Hey there.
You made it to episode three.
Welcome back.
So let's go ahead and hop right in and we're going to go right to the hacked the box Web site.
And let's go ahead and spin up blue.
So we're gonna be working on Blue here and what we're going to be doing is working on this 17 0 1 0.
We're going to talk about that and its importance here in a second.
First and foremost I want you guys to spin up this machine and go ahead and go into your terminal and
start scanning it while we're scanning it.
We can use our common stall tactics and talk about the machine a little bit and then we'll get back
into the actual script.
So as always our scan show looks something like this or whatever your favorite and map or mass scan
is.
And then I'm going to go ahead and type in the IP address which I have already forgotten it is Ten Top
Ten Top Ten dot 40.
OK welcome everyone.
Quick intro.
I know.
So Episode 3 we are going to be covering MH 17 010 a.k.a. Eternal Blue.
Now this is super important.
It's gonna be easy.
We're going.
We're gonna nail this machine several different ways.
We're gonna look at the midas fly away and some of you have been asking for manual ways which I know
why we'll look at the manual method of doing this as well and talk about some precautions how to check
for it as well.
So and there's 17 0 1 0 is a vulnerability that was released a couple of years ago.
The SMB I've been harping on SMB the first couple episodes we're going to harp on SMB at least one more
time here and SMB is just so dangerous right.
And where we're at.
Here is this.
This vulnerability is a couple of years old but it's still very significant.
Now you may have heard of the want to cry vulnerability that used MF 17 0 1 0 as part of its payload
in order to navigate around networks and do ransomware on networks.
So very very disgusting vulnerability very very costly right.
And why.
Why is this critical.
Well you see this on penetration tests all the time especially well definitely internals not as much
on the external side.
You know there showed in and other tools now that people can to search for this and if you still have
this running on your external network chances are you've probably been popped.
But on the internal side see it all the time have explained it multiple times on internal penetration
tests.
In fact the latest time that I have seen it was this past week while doing an internal penetration test.
So this vulnerability while simple is super critical it allows us to have a remote code execution and
gain system access on a machine on top of that.
It's still very very common in networks.
So the reason we're going to cover this is one it's common it's critical you're still going to see it
to its SMB which covers along with the theme that we've been seeing three.
It's still an easy machine right.
We're still newbies.
We're still trying to get through some of the easy stuff.
We got to cover that eases and the basics before we can get into anything else.
So while you might be like wow that was easy.
Sometimes it is this easy.
And for because we only not only get to play the Mets play here but we also get to play with auto blue.
So we'll do it the manual way as well.
OK.
So if we look at this here you can see that we have our scan back.
You come through and you'll start to notice things as you as you see them.
But when I'm looking at a machine and I see SMB right we've got our P.C. which is common to see with
SMB and you got a bunch of RBC ports down here.
We're not going to worry about RBC today we're worried about SMB and we could see that it pulled back
a version of Windows for us.
Now it's Windows 7 professional seventy six or one Service Pack 1 when I see something like this.
Ding ding ding ding ding.
I'm thinking a journal blew right away.
OK.
So that's the first thing I'm probably checking honestly when I see this.
Now we have talked in the past and I'm not going to cover the tools because we covered the last two
times.
Right.
This is just kind of gradually advancing from where we've been.
We could look at this with SMB client and we could say hey SMB client can I connect to four or forty
five And can I get there.
Can I give you the file shares.
We can also run Metis a split on this and see what kind of S&P version is running.
We could also scroll down to the bottom there's always some SMB information down here so you could see
that it's a Windows 7 again down here.
Professional six point one.
A little bit of information.
We've got a P.C. name.
We're going to work groups so we're not in a domain here and we see message signing is disable and then
it says over here it's enabled the now required which is pretty much the same thing as disabled because
you know it's still a vulnerability here.
So we talked about that as well.
And as we get more advanced we'll cover that but this is a more active directory internal pen testing
stuff.
As I mentioned before so.
OK.
We notice you've got SMB we have in the past heard that hey you know a recent exploit is called internal
blue and a 17 0 1 0.
And another thing that I should note is when you're doing hack the box a lot of times like they give
you a hint.
