All right, in this video we're going to be taking a look at
how to exploit the Eternal blue vulnerability. So what I'm going to
do is if I list out my sessions and I'll just put this on
in the background so we can have it running. We
can search for Eternal blue. So eternal
Eternal blue. And we are looking, we can try out
the first one right over here, which is exploit Windows
SM B, Ms. 70, ness010, Eternal blue. And
this essentially, this is the
SMB remote windows kernel pool corruption. So
we can try that.
And if that doesn't work, we can also try the SMB
or sorry the MS 17 2010
PSX sick, and
that allows us to also get remote remote
code execution. So, I'll say use and
we will say, show options and in by default, you'll
select the 64-bit version of meterpreter. So
you can see that this works on Windows 7 and Server
2008 R2, all service packs will
at the airport to 1234 and
set our hosts to our
hosts will be 10.0.0.0. That is
the Metasploit about 3 IP and
we're just hit run and let's see if that works. So
it's going to send the payload. So the target architecture
selected is valid trying the exploit and
it's going to send all but the last fragment of the exploit packet.
So it looks like we were able to get
a second meterpreter session and
Out, that looks like it works. So against this info, you
can now see, we're still on The Meadows, splittable, 3vm.
And we have a 64-bit session. We
say, get user ID, and now, we have anti-authority and
system, privileges. So we
can take a look at the processes. And again, we now have the ability to
view all the processes.
What we can do now is we can try and actually
dump our hashes, and
we can do that really easily by first of
all, we can actually use the the hash dump module.
So we can put this in the background and this
is session 2 so we can search for hash dump
and you can see that we're
looking for post Windows gather credentials.
And domain hash dump. That's the Windows domain control, of
course. And then we can also use post Windows hash
dump so that this is for the windows, local
user accounts. So we can also use that. So we can copy that
and say, use based on that in them show
the options, right? And we set the session to
session to, so we
can say set session to hit enter and we can it
run. And it's going to say, obtaining the boot key calculating the
H, boot key using ciske.
And updating obtaining the user list and keys. Let's
see if we can actually enumerate the passwords. So
I'm just going to wait for this to complete obtaining the user list
and the keys. So hopefully this
works. Otherwise we can just use the default hash
dump. Of course. We also have the ability and we
can see that they did work. We also have the ability to use the windows
smart hash dump module
as well. So these are the ashes we get. What
I'm going to do now is I'm just going to copy these
Ashes, and we are going to add them onto our desktop. So
we will just go into my desktop and we'll save him hashes. And
we'll say Ms. Three Dot txt. And
I'll just paste them in here. And these are the hashes that
will be trying to crack with John, the Ripper an
additional thing that we can do, or initial step we can
take is to setup assistance. So, what I can do is,
why take a look in my sessions, the port's that we have configured,
our four, four, four four. And one, two,
three, four. So, what we can do is we can
Can say and we'll use the the session
that has the system privileges, which is
session 2, so we will search for for
the persistence module and we are looking for
the windows persistence module, which is right
over here. So exploit Windows, local persistence and
that uses the registry. So we'll
say, use and we'll paste that in there. Right?
And we say, show options, the default. It
looks
The default payload is Windows. So we'll set
the payload first. So we say set payload to Windows x64.
We say, meterpreter reverse
TCP, right? And we say
show options.
And we set the airport to, we
can set it to something else so we can say, 1, 2 4, 5
or 1 2, 4 3, and we
can then set the session to session to.
So we say session to
hit enter and we can then hit run and it
looks like we weren't able to set up assistants using
this particular module. So what we
can do is we can try and look for another persistent service,
so we can try and use the exploit Windows local persistence.
This and this essentially set it up as a
service.
So we'll use this particular module. And again,
we'll set the payload so set payload to
Windows x64 and
we can set the meterpreter verse.
Reverse TCP.
Pure options, we can set the airport.
1243, and we
can then set the session.
Set the session 2 2 and hit run and let's see whether
we can set up. So it looks
like the only the
only the it only supports the windows meterpreter
shell reverse staged payload. So
we can set the payload to two windows meterpreter.
Verse TCP and hit run and let's see if that
works. And indeed, it works. So we've set up the persistent session
and we can see we have a third meterpreter
session. So we have essentially, we
have elevated our privileges with setup assistance
and we've dumped the relevant hashes. The
next video. We'll be taking a look at how to crack the
passwords that with all the hashes that we've actually gathered with
John the Ripper, so I'll be seeing you in the next video.