TryHackMe:Blue
A Basic Overview of the WannaCry Ransomware Attack
Before diving into the exploitation process, it’s important to understand the vulnerability behind one of the most infamous cyberattacks — WannaCry ransomware.
What is SMB?
Server Message Block (SMB) is a network protocol used for sharing files, printers, and other resources between systems. It is widely used in Windows environments for communication between machines.
However, SMB is not just a simple data transfer pipeline.
When a system receives an SMB request:
- The Windows operating system processes it internally
- Memory is allocated
- Specific code paths are executed to handle the request
This means SMB interactions directly involve system-level operations, making them a high-value attack surface.
The MS17–010 Vulnerability
In MS17–010 Windows SMB vulnerability, a flaw in the SMB protocol implementation allowed Remote Code Execution (RCE).
Due to improper handling of certain SMB packets:
- Windows would trust and process malicious input
- Attackers could send specially crafted packets
- This would corrupt memory and trigger execution of attacker-controlled code
In simple terms:
The system executes something it should never trust
EternalBlue Exploit
To weaponize this vulnerability, an exploit called EternalBlue exploit was developed.
- Originally created by the National Security Agency (NSA)
- Later leaked by a hacking group known as the Shadow Brokers hacking group
EternalBlue works by:
- Sending specially crafted SMB packets
- Manipulating how Windows handles memory
- Forcing the system to execute arbitrary code
This allows an attacker to gain access without authentication
WannaCry Ransomware Attack
The WannaCry ransomware attack leveraged EternalBlue to devastating effect.
It:
- Automatically scanned for vulnerable machines
- Exploited them using EternalBlue
- Spread rapidly across networks (worm-like behavior)
- Encrypted user data and demanded ransom
No user interaction required — just being vulnerable was enough.
TryHackMe: Blue Room
The TryHackMe Blue room simulates this exact vulnerability.
In this room:
- You are given a vulnerable Windows machine
- Your goal is to exploit it using EternalBlue
- Gain access without credentials
- And perform post-exploitation tasks
Step 1: Enumeration
NMAP is a tool used to discover devices on a network. It can be used to see the services and open ports running on the devices. Using nmap we can see the version of os running on this machine that is Windows 7. We can also see port 445 is open.
Why Port 445 Matters
Port 445 is associated with the SMB (Server Message Block) service.
This is important because:
- SMB is the same protocol we discussed earlier
- The MS17–010 Windows SMB vulnerability specifically targets SMB
- Windows 7 + SMB exposed on port 445
strongly suggests the system might be vulnerable to MS17–010
Step 2-Find exploit
To do this, we use Metasploit Framework, one of the most widely used tools in penetration testing.
Metasploit provides:
- A large database of exploits
- Payloads for gaining access
- Post-exploitation modules for further control
Think of it as a toolkit for offensive security operations
msfconsole
When we launch Metasploit, we enter msfconsole.
This opens the main interface.
A simple way to understand it If Metasploit is the engine, msfconsole is the control panel
This is where we:
- Search for exploits
- Configure them
- Execute attacks
Searching for the Exploit
Since we already suspect the MS17–010 Windows SMB vulnerability, we search for related exploits:
Get Uddhav Sethi’s stories in your inbox
Join Medium for free to get updates from this writer.
search ms17–010
This returns multiple modules, including the one we need.
Set rhost to target io
and set payload as given in question
Step3-run the exploit
We run the exploit. It will fail a few times but when you get win you have system access.
It kept failing and to prevent that i used set GroomAllocations 10
GroomAllocations controls how many times the exploit:
- Prepares (or “grooms”) the target’s memory
- Before attempting the actual exploitation
By default:
- Metasploit tries different values automatically
- This can lead to inconsistent results
By setting it manually:
We:
- Stabilize the exploit behavior
- Increase the chances of success
Now we background the session by pressing ctrl z.
This means keeping your session open but returning to Metasploit console
When you get a shell, you are “inside” the target machine:
You can’t run Metasploit commands (use, set, etc.) and are stuck interacting with the machine.
But by using ctrl z you can open the shell in the background but keep using your msfconsole to upgrade the shell or run new modules.
You can use the sessions command to check active background sessions.
sessions -i 1
Step 4- upgrade the exploit
At this point, we have successfully exploited the target and gained initial access.
This marks the beginning of the post-exploitation phase.After exploitation, we typically get a basic command shell.
While useful, this shell is:
- Limited in functionality
- Less stable
- Lacks advanced features
To perform deeper operations, we need a more powerful interface.
search shell_to_meterpreter.
Now we need to set a payload and run. Without setting a payload Metasploit will use a default payload and that might not match the system architecture of the target machine.
Now as per the question lets migrate to last pid
Step 5) Migrating to pid
You are running inside some random process which you got through exploitation. It can crash or die and you may lose the shell so to prevent this you shift to admin level stable process.
Now you have admin password hash
step6)Get the password
Copy password hash of jon into another file hash.txt and try cracking the hash
I tried cracking it using jon the ripper but it
Mis-detected it as LM which is an older hash. Instead we use Hashcat with -m 1000 which tells the tool that it’s a NTLM hash.
Now next step is finding all three flags
1)flag 1
2)Flag 2
3)Flag 3
Conclusion
This room demonstrates how a critical vulnerability like MS17–010 in the SMB protocol can be exploited to gain unauthorized access to a system. By using EternalBlue through the Metasploit Framework, we were able to move from simple enumeration to full system compromise without requiring credentials.
It also highlights the importance of proper patching and security practices, as outdated systems like Windows 7 become easy targets for such attacks. The exploitation process, along with post-exploitation steps like upgrading the shell, migrating processes, and extracting password hashes, shows how an attacker can maintain control and escalate access within a system.
Overall, this exercise provides a clear understanding of how real-world attacks like WannaCry spread rapidly and why securing network services is critical in preventing such incidents.
