Instructor: Welcome back time to gain access
to our Windows 10 machine using the SMB ghost vulnerability.
For now we manage to scan it,
to see if it's vulnerable.
And we also manage to find a tool
that we can use to crash the target system.
But ideally we don't want to crash it.
Instead we want to gain shell on that target machine.
Well with this vulnerability, it is not that easy.
There are some things that we need to know
in order to be able to remotely exploit it.
Let's see what I mean.
The first thing that we must do
is we must download the tool,
that we are going to use for the exploitation.
And I will check a few of them out
and found the best working one
to be this ZecOps CVE vulnerability.
If you just type the same thing
that we type from the previous video,
which is the vulnerability name and then GitHub.
You should find this ZecOps link to be on the first page.
Click on it and down here, we can see the files that we get.
And right here we also see the usage of the tool itself.
But before we get into all of this,
let us first download the tool from GitHub.
So let's copy the link right here.
Copy go to our terminal, and type git clone,
and then the tool link.
Press enter and here it is.
It finished downloading.
Let us type ls.
And we will see a bunch of these directories
with the same name.
This one however has this extension of RCE and then POC,
which stands for remote code execution, proof of concept.
Let's change the directory to that directory.
And if I type LS right here,
we're going to see a bunch of files.
So we get this dot bat file, which runs on Windows.
We get this SMB ghost assembly shell code
for the 64 bit version.
And we get this Python SMB bleeding ghost file,
which is the exploit itself.
But we don't really know how exactly
do we combine all of these files.
So let's go back to the page
and check out the usage of the program.
The first step right here tells us
that make sure Python and ncat are installed.
Then run this dot bat file on the target computer,
and adjust the offsets at the top
of the SMB bleeding ghost dot py file
according to the script output.
Hmm, what does this mean?
Well, let's go to the Python file first.
Let us nano it.
To see what offsets do they mean.
And I assume they mean these offsets right here.
As we can see, there are five of them
and they have different offsets.
But you might be asking, well it tells us right here
that we must run this on the target computer.
And what's the point then of calling this an expert
if there is a file that we must run
on the target computer first?
Well, let's go to the note down here.
As it says you might be wondering why it is necessary
to run the dot bat file script on the target computer.
And doesn't it defeat the whole point
of the remote code execution being remote?
Well, here is the explanation.
These offsets are not random
and are the same on all Windows instances
of the same Windows version.
One could make the attack more universal,
by detecting the target Windows version,
and adjusting the offsets automatically.
Or by not relying on them all together.
Hmm, what does this mean?
Well, these offsets right here are the same
for the same Windows version.
So for example, this Windows version that we got right here.
If we had a thousand machines that were running
the same Windows version,.
Well it is enough that we run this dot bat file on this one
to check out the offsets.
Then we adjust the offsets right here inside of our exploit.
And then we can attack all the thousand machines
without having to run the dot bat file on them.
But a different version of this Windows machine
might have a different offset.
Which will then make our exploit not work.
So we must check the offsets first.
How we're going to do that?
Well, as it says right here,
we're going to run the dot bat file on the target system.
So I already downloaded the tool right here
on my Windows machine.
Here it is on the desktop.
And what you can do
is you can just open the Windows 10 machine.
Open the internet explorer, type the vulnerability name,
and then GitHub navigate to the ZecOps tool.
And then if you click on it.
Click on this code error right here
and click on download zip.
This will download the tool for you,
and you should have it right here
on the desktop right after it.
Great.
Once you do that.
What we can do is we can navigate using our terminal
to that tool.
So CD desktop, and then CD CVE.
If I type DIR right here and I run the bat file.
Of course you can run it using command front
or you can just double click on this file.
And double click on the calculate target offsets.
As we can see, this will open another terminal,
and this will give us those five offsets,
for this particular Windows 10 version.
What we must do right now
is we must change these offsets to match
inside of our Python file right here.
So let's check it out.
Here we got two D one seven zero.
The first one is the same three two two one zero.
The second one is also the same.
The third one also appears to be the same.
The fourth one is different.
Here it ends with three seven zero
and here it ends with four one zero.
So let's change that first, let's type it three seven zero,
and the last one is also different.
So here it is B A F A eight,
and here if we change it B A F A eight.
Now everything is good.
So if we control O to save this exploit.
Now we should have a working exploit.
We can close this.
We don't need it anymore.
We can also close this.
And if I go back to the page to check out the next step.
It tells us run ncat
with the following command line arguments.
So the purpose of running ncat is
because once we exploit the target,
and we run the payload, it must connect to somewhere.
Now this listening for the incoming connection,
meta split framework did for us automatically.
Right now we must do it ourselves,
and we're going to do it with the help of ncat.
So to listen for the incoming connection
we can type nc and then dash lvp.
And then the port number.
In this case, let us listen on port 4,444.
This will listen for the incoming connections.
And once we run the exploit,
the target machine will try to connect
back to this port number right here on our IP address.
