HTB BLUE WALK-THROUGH

HackTheBox is an excellent platform for various pen-testers to increase their testing skills  and knowledge.
Machine Level -Easy
Machine Name -Blue
Machine OS -Windows
Machine IP -10.10.10.40
Tools:
Nmap -Nmap is a fantastic tools for scanning the open ports, services and OS detection. You can use other tools other than nmap (which ever you are more comfortable with ) like masscan, SPARTA etc. to scan for open ports.
Metasploit -One of the most common and widely used tool by pen-testers to launch exploits, it is maintained by Rapid 7 . Many books are available to understand the features of this tool.
We will be performing the attack by two methodology (using and without using metasploit).
Methodology 1 (using Metasploit)
Scanning the machine is the first step(i.e. Enumeration).
Use the command sudo nmap -sSVS 10.10.10.40 , this will scan for open ports and services on the host.

Lots of ports are open. But if we are looking for juicy port, then there is smb vulnerability present.
Fire up your Metasploit.
Search for smb_version

Use the module.

Set the rhosts(victim's IP) and run it.

We see that the host is running Windows 7 Professional SP1
Search for exploit for this version.

Rapid7 has a module.
Scroll down to find the exploit.

Copy the exploit into the msfconsole.

See for the options. We need to provide rhosts.

Set the rhosts.
Run the exploit.

We got a shell.

We are authority system.
Grab the root and user flag.
For root flag.

For user flag.

*****************************************************************************************************************************

Method 2(without metasploit)

From the previous section we got to know that the machine is vulnerable to MS17-010.

Download AutoBlue-MS17-010 package from GitHub.

Lets see what's in the package.

These are the scripts we will be using throughout this blog.
First lets use the eternal_checker.py script to see if the machine is vulnerable to AutoBlue.
Command is python eternal_checker.py 10.10.10.40

It says the target is not patched. That means its vulnerable.

Let's prepare a shell. Use the shell_prep.sh script
Just run the script by ./shell_prep.sh

Set the LHOST and LPORT(your IP and listening port), generate a meterpreter shell using staged payload.
Shellcode generated.

Let's prepare a listening port using listener_prep.sh
Just run this script with the command ./listener_prep.sh

Set the details as you set it up for the shellcode script.

We see a listening port opens on metasploit automatically.
Open a new tab in the terminal.

Final step, use the eternalblue_exploit7.py script to send the generated shellcode.
Use the command python eternalblue_exploit7.py 10.10.10.40 shellcode/sc_all.bin
(sc_all.bin is the shellcode that we generated)

We get a shell (see the listening port that opened earlier)

Shell opened. We are authority system.

Grab the user and root flags.
For user flag.

For root flag.

That's all for this machine.

Thanks for reading.
Takeaway from the machine -> We were able to exploit and gain access to the machine because it was vulnerable to AutoBlue MS10-059.


Thanks !