Exploiting the Windows MS17-010 SMB Vulnerability.
In this video, we will be exploring
the process of exploiting Windows systems that
are vulnerable to the MS17-010 SMB vulnerability that allows
attackers or that can allow attackers
to essentially execute remote code on vulnerable Windows
systems.
Now, this is probably one of the largest,
most popular vulnerabilities that has been again,
made public in the recent years, and for good reason.
So first and foremost, let's get an idea or an understanding
as to how this vulnerability came to be,
what service it exploits, as well as how it can be exploited
with the Metasploit framework.
All right, so EternalBlue is the name
given to the exploit that takes advantage of the MS17-010
vulnerability.
All right?
Now, this vulnerability is also known through its CVE
code, which is 2017-0144.
So if you ever want to identify it or learn more
about this vulnerability, you can
utilize the Microsoft security or vulnerability
ID, which is MS17-010 and the Common Vulnerabilities
and Exposure code, which is 2017-0144.
And of course, both of these codes
give you an idea as to when this particular vulnerability was
made public and consequently, the exploit was made public.
So EternalBlue is the name given to a collection of Windows
vulnerabilities and exploits that allow attackers
to remotely execute arbitrary code and gain
access to a Windows system, and consequently, the network
that the target system is a part of.
Now, the EternalBlue exploit was developed
by the National Security Agency, that's
the NSA, to take advantage of the MS17-010 vulnerability
and was leaked to the public by a hacker group called
the Shadow Brokers in 2017.
So the NSA had essentially developed exploit code
to take advantage of this vulnerability
before Microsoft was even aware that this vulnerability
actually existed within pretty much all versions of Windows
after Windows Vista.
So again, due to the fact that this vulnerability was released
to the public in 2017 by the hacker group,
the NSA actually reached out to Microsoft
and informed them of this vulnerability, which
allowed Microsoft to again, start
developing patches for the vulnerable systems,
which is pretty much every Windows system
on the planet at the time.
Now, the EternalBlue exploit, in regards to how it works,
essentially takes advantage of a vulnerability in the Windows
SMB version 1 protocol.
As we've already explored SMB, SMB
is used for network file sharing.
And as a result, through this vulnerability,
it essentially allows attackers to send specially
crafted packets to SMB or a target
running SMB, which is pretty much
every Windows system out there.
That again, would consequently facilitate the execution
of arbitrary commands.
Or in the case of Metasploit, the execution
of payloads like a Meterpreter payload.
Now, the EternalBlue exploit--
and this is where it sort of gained its popularity--
was utilized in the WannaCry ransomware attack
on June the 27th of 2017.
And this particular exploit was used to again, exploit
Windows systems.
So it was used during the ransomware campaign
to essentially gain access to vulnerable Windows systems
and then utilize the EternalBlue exploit to again,
access or exploit other Windows systems on the local network
or with the objective of spreading the ransomware to as
many systems as possible.
So it was a really big deal in 2017.
And a lot of companies, hospitals, and institutions
were affected by this particular vulnerability.
And consequently, the exploit code,
which is EternalBlue, as well as the various ransomware
campaigns that utilized the EternalBlue exploit.
Now, the thing that makes this vulnerability so serious
or so dangerous-- especially when it comes down to Windows
systems--
is that it affects multiple versions of Windows ranging
from Windows Vista to Windows 7, Windows
Server 2008, Windows 8.1, Windows Server 2012, Windows
10, and Windows Server 2016.
Now, as I mentioned earlier, Microsoft
released a patch for the vulnerability in March 2017.
However, given the fact that it affects multiple versions
of Windows, many users and companies
have still not yet patched their systems,
which means this is still a viable vulnerability that one
can exploit, especially in some of the older enterprise
environments that have still not yet patched their systems.
Now, the EternalBlue exploit has a Metasploit Framework
auxiliary module that can be used
to check if a target system is vulnerable to the exploit.
And also, has an exploit module that
can be used to exploit the vulnerability
on the unpatched Windows systems.
So the EternalBlue exploit module
can be used to exploit vulnerable Windows systems
and can be used to consequently provide us
with a privileged Meterpreter session on the target system.
The key thing to note here is that
this particular vulnerability, and consequently
the EternalBlue exploit, will provide us
with a privileged session.
So instead of just getting a standard, non-privileged
Meterpreter session, we're now getting
full anti-authority permissions on our Meterpreter session,
which pretty much means we have total control
over that particular target system.
And consequently, other devices or other
Windows systems on the network.
So again, we'll be taking a look at how
to utilize the Metasploit Framework EternalBlue auxiliary
and exploit modules in the practical section.
So in this practical section, I'm
going to be again, performing these techniques
in my own virtual environment.
And of course, the reason I'm doing this
is because, as I said, it's not wise to have this vulnerability
in an online lab environment because again, it
can be exploited by attackers.
And that's how powerful it is.
So in order to demonstrate this technique,
I'm going to be utilizing my Kali Linux VM.
And the target system is going to be a Windows 7
VM that is I think Service Pack 1-- that's running Windows 7
Service Pack 1.
And again, in your case, all you need to know
or all you need to be aware of is the techniques
and the modules that we are going to be utilizing.
And again, if the target system that you're working on
is vulnerable to the MS17-010 vulnerability,
then again, this video will explain
how you can utilize the Metasploit Framework to exploit
that vulnerability.
So let's get started.
All right, I'm back on my Kali Linux VM.
