Instructor: Welcome back.
It is time we switch things up a little bit
and move on to a different target.
For the next few videos,
we are going to be attacking Windows 7 machine.
And the difference between exploit and Windows 7
and the Metasploitable that we were attacking
in the past few videos,
is inside of Windows 7,
we are not going to install any additional software.
So these exploits will work
on anyone that uses Windows 7
and hasn't updated their operating system,
which is most likely everyone running
some pirated version of Windows.
For this, you'll need to install Windows 7 virtual machine.
And I got mine right here.
It is currently up and running,
and you will need to install them
inside of your VirtualBox first.
You can take a look at YouTube
how you can download Windows 7 ISO file,
since the ISO file is something that you will need
for the installation of VirtualBox Windows machine.
And if you can,
try to download the 64-bit version of Windows 7.
Once you get the ISO file,
the installation process is rather easy.
Just go to the VirtualBox, then click on New right here.
You can type in anything you want.
You can call it Windows 7.
You can select right here which version you got,
either 32-bit or 64-bit.
And once you select it, click on Next.
Let me just see it right here.
Cannot create, this folder already exists.
Yeah, this folder already exists
because I have already created the Windows 7 machine.
But if I call it, for example, Windows 77
just so I can change the name of the virtual machine,
click on Next.
Here what you want to do is you want to add
at least two gigabytes of RAM.
Now, in case you don't have two gigabytes of RAM,
feel free to add one gigabyte.
But in that case, I'm not sure whether it'll work
since I haven't really tried it.
Once you create the virtual machine
and set the RAM, you can click on Next.
Right here select Create the virtual hard disk now,
click on Next, Next, Next.
Here, you can select the hard disk size.
You don't need to go too much.
You can just choose something like 20 to 30 gigabytes,
click on Create, and your virtual machine
will be right here.
Once you do all of that,
there are just a few more settings that you need to set up.
So just go right here onto the settings.
And in the storage,
you want to delete this Empty right here.
And under the Controller,
you want to add the Windows ISO file.
So in my case here is mine,
windows_7_ultimate_x64.iso.
I would choose that one,
and then I would proceed to the Network settings
and change from the NAT to the Breached Adapter.
Select your adapter right here and click on Create.
After you do all of this,
you can start your process of installing Windows 7.
And the process is rather easy as I already mentioned.
However, there is one important step
that we need to pay attention to.
And I got the screenshot of that step
right here on my desktop.
As far as I remember,
this step happens
I believe at the very end of installation.
And here it asks us help protect your computer
and improve Windows automatically.
Here we want to select the last option,
which is Ask me later.
It says for that option
until you decide your computer might be vulnerable
to security threats.
And by selecting this,
we are simulating a vulnerable Windows 7 machine
that wasn't regularly updated.
Once you do all of this, you should be ready to go.
The other steps of installation are not important.
Just remember once you get to this step,
select Ask me later.
Okay, so right now I got both of these machines
up and running.
I got Kali Linux and Windows 7.
And if I go to my VirtualBox right here.
And besides this Window 77 machine right here
that I created right now,
so I will just delete it
since I don't really need two Windows 7 machines.
Besides it, you will see I got these two Windows 7 machines.
So I got Windows 7 32-bit and Windows 7 64-bit.
And both are installed with a different ISO file.
And the reason why I got two of them
is just to show you that
sometimes some of the exploits won't work.
And that doesn't mean you didn't perform
the exploit correctly,
it's just that sometimes they just don't work.
Whether it is due to architecture or some Windows update,
it doesn't matter.
Just you will see that, for example,
some of the exploits will work on this version of Windows 7,
but on this one it will not work.
Now there is also one thing that we must do
on the target machine before we actually attack it.
So once you install Windows 7
and you have it up and running, go to it.
And from the desktop
you want to type control panel.
And in the Control Panel,
we want to disable the firewall.
The reason we do that is because the attack
that we are going to perform
target port for 445,
which is by default open on Windows machines.
However, it is also by default being filtered by firewall.
That is automatically on
every time you install a Windows machine.
So for our exploits to work,
target has to have that port unfiltered by the firewall
for us to be able to exploit it in.
In companies and larger networks,
that usually is the case.
This port will be open and unfiltered, why?
Well, because it is SMB protocol
or Server Message Block protocol.
It is used in network file sharing
and it allows applications on the the computer
to read and write the files
and to request services from server programs
in a computer network.
It is basically used for different directory access
or for printer access or something similar.
That's why it is usually open inside companies
without any firewall whatsoever.
Let me show you what I mean.
If I go right here and under the System and Security,
I click on Windows Firewall,
I already have it disabled.
But by default, you should have it like this.
So you should have firewall up and running.
If I leave the firewall up and running,
and I go to my Kali Linux machine and scan it real fast,
so sudo nmap, we're going to use the SYN Scan.
In order for this to work,
I need to know the IP address of my Windows 7 machine.
So I'll just type ipconfig inside of the Command Prompt
and it'll tell me it's 192.168.1.8.
So if I go back and scan the IP address,
input my password,
this scan shouldn't take more than just a few seconds.
And you will see right here that these ports are open.
But for you they will probably not be open, why?
Well, because you haven't really disabled the firewall yet.
So even though I scan it right now once again
while the firewall is on,
you can see in the scanned results
ports are set to be open.
What you are going to see,
in case you haven't disabled the firewall already,
is you will most likely see 1000 ports filtered.
And to fix that, what you can do is go right here,
click on Turn Windows Firewall on or off,
then select right here Turn off Windows Firewall,
and Turn off Windows Firewall in the second option as well.
Click on OK.
And now the firewall is off.
Now if you go and perform the scan once again,
for me, I will have the same results.
But for you, you will have much more ports open.
And I also get some ports open
that weren't open once the firewall was enabled.
Besides all of those ports,
you should also see the port 139 being open
and the port 445 being open.
And those are SMB ports.
So the key thing to get from this
is go to the Windows and disable the firewall.
Once again, Control Panel, System and Security,
and then Windows Firewall.
After you do all of that, you are ready to go.
In the next video, we are going to see
how to perform one of the most known recent exploits
called EternalBlue.
See you in the next video.