Scanning#

Rustscan#

1
rustscan -a 10.10.10.40 -r 1-65535 -b 100

Pasted image 20250517164648.png

Nmap Full Scan#

1
nmap -sC -sV -T5 -oA nmap/initials 10.10.10.40 -Pn

1
# Nmap 7.94SVN scan initiated Sat May 17 16:32:23 2025 as: nmap -sC -sV -T5 -oA nmap/initials -Pn 10.10.10.40
2
Warning: 10.10.10.40 giving up on port because retransmission cap hit (2).
3
Nmap scan report for 10.10.10.40
4
Host is up (0.26s latency).
5
Not shown: 532 closed tcp ports (conn-refused), 460 filtered tcp ports (no-response)
6
PORT      STATE SERVICE      VERSION
7
135/tcp   open  msrpc        Microsoft Windows RPC
8
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
9
445/tcp   open  microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
10
49152/tcp open  msrpc        Microsoft Windows RPC
11
49153/tcp open  msrpc        Microsoft Windows RPC
12
49154/tcp open  msrpc        Microsoft Windows RPC
13
49155/tcp open  msrpc        Microsoft Windows RPC
14
49157/tcp open  msrpc        Microsoft Windows RPC
15
Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows
16
Host script results:
17
|_clock-skew: mean: -18m21s, deviation: 34m34s, median: 1m35s
18
| smb-os-discovery:
19
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
20
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
21
|   Computer name: haris-PC
22
|   NetBIOS computer name: HARIS-PC\x00
23
|   Workgroup: WORKGROUP\x00
24
|_  System time: 2025-05-17T12:07:01+01:00
25
| smb-security-mode:
26
|   account_used: guest
27
|   authentication_level: user
28
|   challenge_response: supported
29
|_  message_signing: disabled (dangerous, but default)
30
| smb2-time:
31
|   date: 2025-05-17T11:06:58
32
|_  start_date: 2025-05-15T15:03:33
33
| smb2-security-mode:
34
|   2:1:0:
35
|_    Message signing enabled but not required
36
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
37
# Nmap done at Sat May 17 16:36:23 2025 -- 1 IP address (1 host up) scanned in 239.53 seconds

The scan reveals several open ports, with SMB (445) being the most interesting target.
The target is identified as Windows 7 Professional with Service Pack 1.
Several concerning security configurations are observed:
- SMB message signing is disabled (dangerous)
- Guest account is being used for authentication
- Authentication level is set to “user” rather than a more secure option
Given the Windows 7 operating system and SMB configuration, this machine may be vulnerable to known SMB exploits.

Enumeration#

1
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-17 17:05 IST
2
Nmap scan report for 10.10.10.40
3
Host is up (0.37s latency).
4
PORT    STATE SERVICE
5
445/tcp open  microsoft-ds
6
Host script results:
7
| smb-vuln-ms17-010:
8
|   VULNERABLE:
9
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
10
|     State: VULNERABLE
11
|     IDs:  CVE:CVE-2017-0143
12
|     Risk factor: HIGH
13
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
14
|        servers (ms17-010).
15
|
16
|     Disclosure date: 2017-03-14
17
|     References:
18
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
19
|       https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
20
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
21
Nmap done: 1 IP address (1 host up) scanned in 5.76 seconds

Used Nmap’s vulnerability scanning scripts to check for common SMB vulnerabilities.
The target is confirmed vulnerable to MS17-010, also known as EternalBlue.
This vulnerability allows for remote code execution with SYSTEM privileges on Windows systems.
EternalBlue is particularly dangerous because it requires no authentication and can provide direct system-level access.
The vulnerability was patched by Microsoft in March 2017, but many systems remain unpatched.

EternalBlue (MS17-010) Vulnerability Explained#

EternalBlue exploits a vulnerability in SMBv1’s handling of specially crafted packets, allowing attackers to send malicious SMB messages to execute arbitrary code. The flaw exists in how the SMB server handles certain requests, enabling buffer overflow in the Windows kernel.
This exploit became notorious as part of the WannaCry ransomware attack in 2017, affecting over 200,000 computers worldwide.
Despite being patched, many systems remain vulnerable due to delayed patching or legacy system requirements.

Exploitation#

I used Metasploit for exploiting this vulnerability due to its reliability and ease of use.
The specific module used was exploit/windows/smb/ms17_010_eternalblue.
Configured the module with the target IP and appropriate payload settings.

Pasted image 20250517171501.png Pasted image 20250517171524.png Pasted image 20250517174013.png

Upon successful exploitation, gained immediate SYSTEM-level privileges.
This demonstrates the severity of the vulnerability - no user interaction required and immediate highest-level access obtained.
The exploitation process worked on the first attempt, indicating the target was highly vulnerable.
User Flag: