Welcome back.
In this small section, we are going to cover some big ghost Windows 10 vulnerability since there is
no manual available for the metal plate framework regarding this vulnerability.
We are going to need to exploit it manually and by manually, I mean, we will have to find a working
exploit ourselves, run it ourselves and redirect the connection to our Linux machine ourselves.
All of these tasks met this framework did for us automatically, and since we can't really rely on tools,
we're going to learn through this window stand vulnerability, how we can do all of that ourselves.
Now, the possibility that we're exploiting is rather new.
I believe it got disclosed in June 2020.
And for this we will need to install Windows 10 virtual machine.
Not all versions are vulnerable since it got patched.
So we will have to install a vulnerable version of Windows 10 machine.
Since this as well is an SMB ability, we won't need any additional software to run on our target machine
for this exploit work, which makes it even more dangerous, just like the previous two vulnerabilities
which were eternal blue and the blue keep.
But they were attacking Windows seven.
This one attacks Windows 10.
All our target needs to have eSport for four or five open and some previous version of Windows 10.
The exact vulnerable version that we are looking for is either Windows 10, 19 or three or Windows 10
ninety nine.
So you will need ISO file, as usual, to create this machine.
And both of these versions are vulnerable to the SMB ghost attack.
Let me show you right now where we can download a previous version of Windows 10 ISO file.
And by the way, we will be using this Windows machine in the next section as well to test the payloads
that we will create.
But more about that later on.
For now, let's focus on creating our virtual environment for this attack.
So what you want to do first is you want to navigate to this Rufous, that IEEE website and this software
right here that we're going to download is used to create bootable USB drives with the ISO files.
Now, you might be asking, well, why are we going to need this?
We're not going to put into our computer over USB drive.
We are installing a virtual machine, and that is true.
But this software also offers us to download some previous versions of Windows and Operating System.
That's why you want to go down here, click on this Rufous three point eleven and download the file.
It is the size of one point one megabyte.
Once you download it, you should be having this file right here on the desktop.
Double click on that file and ask for the password you want to click on.
Yes, or type in the password.
And right here where we want to go is this arrow next to the select button.
Now, here's a small advice.
Sometimes this arrow right here will not appear.
And it actually did not appear to me once I downloaded this software for the first time.
So what I did is I tried restarting this program several times.
So just close this, open this again, close it and open it again.
That might work.
And what also might work is going right here to the application settings and changing this check for
updates, then click on close, restart the program.
And eventually this error right here should appear once it appears, click on it and click on download.
And once you select the download, click on download once again and this will start running download
script in just a few seconds.
You should have this small window pop up here.
We want to select what operating system we want to download if I click on here.
It will ask me if I want Windows eight or Windows 10, I want to select Windows 10, click on Continue.
In the next step, it will ask me which exact police do I want to select?
And right here we want to go with this one, which is 1981, built one eight three six two, the three
five six.
And it says right here, the date is two thousand nineteen September or ninth month.
So click on this right here, then click and continue.
You can select Windows 10 home.
And continue here as well.
Language we can leave on English.
And the last step, which is architecture, we can leave on x 64, then you can click on download right
here or you can download using a browser.
If you simply just click on download, it will open the file explorer.
And here you can pick where you want to save it on your desktop.
Keep in mind that the size of the file is around five gigabytes, so this will take some time since
they have it downloaded.
I will not be downloading it again for you.
Just wait for the download to finish and you should have Windows 10.
I so far already make sure that you pick the exact same version that I did right here.
And once all of that is finished, you can close this program.
The next step is to install Windows 10 virtual machine.
So already got one running right here.
And for you, you can do it the same way that we did with any other machines.
So just type windows.
Then select right here, Microsoft Windows, Windows 10, 64 bit, click on next, choose two gigabytes
of RAM or choose the same amount of RAM that you use for the Windows seven.
Click on Next.
Here, we want to create a virtual hard disk.
All of these steps we can expect next here.
I got twenty five gigabytes in my case and you can choose whatever you want right here and this will
create your virtual machine.
Now, since I already have it, I will delete it.
But before I deleted another two settings that you want to choose is as we did with the Windows seven
machine, under the storage, under the empty, you want to remove and you want to add the Windows 10
file, which I have right here.
The next setting that you want to change is from that to bridge the chapter, once you do all of that,
you can start the process of installing Windows 10.
Now, there is not an important step in Windows 10 installations.
You can do it however you want, but just to protect once it gets to the part where it asks you for
the account creation, where you need to specify an email address and all of that, you can skip that
part by unplugging your device from the Internet and then it will allow you to create and offline Windows
account so you won't need to create an e-mail for the Windows 10 account.
All of the other steps are not important.
You can do them as you like, and once you do all of that, you can start your Windows 10 machine.
Another thing that we need to do to get our Winterstein machine fully ready for this attack is to disable
the firewall.
So go down here type control panel.
And the way we disable it on Windows 10 is the same way that we disabled it on Windows seven.
So click on Control Panel right here.
Click on System and Security.
Windows defender fútbol.
And turn it off in this button right here, which says, Turn Windows Defender, follow on or off.
Mine is currently off.
Once you do that, everything is ready.
And you should be good to go for the next video where we are going to try to search for the exploit
for this particular attack, see in the next video.