Python Program to Detect CVE-2017-0144 Attack

Python program tasked with continuously monitoring network traffic in real-time. It will alert on the console when it detects a CVE-2017-0144 (EternalBlue) attack

1. Lab Model

This lab is performed on 3 virtual machines in VMWare. 1 attacker machine (Kali Linux), 1 victim machine (Windows 7 - 64bit SP1), 1 monitoring machine (Windows 10). The machines share the same network card (NAT) and ensure they can ping each other. Some notes:

• Kali machine needs to update to the latest version sudo apt update
• Windows 7 machine: turn off the firewall
• Windows 10 machine must have Python installed

2. Steps to Perform

B0: Turn on the 3 machines in the model

B1: On the attacker machine: Start Metasploit. You can use the command msfconsole in the terminal to start

B2: Next, search eternalblue to find the appropriate attack module. Use the module: use exploit/windows/smb/ms17_010_eternalblue

B3: Set the parameter set RHOST + victim machine's IP.

B4: On the monitoring machine: Run the program. The running program will log network traffic to a .csv file; if an attack is detected, it will display a notification on the console and log it to a log.txt file

B5: On the attacker machine: start the attack exploit

B6: On the monitoring machine, a notification of the attack detection will be displayed. The Kali machine will have a session to the victim machine; you can use the command shell to open the victim's CMD. Lab complete.

3. References

More information about CVE-2017-0144:

• https://en.wikipedia.org/wiki/EternalBlue

Find a suitable OS version for the victim machine:

• https://www.getmyos.com/