-: Welcome to the lab. 2 2
So in this one, I have two machines. 3 3
I have a Windows 7 64-bit operating system, 4 4
and I'm gonna have a Kali Linux machine 5 5
that we've been using all the time. 6 6
Now my particular Kali Linux machine has been updated 7 7
to the latest patches and the latest exploits, 8 8
including the one we're gonna use today, 9 9
which is called EternalBlue, 10 10
because it was released just four days ago. 11 11
Now the first thing we're gonna do 12 12
is we're gonna go on our Kali Linux machine, 13 13
just like we did before, 14 14
and we're gonna go ahead and find out 15 15
what our IP address is by using ifconfig. 16 16
Now you'll see here that when we use ifconfig, 17 17
our IP address, 18 18
or my IP address is 192.168.56.102. 19 19
Now that tells me that since its subnet mask 20 20
is 255.255.255.0, that this is slash 24 network. 21 21
So I'm gonna open up Zenmap, 22 22
and I'm gonna go do a search across this network. 23 23
That way I can find the Windows machine 24 24
that is on this network, and so I'll know where it is. 25 25
Now if you've done your reconnaissance already, 26 26
and you know the IP address, 27 27
you can scan just for that one IP. 28 28
So, as Zenmap goes, I'm gonna fast forward here 29 29
so we don't have to sit here watching it 30 30
as it's churning away on its scans. 31 31
When it's done, you're gonna see the fact 32 32
that it found the Windows 7 machine, 33 33
and it did find three ports open. 34 34
It found 135, 139, and 445. 35 35
Now for EternalBlue, it does require port 445 to be open, 36 36
and so that means that Windows 7 machine 37 37
has to have file sharing enabled, 38 38
otherwise we're not gonna be able 39 39
to get to it with this exploit. 40 40
So now that it's done finding it, 41 41
we're gonna click on that Windows machine. 42 42
Again, you're gonna see that this is a Windows machine. 43 43
It thinks it's a Windows Server 2008. 44 44
That's okay. 45 45
Windows 7 and Windows Server 2008 46 46
share a very common code base. 47 47
But when I look at the ports and hosts, 48 48
the way that it responded on 445, 49 49
it tells me this is a Windows 7 machine. 50 50
So I'm gonna open up my Metasploit framework 51 51
using msfconsole, just like we did in the previous labs. 52 52
Now, once Metasploit framework has loaded, 53 53
what we're gonna do is 54 54
we're gonna use the command use, and then the exploit. 55 55
Exploit/windows/smb/ms17_010_eternalblue, 56 56
and then we're gonna hit Enter. 57 57
Now, we're gonna show our options. 58 58
And you'll see here that the only option that we have to do 59 59
is set our remote host, 60 60
so I'm gonna set our host as 192.168.56.101, 61 61
the Windows 7 machine, and then I'm gonna type run. 62 62
Now, from here it's gonna go into its exploit. 63 63
We're using a standard shell response, 64 64
not meterpreter payload, 65 65
although we could have set that as well. 66 66
So then I get back c:\Windows\system32, 67 67
and I'm gonna go ahead 68 68
and change myself to the root directory. 69 69
Now, notice on my Windows 7 machine, 70 70
there was no folder there. 71 71
Now I'm gonna do make directory "You've Boon Hacked", 72 72
and when I do that, boom, 73 73
it's on the Windows 7 machine instantly 74 74
because I have root access 75 75
to do whatever I want on this Windows machine. 76 76
So now I'm gonna go ahead 77 77
and I'm just gonna go into that directory, 78 78
and I'm gonna create a file 79 79
and leave a message to the person, 80 80
because again, if I'm doing a penetration test, 81 81
I wanna let them know how I got in and why I got in. 82 82
And so I'm gonna do a quick echo command, 83 83
and here I'm just gonna say, 84 84
"This works on Windows 7 and Windows 2008 servers", 85 85
and I'll put that into a file 86 86
that is gonna be called hack.txt 87 87
or work.txt. 88 88
And now you'll see work.txt 89 89
popped up in the Windows 7 machine. 90 90
So at this point I can do whatever I want 91 91
on this Windows machine. 92 92
I can move files. 93 93
I can remove files. 94 94
I can delete files. 95 95
I can create new files. 96 96
I can grab system information. 97 97
I can create users, pop holes in the firewall, 98 98
and really just start expanding my access from here. 99 99
This was just the initial way in. 100 100
Now again, this is only gonna work 101 101
on Windows 7 and Windows 2008 right now. 102 102
There are people who are working on 103 103
Windows 8 and Windows 10 exploits 104 104
for this particular vulnerability as well. 105 105
Microsoft has released a patch, 106 106
but people are not patching quick enough on this one, 107 107
so it's really been getting out of hand. 108 108
Now the good thing is that a lot of people 109 109
are starting to take notice 110 110
because of the WannaCry ransomware, 111 111
and they don't want their files to get hacked, 112 112
so they have been updating their software. 113 113
So your services and your systems in your companies 114 114
are probably gonna be okay from this one, 115 115
but it is one you wanna scan, and you wanna look for 116 116
as you're going through your penetration tests. 117 117
And this is just a simple example 118 118
that these techniques that we went through in this class, 119 119
they are timeless. 120 120
It is the same stuff we've been doing 121 121
for the last decade or two. 122 122
The only difference is the particular exploit that we use. 123 123
And as you go through and use a vulnerability scanner 124 124
like Nessus, or any of the other products out there, 125 125
OpenVAS, 126 126
you can start learning which things 127 127
are vulnerable on which networks, 128 128
and start getting a better repertoire 129 129
and be able to start attacking those things 130 130
as you move forward. 131 131
I hope you guys enjoyed this bonus lecture, 132 132
as I updated this course just a little bit, 133 133
and really show you some of the latest techniques, 134 134
and what was being used in WannaCry 135 135
to be able to get this ransomware out there.