Hello and welcome back.
Time to get our first expert on the Windows machine, and we will go first with the famous Eternal Blue.
It is the NSA expert that got stolen and leaked and that was used for the famous one, the ransomware
attack in twenty seventeen.
If you want to read more about it, you can Google it right here.
And it has a very interesting story.
As we can see right here.
You will undoubtedly recall the names, shadow brokers who back in twenty seventeen for dumping software
experts widely believed to be stolen from the USA National Security Agency and one of the notorious
ransomware attack that struck only a few months later.
You can also read some other information about the split, like what is internal look and we can see
its vulnerability.
Name CBE twenty seventeen zero point three two zero one four eight.
And as it says, this is a family of critical vulnerabilities in Microsoft.
S&P version one server used in Windows seven, Windows Server 2008, Windows XP and even Windows 10
running on Port four for five.
You can read some other information as well if you want to, and right here, it also tells us that
even after two years of this plane being patched there, millions of machines on the Internet, they're
still vulnerable to this attack.
And what this exploit does basically is it exploits a mathematical error inside the SMB.
And luckily, we got that exploit right here inside the MSF council.
So for now, what we've got right here is the scan of my Windows seven machine.
And your scans should look similar to mine.
Now, these ports right here are not important.
What is important is that you have these ports right here, open support for four, five and port one
three nine.
Also, make sure that your Windows machine is up and running.
And if I open my massive console right here.
We're going to try to find that expert and test it on our Windows seven machine.
One more thing is that besides this expert that we have in our magistrate framework, we also get the
auxiliary module for this expert.
What does this mean?
Well, it means that we can test the machine to see whether it is vulnerable before we actually exploit
it.
Let me show you what I mean.
If I type right here, search and then eternal blue, I will get six results to auxiliary modules and
four different experts.
This is the one that we're currently interested in, expert windows for the SMB, and it is called RMS
17 Internal Look.
But before we use it, we can use the auxiliary scanner for the assembly and for the same vulnerability
as you can compare these names right here to see whether our target is vulnerable.
So let's test this auxiliary module first.
If I type right here, use and then base the auxiliary module, clear the screen and show my options.
There are a few different things that we need to set up, but the only required things is the our hosts.
So let's set our host to be the IP address of our Windows seven machine.
In my case, it is this one.
And if I type show reinforcer, we can also read what this module does.
It uses information disclosure to determine whether the internal blow has been patched or not.
And here it describes you how exactly does it do it?
So if I triple check our options, everything seems to be set.
You don't want to change this name pipes and you also do not want to change the output.
So only thing you need to set up is this our hosts right here and let us run.
If you finish in just a few seconds and it will tell me who is likely vulnerable to the eternal attack,
it even gives us the version of Windows seven ultimate seven six zero one service pack, one 64 bit.
Great.
Our target seems to be vulnerable.
Let us now perform the exploit and you will see how easy it is.
So if I search eternal glow once again, I copy the expert name, which is this one.
Clear the screen type used.
It was by default, set the payload to be Windows reverse interpretor shell for the 64 bit machine.
Now, since it will set this by default, you must consider changing this in case your Windows seven
machine is a 32 bit machine.
If it is a 64 bit, you can simply just leave this to be Windows sixty four with an interpreter reverse
DCP.
If it is not, then you want to set payload to be equal to Windows and interpreter reverse PXP.
And you will notice the only difference between this payload and this payload right here is this sixty
four.
So this just indicates that this is a 64 bit payload.
Now, I will not run this comment because my Windows seven machine is sixty four, but I will just type
show info and here we can see the exact definition and description of the exploit.
This module is a part of the equation group, eternal blue export.
Part of this toolkit right here released by shadow brokers.
There is a buffer overflow operation in this function right here.
The size is calculated in this.
So I'm not going to read this, of course, with mathematical error where a D word is abstracted into
a word.
OK, so since our target is vulnerable, at least the auxiliary module told us, let's check out the
options and let's run the exploit.
So here it's probably got a few things that we need to set up.