OK.
They give you a hint if you notice some of these if you look through these like devil if you look through
legacies even kind of a hint.
Sunday's a hint active is a hint slightly some of these curling you might have to think hey am I have
to do with curl.
So you know there's always I wouldn't say always but a good amount of the time something in the box
name relates to something you're gonna have to do.
So Blue probably stands out right away.
That's why I'm not like going through the scan and saying hey you know I don't know what it could be.
Let's enumerate this right off the bat.
When you have a 17 010 you have it.
OK.
So we're going to do this two ways.
First way we're going to do is the autopen method.
So let's go with MSF console and let's talk about a couple things here.
Once we load this up say we're doing a real pen test.
First things first we want to confirm that we think it is eternal blue.
We want to make sure that we can see that.
So what we can say is we can say search and 17 0 1 0 something like that.
And there is this auxiliary scanner here.
Right.
We just want to know does Eternal Blue exist.
Do we think it exists.
So that's important first right.
You don't just want to fire and explode without confirming or least having a good hunch that this exists.
Also it should be noted too that I screwed that up SMB and 17 010.
It should also be noted that this exploit can tip a machine over.
So if you're doing it on an internal environment make sure that it's not a significant machine like
it.
This was a domain controller.
You'll probably want to call up you know the the client and say hey I'm about to use an exploit.
Can I use this.
It may tip your machine over.
Are you ready in case that happens.
You know if this is just like a workstation it's iffy.
They kind of maybe expect you being in there but still you don't know who's working on what.
And it would suck to lose all your work as well.
So best practice might be just to call all the time.
So we could say options here and then all we have to do is set and our host.
So the our host that we're going to set is 10 that 10 10 top 40 and then we'll say options and everything
else looks like it is set.
So it's going to check for named pipes here in this exploit.
That's kind of how it works.
Now this is complicated more and more with my head than I'll ever be able to fully understand.
But it has to be able to find a name pipe in order to actually exploit.
So let's go ahead and just run this check here and you'll get this.
It'll say host is likely vulnerable Dems 17 0 1 0 and it pulls back at 64 bit.
Perfect.
OK.
So if we scroll back up a tiny bit there are a few different ones.
There is Emma 17 010 maternal blue.
There is a P.S. exact version and there is Windows 8 here.
So this is for.
What is it.
It's for Windows 7.
And I forget the other operating system.
You can run these on Windows 10 and other servers this is a server twenty two thousand eight.
2012 I remember which one it is.
But you know it's always worth checking especially nowadays if you're running something like NASA's
nest is going to pull up and say Hey we found eternal blue at least we think we do.
Especially like on an internal assessment.
But if you don't have those sorts of tools available to you you could do this sort of check here.
So let's go ahead and just say use and then I'm just gonna paste what I just copied their sorry I'm
clumsy.
If you guys hear some shaking I keep hitting my my microphone.
OK.
Options.
And again all we've got to do is set the our host for this.
So this says two thousand eight R2 and Windows 7.
I used it on other machines I've used it on Windows 10 before it's worked.
OK.
So now we are good and we can use show targets like I've said in the past all there is is one target
here.
So let's run it.
Now this exploit doesn't always work on the first try.
It's kind of a finicky exploit.
So we'll let it run here and see if it actually works and it's it's worked first time.
Awesome.
Great.
So you see we got the win and then might just have to hit enter here and we are on the system.
OK.
So we have a command show.
We could say who am I and we are authority system on the hostname of Harris P.C. not bad.
This is pretty good.
We can improve this I believe.
So let's go ahead and hit.
Yes a board session.
Control C and then abort the session we'll close the shell.
Let's take an options again.
Now you could see that we use a generic reverse shall here see the payload generic for its last shell.
Reverse TTP.
Now this is what we consider an onstage payload a stage payload would have a forward slash here meaning
that it sends this payload in stages.
Right.
So it would say hey.
Stage one stage two stage three.
But because we now have this for its last year we can identify this as an on stage payload meaning that
it sends is all at once.
So there's different different pros and cons to both.
My recommendation is always if you're having trouble getting a shell and you're pretty sure that there's
a and exploit available consider changing this to a stage payload here.
