Legacy Writeup
The top of the list was legacy, a box that seems like it was one of the first released on HTB. It’s a very easy Windows box, vulnerable to two SMB bugs that are easily exploited.
Vulnerability Exploited: Microsoft Windows 7/8.1/2008 R2/2012 R2/2016 R2 - 'EternalBlue' SMB Remote Code Execution (MS17-010) (CVE-2017-0144)
System Vulnerable: 10.10.10.4
Vulnerability Explanation: The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
Vulnerability Fix: For Windows Vista and earlier, matched pair method is impossible because we cannot allocate transaction size smaller than PAGE_SIZE (Windows XP can but a large page pool does not split the last page of allocation). But a transaction with an empty setup is allocated on a private heap (it is created by RtlCreateHeap() on initialing server). Only this transaction type uses this heap. Normally, no one uses this transaction type. So, transactions alignment in this private heap should be very easy and very reliable (fish in a barrel in NSA eternalromance). The drawback of this method is we cannot do information leak to verify transactions alignment before OOB write. So, this exploit has a chance to crash target same as NSA eternalromance against Windows Vista and earlier.
Privilege Escalation Vulnerability: The MS17-10 allows to exploit the system as NT AUTHORITY\SYSTEM privilege. (No needs to privesc)
Vulnerability Fix: Mentioned on the MS17-10 vulnerability fix (mentioned above)
Severity: Critical
An initial Nmap scan revealed the microsoft-ds on port 445 and netbios-ssn on port 139.
Check if this machine is infected by any smb vulnerabilities using smb-vuln* nmap scripts.
Create a reverse shell payload and store it on eternablue.exe file
Download the exploit script from this link:
https://github.com/helviojunior/MS17-010/blob/master/send_and_execute.py
Launch a nc listener on the local machine and using the send_and_execute.py script launch the exploit against the 10.10.10.4 on port 445
By the end of the exploit, a reverse shell received as NT AUTHORITY\SYSTEM
On this version of windows, the whoami command doesn’t found, so the attacker can transfer the whoami binary from the Kali Linux machine to the exploited machine using smbserver.
Launch a smbserver on the attacker machine using python3 script.
user.txt
root.txt
Lessons Learned
This was a relatively simple machine to solve. It was running a vulnerable outdated version of SMB. So far, I’ve solved four machine and each one of them required me to exploit a vulnerable version of some software to either gain a foothold on the machine or to escalate privileges. So it goes without saying that you should always update your systems especially when updates are released for critical vulnerabilities! If the user had installed the MS17–010 security update, I would have had to find another way to exploit this machine.
Last updated