My payload is automatically set right here to the IP address and the port.
These two, we do not want to change the airport, we do not want to change and our hosts, we need
to set to the IP address of Windows seven machine.
Once everything is done, we can type run and this will start our expert.
And in just a few seconds, I should get the interpreter reverse shall open on the Windows seven machine
and here it is down here, it will print out this win, which means the exploit worked successfully.
And I got my.
Windows seven machine, if I type the comment, get you ID, which stands for get user ID, it will
tell me the time currently on that machine as the system account.
And this is the highest level account on a Windows machine.
Great.
We successfully exploited our first vulnerability inside the Windows seven machine.
And by the way, since we haven't really covered the interpreter yet, remember that we can run the
help command and here we can execute all of these commands that the interpreter gives us.
But for now, we are not going to do that.
We're going to cover these comments and bunch of other comments that we don't have here in the post
exploitation module, which is coming.
So for now, we just want to gain access to the target.
And in this video, we successfully did it.
But I want to show you one more thing.
So don't worry, I know that you're impatiently waiting for us to actually do something on the target,
but for now, the goal is to only gain access to it.
If you want, you can test these comments by yourself, you can just simply type screenshot, for example,
just to show you how it works and it will take the screenshot of the target's desktop.
It will save it in this flash home slash, Mr. Hacker.
So let's check out that directory file over my terminal right here and go to the slash home slash.
Mr. Hacker, open the folder.
Here is the screenshot that we took of the target's desktop, it is saved on our machine and that is
just one of the cool commands that we can do with the interpreter shell.
Others we will cover later for now.
Let me show you one more thing.
If I exit out of the shell.
I just want to show you, if I open the second Windows seven machine that I got right here.
And there is no difference between these two machines.
Just one is a 32 bit and the other one is a 64 bit machine.
I just want to show you that on this one, which is the thirty two between the XPoint will not work.
Even though the auxiliary module will tell us that the machine is vulnerable, so I will just wait for
this machine to open up.
Matter of fact, if I remember correctly, the exploit for crash, these Windows seven machine, it
will not manage to gain the potential, but instead this Windows machine will get the blue screen of
death and then it will crash.
Let's see what happens.
Log in to this machine.
I will check two things out once it opens up double check the IP address.
So it is to that 168, that one, the 13.
And one more thing I will check is whether the firewall is disabled.
So go to control panel system and security and then Windows firewall.
It is open.
So just close the Windows firewall.
And now if I perform the same exploit,
just change the IP address to the IP address of these new Windows seven machine and they try to run
it.
It will start the same just after a few seconds, this machine right here should crash.
It even tells us right here who is likely vulnerable to the MS 17, which is the eternal Blue explained.
So let's see what happens.
And here it is, you can see the the Windows machine crashed and now it is restarting.
Also here we can see that the explosion failed.
Remember that we got the win message once we exploited the previous Windows seven target.
But right now, the exploit failed.
Matter of fact, in the second attempt of it exploiting the Windows seven machine, it crashed the machine.
So this is just an example that sometimes an expert will not work.
In the first one, we managed to gain the access to the Windows machine with the interpreter.
But in the second one, we only managed to crash it.
However, even if you managed to only crash it.
This is something that you will 100 percent right on the report.
This is a vulnerability.
You should never be able to crash a target computer just like this.
Imagine if this Windows seven machine was doing something important and just us knowing its IP address
and running this expert, we managed to crash it.
That could cause a lot of problem.
Now, if you really want to get this XP to work, you can try to find the different Windows seven nisso
file and try with it to see if it might work on that one.
I would also advise you that if you can, you try to install Windows seven, 64 bit version.
And in the next video, we are going to see how we can perform a slightly different version of this
exploit using eternal blue double pulser attack in my personal experience.
This one works a little bit better than the speed version of Eternal Blue.
And another interesting thing is that we don't have it inside of our metal framework.
So what are we going to do?
Well, not only are we going to run it in the next video, but also show you how we can add the eternal
blue double pulser module to the metal plate framework by ourselves.
See you in the next video.