And I'm sure we're going to encounter that as we go further.
But I can show you the differences here as well.
So we can say something like set payload what I want here is I am a a Windows fanboy right.
And this is going to be auto tab.
So Windows X 64 and I said Windows cam where I'm a mature sprit or fanboy so we can say my interpreter
if it's available it is OK.
And then we just say return fritter and this is staged right.
Look at the stages and then reverse TCB.
This is the one we're gonna want.
So let's go ahead and select that first.
And what we're doing here is we're improving our payload.
So we're going from this generic shell and you saw of brought us into it brought us into a command from.
That's OK but we could do better.
So we're going to set this payload here.
Now if we went back and we just said set payload and we did windows X 64 and a double tabbed you can
see there's other stuff besides my interpreter and here they have a shell say look at this buying TCB
or look at this reverse CPC for its last year.
This is a staged payload.
Look at this one here.
This is onstage.
So this sends in multiple stages.
This kind of sends all at once.
OK.
So it's always good to try both.
And if you're struggling say with the interpreter in general going to a generic reverse teepee like
this is always a good option as well just to try out different payloads and make sure that you're not
losing your mind with attacking with the right exploit but not having the right payload.
So payloads are important as well.
So we already have our payload selected.
Let's go ahead and say options and you could see it picks for us our Al hosts.
That's correct.
And our Al part.
That is correct.
That's fine.
We're gonna go ahead and say run now or you could type an exploit if you want to be cool.
You can see the payload option changed up here from the generic as well.
So good to note so we'll let this ride and see if it works it's possible that it doesn't work with this
mature operator.
It could be too much for it.
Maybe that's why we're using generic but hopefully we can improve this shell here in while we're waiting
on this.
What we can do is we can go out to the inter webs and we can hit the plus area get a new tab going.
So we're going to look for is a tool called Auto blue and we'll just type in GitHub.
There's a perfect Google already knows what we want auto blue MH 17 010.
So we're going to try this here and if we go to the get hub we read through it.
It tells you what it is.
So it has a python eternal blue checker here so it'll tell us Hey does this work or not work.
This will also come down and it will allow us to compile shell code similar to what we're doing shall
code will just be the payload that we're using it allow us to compile that and set up a listener with
maternal critter and then we can just post it.
It all makes sense here in a minute.
It's just a little bit more manual the method.
And this one is actually pretty good.
The one in the past when you turned blue first came out was was like it was a little bit more hands
on a little bit more detail.
This one has made it way more comfortable to use and user friendly.
So my advice is if you're looking for an alternative to Mattel operator and this is still going to use
Mattel prettier though you do not have to.
You can see in here it's going to say zero from interpretive shell one for regular command shell.
I always like them interpreter shell just because you get extra I understand their situations.
Certain exams where you can't write in that instance I think it's best still to practice with this and
practice the other way as well and just get comfortable with both.
But if I had the choice on a real world assessment I'm always using interpreter because of the flexibility.
OK so let's go back here.
You see that we've got a shell.
This is perfect.
It failed the first time I told you guys it might fail.
That happens but we've got to win here.
Same thing if you get the UIC we are authority system says info here.
OK.
We've got a return greater 64 bit in architecture 64 bit wonderful.
That's only right.
Right.
Remember from the previous episodes first things first.
Why not dump some hashes.
Right.
So now we can take these hashes and we can try to pass them around the network.
We can try to you know crack them as well with hash cat or John or whatever and see if this gets us
a foothold anywhere else in our network.
We can also dive into the machine and look for valuable information we can look at the routing table.
You know we can go into a shell and we can say like root print.
OK.
What other word is this talk to you know.
And this is it going to talk to anything.
It's not really the best example because there's no dual home machines that I know of at least in in
half the box.
So tend not to end up tend to is its gateway we can look at that.
We can look at our dash a and see what's in the ARP table and what machine that it talks to it's only
going to talk to itself NetSuite at that age you know.
So if you're not familiar with these commands again I know I mentioned them before but it's important
to learn some of these common networking commands and what we're trying to do a network that's going
to show what ports are open and what ports we're talking to.
