Welcome back, and we right now have to cover another vulnerability for Windows.
This vulnerability is called biochip, and it came out in 2009.
This is a remote desktop protocol or are the people unknowability and what is so special about it?
Well, as it says right here on this page, this latest are the people unknowability could allow hackers
to remotely run code at the system level without even having to authenticate.
In other words, any unpatched Windows system from XP to Windows seven.
So these are our targets with and exposed are the people.
It is a potential target.
So this is a serious vulnerability, matter of fact, many people link it to be as high vulnerability
as the eternal bluebox, which we already covered and which came out in 2000 17.
We can read more about it right here, but as usual, our most important thing is to see how we can
exploit it.
You can go to this page if you want to find out more about the Blue-Chip vulnerability.
It even gives some code examples as to what the vulnerability was and how it got patched down.
Here we can see what systems are affected.
We got Windows seven, Windows Server 2008, Windows Server 2008, R2 with the server, 2003, Windows
Vista and Windows XP exploit potential.
It is a remote code execution as the eternal blue was, and number of potential victims are around one
million.
Now, for this attack at work, there is one thing that needs to be enabled on the target system and
that thing is bought three three eight nine now Dysport three three eight nine is used for remote desktop
protocol and it is often used inside of big and large companies.
You will most likely never see it on home devices unless it is purposely enabled.
But in order for us to be able to exploit it, we must enable it on our Windows seven machine.
So what I'm going to do is go to my Windows seven machine and open the Linux as well in order to see
whether it is enabled.
We can use our regular good old and maps so we can type pseudo and map, Desch says one night to the
168 at one end.
Let me check the I.P. address.
I'll be config eight, perform this can open your Windows seven machine, and in just a few seconds,
we should get results of which ports are open.
And right here we do not see Port three three eight nine being open.
This means this target is not vulnerable because that port is closed in order to make it vulnerable.
All we need to do is open this remote desktop protocol to go to the control panel system and security.
Then under this system.
On the side, you will see this remote settings click on it and down here, check allow connections
from computers running any version of remote desktop by default, it should be done to allow connections
to this computer.
And as I already mentioned, many large companies have this enabled.
We just click on apply, click on, OK, we can close this.
And if we ran, this can once again.
Right now, we will have three three eight nine port open.
Let us see whether it is vulnerable or has it been patched if I open my console?
And the exploitation is similar as it was we did, but we got the auxiliary module that will tell us
whether the target is vulnerable without exploiting it, and then we have an exploit that will gain
access to the target and give us the interpreter.
So what we can do is we can just type the vulnerability name.
So search, biochip press, enter and we will see the results right here.
As I mentioned, the auxiliary module and the exploit.
So let's go with the auxiliary module first, we copy its name.
We use and then base the name of the auxiliary module, clear the screen, show information, this module
checks a range of hosts for the Blue-Chip vulnerability by binding this channel outside of its normal
slot and sending Nontas packets would respond differently, unpatched and vulnerable hosts.
So this is the way that it will figure out whether the target is vulnerable or not.
Let's see what options we need to set.
So show options and there seems to be a few of them.
We got the airport, which is three three eight nine.
This is something we will not change.
We got the our hosts.
So let's set it to the IP address of the Windows seven machine.
We got these four options right here as well.
But the only one that is required is these are the P client IP.
And it says right here the client IP for address to report during Connect.
And this pretty much doesn't matter.
It can be any IP address, for example.
I will just leave it to be this one, even though this is an IP address that I do not have on my local
network.
But I will just leave it on this.
And if I go right here and type run.
It will tell me the target is vulnerable, the target attempted cleanup of the incorrectly bound mouse,
the hundred channel, this means it is vulnerable.
Let's use the exploit to gain access.
So use exploit windows are deep and then let's check our possible options.
We want to go with the CVT 2090 Bluechip Remote Code execution.
If I show info down here, it will tell you how exactly to exploit the target and if I show our available
options.
So we got pretty much the same options as with the axillary module.
We got the RTP client IP, which is this one, and we are not going to change it.
Once again, these options are not required.
So we're not going to specify them anyway to our hosts.
We want to set to the IP address of Windows seven machine.
The airport is set correctly.
The payload is set to Windows X 64 Interpretor Reverse DCP.
And this is also something that we do not want to change.
Is this the only payload that will work?
Well, most likely since if I go to show targets, you will see that this target's only 64 bit machines,
so it will not be able to run on a 32 bit machine.
So by this, it seems the 32 bit Windows seven machines and Windows servers 2008 are not vulnerable,
which we really don't care because 99 percent of machines are 60 Forbert.
And these targets right here is something that we must choose from now.
This is for default and normal Windows machines and right here we have targets for the virtual machines.
And this is something that we must set.
If we leave it on automatic, it should figure out on its own that we are running Windows seven inside
of a virtual box and it will perform the exploit for the virtual box Windows seven version.
But if we, for example, set this one, the exploit should not work.
So we must set the target to two in case we are running the Windows seven inside of our toolbox, if
we were attacking of regular Windows machine that is vulnerable, we would set one.
If we were attacking a virtual machine from the VM workstation, we would set one of these three and
we would set these two accordingly as well.
So let's triple check our options.
Everything here is set, the payload is a 64 bit payload, which is good, and the target is Windows
seven inside of a virtual box.
Great.
Let us run the exploit.
It tells us that the target is vulnerable and in just a few seconds, we should get them opened on that
Windows seven machine.
And after 30 to 40 seconds, here it is, we got an interpreter session one opened on the target machine.
If I type get user I.D., it will tell me that we are system once again, the highest privilege account
on the target machine.
We can perform the commands, as usual, entered the shell type hostname.
We are testing PC IP config gives us the IP address of the target machine and all of these things that
we're already familiar with.
Great.
Another Windows seven vulnerability covered.
So what is the important thing that we learned from this video?
The vulnerability is called bluechip.
It is a critical, deep or remote desktop protocol vulnerability.
And in order to exploit the target, it must be an unpatched 64 bit Windows XP to Windows seven machine,
including Windows Server 2008.
And it must have already enabled and bought three three eight nine open.
Where are these machines most likely to be found in large companies?
So, once again, most likely we will not see these types of targets in whole networks.
OK, great, now that we covered Windows seven, vulnerabilities tend to go on to exploit Windows 10
machine.
See you in the next video.