Recon

I again started with a little up/down scan on TCP ports using nmap

Namp -T4 -p- 10.10.10.40 -oX /root/Desktop/HTB/Blue/nmapb.xml

Then I converted that to HTML

# xsltproc /root/Desktop/HTB/Blue/nmapb.xml -o /root/Desktop/HTB/Blue/nmapb.html

A goodly amount of open ports to feed into our next scan, which will utlizse the -A switch in nmap to finger the OS and services.

# nmap -T4 -A -p135,139,445,49152,49153,49154,49155,49156,49157 10.10.10.40 -oX /root/Desktop/HTB/Blue/nmapf.xml

The results show lots of ports for RPC, one net bios and SMB on port 445

No FTP, Web, SSH to try and exploit. But we do have SMB open which has a bunch of vulns… so lets get to googling

Exploit

The first result for Win7 smb Exploit is probably one you've heard of before.. Eternal Blue

If not you might want to read up on it here.

Basically this an exploit created by the National Security Agency (NSA), you know the spooks.

This is the exploit that brought you such hits as "Wannacry" and "NotPetya"

Microsoft blamed the Government for finding this exploit and keeping it secret from them so they couldn't patch it….

Any way I digress

Let's fire up metasploit search for the Vuln and see if we can get this box super quick

In this screenshot I loaded up metasploit used the search function on the word "eternal"

It came back with 6 results, number 3 looked like the one we wanted to use

So I entered use 3

Here I got the options for this exploit, all we need to do is set the remote host IP address.

Set RHOSTS 10.10.10.40

Ran the sploit and ……

Not only did we get shell, but is system from the start… now all that's left is to get our hashes.

Users is 4c5******************************

Root is ff**************************