-: Hello and welcome back.
Time to get our first exploit
on the Windows machine.
And we will go first with the famous EternalBlue Exploit.
It is the NSA exploit
that got stolen and leaked,
and that was used for the famous
WannaCry ransomware attack in 2017.
If you want to read more about it
you can google it right here
and it has a very interesting story.
As we can see right here.
You will undoubtedly recall the names Shadow Brokers
who back in 2017 were dumping software exploits
widely believe to be stolen
from the USA National Security Agency,
and WannaCry, notorious ransomware attack
that struck only a few months later.
You can also read some other information about the exploit
like what is EternalBlue
and we can see its vulnerability name
CVE-2017
-: 0143
to 0148,
And as it says,
this is a family of critical vulnerabilities
in Microsoft SMB version one
server used in Windows 7,
Windows Server 2008,
Windows XP,
and even Windows 10 running on port 445.
You can read some other information as well if you want to.
And right here it also tells us
that even after two years of this exploit being patched,
there are millions machines on the internet.
They're still
vulnerable to this attack.
And what this exploit does basically is
it exploits a mathematical error inside the SMB.
And luckily we got that exploit right here
inside of our MSF console.
So for now, what I got right here is the scan
of my Windows 7 machine
and your scans should look similarly to mine.
Now these ports right here are not important.
What is important is
that you have
these ports right here open.
So, port 445,
and port 139.
Also make sure that your Windows machine
is up and running,
and if I open my MSF console
right here
we're going to try to find that exploit
and test it on our Windows 7 machine.
One more thing is that
besides this exploit that we have
in our Metasploit point framework,
we also get the auxiliary module for this exploit.
What does this mean?
Well, it means that we can test the machine
to see whether it is vulnerable
before we actually exploit it.
Let me show you what they mean.
If I type right here, search,
and then EternalBlue
I will get six results
to auxiliary modules and,
four different exploits.
This is the one that we're currently interested in.
exploit/windows for the SMB
and it is called ms_17_eternalblue.
But before we use it,
we can use the auxiliary scanner
for the SMB and,
for the same vulnerability
as you can compare these names right here
to see whether our target is vulnerable.
So let's test this auxiliary module first.
If I type right here use,
and then paste the auxiliary module
clear the screen and show my options.
There are a few different things that we need to set up
but the only required things is
the our hosts.
So let's set our hosts to be the IP address
of our Windows 7 machine.
In my case, it is this one,
and if I type show info.
So we can also read what this module does.
It uses information disclosure to determine
whether the EternalBlue has been patched or not.
And here he describes you, how exactly does it do it?
So if I triple check
our options
everything seems to be set.
You don't want to change this named pipes
and you also do not want to change the our port.
So only thing you need to set up is this
our host right here,
and let us type run.
It'll finish in just a few seconds
and it'll tell me
Host is likely vulnerable
to the EternalBlue attack.
It even gives us the version Windows 7 Ultimate,
7601,
service pack 1, 64 bit.
Great,
our target seems to be vulnerable.
Let us now perform the exploit,
and you will see how easy it is.
So if I search EternalBlue once again
I copy the exploit name which is this one,
clear the screen,
type use.
It will by default set the payload to be
Windows reverse meterpreter shell
for the 64 bit machine.
Now since it'll set this by default
you must consider changing this
in case your Windows seven machine is a 32 bit machine.
If it is a 64 bit,
you can simply just
leave this to be Windows 64 bit meterpreter reverse_tcp.
If it is not,
then you want to set payload
to be equal to
Windows slash
meterpreter slash
reverse_dcp
and you will notice the only difference
between this payload,
and this payload right here is this 64.
So this just indicates that this is a 64 bit payload.
Now I will not run this command
because my Windows seven machine is 64 bit.
I will just type show info,
and here we can see the exact definition
and description of the exploit.
This module is a part
of the Equation group, EternalBlue exploit.
Part of this toolkit right here released by Shadow Brokers.
There is a buffer overflow
operation in this function right here.
The size is calculated in this.
So I'm not going to read this of course
with mathematical error where a Dword
is abstracted into a word.
Okay, so since our target is vulnerable
at least the auxiliary module told us
let us check out the options,
and let's run the exploit.
So here is, as well
we've got few things that we need to set up.
My payload is automatically set right here
to the IP address and the port.
