In his demonstration,
we're going to look at content of the different exploits
and how we can use this information.
As you see, we're in Metasploit here,
and we're going to go and review that WannaCry exploit as
we did in the previous demonstration, ms17‑010,
and there we go.
And once again, we have it.
What we want to do is, as we always do,
we want to look at the different exploits and you see
we got the actual top one here, the 0, and that's the 1 we tried before,
and then you've got the 1 which was specifically for Windows 8,
and you've got different information there in the
description about the different ones.
So when you start looking at them to interact,
it shows you here a hint of how to interact with them.
But now what we want to talk about here is the content for the exploit.
So if we do a actual use and go into our 0 again,
we've only got 2 targets and the ID 0, which is the automated target.
So we have a target for Windows 7 and Server 2008 R2 x64,
that's the only 2 targets that this exploit has been written for,
and that's what we talk about where it's so important that
we have to understand with these targets,
we have to select the proper 1.
So if we had Windows 8, in this case, it wouldn't work.
If we had Windows Server 2016, it wouldn't work.
It wouldn't even work if we had Windows Server 2008, not R2 x64.
So I wanted to show you that because it's that important when you
start looking at these different types of things.
Now, we only see one as we look on here,
we only see one, and again,
the ranking is something we'll discuss, we only see one that is great,
the rank of great, and that's the actual smb double pulsar remote code execution.
So that's kind of where you start to see how it evolved.
So when you look here at the disclosure date,
you see the actual 2017 April 14th disclosure date was for
that exploit that's the double pulsar.
So now if we go use five and go look at that exploit
and do an info like we always do,
you see this module execution Metasploit payload
against the group DOUBLEPULSAR implant.
So this one is a little bit different because with this is you've
already got the DOUBLEPULSAR implant onto the machine,
and by having that on the machine, then you can run the exploit.
Now of course,
that's going to be much more when you've already got some
type of infection on the machine and that's why I wanted to
show it to you because yes, it works very well,
but we have to get that user interaction first and then we run this type of
attack so these are the types of things to be aware of.
We've only seen that so let's clear our screen,
get up to the top here, and do show targets.
And you see, in this case, the execute payload to x64 and the neutralize implant,
which of course, just deactivates it.
Clear to get the top.
An actual exploit that's going to have a lot more targets
and this was one of the older exploits,
but it was a famous exploit because it was one of the closest to
100% that we could ever get and that is the Microsoft Server
services buffer overflow in the path canonicalization path and
the canonicalization name.
And what that actually is,
is just the actual inability to reduce that path properly is what
resulted in the actual parsing to make the buffer overflow,
but that's beyond the scope here.
But that vulnerability had a Microsoft bulletin number of ms,
always ms for Microsoft if it's a Microsoft related product,
08 for the year 2008, and then 067.
So what we do is we enter, so we clear our screen,
we get up to the top, and we're going to do a search ms08‑067.
So you see we only got 1 exploit here,
but it is ranked as great and you see it was actually disclosed October 28,
2008, so a long time ago,
but it's still prevalent as far as what caused the actual exploit
to actually work and that is buffer overflow.
We continue to have buffer overflow stuff like that.
So now if we go and use 0, that puts us in the exploit and now we do an info.
Let's look at a description.
This module exploits a parsing flaw in the path canonicalization code
in that API 32 DLL through the server service and it's capable of
bypassing NX on some operating systems, and NX means no execute on the stack.
So that's very important and you see that even though it was old,
look at what is the service port, right there,
it's represented by the RPORT 445.
Guess what?
That is the exact same port of the WannaCry ransomware exploit.
So when we looked at the code in the WannaCry ransomware,
it is the same vector of attack.
That means in 2008, you had to have Port 445 open, and in
2017, the WannaCry attack was the same vector of attack, so
nobody learned the lesson in 9 years.
So 9 years later, we still had people leaving that port open,
which I've already explained that's like a door and that's like
leaving your door open all night long at home and stuff like
that, so that's always a concern.
So we never learned our lesson in 9 years, but it's good for
us if we're hacking and doing pen testing.
Okay, so now let's do a clear here and this is where it gets interesting.
So we do a show targets, look at all the targets. We have 72 targets.
This bottom target is 70, the 72nd target. Windows
2003 Service Pack 2 French NX.
So it's not just the operating system,
it's not just the operating system and the service pack,
but it's also the language pack.
So this is one of those vulnerabilities that it's that granular and
this will happen sometimes where in the exploit,
you have to go all the way down, in this case, to the language
pack to get a successful exploit, and the NX,
as we've said, means no execute on the stack.
Now that's bypassed with finding an area that you can execute,
but that's something a little bit out of our scope of what we're doing
here, but you're encouraged to look at that if you want to actually pursue
it further and that's the libc attack and those types of things and we're
out to bypass the no execute bit on the stack being set. With that, we've
accomplished what we wanted to in this demonstration, and we'll conclude
the demonstration here.