0

I've tried recently to run the EternalBlue exploit via metasploit (on VirtualBox lan), and I've spotted that if the victim PC uses the most naive windows-firewall than the attack would fail. That got me thinking - how initially attackers used this exploit to run WannaCry-like ransomware, how did they bypass firewalls to execute the exploit ?

1

There are many reasons why you may not be able to exploit the host, not all of which will have to do with the firewall.


Firewall Settings

Many firewalls have a default configuration where all incoming connections are blocked, except for the allowed connections, while all outgoing connections remain unblocked.

If you attack an open port that is allowed to receive connections from your particular host -- and the target is exploitable -- you should be able to retrieve a reverse shell from the target, provided you used the correct settings.

You may still be able to exploit this by finding a port that is allowed by the firewall's outgoing connection configuration.

You may even encounter settings where the incoming connections are allowed, but creating new outgoing connections are blocked. In this case, you may need to use a bind shell.

If RDP is open externally, you may be able to add a new administrative user and log in to that host.

However...


Payload Settings

It's also possible that the firewall is not blocking this attack.

You may be attempting to exploit this using the wrong target architecture, wrong process, etc. It's highly recommended that you enumerate your target to discover which kind of payload to use.

You may have even made the service unstable through repeated exploitation attempts, meaning it will not respond even if you use the correct settings. In this case, reboot the machine and try again.


Anti-Virus

If you know the target is using adequate anti-virus, you will likely need to encode/obfuscate the payload before it can be executed without being stopped.

1

EternalBlue requires network connectivity to SMB on the target, so if the Windows Firewall (or any firewall between attacker and target) is blocking that access, the attack will fail.

Ransomware like Wannacry depended on the fact that most organizations do not run host firewalls like Windows Firewall on their systems.

1

Eternalblue targets tcp port 445 running SMB, and in some cases 139 as well. Windows firewall don't normally block access to this port as it's supposed to be used for internetworking between domain users. A sure way to check would be to scan and see if the port appears as open. If it does and you are able to identify it as SMB, then windows firewall is definitely not blocking any connection to it.

Exploiting eternalblue is trivial once the port is exposed and the SMB running is not patched. However, from experience, it sometimes take a couple of tries before getting a successful exploitation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.