> For the complete documentation index, see [llms.txt](https://www.jacobshodd.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.jacobshodd.com/writeups/hack-the-box/legacy.md).

# Legacy

![info-card](https://3224288402-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lu8Z9CKAFTUHKxIXyp7%2Fuploads%2Fgit-blob-b647d62f912769e7538d5d41265b3038c0385808%2Finfo_card.png?alt=media)

## Initial Enumeration

Like any other target, we'll start off with a quick port scan to see what we're working with:

```bash
nmap -sV 10.10.10.4
```

![Initial Nmap Scan](https://3224288402-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lu8Z9CKAFTUHKxIXyp7%2Fuploads%2Fgit-blob-0a5ccba0eee3a944f7a2b95a81b985af8b641caa%2Finitial_nmap.png?alt=media)

Looking at this output it's safe to say SMB is the target here. Let's take a closer look at this service using some NSE scripts:

```bash
nmap -p 139,445 --script=smb-vuln* 10.10.10.4
```

![SMB Vulnerability Scan](https://3224288402-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lu8Z9CKAFTUHKxIXyp7%2Fuploads%2Fgit-blob-63da9af82259888e44ac9295dc15d69b2f6488f9%2Fsmb_nmap.png?alt=media)

Bingo, now we just have to find ourselves an exploit. In the interest of time, we'll just use metasploit to exploit this vulnerability. I originally intended to show how to do this manually, but due to the older version of windows this box is running, I ran into a lot of issues. for a non-metasploit look at MS17-010 be sure to take a look at my write-up on [blue](https://wiki.jacobshodd.com/writeups/hack-the-box/blue). The first thing we'll do is start our `msfconsole` and validate that this exploit will work on this target:

```
# starting msfconsole
msfconsole

# the following happens inside the console:
use exploit/windows/smb/ms17_010_psexec 
set RHOST 10.10.10.4
check
```

![MSF Exploit Validation](https://3224288402-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lu8Z9CKAFTUHKxIXyp7%2Fuploads%2Fgit-blob-5cd47f0662c95a6d5ac2071665bd437297111bcd%2Fvalidate.png?alt=media)

## Exploitation

Exploitation from here on is pretty simple. So simple in fact that it just takes typing one word: `exploit`. While I really prefer to not use metasploit for learning purposes, I can't deny how convenient it makes common exploits like this:

![Executing the exploit](https://3224288402-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lu8Z9CKAFTUHKxIXyp7%2Fuploads%2Fgit-blob-8b316c132400bd41e6b34a7ebd51bd5d23a9cbf7%2Fexploit.png?alt=media)

With this we can either grab the flags using meterpreter commands, or spawn a shell with the command `shell`. With this we are able to read the flags:

![Flags](https://3224288402-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Lu8Z9CKAFTUHKxIXyp7%2Fuploads%2Fgit-blob-e5c21dc08e34e7028750fd7726acc22d82730831%2Fflags.png?alt=media)