Greetings in this short video presentation, we're going to see how we go about scanning our network for the Microsoft 17 dash 010 sm, the external blue vulnerability, or the wanna cry ransomware that was recently launched on May 12 of 2017. So, initial video presentation, we're going to see how we can use n map and a script that was created by an end map user to scan our devices on the network using the Nmap scripting engine to find machines that could be vulnerable to this ransomware attack. So the first thing we're going to do is begin by locating this script and then we're going to copy it to text file up inside of Cali. And then we're going to save it to the Nmap script folder. So inside the lab, you do have the URL for the download of the script. And I've gone there.

And now I'm going to click on the download link for that particular script is going to take me over to an HTML page. Now on this HTML page, we see everything that has to be loaded into the script. So all I'm going to do is I'm going to hold down the Ctrl key. Then I'm going to hit the A key at the same time. Now if I hold down the Ctrl key, and I hit the C key at the same time, that's going to copy everything. Now with all this information that the script needs, copy to my clipboard, I'm going to Go up inside of Cali, I'm going to go to my application launcher.

And I'm going to launch leafpad. This is just a text editor solid is. Now I'm just going to right click inside of the white area, the white text box. And I'm going to right click, and I'm going to select Paste. Now there's the contents of the script that I took from the web page. I'm now going to go to file.

I'm going to do save as. And now I'm going to save this script using a particular name. Now it's important that this name remain consistent. So make sure that you say this name correctly. And what I've done is I've gone into the lab and I have copied the name from the lab instructions. And I'm just going to paste that into this Save As for this particular script name The next thing I have to do is save this script to the end map script folder so that we can call upon it, and then map will know where to find it.

So we're going to begin by going to the file system. We're next going to scroll on down to the US our folder. We're next going to go into the share folder. And from here we're going to scroll on down to where we come to in map. Open that up. And we're going to now open up the Scripts folder.

And this is as far as we have to go. All we have to do now is just click on the Save button and then map will be able to find this particular script when we decided to run it up inside of the terminal and scan our network for wanna cry ransomware vulnerability. So the next thing I want to do is Want to make sure that my callin machine is on the same network as my other devices that need to be scanned for this vulnerability. To do this, I'm going to open up the terminal. And on this terminal, all I'm going to do is type if config. What I'm looking for is the network portion of the IP address.

And that's the first three octets that we see here. So these first three octets make up the network portion of my IP for the network. Now I'm going to go to my Windows XP, and I'm gonna do the same thing. And I'm going to go to the command prompt over here. And I'm going to type in IP config. And what am I looking for?

I'm looking to see that they both share the same three octets 192 dot 168145. If it's anything Other than the first three octets, and your IP address for your network will probably differ. This is the IP for my network, yours could be 150, it could be zero dot something. Regardless, they must both be on the same network for them to be able to see each other and have connectivity. And that's what we're doing here. So back at my Cali machine, I have now cleared my terminal.

And now I'm what I'm going to do is I'm just going to go in here, and I'm going to type in the following command followed by the network, IP, and the subnet mask or the cider so that I can scan my entire network so I'm gonna type in 192168145 Zero, backslash or four slash 24. Now this says I want you to scan all of the devices, or all of the IPS that are available in this class C network. That's what it means. Once I've done this, all I'm gonna have to do is just hit enter, give it a second, and it's going to come back with the results. And if there's a machine on here, with the particular problem of being vulnerable to the ransomware, want to cry, this is what's going to happen, it's going to come back it's going to say that it found a machine that was vulnerable to the vulnerability entitled ms 17 dash 010.

And it talks about why this particular machine is vulnerable because of its running the SMB version one and setup tells me that the risk factor is high and the critical remote execution volume Existing Microsoft SMB version one, which we have running on our Windows XP machine. So I have one machine on my network with the host IP of 129, which for this demonstration is Windows XP machine. But if I was doing this on actual network, it could be 20 or 30 different machines and it doesn't have to just be Windows XP. This vulnerability affects windows seven, Windows 10 and other types of server operating systems as well. So it could be any number of devices that were discovered to have the vulnerability. So I've taken note of the IP address for the machine that was found to be vulnerable.

