Stage EternalBlue PneumaEX plugin payload
Tactic: Resource-development
Stage a payload for use in the EternalBlue PneumaEX module. The EternalBlue PneumaEX module uses EternalBlue to exploit SMBv1 services. Once exploited, the module uses DoublePulsar to load and execute shellcode in the kernel. The default payload contains shellcode to launch calc.exe.
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.
LoginTest this TTP
Download Operator (1.7.1)
Test this TTP using one of our Operator chains
Perform lateral movement using EternalBlue and DoublePulsar exploits.
APT38 WannaCry
2022-05-31
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github