search

HTB Blue Writeup

hashtag
Enumeration

First I do an nmap scan nmap -sC -sV -oA scan 10.10.10.40. Here’s what it outputs: nmap scan

So doing research on the ports, OS versions, SMB version, and potential exploits, I found out about EternalBluearrow-up-right. Here’s the link for the Microsoft webpage explanation herearrow-up-right. Cross checking, I see this machine can be used using Eternalblue (and thus the name of this box).

hashtag
Exploitation

So for this exploit we’ll use the metasploit module: exploit/windows/smb/ms17_010_eternalblue

Opening up metasploit and setting up the module:

blue

Also we see that the RHOST (remote host) is currently set to nothing so I set it to 10.10.10.40 (the IP of the box).

When we run the exploit, we successfully get a shell inside the box:

Doing a whoami check confirms we got basically administrator access (nt authority\system has the highest priviledges on the local system).

Thus we find the flags:

root: C:\Users\Administrator\Desktop\root.txt

user: C:\Users\haris\Desktop\user.txt

PreviousHTB Blocky WriteupNextHTB Celestial Writeup

Last updated