HTB - Blue

Blue

About the Box:

OS Name:        Microsoft Windows 7 Professional
OS Version:     6.1.7601 Service Pack 1 Build 7601
IP:             10.10.10.40
Arch:           x64-based PC
Difficulty:     Easy

Getting Root:

  1. Discovered smb ports are opened

  2. Check for smb vulnerabilities and discovered it was vulnerable to MS17-010

  3. Used a python exploit from github

  4. Get a shell with system privileges

Nmap

Quick scan

Enumerating versions and execute default scripts

Nmap - smb vuln script

Nmap shows the target is vulnerable to MS-17-010

smbmap

Checking smp shares without username, we get nothing

Checking smb shares specifying a username (I used "nobody12") and we got something

The same results can be obtained by using -u " " (I prefer to specify a user)

Checking the files recursively with -R to check for interesting files we read.

Exploiting - MS17-010 Manually

Github: https://github.com/3ndG4me/AutoBlue-MS17-010

Run the shell_prep.sh script and it will generate the payloads for x86 and x64

Start the listener

Execute the exploit

We got a shell with system privileges

PreviousHTB - BashedNextHTB - Tenten

Last updated