Instructor: Welcome back,
and we, right now, have to cover
another vulnerability for Windows.
This vulnerability is called BlueKeep,
and it came out in 2019.
This is a Remote Desktop Protocol or RDP vulnerability,
and what is so special about it?
Well, as it says right here on this page,
this latest RDP vulnerability could allow hackers
to remotely run code at the system level
without even having to authenticate.
In other words, any unpatched Windows system
from XP to Windows 7, so these are our targets,
with an exposed RDP port is a potential target.
So, this is a serious vulnerability.
Matter of fact, many people link it
to be as high vulnerability as the EternalBlue was,
which we already covered
and which came out in 2017.
We can read more about it right here,
but, as usual, our most important thing is
to see how we can exploit it.
You can go to this page
if you want to find out more
about the BlueKeep vulnerability.
It even gives some code examples
as to what the vulnerability was and how it got patched.
Down here, we can see what systems are affected.
We got Windows 7, Windows Server 2008,
Windows Server 2008 R2, Windows Server 2003,
Windows Vista, and Windows XP.
Exploit potential, it is a Remote Code Execution,
as the EternalBlue was,
and number of potential victims are around one million.
Now, for this attack to work,
there is one thing that needs to be enabled
on the target system,
and that thing is port 3389.
Now, this port 3389 is used for Remote Desktop Protocol,
and it is often used inside of big and large companies.
You will most likely never see it on home devices
unless it is purposely enabled,
but in order for us to be able to exploit it,
we must enable it on our Windows 7 machine.
So, what I'm going to do is
go to my Windows 7 machine
and open the Kali Linux as well.
In order to see whether it is enabled,
we can use our regular good old Nmap,
so we can type sudo nmap dash ss
192.168.1, and let me check the IP address.
Ipconfig.8.
Perform the scan on your Windows 7 machine,
and in just a few seconds,
we should get results of which ports are open,
and right here, we do not see port 3389 being open.
This means this target is not vulnerable
because that port is closed.
In order to make it vulnerable,
all we need to do is open the Remote Desktop Protocol.
So, go to the Control Panel, System and Security,
then under the System, on the side,
you will see this Remote settings, click on it,
and down here, check Allow connections
from computers running any version of Remote Desktop.
By default, it should be Don't allow connections
to this computer, and, as I already mentioned,
many large companies have this enabled.
We just click on Apply, click on OK,
we can close this, and if we run the scan once again,
right now, we will have 3389 port open.
Let us whether it is vulnerable or has it been patched.
If I open msfconsole, an exploitation is similar
as it was with the EternalBlue.
We got the auxiliary module that will tell us
whether the target is vulnerable without exploiting it,
and then we have an exploit
that will gain access to the target
and give us the Meterpreter shell.
So, what we can do is
we can just type the vulnerability name,
so search bluekeep, press Enter,
and we will see two results right here,
as I mentioned, the auxiliary module and the exploit.
So, let's go with the auxiliary module first.
We copy its name,
we use and then paste the name of the auxiliary module,
clear the screen, show information,
this module checks a range of hosts
for the BlueKeep vulnerability
by binding this channel outside of its normal slot
and sending non-DOS packets which respond differently
on patched and vulnerable hosts.
So, this is the way that it will figure out
whether the target is vulnerable or not.
Let's see what options we need to set.
So, show options, and there seems to be a few of them.
We got the RPort, which is 3389,
this is something that we will not change,
we got the RHost, so let's set it
to the IP address of the Windows 7 machine,
we got these four options right here as well,
but the only one that is required is
this RDP Client IP, and it says right here,
The client IPv4 address to report during connect,
and this pretty much doesn't matter,
it can be any IP address.
For example, I will just leave it to be this one,
even though this is an IP address
that I do not have on my local network,
but I will just leave it on this.
And if I go right here and type run,
it will tell me, The target is vulnerable.
The target attempted cleanup
of the incorrectly-bound MS_TI120 channel.
This means it is vulnerable.
Let's use the exploit to gain access,
so use exploit/windows/rdp,
and then let's check our possible options, we want to go
with the CVE 2019 BlueKeep Remote Code Execution.
If I show info, down here, it will tell you
how exactly it exploits the target,
and if I show our available options,
so we got pretty much the same options
as with the auxiliary module.
We got the RDP Client IP, which is this one,
and we are not going to change it once again.
These options are not required,
so we're not going to specify them anyway.
The RHosts, we want to set
to the IP address of Windows 7 machine.
The RPort is set correctly.
The payload is set
to windows/x64/meterpreter/reverse_tcp,
and this is also something that we do not want to change.
Is this the only payload that will work?
Well, mostly since, if I go to show targets,
you will see that this exploit targets
only 64-bit machines,
so it will not be able to run on a 32-bit machine.
So, by this it seems the 32-bit Windows 7 machines
and Windows Servers 2008 are not vulnerable,
which we really don't care
because 99% of machines are 64-bit,
and these targets right here is something
that we must choose from.
Now, this is for the default and normal Windows machines,
and right here, we have targets
for the virtual machines,
and this something that we must set.
If we leave it on automatic,
it should figure out on its own
that we are running Windows 7 inside of a VirtualBox,
and it will perform the exploit
for the VirtualBox Windows 7 version.
But if we, for example, set this one,
the exploit should not work.
So, we must set the target to two
in case we are running the Windows 7
inside of a VirtualBox.
If we were attacking a regular Windows machine
that is vulnerable, we would set one.
If we were attacking a virtual machine
from the VMWare station,
we would set one of these three,
and we would set these to accordingly as well.
So, let's triple-check our options.
Everything here is set.
The payload is a 64-bit payload, which is good,
and the target is Windows 7 inside of a VirtualBox.
Great, let us run the exploit.
It tells us that the target is vulnerable,
and in just a few seconds,
we should get the Meterpreter shell opened
on that Windows 7 machine.
And after 30 to 40 seconds, here it is,
we got Meterpreter session one opened
on the target machine.
If I type get user ID,
it will tell me that we are system,
once again, the highest privilege account
on this target machine.
We can perform the commands as usual,
enter the shell, type host name, we are Test2-PC,
type the config, gives us the IP address
of the target machine,
and all of these things that we're already familiar with.
Great, another Windows 7 vulnerability covered.
So, what is the important thing
that we learned from this video?
The vulnerability's called BlueKeep.
It is a critical RDP
or Remote Desktop Protocol vulnerability,
and in order to exploit the target,
it must be an unpatched 64-bit Windows XP,
two Windows 7 machine,
including Windows Server 2008,
and it must have RDP enabled and port 3389 open.
Where are these machines most likely to be found?
In large companies.
So, once again, most likely,
we will not see these types of targets in home networks.
OK, great.
Now that we covered Windows 7 vulnerabilities,
time to go on to exploit Windows 10 machine.
See you in the next video.