Blue
Blue, while possibly the most simple machine on Hack The Box, demonstrates the severity of the EternalBlue exploit, which has been used in multiple large-scale ransomware and crypto-mining attacks sin
Recon
Let's start with an nmap scan.
The SMB output says this is Windows 7 Professional.
There are a couple shares with null session read access (the trick of giving smbmap wrong creds works here):
Users has just empty Default and Public folders.
nmap has vuln scripts that will check for known vulnerabilities in service. It finds a big one, MS-17-010.
Searching on Exploit DB lead to the following script.
We can use Metasploit to execute this.
3 is a scanner, we can run that to confirm the vulnerability. 4 needs a backdoor that is already on the system so we can't use it. Let's start with the scan first and then use 0.
We can run it after entering RHOST.
We can see the it is indeed vulnerable. We can exploit it.
Initial Access
Coming back to 0 i.e exploit/windows/smb/ms17_010_eternalblue. We shall use it now after setting up the options and payload.
We now have meterpreter shell.
As you can see we are already NT AUTHORITY\SYSTEM which is root access.
Now we can just get the flags need.
Last updated
Was this helpful?