Understanding the WannaCry Ransomware Attack: A Hands-On Simulation Using Kali Linux and Metasploit

Introduction

Ransomware is one of the most dangerous forms of cyberattacks in today's digital world. It is a type of malicious software that encrypts a victim's files and demands a ransom payment in exchange for restoring access to the data.

One of the most infamous examples is WannaCry, a ransomware attack that spread across the world in May 2017, affecting thousands of organizations, businesses, and healthcare institutions.

In this blog, I'll walk through a hands-on simulation of the WannaCry ransomware attack in a controlled virtual environment. The objective was to understand how attackers identify vulnerable systems, exploit security weaknesses, gain access, and ultimately execute ransomware.

1. Understanding the WannaCry Attack

WannaCry was a ransomware attack that exploited a vulnerability in Microsoft's Windows operating system.

It leveraged an exploit known as EternalBlue, which targeted the Server Message Block (SMB) protocol.

The vulnerability was associated with MS17–010 and allowed attackers to execute malicious code on vulnerable Windows systems.

What made WannaCry particularly dangerous was its ability to spread across networks by exploiting vulnerable machines.

Instead of affecting just one computer, it could move from one system to another, causing widespread disruption.

2. Setting Up the Virtual Lab Environment

To understand how this attack works, I created a virtual lab using two machines.

Attacker Machine:

• Operating System: Kali Linux
• Tools: Nmap and Metasploit Framework

Victim Machine:

• Operating System: Windows 7
• Purpose: To simulate a vulnerable target system containing sample files.

Both machines were configured within a virtual network for the simulation.

The objective was to create an environment where the attack could be studied without targeting real-world systems.

Creating a Virtual Machine Snapshot

Before proceeding with the attack simulation, I created a snapshot of the Windows 7 virtual machine using VirtualBox.

A snapshot captures the current state of a virtual machine, allowing it to be restored to that earlier state if something goes wrong during an experiment.

Since this simulation involved ransomware, creating a snapshot was particularly important. It provided a recovery point to return to the original state of the victim machine after the experiment.

3. Understanding the Attack Workflow

The simulation was divided into three major stages:

1. Network scanning and identification of the vulnerable machine.
2. Exploitation of the vulnerability to gain access.
3. Uploading and executing the ransomware sample.

Let's understand each stage.

4. Phase One: Network Scanning Using Nmap

Step 1: Identifying the Attacker's IP Address

First, I used the ifconfig command in Kali Linux to identify the active network interface and its assigned IP address.

The output showed that the Kali Linux machine was using the IP address 10.0.2.4.

Step 2: Operating System Detection Using Nmap

Next, I used the Nmap operating system detection option:

nmap -O 10.0.2.0/24

nmap -O 10.0.2.0/24

The -O option enables OS detection. It helps identify the operating system running on the target machine by analyzing its network responses.

This step helped determine whether the target was running Windows or another operating system.

Step 3: Vulnerability Scanning and Service Detection

After identifying the target, I performed another scan using Nmap's vulnerability detection scripts and service version detection.

The command is:

nmap --script vuln -sV 10.0.2.3

nmap --script vuln -sV 10.0.2.3

Here's what the options mean:

• --script vuln: Runs Nmap scripts designed to check for known vulnerabilities.
• -sV: Detects the services running on open ports and attempts to identify their versions.
• 10.0.2.3: IP address of the target Windows machine.

This scan helped gather more information about the services running on the target and identify potential security weaknesses.

During the scanning process, I observed that port 445 (SMB) was open on the target Windows machine. This finding was relevant because the WannaCry attack exploited vulnerabilities associated with the SMB protocol. The scanning phase provided the information needed for the next stage of the simulation

5. Phase Two: Exploiting the MS17–010 Vulnerability Using Metasploit

After identifying the target Windows 7 machine during the scanning phase, the next step was to explore the MS17–010 vulnerability using the Metasploit Framework.

Metasploit is a penetration testing framework that provides tools and modules for testing known security vulnerabilities in controlled environments.

Step 1: Searching for the MS17–010 Exploit

I first opened the Metasploit Framework and searched for the available exploit modules related to MS17–010.

search ms17-010

search ms17-010

This command displayed the available exploit modules associated with the MS17–010 vulnerability.

