Eternal Blue
REF:
LegacyHTB, BlueHTB, SambaSMB, WindowsCmdKungFu
nmap
---------------------
nmap search and test:
PORT STATE SERVICE
139/tcp open netbios-ssn
445/tcp open microsoft-ds
> grep smb /usr/share/nmap/scripts/
.. smb-vuln-ms08-067.nse
> nmap --script vuln
> nmap --script smb-vuln $IP -Pn -p 445
> nmap --script smb-vuln* $IP -p 139,445
> nmap --script smb-vuln-ms08-067 $IP -Pn -p 445
> nmap --script smb-vuln-ms17-010 $IP -sV -p 445
Host script results:
| smb-vuln-ms08-067:
| smb-vuln-ms17-010
| VULNERABLE:
| Microsoft Windows system vulnerable to remote code execution (MS08-067)
| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
| State: VULNERABLE
| IDs: CVE:CVE-2008-4250
| IDs: CVE:CVE-2017-0143
Eternal Checker
Eternal Blue - Metasploit
AutoBlue - Metasploit
Auto-merge - with Metasploit
Shellprep, AutoMerge, Netcat: Exploit7
No Metasploit
AutoBlue - No MSF - zzz_exploit.py
Needs: mysmb.py
If you are lucky, this might work without custom payload
Needs to have pipe known/exposed and guest/anonymous
Ex: legacyHTB..worked blueHTB..failed
Exploit7 - No MSF - Manual Merge
Create 32 and 64bit payloads. Then Merge.
This Method will skip the "Named Pipes" headache
Exitfunc means less chance of crash
AutoBlue - No MSF - zzz_exploit.py - Named Pipes
Custom Payload. No Metasploit.
zzz_exploit.py
Needs: mysmb.py
auxiliary/scanner/smb/pipe_auditor .. Not allowed on OSCP
pipes = [ 'browser', 'spoolss', 'netlogon', 'lsarpc', 'samr' ] ..check the code for this!
Ex: blueHTB
RDP Trick
Last updated
Was this helpful?