Welcome back.
Time to check out a variant of Eternal Blue explained, I prefer to always use this one due to two different
reasons.
It showed to work more than the default metal plate framework explained.
And it also has a little better options aimed at both 32 and 64 bit Windows systems.
Nonetheless, we can read more about double pulser right here.
This is the official Rapide seven website.
And here we can check out what exactly is a double pulser when it is used and when did it come out.
So here it says double pulser is an implant leaked by the shadow brokers group earlier this year that
enables the execution of additional malicious code.
So you can read right here, but you can also check out different websites in order to find out how
exactly does the expert work in case you're interested in that.
But what is important for us in this video is how to run the exploit.
Remember, we have no model in Matus plate framework for the eternal double pulser.
So we must download the exploit ourselves and import it in matters framework.
This will be a little bit of a longer video since there are a few things that we need to do to achieve
this exploit.
The first thing that we must do is install one.
And what is wine?
Well, Fine is a program that allows us to execute Windows applications on Linux systems.
Why do we need this?
Well, it is required for double pulser to run to install it.
We can run the following comment pseudo deep CGY, dash, dash and dash architecture.
I three, eight, six, and then these two signs, which mean that we are going to add another comment
to this larger comment and that is apt, get update and another comment is apt to get installed.
Win32.
So these are three separate comments.
And in the last one, we are going to install the Win32.
If you press, enter and type in the password, this command should start executing.
Now, if it tells you right here this, which is permission denied, then just copy this command without
the pseudo enter the root terminal by typing pseudo seal and then paste the command press enter and
now it should start executing all of these three commands.
Now our control see this because I have already performed this for you.
Just wait for this to finish and then proceed with the editorial.
And the reason why we are doing all of this is because we need to get find directory with the drive
folder.
And you might be asking, well, what is that and where do I even find it?
Well, sometimes it won't appear after installation.
So what we must do is install some Windows program.
In this case, let's just go and install Python two four windows on our Kalinda's machine, not because
we need it, but because after we install it, our drive C folder will appear.
And if you have no idea what I'm talking about, hang on for just a second and you will see it after
we install in this program.
It is all required for our expert to run.
So navigate to this link right here, which is https w w w dot python dot org slash downloads, slash
release and then slash python dash two seven one four and slash at the end.
Here we should see this version of Python.
And what we are interested in from all of these versions is Windows XP.
Eighty six MSA installer.
Click on it and click on Save File, it will start downloading our Windows installer and once it has
finished.
We want to go to the downloads directory and open terminal inside of it.
Once it does that, we can run the command line MSA execute.
I and then the name of the file, which in my case and in your case will be Python two point seven point
fourteen dot.
Just a small interrupt this command that I just showed you.
Make sure to execute it using fruit terminal.
So do not executed using our regular Mr. Hacker terminal.
Otherwise, in most cases, it might not actually work.
So what you can do is you can just type pseudo.
You enter the password for your account and run the find MSA execute slash I and then the name of the
file using fruit terminal.
OK, let's go back to the video.
Click, enter, and this will start installing Python two point seven point fourteen as a Windows program.
We want to click on Next on Every Step.
So next next next next show.
This already exists.
I will click on.
Yes.
And this installation should finish in just a few seconds.
Once it is done, you can click on Finish.
And right now we should have our wine folder in the root directory.
So if I go to this directly, I need to go see the root.
Let us just enter the terminal and go to the root directory, if we type, yes, it will be empty.
Did we fail somewhere?
Well, not exactly.
Once installed, wine will be a hidden directory, which means its name will start with a dot.
And by the way, to list all the files inside of a directory, including hidden files, we can run the
command ls ALP and hear all the hidden files, including our DOT find the rectory.
Now, if you cannot see it, make sure that you run this command, which is why MSRA execute I Python
two point seven point fourteen from the root terminal.
And just click on next next next steps and you should have this dot find folder inside of the root directory.
Great.
So if I go to that folder CD dot fine here I will have drive C folder and some other folders as well.
So everything works for now.
Now that we got this ready, we can proceed to download our exploit, go once again to the Firefox,
open a second step and type eternal blue double pulser and it'll show up this first link, which is
a GitHub.
We want to click on it.
And since we already know how to install our GitHub tool, let's just do it real quick.
We just want to copy this link right here.
Go inside our terminal.
Let's change the directory to the home.
Mr. Hacker, slash the directory and once again, our advise you to run all of these commands using
through the terminal.
Otherwise it might not work and type to clone.
Basic command, and it should download the eternal blood cancer tool for us now, we are not done yet.
We must do some modification in order for this tool to be able to open in the metastatic framework.
