TryHackMe: Blue CTF Walkthrough

Welcome to my latest CTF write-up! I regularly tackle machines on TryHackMe to sharpen my skills and build hands-on experience for a career in penetration testing. Today, I am walking through the "Blue" room, which focuses on exploiting a very famous Windows vulnerability. Let's get into it!

1. Reconnaissance

Firstly, as usual like for all the labs we do, I started by scanning the target IP using Nmap. I used the command nmap -sC -sV --script vuln so I could find all open ports and automatically check them for known vulnerabilities right away.

Looking at the scan results, I could answer the first two questions of the room:

Q: How many ports are open with a port number under 1000?

Answer: 3

Q: What is this machine vulnerable to?

Answer: ms17–010 (also known as EternalBlue)

2. Gaining Initial Access

Now that I knew what it was vulnerable to, gaining access was the next step. I used Metasploit and searched for ms17-010 to find the available exploit modules. I did info 0 to know more information about the exploit.

• Q: Find the exploitation code we will run against the machine. What is the full path of the code?
• Answer: exploit/windows/smb/ms17_010_eternalblue

I selected that exploit and then used show options to see what parameters I needed to configure.

• Q: Show options and set the one required value. What is the name of this value?
• Answer: RHOSTS (This is where we put our target IP).

Then, as the room instructions suggested, I changed the payload. Usually, it would be fine to run this exploit as is; however, for the sake of learning, I entered the following command: set payload windows/x64/shell/reverse_tcp.

Then I used the command exploit to run it. It worked, and I got a normal Windows command shell! I backgrounded this shell using Ctrl + Z so I could upgrade it.

3. Upgrading the Shell & Privilege Escalation

A normal shell is okay, but I researched online how to convert a shell to a Meterpreter shell in Metasploit because Meterpreter gives us way more post-exploitation commands.

• Q: What is the name of the post module we will use?
• Answer: post/multi/manage/shell_to_meterpreter
• Q: Show options, what option are we required to change?
• Answer: SESSION (I set this to the ID of my backgrounded shell).

Then I used exploit to run the module, and I got my Meterpreter shell! Just to check things out, I typed shell to get a standard command prompt back, used whoami to know my current user info, and then backgrounded that normal shell again to return to Meterpreter.

To make sure my access was stable and fully elevated, I used the ps command to know the PID (Process ID) of a process running with NT AUTHORITY\SYSTEM privileges. Then I used the migrate [PID] command for privilege escalation.

4. Cracking Hashes & Finding Flags

Now that I was running as SYSTEM, I was ready to grab the loot. Back in Meterpreter, I used the hashdump command to easily extract the user password hashes from the machine.

I took the hash I found, went to an online tool called CrackStation, pasted it in, and successfully cracked the hash to find the plain text password!

Finally, I needed to find the room's flags. I used Meterpreter's built-in search feature by running search -f flag*.txt to automatically locate all the flag files across the system. Once I had their locations, I simply used cat to read the data inside them. Room completed!

Conclusion

This room is an excellent reminder of why patching systems is so critical. A single unpatched vulnerability like MS17–010 can give an attacker complete system control in a matter of minutes.

Thanks for reading my write-up!