Step 2: Selecting the Exploit Module

After identifying the relevant module, I selected it using:

use 0

use 0

This loaded the selected exploit module into the Metasploit console.

Step 3: Configuring the Target Machine

Next, I configured the remote host (RHOST), which represents the IP address of the target machine.

set RHOSTS 10.0.2.3

set RHOSTS 10.0.2.3

This specified the Windows 7 virtual machine as the target for the lab exercise.

Step 4: Running the Exploit

After configuring the target, I used the run command to execute the selected module.

run

run

The exploitation attempt established a remote session with the target machine in the controlled lab environment.

Step 5: Checking the Working Directory

After establishing the session, I used:

pwd

pwd

The pwd command displays the present working directory of the remote session. This helped me understand the location from which the session was operating.

6. Understanding Remote Access

Once access was established, the next step was understanding the level of control available over the target machine.

The simulation demonstrated how remote access can allow an attacker to interact with a compromised system and transfer files.

This stage helped me understand an important cybersecurity concept: unauthorized access to one machine can potentially expose its resources and data.

It also demonstrated why organizations need to monitor suspicious remote connections and restrict unnecessary network access.

7. Phase Three: WannaCry Ransomware Execution

The final stage involved simulating the ransomware execution.

Step 1: Uploading the File

I used the Metasploit file transfer functionality to upload the WannaCry executable from the Kali Linux machine to the Windows 7 virtual machine.

This demonstrated how files can be transferred between an attacker machine and a compromised system through an established remote session.

Step 2: Verifying the Uploaded File

After transferring the file, I used the ls command to check the contents of the destination directory.

This helped verify whether the executable was successfully transferred to the target machine.

Step 3: Ransomware Execution

The final stage involved executing the WannaCry sample in the controlled virtual lab.

After execution, the ransomware began encrypting the sample files stored on the victim machine.

The files that were previously accessible became unavailable, and a ransom notification appeared on the screen.

This demonstrated the basic impact of a ransomware infection:

• Files become encrypted.
• Users lose access to important information.
• A ransom demand is displayed.
• Normal system operations can be disrupted.

8. Before and After the Attack

One of the most interesting parts of this simulation was observing the difference between the system before and after ransomware execution.

Before the attack:

• Sample files were accessible.
• Documents could be opened normally.
• The system was functioning as expected.

After the attack:

• Files were encrypted.
• Normal access to the sample data was disrupted.
• A ransom notification appeared.

This comparison helped demonstrate the real impact ransomware can have on individuals and organizations.

9. What Did I Learn From This Simulation?

This hands-on exercise helped me understand several important cybersecurity concepts:

1. Network Scanning

I learned how Nmap can identify active devices, open ports, and services running on a network.

2. Vulnerability Exploitation

I understood how an unpatched Windows system can become vulnerable to attacks targeting known security weaknesses.

3. Metasploit Framework

I gained practical exposure to Metasploit and its role in authorized penetration testing.

4. Remote Access

I understood how successful exploitation can potentially provide access to a target machine's resources.

5. Ransomware Behaviour

I observed how ransomware can encrypt files and disrupt access to important information.

Most importantly, I understood how multiple stages of an attack can combine to compromise a system.

Conclusion

The WannaCry ransomware simulation was a valuable hands-on learning experience that helped me understand how ransomware attacks work beyond theoretical explanations.

By using Kali Linux, Nmap, Metasploit, and a Windows 7 virtual machine, I explored the different stages of an attack, from identifying a vulnerable system to observing the impact of ransomware execution.

This exercise reinforced an important lesson:

Cybersecurity is not just about understanding how attacks happen; it is also about learning how to identify vulnerabilities, prevent exploitation, and protect systems before an attack occurs.

This is one of the practical steps in my journey of learning cybersecurity, and I look forward to exploring more security tools, vulnerabilities, and hands-on labs.

Disclaimer: This exercise was conducted strictly for educational purposes in a controlled virtual lab environment. The techniques discussed should only be tested on systems you own or have explicit authorization to assess. Never execute ransomware samples on personal, organizational, or publicly accessible systems.