Therefore, right after it,
we should have a shell popup right here,
and we should be able to execute commands on target machine.
Great.
Let's check out the next step.
The next step is to run the .py file,
while following the command line arguments.
So the command that we must run is the file name,
then the target IP address, then the Kali Linux IP address,
and then port that we're listening on.
And this reverse shell IP is just the IP address
of the machine that you're listening
for the incoming connections.
And you get the explanation right here as well.
So let's try it out.
We are listening right here already.
And let us run the file right here.
We're going to use Python three SMBleedingGhost.py.
Then comes the targets IP address.
Which is in my case, 192.168.1.5, as it says right here.
Then comes the IP address on Kali Linux machine.
And I'm going to check it out
inside of a third terminal real quick.
It is dot one dot 12.
So let's type it right here.
And the last step is to specify the port number
that we're listening on.
And in our case that is the port four four four four.
If I press enter, hmm.
We get an error that says no attribute windll,
and I knew this error will come up.
The solution to this is to run the exploit
from a Windows machine.
So this file right here must be ran
from another Windows machine,
and then we can redirect the connection
to this Kali Linux Machine to Papa Shell.
Why is that?
Well, this C types library has no attribute in windll.
Which is only to be ran in a Windows environment, I believe.
So let's test it out.
For this, I'm going to use my main Windows 10 machine
right here to run the exploit.
And I will redirect the connection once exploited,
to the Kali Linux machine that is already listening,
for the incoming connections.
Now, I know it sounds a little bit complicated,
but let's give it a try.
I already downloaded the exploit right here.
Here is the file containing all of the other files.
And if I open my command prompt, then I navigate
to this directory right here containing the exploit.
What I'm going to do is
I'm going to run the exact
same command that I ran previously on my Kali Linux machine.
Just this time I will be running it
from my main Windows 10 machine.
So the IP address of the target is first.
Then comes the IP address of the machine
that is listening for the incoming connections.
And this might sound confusing,
but this is still the IP address of our Kali Linux machine.
If you want, however,
you can also connect back to this Windows 10 machine,
but in that case you must install Netcat for Windows,
and listen using Netcat from a Windows machine.
And then right here you would specify the IP address
of the Windows 10 machine that is running the exploit.
Since there is no need for me to do that.
I will just specify the Cal Linux IP address
and the port number is four four four four.
Great.
The command is here and if we execute it.
It will start the exploit,
and sometimes this exploit will crash the target.
As we can see right here.
The first try of running this exploit
crashed our target machine.
And this is something that you must get used to
once running these type of exploits.
So what I'm going to do is
I'm going to control CD to quit this exploit.
And then what I'm going to do
clear the screen using CLS command,
and I will run this command once again.
Just I will wait for this Windows 10 machine
to boot up once again.
And we are going to give it a second try.
And now that we're logged in,
I will run the command once again.
Now there is a chance that it will crash once again,
but hopefully it will not.
And here it is.
It crashed once again.
So I'm just going to restart it again real quick,
and then run the exploit for the third time.
Hopefully the third time it'll work.
Okay, here it is,
and hopefully the third time will be our lucky run.
Let's run the exploit.
For now everything seems to be working.
We haven't reached this point in the past two tries.
So hopefully right now the target will not crash.
And what we're looking for at the end of this,
is after the exploit is done,
we're looking to gain the shell right here,
inside of our Kali Linux machine.
So let's wait for this to finish.
It tells us right here, wrote shell code
and if I go to my Kali Linux machine, here it is.
We got the shell on our Windows 10 target machine.
If I type who am I.
We are the system level account.
So we are the highest level account possible.
If I type IP config just to check
whether we have the same IP address,
and that indeed is the same machine.
So we successfully exploited the Windows 10 target machine.
Just for this, we had to use a Windows machine
to run the exploit.
Because of some libraries inside of the Python file.
And if you notice right here,
it tells us that if we disconnect
and if we exit this exploit, the target will probably crash.
So what we would want to do is we would want to execute all
of the commands that we want to execute.
Do what we need to do on the target machine.
And then after we've done and we've exited the shell.
We can go right here, stop the exploit.
And once this exploit has been disrupted,
that will again crash the target machine.
As we can see right here.
Just this time, we managed to run the shell.
We managed to execute commands on the target machine,
for as long as we wanted, before crashing the machine.
So the goal right here is to first gain the shell,
and then the machine will crash,
and not crash the machine at the beginning of the exploit.
But that is something that we do not have control of.
So sometimes you will gain the shell,
and sometimes you might crash the target machine.
Okay, great.
So we successfully exploited Windows 10 machine.
We did it manually
with the help of tools that we found online.
We also set up our own listener
that was waiting for the incoming connections.
And right now that we covered all of these vulnerabilities.
Starting from the next video,
we're going to see how we can attack targets
that do not have any vulnerability.
So we are going to see how we can generate our own payloads,
and how we can deliver them to the target machine.
See you in the next video.