[ Blue ] - TRYHACKME

Hello guys Today i am going to do walkthrough on the machine called Blue. This is very easy box based on the vulnerability of EternalBlue(CVE-2017-0143). As usual first thing we are going to do is scanning the network using the nmap tool to see which ports are open and which services are running on this machine.

The flags used in the nmap scan are:
-sS - for a syn scan
-sV -for a service version scan
-O - to identify the OS used
-T4 - the speed of scan
-open - to show only the open ports

We notice the service running on the port 445 is SMB so we can use nmap script engine to verify this service is vulnerable or not for EternalBlue vulnerability.

The flags used are:

-p - to test only the port provided(in this case 445)
--script=smb-vuln-ms17-010 - the nmap script to run against our target
The output of the scan is shown us to machine is vulnerable.

Metasploit already has this exploit, so let's fire it up to gain access.
To start the metasploit console just run the command msfconsole. Once the console is shown in the terminal type the command:
search eternalblue.
I'll be using windows/smb/ms17_010_eternalblue because we know from initial NMAP scan that the target is running Windows 7. So let's configure the exploit and run against the machine. To configure the exploit type following command:
use windows/smb/ms17_010_eternalblue
Now check the options using the command show options. After typing this we have several configurations but in this exploit we have to setup only RHOSTS.
To do this type the command:
set RHOSTS  <ip of the vulnerable/target machine>
Now all configuration is complete it's time to run the exploit.
To do this type the command:
run/exploit
You should output similar like this:

This machine have three flags capture one by one . You can get the first flag1.txt from the home directory located in c:\flag1.txt second one in the  c:\Windows\System32\config\flag2.txt where is the actual location of the sam database third one is in the jon document folder location is c:\Users\Jon\Documents\flag3.txt

we have some more tools in our hand, we'll upgrade our os shell to meterpreter shell. Background the session with CTRL+Z, and search shell_to_meterpreter post module. use this module and upgrade your session using this module to do this type set session <your_session_id>. After setup of session type run/exploit to run this post to upgrade your shell. To get NT AUTHORITY/SYSTEM(privileged user/admin) we can use the meterpreter command getsystem which automatically escalate privileges for us.