Skip to content

Commit 26f78f1

Browse files
tamagorengstamagorengs
committed
Site updated: 2026-06-01 13:58:31
1 parent 18617b1 commit 26f78f1

55 files changed

Lines changed: 548 additions & 143 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎2026/02/04/HTB-Blue-Writeup/index.html‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,9 @@
161161
isHighlightShrink: false,
162162
isToc: true,
163163
pageType: 'post'
164-
}</script><meta name="generator" content="Hexo 8.1.1"></head><body><div class="bg-animation" id="web_bg" style="background-image: url(/img/sukuna.png);"></div><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="avatar-img text-center"><img src="/img/mash.jpg" onerror="this.onerror=null;this.src='/img/friend_404.gif'" alt="avatar"/></div><div class="site-data text-center"><a href="/archives/"><div class="headline">Articles</div><div class="length-num">8</div></a><a href="/tags/"><div class="headline">Tags</div><div class="length-num">26</div></a><a href="/categories/"><div class="headline">Categories</div><div class="length-num">9</div></a></div><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> Home</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> Archives</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> Tags</span></a></div><div class="menus_item"><a class="site-page" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> Categories</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-user"></i><span> About</span></a></div></div></div></div><div class="post" id="body-wrap"><header class="post-bg" id="page-header" style="background-image: url(/2026/02/04/HTB-Blue-Writeup/htb-blue.png);"><nav id="nav"><span id="blog-info"><a class="nav-site-title" href="/"><span class="site-name">Tamago Security</span></a><a class="nav-page-title" href="/"><span class="site-name">HTB Blue Writeup</span><span class="site-name"><i class="fa-solid fa-circle-arrow-left"></i><span> Back to Home</span></span></a></span><div id="menus"><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> Home</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> Archives</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> Tags</span></a></div><div class="menus_item"><a class="site-page" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> Categories</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-user"></i><span> About</span></a></div></div><div id="toggle-menu"><span class="site-page"><i class="fas fa-bars fa-fw"></i></span></div></div></nav><div id="post-info"><h1 class="post-title">HTB Blue Writeup</h1><div id="post-meta"><div class="meta-firstline"><span class="post-meta-date"><i class="far fa-calendar-alt fa-fw post-meta-icon"></i><span class="post-meta-label">Created</span><time class="post-meta-date-created" datetime="2026-02-04T15:22:17.000Z" title="Created 2026-02-04 23:22:17">2026-02-04</time><span class="post-meta-separator">|</span><i class="fas fa-history fa-fw post-meta-icon"></i><span class="post-meta-label">Updated</span><time class="post-meta-date-updated" datetime="2026-02-06T13:17:34.739Z" title="Updated 2026-02-06 21:17:34">2026-02-06</time></span><span class="post-meta-categories"><span class="post-meta-separator">|</span><i class="fas fa-inbox fa-fw post-meta-icon"></i><a class="post-meta-categories" href="/categories/Writeups/">Writeups</a><i class="fas fa-angle-right post-meta-separator"></i><i class="fas fa-inbox fa-fw post-meta-icon"></i><a class="post-meta-categories" href="/categories/Writeups/HackTheBox/">HackTheBox</a></span></div><div class="meta-secondline"><span class="post-meta-separator">|</span><span class="post-meta-pv-cv" id="" data-flag-title=""><i class="far fa-eye fa-fw post-meta-icon"></i><span class="post-meta-label">Post Views:</span><span id="busuanzi_value_page_pv"><i class="fa-solid fa-spinner fa-spin"></i></span></span></div></div></div></header><main class="layout" id="content-inner"><div id="post"><article class="container post-content" id="article-container"><p>Blue is a straightforward Windows box on HackTheBox, rated easy, that demonstrates the dangers of unpatched systems. We start with an Nmap scan revealing it’s Windows 7 SP1, vulnerable to EternalBlue (MS17-010). Using Metasploit’s exploit module, we get a SYSTEM shell immediately and grab both flags. No privesc needed.</p>
164+
}</script><meta name="generator" content="Hexo 8.1.1"><link rel="alternate" href="/atom.xml" title="Tamago Security" type="application/atom+xml">
165+
<link rel="alternate" href="/rss2.xml" title="Tamago Security" type="application/rss+xml">
166+
