tevora-threat/eternal_blue_powershell

Explanation

Closed this issue · 3 comments

bat553 commented

Hi and congratulation for your work 👍

But can you explain a little bit more how does this script work ?

Because I don't know what to put on line 620 :

#Put your shellcode here
[Byte[]] $payload = [Byte[]]()

Thank for your help ! :-)
Swano

e0x70i commented

Updated the readme with some more detail, and pushed some fixes for typos.

If you look at the first commit in the history, you can see an example with some live shellcode, though I don't recommend running it ;)

bat553 commented

Yes thank !
I generate a reverse shellcode with msfvenom, but when I run the script the victim show a warning message and the system reboot after 1 minute (no bluescreen).

Can you help me ? (I use PowershellEmpire)

EDIT : I created a shellcode, i injected it with DoublePulsar, BlueScreen. 👎
Same with your live shellcode :-/

e0x70i commented

What target are you using? This is a straight port of the metasploit module, so only supports 2008 R2 and Windows 7.

We've seen it bluescreen periodically, but usually only after running it multiple times.