[HackTheBox] Blue
This machine is more about teaching a single exploit rather than usual HTB process. It is still fun and enjoyable!
Summary
- Enumerate machine’s OS.
- Use EternalBlue exploit to get a shell as
nt authority\system.
Recon
Port Scan
nmap -T4 -p- -sV -n 10.10.10.40
PORT STATE SERVICE REASON VERSION
135/tcp open msrpc syn-ack Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn
445/tcp open microsoft-ds syn-ack Microsoft Windows 7 - 10 microsoft-ds (workgroup: WORKGROUP)
49152/tcp open msrpc syn-ack Microsoft Windows RPC
49153/tcp open msrpc syn-ack Microsoft Windows RPC
49154/tcp open msrpc syn-ack Microsoft Windows RPC
49155/tcp open msrpc syn-ack Microsoft Windows RPC
49156/tcp open msrpc syn-ack Microsoft Windows RPC
49157/tcp open msrpc syn-ack Microsoft Windows RPC
nmap also shows that this machine is running Windows 7 SP 1
...
OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
...
Exploit
Windows 7 SP 1 is vulnerable to a very popular and well-known exploit EternalBlue.
It can be easily exploited with Metasploit’s module windows/smb/ms17_010_eternalblue. It instantly gives you nt authority\system.
C:\Windows\system32>whoami
whoami
nt authority\system