Blue Writeup
Probably the easiest machine in HTB, the name itself hints what kind of vulnerability this machine possesses.
Vulnerability Exploited: Microsoft Windows 7/8.1/2008 R2/2012 R2/2016 R2 - 'EternalBlue' SMB Remote Code Execution (MS17-010) (CVE-2017-0144)
System Vulnerable: 10.10.10.40
Vulnerability Explanation: The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
Vulnerability Fix: For Windows 7 and later, it is good to use matched pair method (one is large pool and another one is fit for freed pool from large pool). Additionally, the exploit does the information leak to check transactions alignment before doing OOB write. So this exploit should never crash a target against Windows 7 and later.
Privilege Escalation Vulnerability: The MS17-10 allows to exploit the system as NT AUTHORITY\SYSTEM privilege. (No needs to privesc)
Vulnerability Fix: Mentioned on the MS17-10 vulnerability fix (mentioned above)
Severity: Critical
An initial Nmap scan revealed the microsoft-ds on port 445 and netbios-ssn on port 139.
Check if this machine is infected by any smb vulnerabilities using smb-vuln* nmap scripts.
Search for existence exploits using searchsploit.
https://www.exploit-db.com/exploits/42315
Copy the exploit to the working directory
Download mysmb.py since the exploit imports it. The download location is included in the exploit.. Then rename it to mysmb.py:
Create a reverse shell payload using msfvenom
Make changes in the exploit to add the authentication credentials and the reverse shell payload.
We need to change the exploit to add credentials. In our case we don’t have valid credentials, however, let’s check to see if guest login is allowed. For that, we run enum4linux
Add the username guest and the payload path to the exploit file
Launch a nc listener on the local machine and execute the exploit.
A reverse shell received as NT AUTHORITY\SYSTEM
user.txt
root.txt
Lessons Learned
I keep repeating this in most of my HTB writeup blogs and I’ll say it again, it goes without saying that you should always update your systems especially when updates are released for critical vulnerabilities! If the system administrator had installed the MS17–010 security update, I would have had to find another way to exploit this machine.
Last updated