once we exploited the previous Windows 7
target, but right now the exploit failed.
Matter of fact, in the second attempt of
it exploiting the Windows 7 machine, it crashed the machine.
So this is just an example that sometimes an exploit will not work.
In the first one, we managed to gain the access to the Windows 7 machine with the
Meterpreter shell, but in the second one we only managed to crash it.
However, even if you managed to only crash it, this is something that you will
100 % write on a report.
This is a vulnerability.
You should never be able to crash a target computer just like this.
Imagine if this Windows 7 machine was doing something important.
And just us knowing its IP address and running this exploit, we managed to crash it.
That could cause a lot of problem.
Now if you really want to get this
exploit to work, you can try to find a different Windows 7 ISO file and try with
it to see if it might work on that one.
I would also advise you that if you can,
you try to install a Windows 7 64 -bit version.
And in the next video, we are going to
see how we can perform a slightly different version of this exploit using
EternalBlue double pulsar attack.
In my personal experience, this one works
a little bit better than the Metasploit version of EternalBlue.
And another interesting thing is that we don't have it inside of our Metasploit framework.
So what are we going to do?
Well, not only are we going to run it in
the next video, but I will also show you how we can add the EternalBlue double
pulsar module to the Metasploit framework by ourselves.
See you in the next video.