And I'm going to need this when I go ahead and I'm going to try to exploit this machine with this vulnerability using Metasploit. Now since this is a fairly new vulnerability. It hasn't been around very long. We want to make sure that our Kali has been updated. And then we have the latest packages. And the same thing with medicine toys.

So I'm going to go ahead and ensure that I update both Kali and meta SQLite to ensure that I have all the latest and the greatest exploits and packages so that I don't run into a problem later on not finding this particular vulnerability. So the update has been completed successfully. And I have ensured that I have updated Kali and meta sploit so that we don't have a problem, not finding this vulnerability. The next thing I want to do is just go ahead and launch the management console. So I'm just going to go ahead and hit enter. I've typed in MSF console at the end terminal prompt.

And in just a few moments, I will have misquote up and running. Okay, so now my misquote framework console is up and running. And we're ready to go ahead and see about how we go about scanning the network and exploiting this vulnerability that is present on my Windows XP machine. So the first thing I'm going to do is I'm going to go ahead and just do a search for this particular exploit and see if it actually exists. So using the search feature that is built into misquote, I'm going to now search for this particular vulnerability to make sure that I actually have it so that I don't waste my time. And this is all part of the update process.

And that's why we do this before we get into the actual scanning or trying to attempt to exploit our victim so the database is going to be searched. And we're going to come back up and hopefully we'll we will have the SMB underscore ms 17 underscore 010 exploit available for us. So the search has completed and we do see that we have the SMB exploit available for us. Now the next thing we're going to do is actually run this exploit and ensure that we have machines that are vulnerable for this wanna cry ransomware. So we're going to be using this SMB exploit, what I like to do is just go ahead and highlight like to go ahead and just highlight the path, copy it, and then go back down here to my s, my MSF prompt and I just like to type in the word use like that.

I'm going to right click, and I'm just going to paste it that's a lot easier than have to type it in one line at a time. And that's another reason why I like to search for the exploit. I'm just going to hit hit enter. Notice that the prompt changes to know that we are now using this particular exploit. Now the next thing we have to do is set the remote host. And to do this, I have typed in set space in capital letters, our host, and I've gone and I've used the Pacific IP address, but if I'd want it to scan the entire network, as I did within map, I can just back this off, type in zero slash 24.

Like that. And again, I will scan the entire network for devices that are vulnerable to this particular exploit. I'm just going to go ahead and hit enter. Now let's We know that the our host, remote host has been set. So the next thing we have to do is set the threat level. And that was, that's going to be 10.

And once I have this type thing, I'm just going to hit Enter. And the next thing we, we have to do it just type in run for the exploit to launch. I'm going to type in run, I'm going to hit enter, give it a second, it's going to go out it's going to scan my network just as it did with n map. And it's going to come back and it's going to tell me what machine or what machines are vulnerable for this particular exploit. So after about 20 minutes, the scan that we launched, to confirm that the vulnerability for the external blue and the wanna cry ransomware does exist. I see that I have identified my Windows XP machine 192 dot 168 dot one 5129 as being vulnerable on port 445, and it comes back and it says host is likely vulnerable to this exploit.

So that concludes this lab. But the takeaway from all this should be that you learn how to import a script into the Nmap script folder. And that when something happens out there in the wild, you can be proactive. And you can go out and you can get this these scripts from someone who has written it and posted upon the end map repository. And you can be the one who says that, hey, we got a problem coming our way. It's a new ransomware attack or it's a new network attack of some type.

And you can be the one who can go up on the firewall and you can filter out port in this case 445. All right. So that's all I got for you. If you have any questions don't hesitate to contact your instructor and I will see everybody up inside of the discussions. Thank you.