Hello, everyone. And this video, we're going to be taking a
look at the Eternal blue exploit have specifically targeting
Windows 7 and any
older operating system. So this is not work on Windows
10 and later. So again,
I'll just take you through one of the the actual disclosures
here or really just a primer that gives
you more information regarding this particular exploit. If you're
not familiar with it already, it was famously used
by the Wanna Cry.
A or used in the Wanna Cry attack and
it is a next Ploy developed by the NSA. So
I don't blue is an exploit that allows cyber
threat actors to remotely. Execute arbitrary code and
again access to a network by sending specially crafted packets.
It exploits a software vulnerability in Microsoft Windows
operating systems SMB or server message
block version 1. So again, this is more specifically going
to affect only Windows operating systems
with SMB version 1.
A network file sharing protocol that allows access to files
on a remote server and by default Windows will
typically have SMB enabled as its again used for sharing
files in peripherals, like network devices, like
printers Network, attacks to touch, so
storage Etc. This exploit potentially allows
cyber threat access to compromise the entire network and
all devices connected to it, due to internal Blues
ability to compromise network. If one device is infected
by the malware vital blue every day.
Device connected to the network is at risk. Now.
As I said, we're going to be exploiting the Eternal blue exploit, and we
are going to be targeting the Windows 7 virtual machine.
So I already have that up and running. And again,
we'll just open up. Msf. Console, Metasploit already
has a module built in for this particular exploit,
that allows us to again gain access. This
exploit will give us a meterpreter reverse reverse
TCP session, which means we can execute
commands on the Target. And again, if you
compare it to
The manual types of attacks where we had to manually manually, generate payloads,
in this case. We don't have to make contact with the operating
system. It can be done remotely. The only thing you
need is the is the targets IP address. So
I will search for Eternal blue and
we are not talking about the double pulse vulnerability.
We are primarily talking about the
windows. This is exploit Windows s mbms
17 2010, PS, exact
So again, this will allow assembly remote
code execution. So we're going to select that module and
we can then use we say use and we
hit enter and it's going to specify the
default payload as Windows meterpreter, reverse TCP. If
your version of Windows or the target version of Windows
is running a 64-bit and sure that you set the
payload to set payload and you
specify windows x64
and
Meterpreter reverse TCP in my case. The target is
a 32-bit version of Windows 7. So again, I can just hit
show options and the options that we can
set our listed above here. So again, we need to
set the RO. So the Target and pretty much everything else can be
left by default. So what we can do is
we can say set our hosts and
we're going to set that to 10.0.0.0. That
is the IP address of the Windows 7
virtual machine. So, I'm
Going to enter and that's pretty much all we need to
do. The SMB Port by default is going to be 45, and that
is how it is configured on Windows systems. All
we need to do now is hit run and it's going to start. And
there we are going to send the stage for us and we get a
meterpreter session. Again. I can confirm that by typing
in sis info and I can hit enter and there we are.
We can see. It's Windows, 7, Service, Pack, 1. It's a
it's a 32-bit system and we have the 32-bit version
of meterpreter running again, we can then run.
Additional meterpreter commands like get system. I
hit enter and we get the system. If I get user ID.
Now, you can see we have anti-authority and we have administrative access.
So just through one exploit. I
was able to get administrative access using Metasploit without
without having to access or having
physical access to the Target machine without performing social
engineering. The only thing I require is the target IP
address and of course, the parameters have to be that it
is running Windows 7 or
Older right now. We are going to be talking about
various other types of attacks and in the next module would
be talking about encoding using particular Frameworks
like Veil evasion. Where things will become much more
interesting. So I just thought I would take you through the Eternal blue
exploit. Again, you can try it out on with your
own virtual machines are extremely powerful and can
lead to the compromise as mentioned within the primer here
of an entire network. And again, this was
used during the Wanna Cry ransomware attack,
and
It is usually targeting various companies
and hospitals that still had older versions of
Windows 7, Enterprise running which again were vulnerable
to this particular exploit and they were able to gain access. Extremely
simple, extremely simply or
really easily. And as you can see, I was able to get administrative privileges
which means I practically own the system. At this
point, that being said that's going to be it for this video and
I'll be seeing you in the next video.