If we type place and change to the eternal blue pulser right here, we should have two interesting files.
One of them is the ruby file, which is the expert itself, and the other one is this deps directory.
Now this is a directory.
Once again, it is not the file and you cannot really see that from the root terminal because different
file types are not different colors.
And that is the only problematic thing.
But nonetheless, what we must do is we must copy these two files.
So let's go with copy Depp's first.
To the user share.
Metal plate framework modules exploits Windows and then SMB, and here we can copy the depth directory
and to copy at the rectory.
You just need to add Besch are at the end.
So once again, copying taps directly to this user SlideShare framework modules exploit windows and
then slash Sambi click enter and it should copy the depth directory there.
We want to do the same thing with the internal blue ruby file copy to the same directory.
Modules exploit Windows Assembly.
And here we want to keep it just for this file, you don't need to add a dash R since it is a file and
not a directory.
OK, great.
There is one more location that we want to copy both of these files, so we'll just type once again
the same comment.
Just this time I will switch the location to this root directory so we'll copy the depths in this route
at this are at the end and double copy the eternal glue to this root directory as well.
Great.
Now we should be ready to go.
Let us open our MSF council.
While this is opening, make sure that your Windows seven machine is up and running and let us straightaway
check out the IP address of these Windows seven machine by typing IP config when to that 168, that
eight for me.
And what we want to do once the display opens up is we want to navigate to our eternal blue double pulser
exploit.
And remember, we put it inside of the windows, exploit and sambi exploit.
So what we can do is we can use exploit windows SMB type the name of the exploit which is eternal blue
double pulser.
So just type eternal blue underscore double click enter.
And now we got our exploit imported in metabolised framework.
This is an exploit that we didn't have before.
Let us show information for it.
As it says in the description, this module exploits availability on SMB version one and version two
protocols through eternal blue.
After that, double pulser is used to inject remotely a malicious DL.
Great.
Let's also show options to see what options we got.
And up here we got quite a few of them and keep in mind that all of them are required.
Now, here, it tells us that we need to specify the path to the depths, the rectory, so it seems
that I made a mistake before I copied it directly to the root directory and we had to copy the entire
file.
So what I'm going to do is I'm going to open a second terminal, enter the root terminal, go to the
desktop of our Mr. Hacker account and copy this entire internal blue double pulser matter split to the
root directory.
So copy eternal blue to this root.
Make sure to add dash r because we are copying a directory and right now this path should be good and
we should not really change it.
We can just leave it right here, since that's the rectory is inside of the eternal blue double pulser
directory and we just copied it to the root directory.
So these two are good under the process.
Inject it tells us right here name of the process to ejecta and we must change to this process.
Name right here for 64 bit machines.
Since my Windows seven machine is a 64 bit, I will type this name right here and change the process
to eject since it is not set right here by default, sir type set process.
Inject and paste the name of the process and press enter.
If your Windows seven machine is a 32 bit one, you can leave this w Alam's Dotti the process to inject
it to our hosts.
We already know to be the IP address, so why not do it at 168 eight the airport we are going to leave
to four, four five.
The target architecture.
If your Windows machine is a 32 bit, you can leave it to exit six my is sixty four bit.
So I will set the target architecture to X sixty four.
The wine path, and this is why we needed the wine for we need to set the wine path in order for all
of this to work.
And right here it is set correctly.
Remember, our wine folder is inside of the food directory and the drive folder is inside of the DOT
wine directory.
So this is something that we will not change.
Another configuration that we want to do is this payload options right here.
It is currently set to Windows Interpretor Reverse DCP.
And remember, in one of the last few videos, I told you that this is a payload for 32 bit windows.
If your windows is 32 bit, once again, you don't need to change this.
But if it is a 64 bit windows, I want to type set payload Windows X 64 and interpreter reverse DCP
show options once again.
Everything seems to be good now.
You can also show targets if you want to, just to see what are all the possible targets that you can
attack with this exploit.
And once you check all of that out, you can just type front.
This will launch our eternal blue double pulser exploit on target machine.
It might take a few seconds for it to work.
And here it is, our interpreter session is once again open exploit for successfully and we can once
again from the comments on the target system, we can enter a shell and get its command prompt.
If I type who I my.
It says that we are the system level account, so we are the highest privilege account once again,
great.
Now I know you're impatiently waiting for us to cover this interpretor shell and all of its comments,
as well as the post exploitation modules.
We can run with it.
But hang on for just a little bit more.
We got two more experts to cover and then we can proceed to creating our malicious files and using them
as well as running post exploitation modules.
In the next video, we're going to cover an expert called Blue Keep, which was discovered in thousand
nineteen.
See you there.