And I'm just going to open up my terminal here.
And we'll start up the Metasploit Framework console.
And again, go through the process
of performing a port scan on the target system
in order to identify where the SMB is running.
So again, we're just going to wait for MSFConsole
to start up.
I'm just going to increase the font size here
so you can see what's going on.
There we are.
Starting the Metasploit Framework console.
And I'm going to create a workspace called--
we're just going to call it EternalBlue, all right?
There we are.
And now that that's done, we're going to again,
utilize the db_nmap command to perform an Nmap scan
and directly import the results into the Metasploit Framework
database.
And more specifically, into our current workspace.
So we're going to perform a SYN scan, as well as a surface
detection scan, as well as an operating system detection
scan.
So we'll use the operating system detection flag there.
And then the target IP address or the IP address
of the target system.
In my case is 10.10.10.7.
And I'm going to hit Enter.
It's going to tell us that this particular scan requires
root privileges.
So I'm just going to type in my password here.
And we're going to wait for the scan to complete.
All right, the Nmap scan is complete.
And as you can see, the target is running SMB, obviously.
And it is a Microsoft Windows 7 system.
And we don't get the exact version or the exact service
pack, but under the operating system detection
output here provided by Nmap, we can
see that we get some good guesses as to what
the operating system is.
And in this case, it correctly identifies it
as either a Windows 7 Service Pack 1 or Windows Server 2008.
So let's clear out our terminal.
And of course, we can always list out the services
by typing out these services command here.
The first thing we want to do is perform
a check using the EternalBlue auxiliary module.
And this module, as I mentioned previously,
will be utilized to scan and check
whether the target is vulnerable to the EternalBlue exploit.
In order to do this, we're going to say Search
and then the type is going to be Auxiliary
because we are looking for an auxiliary module specifically.
And then we can type in EternalBlue and hit Enter.
As you can see, we have the auxiliary module here.
That will essentially-- this is the module here,
this module will essentially perform the MS17-010 SMB
remote code execution detection.
So we can utilize that module by just copying the name.
And we can then paste it in here.
If we show the options, you can see
that we have various options that we can check.
One of them is the Check Architecture option.
That is, by default, set to True.
And this will check for the target architecture
on the vulnerable host.
That is very important.
It is also going to check the actual DOUBLEPULSAR exploit,
and that is also set to True.
It is also going to again, check the pipe, the SMB pipe.
There we are.
That's going to check for the named pipe on vulnerable hosts.
And then we can specify the target IP here,
which we'll do in a few seconds.
And the RPORT is set by default to 445.
So we're going to set the RHOST option here
through the target IP.
And of course, you can also scan an entire subnet.
If you are performing a penetration test
on an entire network, I would recommend
performing the vulnerability scanning with this module
to essentially check whether any of the systems on a network,
any of the Windows systems on a network,
are vulnerable to this particular exploit.
Once we're ready, we just type in Run.
And as you can see, it immediately
tells us that the host is likely vulnerable to MS17-010.
And it then gives us the actual operating system version.
So it's a Windows 7 Ultimate 7601 Service Pack 1
and it's a 64-bit operating system.
All right, so we can now search for the exploit module,
the EternalBlue exploit module, which
can be done by saying Search, limiting
the output to the exploit--
or rather to exploit modules.
And then searching or specifying the EternalBlue
exploit name here.
So we're going to say EternalBlue, hit Enter.
And the exploit that we are looking for
is going to be this one right over here.
So that's exploit/windows/smb/ms17 010
eternalblue.
It is released in 2017.
And again, we can copy that here.
There we are.
And we just say Use, paste in the module name.
And by default, it's going to set the payload to Windows x64
Meterpreter Reverse TCP.
And in our case, that works out fine because the target
operating system, as we have been able to enumerate,
is running Windows.
And it's also a 64-bit version of Windows 7.
So if we show the options for this module,
we have the ability to specify the payload options
like the LHOST IP address, which is
going to be your Kali Linux IP.
And then the LPORT option, which is, again,
going to be the port that you want
to listen on for the connection or the reverse connection back.
And then of course, we need to specify the RHOST option here,
which we'll do right now.
So set RHOSTS to the target IP.
That we are.
And then we can hit Run.
And it's going to begin performing or executing
the actual exploit, as well as exploiting or executing
the payload that we have paired with this particular exploit
module.
As you can see, because this is a staged payload,
it'll send the stage or set up the stage
and then send the stage and we get a Meterpreter session
on the target system.
We can verify that this is the Windows 7
system by typing in sysinfo.
And we get, as you can see, the target architecture
or operating system architecture is 64-bit.
And we also get a 64-bit Meterpreter session.
We can check our privileges by typing in the Get User ID
command.
And as you can see, we get or we currently
have access on the target system as anti-authority system, which
means we have the highest privileges
possible on the Windows system.
Which again, consequently means that we
have total and complete control over this system
and can execute any commands.
That being said, in this particular case--
or once we have utilized this particular exploit--
we do not need to perform any privilege escalation
as we've already obtained an elevated Meterpreter session.
So that is how to scan for the EternalBlue,
or rather the MS17-010 vulnerability on a target
system, as well as how to exploit the vulnerability
using the EternalBlue Metasploit Framework exploit module.
So that is going to conclude the practical section
of this video.
In the next video, we are going to be exploring
the process of exploiting the WinRM protocol or the Windows
Remote Management protocol on Windows systems.
So I'll see you there.