Exploiting Eternalblue & DobulePulsar MS17-010

Exploiting Eternalblue & DobulePulsar MS17-010  (A root behind of Mass attack of WannaCry and Petya malwares)

Brief Description: This exploitation uses the buffer over vulnerability in SMBv1 of windows OS. Without going in detailed technical analysis about the vulnerability, this document shows the exploitation of 32 Bit Windows 7 OS using metaSploit provided within Kali. 

Pre-requisites

•       Target Windows 7 32Bit OS with running 445 Port with SMBv1 protocol. (Windows OS runs default with 445 Port)

•       Attacker Up-to-date Kali Box with metaSploit with 

1.       smb_ms17_010.rb ruby script to check MS17_010 vulnerability check on target. Download Link: https://github.com/rapid7/metasploitframework/blob/master/modules/auxiliary/scanner/smb/smb_ms17_010.rb  

2.       Exploit code Eternalblue-Doublepulsar-Metasploit

Download Link: https://github.com/ElevenPaths/Eternalblue-Doublepulsar-Metasploit.git  

3.       VMWare having above 2 box deployed and running with Network Adaptor set to NAT.

In below demonstration below are the IP configurations of Target and Attacker machines.

Kali Box IP is: 192.168.29.130

Windows Box IP is: 192.168.29.129

Steps to exploit:  In your Kali Box

1.       Firstly run apt-get update && apt-get upgrade on terminal

2.       And then apt-get install wine or wine install (don’t worry about reflected error if any)

3.       Now copy smb_ms17_010.rb file at location root/usr/share/metasploitframework/modules/auxiliary/scanner/smb/ . 

4.       From downloaded Eternalblue-Doublepulsar-Metasploit folder copy  eternalblue_doublepulsar.rb  file at root/usr/share/metasploitframework/modules/exploits/windows/smb/

5.       Now open the  Metasploit framewokr on terminal with commands msfconsole you will be the msf console and run  reload_all command as below

Use use exploit/windows/smb/eternalblue_doublepulsar as below and set target as RHOST 192.168.29.129 and check with options

Hit the run command and result shows target windows machines is vulnerable to smb_ms17_010.

Now for exploiting the target use the exploit module “exploit/windows/smb/eternalblue_doublepulsar” and set all the various options as given below:

Finally run the exploit as below and hurrey….. we got a shell on target machine. 

Further we can run any Post exploitation commands and utility with the available meterpeter session to do anything with the compromised machine.