You can see that are we're have a close wait on our last shell here and then we open up a new port.
And this is us communicating here on PDA of 10 68 and we can come back if you're curious about how that
works if we look for 10 68 OK this is apparently what we came in on this spool SUV SUV.
You can kind of look around and gain some information about you know the forensic side of things as
well.
I'm no good at forensics but it's always it's always interesting to look at these these PPD and the
p i d see the parent and the BD to see you know like OK where do we come in come in and do we see any
kind of information here.
This is also good for Migration which we'll talk about at a later time when we have to do it.
As of now we haven't had to migrate that's a little bit of a later lesson.
So we've gathered hashes we can gather network information.
We can go look at files in the file system.
Of course you know you can go and dump your hashes so your hashes are gonna be in the administrator
folder for the root hash.
And the user folder for the user hash and I won't try to do that.
Somebody showed you a couple of times now.
So this is the this is the method for the automated Meadows blight and we can also say like there's
load commands so I'm not sure if I've shown you guys these before but we can load something like kiwi
and Kiwi will do we can say help and we could do like a creds all done.
And try to dump all the credentials that we can.
Nothing came back here.
That's OK but it's cool we can dump curb Rose we could dump the W digests and you'll have to know what
any of this is right now.
I just know that we have a lot of power with maternal printer.
We can dump the Wi-Fi list.
The Wi-Fi shared list here we can change passwords can dump the Sam right.
Would seek LSA dump Sam.
OK.
There's the Sam that we just saw with the hash dump.
We could dump secrets right.
So there is a lot going on here.
You know Incognito is another great tool but I'm not going to get into.
But we can look at for example we can say list tokens for users and then we can impersonate a user if
there's one of value here way advanced topic.
I'm just trying to show you the flexibility that we have here and really hammer down That like my interpreter
is is very very flexible on top of that which we're not going to get into today either is my preference
is a bunch of post exploitation commands and you're going to see one in an upcoming video on running
a post exploit suggests.
So when we get to that you'll get to see the post the post commands and how they work as well.
So we'll focus those at a later time.
So let's go ahead and I'm going to exit out of all of this and I'm going to exit here too and let's
go download this this get Hub Repository here so we get click on this clone download and just copy this
link we can go back in and what I want to do is I'm going to change directory to my app folder that's
why I like to put my files or my programs and if you don't have get I don't know if it comes pre installed
app install get like that we'll get you what we're about to use so get clone and then we're gonna paste
this in here and then we are going to say seedy to RW alas and it looks like it's all ready for us so
if we go back into the instructions come down here now it's gotten an eternal blue checkered pie and
if we look we've got the eternal blue checker right here.
So let's run Python against that and we'll just say 10 not 10 not ten that 40 similar to the instructions
that told us to run with an IP address hit enter and it says the target is not patched.
OK so that means that it's likely vulnerable.
This is telling us this is another way when I want to use something on an assessment to prove say that
I ran the exploit the exploit is not working but I have a good feeling that the exploit is there the
vulnerabilities there.
There are times where MF 17 is there you cannot exploit it without a valid user.
There's times where you have no pipes.
This says is testing the name pipes.
There are more pipes than this and that's what maturity are found.
But there are times where you have to have a user a user of any kind doesn't have to be ad name but
just a user of any kind.
And it will allow us to get a shell in this machine.
So this is good.
This is another way to check you saw how to check with medicinally.
Now you can see how to check with this tool as well.
And what we can do here is we can follow the instructions now on how to actually generate this.
So we're going to navigate to the shell code folder.
We're going to generate some shell code and all this is is the payload.
Right.
The payloads that you were seeing just a minute ago the interpreter payload the generic payloads all
we're doing is generating this a little bit manually.
This is actually going to do it for us which is super nice super friendly.
So we're going to run the shell prep SDH and it's going to say do you want to generate a reverse shell
with MSF venom.
We'll say Yeah why not.
And then what's our Al host.
That's us.
What's the listening host.
So let's go to a new tab and I'll blow this up.
We'll say I have config or IPA if you like the new new version of doing it 10 not 10 to 14.
Twenty four for me.
