Hacking Windows using Eternalblue - [THM] Walk-through

In 2017 the EternalBlue exploit was leaked to the public by a hacker group known as the Shadow Brokers. EternalBlue is a software vulnerability in Microsoft's Windows operating system Server Messaging Block (SMB) protocol, specifically SMBv1, and also happens to be the name of the exploit that the Shadow Brokers claim was developed and weaponized by the National Security Agency (NSA) to take advantage of this vulnerability.

This walk-through will demonstrate how EternalBlue can be leveraged to exploit the EternalBlue vulnerability in the Windows SMB protocol allowing an attacker to manipulate flaws to remotely execute code, gain access, and elevate privileges on the remote target. 

Enumerate the target 

We begin by enumerating our target using rustscan. RustScan is an open-source scanning tool, written in the Rust language, that works with Nmap but turns a 17 minute Nmap scan into about 60 seconds give or take. Either way it is much faster. The -- in the command signifies the end of rust commands and the beginning of Nmap scripts command. In this case we are running Nmap's "vuln" script.

 

We can see from the output that the target system is listening on ports 139 (NetBIOS) and 445. Therefore, we can deduce that this system most likely has SMB running which we also confirmed using Nmap's vuln script as it identified that the target is indeed vulnerable to SMB remote code execution (RCE) vulnerability MS17-01.

Armed with this knowledge we can now move on to the...

Exploitation Phase

To start the exploitation phase we will fire up the Metasploit Framework (MSF) on our Kali attack system and execute a search for "eternal".

 

 

The search provides us with several results. The first one is an SMB Remote Windows kernel pool corruption exploit. We will choose that one. Next, we run show options to see what we have to configure for the attack. Looks like we have to set the remote host (RHOST- victim) and the local host (LHOST -  attacker)

 

Our victim's IP address (RHOST) is 10.10.22.244, now we have to find out IP address (LHOST). 

 

Next we configure and launch the exploit in MSF. The port settings (LPORT) will default to 4444.

The exploit runs and....Winner winner chicken dinner! The exploit was successful and we now have a reverse TCP shell as the NT System account.

Although we landed in a meterpreter session we can us the shell command to get a Windows shell and run whoami to further validate we are NT AUTHORITY\SYSTEM. CNTRL-Z sends shell to background and brings us back to Meterpreter.

 

Privilege Escalation 

Just because we are system doesn't mean our process is. So we want to find a process  that is running at NT AUTHORITY\SYSTEM. We executed the "ps" command and see that winlogon.exe runs as system. We use the "migrate" command to migrate to the winlogon.exe process. Now that we are sure that we are in an elevated Meterpreter shell we will execute a hashdump to dump the non-default user's password and crack it.

 

Once we have the hash for "Jon" there are a couple of ways to go about cracking the password. For the first way we can use a site called CrackStation. 

 

Another way to crack the password would be to use a tool that is local to our Kali attack box. The tool is John the Ripper. 

Now that we have cracked the password it is time to capture the flags. All the flags on TryHackMe have a clue as to where they are located. The clue for the first flag is that it can be found at the system root. 

Flag2? This flag can be found at the location where passwords are stored within Windows.

flag3? This flag can be found in an excellent location to loot. After all, Administrators (our "Jon" account is a local admin) usually have pretty interesting things saved.

Finally and easier way to find the flags using the Windows command line would be to cd to the top-level drive and run the following command C:\ dir /s *flag* this will show you the location of all the flags.

I appreciate you taking the time to read through and comment on this walk-through. I have taken you all the way to the point of locating the flags. I will leave it up to you to figure out the last step. How to read them #tryharder ;-). Thanks again! and until next time...Happy Hunting!