Blue
Blue Walkthrough
I just exploited a machine vulnurable to Eternalblue & am sharing my writeup on manual & automatic exploitaion. Enjoy!
Manual Exploitation of Windows Eternalblue Vulnurability
We start again with an Nmap scan
nmap -A 10.10.88.46
Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-15 00:36 UTC
Nmap scan report for 10.10.88.46
Host is up (0.19s latency).
Not shown: 991 closed ports
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
3389/tcp open ssl/ms-wbt-server?
| ssl-cert: Subject: commonName=Jon-PC
| Not valid before: 2021-07-14T00:33:17
|_Not valid after: 2022-01-13T00:33:17
|_ssl-date: 2021-07-15T00:37:43+00:00; 0s from scanner time.
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49158/tcp open msrpc Microsoft Windows RPC
49160/tcp open msrpc Microsoft Windows RPC
Service Info: Host: JON-PC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 1h14m59s, deviation: 2h30m00s, median: -1s
|_nbstat: NetBIOS name: JON-PC, NetBIOS user: <unknown>, NetBIOS MAC: 02:66:df:f5:fe:b3 (unknown)
| smb-os-discovery:
| OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
| OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
| Computer name: Jon-PC
| NetBIOS computer name: JON-PC\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2021-07-14T19:37:37-05:00
| smb-security-mode:
| account_used: <blank>
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 2.02:
|_ Message signing enabled but not required
| smb2-time:
| date: 2021-07-15T00:37:37
|_ start_date: 2021-07-15T00:33:16
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 87.02 seconds
We see that SMB service is running on 445, and that the system is running Windows 7. Whenever I see Windows 7 and SMB in the same place I’m tempted to scan the machine to see if it is vulnerable to Eternal Blue or other vulnerabilities affecting the older operating systems).
This time I’m scanning for this with nmap, Here’s scan result;
nmap --script vuln 10.10.88.46
Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-15 01:18 UTC
Pre-scan script results:
| broadcast-avahi-dos:
| Discovered hosts:
| 224.0.0.251
| After NULL UDP avahi packet DoS (CVE-2011-1002).
|_ Hosts are all up (not vulnerable).
Nmap scan report for 10.10.88.46
Host is up (0.18s latency).
Not shown: 991 closed ports
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3389/tcp open ms-wbt-server
| rdp-vuln-ms12-020:
| VULNERABLE:
| MS12-020 Remote Desktop Protocol Denial Of Service Vulnerability
| State: VULNERABLE
| IDs: CVE:CVE-2012-0152
| Risk factor: Medium CVSSv2: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:N/A:P)
| Remote Desktop Protocol vulnerability that could allow remote attackers to cause a denial of service.
|
| Disclosure date: 2012-03-13
| References:
| http://technet.microsoft.com/en-us/security/bulletin/ms12-020
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0152
|
| MS12-020 Remote Desktop Protocol Remote Code Execution Vulnerability
| State: VULNERABLE
| IDs: CVE:CVE-2012-0002
| Risk factor: High CVSSv2: 9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C)
| Remote Desktop Protocol vulnerability that could allow remote attackers to execute arbitrary code on the targeted system.
|
| Disclosure date: 2012-03-13
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0002
|_ http://technet.microsoft.com/en-us/security/bulletin/ms12-020
|_ssl-ccs-injection: No reply from server (TIMEOUT)
|_sslv2-drown:
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
49158/tcp open unknown
49160/tcp open unknown
Host script results:
|_samba-vuln-cve-2012-1182: NT_STATUS_ACCESS_DENIED
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: NT_STATUS_ACCESS_DENIED
| smb-vuln-ms17-010:
| VULNERABLE:
| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
| State: VULNERABLE
| IDs: CVE:CVE-2017-0143
| Risk factor: HIGH
| A critical remote code execution vulnerability exists in Microsoft SMBv1
| servers (ms17-010).
|
| Disclosure date: 2017-03-14
| References:
| https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|_ https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
Nmap done: 1 IP address (1 host up) scanned in 95.81 seconds
And apparently this machine is vulnurable to EternalBlue(MS17-010).
Enumeration
After getting the exploit on our machine, we can run the eternal-checker.py script to confirm vulnurability
Generating Reverse shell from shell_prep.sh script, 
Listening on netcat port & boom we have shell as a low pridilege user, 
Most times We will need a tool like Mimikatz to help us. We will be using certutil.exe this time to pull the file as Powershell is being uncooperative on the older version of Windows.
We are pulling the file from our server, naming it mimikatz.exe, and then running it after the ampersand. We have a Mimikatz command line, which will allow us to grab the NTLM hash we need.
And we have the password hashes of the users of the machine; 
We can crack the password hash of the user of interest, this time (Jon), to get the plain-text password using Crackstation else we use John the ripper or hashcat or any similar tool.
And that’s it for manual exploitation of the Windows Eternalblue Vulnurability.
###Automatic Exploitaion of Eternalblue (Metasploit)
We can go ahead & search for the vulnurability on the metasploit database 
Enjoy Reading This Article?
Here are some more articles you might like to read next: