Instructor: Welcome back.
In this small section we're going
to cover SMB Ghost Windows 10 vulnerability.
Since there is no module available
for the Methods Plate framework
regarding this vulnerability,
we are going to need to exploit it manually.
And by manually I mean we will have
to find a working exploit ourselves,
run it ourselves,
and redirect the connection
to our Linux machine ourselves.
All of these tasks
Mathis Point Framework did for us automatically.
And since we can't really rely on tools
we're going to learn through
this Windows 10 vulnerability
how we can do all of that ourselves.
Now the vulnerability that we are exploiting is rather new.
I believe it got disclosed in June 2020
and for this we will need
to install Windows 10 virtual machine.
Not all versions are vulnerable since it got batched
so we will have to install a vulnerable version
of Windows 10 machine.
Since this as well is an SMB vulnerability
we won't need any additional software to run
on our target machine for this exploit to work
which makes it even more dangerous.
Just like the previous two vulnerabilities
which were EternalBlue and the BlueKeep.
But they were attacking Windows 7.
This one attacks Windows 10.
All our target needs to have his Port 4 4 5 open
and some previous version of Windows 10.
The exact vulnerable version that we are looking for
is either Windows 10, 1903 or Windows 10, 1909.
So you will need ISO file as usual to create this machine.
And both of these versions are vulnerable
to the SMB ghost attack.
Let me show you right now
where we can download previous version
of Windows 10 ISO file.
And by the way, we will be using this Windows machine
in the next section as well to test the payloads
that we will create.
But more about that later on.
For now on, let's focus on creating our virtual environment
for this attack.
So what you want to do first is you want to navigate
to this rufus.ie website.
And this software right here
that we're going to download
is used to create bootable USB drives
with the ISO files.
Now you might be asking, "Well why are we
going to need this?
We're not going to boot into our computer over USB drive.
We are installing a virtual machine."
And that is true
but this software also offers us
to download some previous versions
of Windows 10 operating system.
That's why you want to go down here.
Click on this Rufus 3.11 and download the file.
It is the size of 1.1 megabyte.
Once you download it, you should be having
this file right here on the desktop.
Double click on that file
and it'll ask for the administrator password.
You want to click on yes or type in the password.
And right here where we want to go
is this arrow next to the select.
But now here's a small advice.
Sometimes this arrow right here will not appear
and it actually didn't appear to me
once I downloaded this software for the first time.
So what I did is I tried restarting
this program several times.
So just close this.
Open this again.
Close it and open it again.
That might work and what also might work is going right here
to the application settings
and changing this check for updates.
Then click on close.
Restart the program
and eventually this arrow right here should appear.
Once it appears, click on it and click on download.
And once you select the download, click
on download once again,
and this will start running download script.
In just a few seconds you should have
this small window pop up.
Here we want to select
what operating system we want to download.
If I click on here
it will ask me if I want Windows 8
or Windows 10.
I want to select Windows 10.
Click on continue.
In the next step it will ask me
which exact release do I want to select.
And right here we want to go with this one
which is 19 H 1, build 1 8 3 6 2 dot 3 5 6.
And it says right here the date is 2019 September
or ninth month.
So click on this right here.
Then click on continue.
You can select Windows 10 home.
Click on continue here as well.
Language we can leave on English.
And the last step, which is architecture, we can leave
on Act 64.
Then you can click on download right here
or you can download using a browser.
If you simply just click
on download it'll open the file explorer.
And here you can pick where you want to save it
on your desktop.
Keep in mind that the size of the file
is around five gigabytes.
So this will take some time.
Since I already have it downloaded I will not
be downloading it again.
For you, just wait for the download to finish
and you should have a Windows 10 ISO file ready.
Make sure that you pick the exact same version
that I did right here.
And once all of that is finished you can close
this program.
The next step is to install Windows 10 virtual machine.
So I already got one running right here
and for you, you can do it the same way that we did
with any other machine.
So just type Windows 10.
Select right here, Microsoft Windows, Windows 10, 64 bit.
Click on next.
Choose two gigabytes of RAM or choose the same amount
of RAM that you use for the Windows 7.
Click on Next.
Here we want to create a virtual hard disc.
All of these steps we can next, next, next.
Here, I got 25 gigabytes in my case.
And you can choose whatever you want right here.
And this will create your virtual machine.
Now since I already have it I will delete it
but before I delete it, another two settings
that you want to choose
is as we did with the Windows 7 machine
under the storage, under the empty, you want to remove,
and you want to add the Windows 10 ISO file
which I have right here.
The next setting that you want to change
is from Net to Bridged Adapter.
Once you do all of that you can start
the process of installing Windows 10.
Now there is not any important step
in Windows 10 installation
so you can do it however you want.
But just a pro tip.
Once it gets to the part where it asks you
for the account creation
where you need to specify an email address and all of that.
You can skip that part by unplugging your device
from the internet.
And then it'll allow you to create
an offline Windows account.
So you won't need to create an email
for the Windows 10 account.
All of the other steps are not important.
You can do them as you like.
And once you do all of that
you can start your Windows 10 machine.
Another thing that we need to do
to get our Windows 10 machine fully ready
for this attack is to disable the firewall.
So go down here.
Type control panel.
And the way we disable it
on Windows 10 is the same way that we disable it
on Windows 7.
So click on control panel right here.
Click on system and security.
Click on Windows Defender Firewall
and turn it off in this button right here
which says turn Windows Defender Firewall on or off.
Mine is currently off.
Once you do that, everything is ready
and you should be good to go.
For the next video where we are going to try to search
for the exploit for this particular attack.
See in the next video.