search
RedTeam Capstone Challegen TryHackMe

Blue

Blue, while possibly the most simple machine on Hack The Box, demonstrates the severity of the EternalBlue exploit, which has been used in multiple large-scale ransomware and crypto-mining attacks sin

LogoHack The Boxapp.hackthebox.comchevron-right

hashtag
Recon

Let's start with an nmap scan.

The SMB output says this is Windows 7 Professional.

There are a couple shares with null session read access (the trick of giving smbmap wrong creds works here):

Users has just empty Default and Public folders.

nmap has vuln scripts that will check for known vulnerabilities in service. It finds a big one, MS-17-010.

Searching on Exploit DB lead to the following script.

LogoMicrosoft Windows - SMB Remote Code Execution Scanner (MS17-010) (Metasploit)Exploit Databasechevron-right

We can use Metasploit to execute this.

3 is a scanner, we can run that to confirm the vulnerability. 4 needs a backdoor that is already on the system so we can't use it. Let's start with the scan first and then use 0.

We can run it after entering RHOST.

We can see the it is indeed vulnerable. We can exploit it.

hashtag
Initial Access

Coming back to 0 i.e exploit/windows/smb/ms17_010_eternalblue. We shall use it now after setting up the options and payload.

We now have meterpreter shell.

As you can see we are already NT AUTHORITY\SYSTEM which is root access.

Now we can just get the flags need.

PreviousHeadless

Last updated