On Friday, April 14, 2017 – The mysterious hacking group ShadowBrokers released over 300MB of NSA hacking tools and exploits. The dump is hosted as a Yandex disk with password “Reeeeeeeeeeeeeee”. The current dump contains 3 folders oddjob, windows, swift as described below, and a detailed list of the contents can be found here.
|oddjob||An implant builder|
|windows||Exploits, supporting resources and exploit framework similar to Metasploit|
|swift||SQL scripts for querying SWIFT data from databases|
Most of the windows exploits are organized in a 3 file system .exe, .fb and .xml file. The .fb file lists the options supported by the exploit, and the XML file is used as a configuration file for the exploit.
The .fb file listing options supported by ETERNALROMANCE are:
Below are some of the exploits that are in the spotlight and/or have been successfully tested. This list will be updated as we investigate further .
|ETERNALROMANCE (MS17-010)||SMBv1 Exploit Targeting Windows XP, 2003 SP1 SP2, 2008* SP1 SP2, 2008 R2* SP1, Vista SP1 SP2 , 7 SP1||shadowbrokers-exploits/windows/exploits/|
|ETERNALCHAMPION (MS17-010)||SMBv1/v2 exploit Windows XP SP1 SP2, 7 SP1, 2003 SP1 SP2, 2008* SP1 SP2, 2008 R2* SP1, Vista SP1 SP2, 8||shadowbrokers-exploits/windows/specials/|
|ETERNALBLUE (MS17-010)||SMBv2 exploit Targeting Windows XP SP1 SP2 SP3, 7 SP1, 2003 SP1 SP2, 2008* SP1 SP2, 2008 R2* SP1, Vista SP1 SP2||shadowbrokers-exploits/windows/specials/|
|EXPLODINGCAN||Exploit targeting CVE-2017-7269 on Windows 2003 SP1 SP2||shadowbrokers-exploits/windows/exploits/|
|EWOKFRENZY||Lotus Domino 6.5.4, 7.0.2||shadowbrokers-exploits/windows/exploits/|
|ZIPPYBEER||Microsoft Domain Controller exploit||shadowbrokers-exploits/windows/exploits/|
|ESTEEMAUDIT||DLL Injection exploit via RDP Targeting Windows XP SP1,SP2,SP3; Windows 2003 SP1,SP2||shadowbrokers-exploits/windows/exploits/|
|EASYBEE||MDaemon WebAdmin Exploit||shadowbrokers-exploits/windows/exploits/|
|ENGLISHMANSDENTIST||Probable Outlook WebAccess Exploit||shadowbrokers-exploits/windows/exploits/|
|ERRATICGOPHER||SMBv1 Exploit targeting Windows 2000 SP4,XP SP2 SP3,2003 SP1 SP2||shadowbrokers-exploits/windows/exploits/|
|ESKIMOROLL (MS14-068)||Kerberos Service exploit targeting Windows 2000,2003,2003 R2,2008,2008 R2||shadowbrokers-exploits/windows/exploits/|
|ETERNALSYNERGY (MS17-010)||SMBv1 Exploit targeting Windows 8,2012||shadowbrokers-exploits/windows/exploits/|
|EMPHASISMINE||Exploit targeting Lotus Domino 6.5.4-6.5.5FP1, 7.0-8.5.2||shadowbrokers-exploits/windows/exploits/|
|EMRALDTHREAD (MS10-061)||Exploit targeting SMBv1 on Windows XP SP1 SP2 SP3, 2003 SP1 SP2||shadowbrokers-exploits/windows/exploits/|
|EDUCATEDSCHOLAR (MS09-050)||Exploit targeting SMBv1 on Windows Vista SP1 SP2, 2008 SP1 SP2||shadowbrokers-exploits/windows/exploits/|
|ECLIPSEDWING||Exploit targeting Server service on Windows 2000 all versions, XP SP1-SP3, 2003 SP1 SP2||shadowbrokers-exploits/windows/exploits/|
|EASYPI||Exploit targeting Lotus ccMail on Windows NT, 200, XP, 2003||shadowbrokers-exploits/windows/exploits/|
* We are in the process of verifying if the exploit works for this platform
Fuzzbunch is an exploitation framework similar to Metasploit that is used to run exploits against target machines. The framework is executed via fb.py. The framework requires python 2.6 to function, later versions of python seem to fail due a dependency on python26.dll in one of the .pyd files. Fuzzbunch is compatible on 32- and 64-bit architectures. It provides a console-based interface for collecting exploit configuration.
Upon selecting an exploit Fuzzbunch automatically collects information about the targets and parameters for the exploit.
A command & control tool used for post exploitation monitoring and controlling. The tool provides utilities for generating payloads in form of dll’s and exe’s for injection into target machines processes among other things.
Below are the supported commands.
As mentioned earlier the tool is also used to generate payloads to use with Doublepulsar.
DanderSpritz ships with module PeddleCheap used to connect and listen to target machine. It can also be used to trigger exploits on target machines.
The Microsoft Security Response Center (MSRC) has released a statement addressing the exploits released by ShadowBrokers. MSRC has assured us that most of the exploits are already patched. In addition to the ones listed below some of the exploits do not reproduce on supported platforms, therefore customers running Windows 7 and latest versions of Windows or Exchange Server 2010 (EnglismansDentist) are not vulnerable.
|EternalBlue||Addressed by MS17-010|
|EmeraldThread||Addressed by MS10-061|
|EternalChampion||Addressed by CVE-2017-0146 & CVE-2017-0147|
|ErraticGopher||Addressed prior to the release of Windows Vista|
|EsikmoRoll||Addressed by MS14-068|
|EternalRomance||Addressed by MS17-010|
|EducatedScholar||Addressed by MS09-050|
|EternalSynergy||Addressed by MS17-010|
|EclipsedWing||Addressed by MS08-067|
Based on our initial analysis many exploits appear to be zero-day vulnerabilities, i.e. issues where there are no patches from the vendor. In addition to that, many exploits affect end-of-life software for which vendors will not release patches. A good mitigation step is to disable SMB service as many exploits are targeting various versions of SMB. We request organizations to keep track of patches released by the respective vendors and upgrade their end-of-life software.
An update for the Metasploit framework adds a new more reliable exploit for EternalRomance, EternalChampion, EternalSynergy. If successful an attacker can target machines listed below.
|Operating System||Versions/Service Pack/Build Versions||Architecture|
|Windows 2000||SP0,Professional SP4,Advanced Server SP4||x86|
|Windows Vista||Home Premium||x86|
|Windows 7||Ultimate SP1, Enterprise SP1||x86|
|Windows 8.1||Enterprise Evaluation 9600,SP1||x86|
|Windows 10||Enterprise 10.10240,10.10586,10.0.14393||x86|
|Windows 10||Enterprise Evaluation 10.14393 10.0.14393,10.10586||x64|
|Windows Server 2003||SP0,SP1, Enterprise SP2,R2 SP1,R2 SP2||x86|
|Windows Server 2003||SP1,R2 SP1,R2 SP2||x64|
|Windows Server 2008||SP1||x86|
|Windows Server 2008||R2,R2 SP1||x64|
|Windows Server 2008||x64|
|Windows Server 2008 R2||x64|
|Windows Server 2008 R2||SP1||x64|
|Windows Server 2012||x64|
|Windows Server 2012||R2,R2 Standard 9600,R2 SP1||x64|
|Windows Server 2012 R2||x86|
|Windows Server 2016||10.10586,Data Center 10.14393||x64|