These two, we do not want to change,
the Rport,
we do not want to change.
And the Rhosts,
we need to set
to the IP address of Windows 7 machine.
Once everything is done,
we can type, run,
and this will start our exploit.
And in just a few seconds
I should get the meterpreter river shell open
on the Windows 7 machine.
And here it is.
Down here.
It'll print out this win
which means the exploit worked successfully,
and I got
my
Windows 7 machine.
If I type the command
getuid
which stands for get user id,
it'll tell me the time currently on that machine
as the system account.
And this is the highest level account on a Windows machine.
Great. We successfully exploited our first
vulnerability inside of Windows 7 machine.
And by the way,
since we haven't really covered the meterpreter yet,
remember that we can run the help command,
and here we can execute all of these commands that
the interpreter shell gives us.
But for now,
we are not going to do that.
We're going to cover these commands,
and bunch of other commands that we don't have here
in the post exploitation module,
which is coming soon.
For now,
we just want to gain access to the target,
and in this video we successfully did it,
but I want to show you one more thing.
So don't worry.
I know that you're impatiently waiting
for us to actually do something on the target,
but for now,
the goal is to only gain access to it.
If you want,
you can test these commands by yourself.
You can just simply type screenshot, for example.
Just to show you how it works,
and it'll take the screenshot of the target's desktop.
It'll save it in the /home/mrhacker
So let's check out that directory.
If I lower my terminal right here,
and go to the
/home/mrhacker,
open the folder.
Here is the screenshot that we took
of the target's desktop.
It is saved on our machine,
and that is just one of the cool commands
that we can do with the meterpreter shell.
Others, we will cover later.
For now on,
let me show you one more thing.
If I exit out of the shell,
I just want to show you
if I open the second Windows 7 machine
that I got right here.
And there is no difference between these two machines
Just one is a 32 bit,
and the other one is a 64 bit machine.
I just want to show you that
on this one which is the 32 bit one,
the exploit will not work.
Even though
the auxiliary module will tell us
that the machine is vulnerable.
So I will just wait for this machine to open up.
Matter of fact, if I remember correctly,
the exploit will crash this Windows 7 machine.
It will not manage to gain the meterpreter shell
but instead
this Windows machine will get the blue screen of death,
and then it will crash.
Let's see what happens.
So I will log in to this machine.
I will check two things out.
Once it opens up, I will check the IP address.
So it is 192.168.1.13.
And one more thing I will check is
whether the firewall is disabled.
So I'll go to control panel system and security,
and then Windows Firewall.
It is open.
So I'll just close the Windows Firewall.
And now if I perform the same exploit,
just change the IP address to the IP address
of this new Windows 7 machine,
and I try to run it.
It'll start the same
just after a few seconds.
This machine right here should crash.
It even tells us right here,
Host is likely vulnerable
to the ms17
which is the EternalBlue exploit.
So let's see what happens.
And here it is,
you can see that the Windows machine crashed,
and now it is a restarting.
Also. Here we can see that the exploit failed.
Remember that we got the WIN message
once we exploited the previous window 7 target,
but right now the exploit failed.
Matter of fact,
in the second attempt
of it exploiting the window seven machine
it crashed the machine.
So this is just an example
that sometimes an exploit will not work.
In the first one,
we manage to gain the access
to the Windows 7 machine
with the meterpreter shell
but in the second one,
we only manage to crash it.
However, even if you manage to only crash it,
this is something that you will 100% write on a report.
This is a vulnerability.
You should never be able to crash
a target computer just like this.
Imagine if this Windows 7 machine
was doing something important,
and just us knowing its IP address,
and running this exploit,
we managed to crash it.
That could cause a lot of problem.
Now, if you really want to get this exploit to work,
you can try to find a different Windows 7 files,
and try with it
to see if it might work on that one.
I would also advise you that
if you can,
you try to install up Windows 64 bit version.
And in the next video
we are going to see how we can perform
a slightly different version
of this exploit
using EternalBlue Double Pulsar attack.
In my personal experience,
this one works a little bit better
than the Metasploit version of EternalBlue.
And another interesting thing is that
we don't have it inside of our Metasploit framework.
So what are we going to do?
Well,
not only are we going to run it
in the next video,
but that will also show you
how we can add
the EternalBlue Double Pulsar module
to the Metasploit framework by ourselves.
See you in the next video.