LEGACY
- Layout for this exercise:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5PdIVIOqRvzKGsJ_ArvmW67E96TbvcoEUF4qaXEKgQSvEnZecl1hnK3oJjFWjzfrI8yC_ZjzH_XrL93Frc22Qsitb1wk5-3hRK7_RyCBoZxReIXtFpFXGi_aXOep15yYa_U4ROg1W4QIj/s1600/screenshot.17.jpg)
1 - INTRODUCTION
- The goal of this exercise is to develop a hacking process for the vulnerable machine Legacy, what is a retired machine from the Hack The Box pentesting platform:
https://www.hackthebox.eu
2 - ENUMERATION
- Legacy's IP is 10.10.10.4:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhc2Bh9Hynhx-GgyOgB2Os7S0BDWRpnnZU04S_Er5UJVOuLqsdBxV9KCx5NMPmVScN9mebVHvm21lBeWidEPi1FNXMOK4fU77-trwdV0pjucj15sLE4vy5IYOOKvd_8SN00VEhs1__Z9wsB/s400/screenshot.2.jpg)
- Scanning with Nmap we learn that a Windows XP system is running SMB service at ports 139 and 445:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpQgXJGlsRadVEopv9IAdnfHVvERK4naORK5QJ1XvzDyvQL5IWYg1Ej0sKFeHPlpQcfrTfGxur7CnhJs3btVIpiF33yF2HrG1Dt0QSRpuuDSW6DUB2ITgecIbVViO8DzzPJi5R0TKTPut-/s1600/screenshot.3.jpg)
- Scanning deeper those two ports:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfj7RfPpUQ8CrqaJCYFV2THmb6KqKX_imPqzR4be2xtcqc6unPH8DoIRlREfZZauO7KFx6Rfbwei9Uy4gqjrYm8qXmWUD_V7bKI5G_cauyntmO4qssuN2dfiJmrY1cr5CxxM-A55p_VoA7/s1600/screenshot.8.jpg)
- Looking for vulnerabilities on port 139:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4baVw6Lmb791nwU6rDB8rzZs-1ANuCG4-UDlhXQLYd7Yg47Pw4TocanmqLrEsunUj1JaGnaq2WRUXwJEYQVefozi1xteTa4NxY9fY9E-QoinZgJCOkBQN-Y53IsRDMS5janWZ8DsbzAi9/s1600/screenshot.4.jpg)
- Looking for vulnerabilities on port 445:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYTEP0XtPWzshm7XGEgf5WchqGTtzO1SZ1MUIjPcvrJWBMmfgOKXe7MmzS8BLWbvp2fZe2DFdDW7um2t9SyNzWD8_FqUdqEYwHcyETBmAWr60iTPPAXIs6Ud-zQcTvCq3FOfyuJZjR1Vvg/s1600/screenshot.7.jpg)
- To sum it up, we have discovered these potential vulnerabilities:
- CVE-2008-4250
- CVE-2017-0143
- CVE-2009-3103
3 - EXPLOITATION
- There are several Metasploit modules associated to these vulnerabilities.
- For instance ms08_067_netapi is able to exploit CVE-2008-4250:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEQmn1jIhk4Vps6-cfqhtLck6UFIlLxr_snPbm9Y6TRis5w8TIx-UcbdJNJK-4IqT3XCdiUITU0qDuIh5sKjJeuvd7mMQgJXfBLq2KvsPIVAco1copE330WwHe3aDNvvvF9ccLBgZsHpHC/s1600/screenshot.18.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9OoTHbL3A9JBIbBg6T_XtFOtxdjZnbOCy4ZTH-s2lkIwOrfIB4qiGN3lox3Em9QuJMhjO9gNNCNXFotlWpuGV5axZu-nRN8kGNW5urz876Qb_6aWuX6F7Qj9Lsz4WXjA_psBZx0a08Lip/s1600/screenshot.6.jpg)
- Launching Metasploit and taking the module ms08_067_netapi:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7do60-YJGtr-C2y4-qX_KfUwVOPfwIqZxifbW1rOiVS3UxOEpUUmQCZwkUF5rK8Ib3IldA1-r9GEKMjg7JyXpCOgQ_rBEMxaOm3mT3Us3AsaYhEgsyDb22qIJs3dLDxfScuJWnH3Z4gOZ/s1600/screenshot.15.jpg)
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRLC3lpg5dOVHjdMPVg2omZ4XvzP8Q_KOfRxcuwJ7QwvIYl27p16A720_uS4DsBe__1HYTldJcuvrxw9g8qXWVrsv9XdCwQVUbfNPvFSMjuFpQJLtHdr6Li1fs91JiIYeSREproRXvXsEb/s400/screenshot.16.jpg)
- Once we get a System privileged Meterpreter session it is easy to spawn a shell:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjr4m5py0VHWGhCcjJLy7yv_dqHPsRETX2cRQZum-m9d2UBsKXloHKSskZoQGKPLZNvbyM8IHaKh1Ah711lC2Df3ec6IE1tVeHn4JJSsz1IghZhagRR5O8on4_r5P5wi3CrV7NTMy_iSUC/s1600/screenshot.12.jpg)
4 - CAPTURING THE FLAGS
- Reading user.txt:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgSBBKqM0m_2dwQJreCz5XH9_chLaJCQh-7GIIyvDqYOEQ55AYXxHM0Qjbs3vp6xyBlTQ27wZv4RwQTbRAiKHmQTDQjY7q9UpPwvf3NeErKrXCZZuGOnU8Gpeh6gIVpqTtyXkc4RbemYt_j/s1600/screenshot.13.jpg)
- Reading root.txt:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgfJJXqybQVLfP6FZDupdjiN26GEwVENSbEbMl-udKzSefOevZuhflA89oSm_sBTlEnP-XCxUiEDhmTprFK5JND4efxZWD0MNTrfGv3VVrQ6lHgcUogKFqs7HUhJ3mySjvw9Xerdaoa7v3J/s1600/screenshot.14.jpg)