OK.
What's the part you wanna listen in on.
We'll say four four four five.
Just to be different and then four x eighty six we need a different one.
Not that this is gonna be x 86.
We already know it's X 64 but that's fine.
So now do we want to generate an interpreter shell or do we want to generate a rig or command shell
if we're going completely manual will generate a command shell but just for simplicity's sake I'm going
to generate an interpreter shell and we want to be staged or stage lists.
We'll try with stage first and if not we'll try with stage was afterwards but we try to stage payload
and it worked so well.
We'll do that again here and see if we can get it to work.
And you can see the commands is running so it's running MSF venom which is a payload generator.
We're going to get into that in a later episode as well on how to generate payloads.
Actually I think the next episode's going to cover that and you can see it's just generating a payload
for the X sixty four.
You see the 64 band here that it has and it's generating one for the x eighty six as well.
So 64 bit and 32 bit different ports.
Same kind of idea.
It's just doing everything for us.
We could do this ourselves if we wanted to.
All right.
So coming through here now it says we need to do a run listener or the run listener prep so we go back
a directory say let's make sure we're in the right directory OK.
We're going to do listener prep the S H.
Now we've got to generate a listener.
So again we need our ELL host.
I believe him at twenty six or twenty four twenty four.
I used to be twenty six OK.
And we said 4 4 4 5 4 4 4 6 0 and 0.
So what this is doing is this is going to start Meadows Boy Meets Boy has something called an exploit
handler and I will be showing you guys that as well so we can use exploit handler to to set up a listener.
So we're listening here in the background for any connections that come through in our IP address at
4 4 4 5 or 4 4 4 6.
And that's all.
So it has to know the payload that you use.
So we're actually using a Windows X 64 interpreter reverse underscore TCT payload.
So the payload that we generate which you saw we generated earlier MSF venom payload.
This payload here has got to match the listener.
So listeners defining the payload.
And that's why it's asking these questions hey do you want to set up an interpreter listener.
Do you want it to be staged like this or onstage.
Do you want to be 64 bit blah blah blah.
So it's doing that.
And it set us up and then you see it set us up here with out a 64 bit payload and it's just handling
this for us.
So now you've got the multi handler running.
I've got a new tag already opened up so you guys can open up manage tab as well.
Let's scroll down to the pone down here.
So this has been tested on Windows 7 server 2008 and Windows 10.
It should work on Windows 8 and Server 2012 as well.
So we say see these dot dot.
Back to our main folder.
Now we need to do is we need to say Eternal Blue exploits 7 not pi is what it looks like.
So we'll say Python Eternal Blue exploit seven dot Pi.
All right.
We need the target IP which we know is 10 not 10 that 10 dot 40.
We need the path to the shell code.
SC All been which is just going to be shall code here.
C all been.
That's what it generated for us and then the number of Groom connections.
Now I don't know exactly what the groom connections are.
I know that it's super important.
I think it starts with 12 or 13 and then we can set it manually if we're having issues but let's go
ahead just leave that blank.
OK.
So I fired off and it looks like we got a session so we could type in sessions now and you could see
that we've got authority system on session ones we just type in sessions one we've interacted.
Same thing.
Get you.
Who am I or hostname.
We can doesn't know hostname.
That's OK.
Use this info.
And that's where you get your hostname so that's it.
That's really it like from here.
We took an easy exploit but we learned several things today right.
We learned that we can do the exploit manually.
We can also use medicinally to do it.
We learned about different types of payloads.
There are stage versus unsafe.
Now I encourage you to go read up on what the benefits are both and what the differences are but you
should know that they exist and you should know that you know the alternative might be an option or
even a generic payload might be an option that if you're sure or unsure maybe try changing your payload
before giving up completely on an exploit and we learned a little bit about MSF venom we're going to
learn more about that in the next video.
We learned about some load commands from interpreter.
You know again how to dump hashes some important network commands.
So really another SMB exploit that we can just take and build upon.
And that's all we're after we're just going to continue building on these exploits and get better hopefully.
So this is the end of episode three and that's that's all I got for you.
So until the next episode I am TCM and I thank you for joining me.