</head><body><div class="bg-animation" id="web_bg" style="background-image: url(/img/sukuna.png);"></div><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="avatar-img text-center"><img src="/img/mash.jpg" onerror="this.onerror=null;this.src='/img/friend_404.gif'" alt="avatar"/></div><div class="site-data text-center"><a href="/archives/"><div class="headline">Articles</div><div class="length-num">8</div></a><a href="/tags/"><div class="headline">Tags</div><div class="length-num">26</div></a><a href="/categories/"><div class="headline">Categories</div><div class="length-num">9</div></a></div><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> Home</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> Archives</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> Tags</span></a></div><div class="menus_item"><a class="site-page" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> Categories</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-user"></i><span> About</span></a></div></div></div></div><div class="post" id="body-wrap"><header class="post-bg" id="page-header" style="background-image: url(/2026/02/04/HTB-Blue-Writeup/htb-blue.png);"><nav id="nav"><span id="blog-info"><a class="nav-site-title" href="/"><span class="site-name">Tamago Security</span></a><a class="nav-page-title" href="/"><span class="site-name">HTB Blue Writeup</span><span class="site-name"><i class="fa-solid fa-circle-arrow-left"></i><span> Back to Home</span></span></a></span><div id="menus"><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> Home</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> Archives</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> Tags</span></a></div><div class="menus_item"><a class="site-page" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> Categories</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-user"></i><span> About</span></a></div></div><div id="toggle-menu"><span class="site-page"><i class="fas fa-bars fa-fw"></i></span></div></div></nav><div id="post-info"><h1 class="post-title">HTB Blue Writeup</h1><div id="post-meta"><div class="meta-firstline"><span class="post-meta-date"><i class="far fa-calendar-alt fa-fw post-meta-icon"></i><span class="post-meta-label">Created</span><time class="post-meta-date-created" datetime="2026-02-04T15:22:17.000Z" title="Created 2026-02-04 23:22:17">2026-02-04</time><span class="post-meta-separator">|</span><i class="fas fa-history fa-fw post-meta-icon"></i><span class="post-meta-label">Updated</span><time class="post-meta-date-updated" datetime="2026-02-06T13:17:34.739Z" title="Updated 2026-02-06 21:17:34">2026-02-06</time></span><span class="post-meta-categories"><span class="post-meta-separator">|</span><i class="fas fa-inbox fa-fw post-meta-icon"></i><a class="post-meta-categories" href="/categories/Writeups/">Writeups</a><i class="fas fa-angle-right post-meta-separator"></i><i class="fas fa-inbox fa-fw post-meta-icon"></i><a class="post-meta-categories" href="/categories/Writeups/HackTheBox/">HackTheBox</a></span></div><div class="meta-secondline"><span class="post-meta-separator">|</span><span class="post-meta-pv-cv" id="" data-flag-title=""><i class="far fa-eye fa-fw post-meta-icon"></i><span class="post-meta-label">Post Views:</span><span id="busuanzi_value_page_pv"><i class="fa-solid fa-spinner fa-spin"></i></span></span></div></div></div></header><main class="layout" id="content-inner"><div id="post"><article class="container post-content" id="article-container"><p>Blue is a straightforward Windows box on HackTheBox, rated easy, that demonstrates the dangers of unpatched systems. We start with an Nmap scan revealing it’s Windows 7 SP1, vulnerable to EternalBlue (MS17-010). Using Metasploit’s exploit module, we get a SYSTEM shell immediately and grab both flags. No privesc needed.</p>
165167
<h2 id="Reconnaissance"><a href="#Reconnaissance" class="headerlink" title="Reconnaissance"></a>Reconnaissance</h2><p>I kicked off with a full port Nmap scan, adding version and script scanning to get as much info as possible:</p>
166168
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br></pre></td><td class="code"><pre><span class="line">$ nmap -p- -sCV -oN nmap-blue.txt 10.129.194.164 --min-rate 10000</span><br><span class="line">Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-04 08:50 -0500</span><br><span class="line">Warning: 10.129.194.164 giving up on port because retransmission <span class="built_in">cap</span> hit (10).</span><br><span class="line">Nmap scan report <span class="keyword">for</span> 10.129.194.164</span><br><span class="line">Host is up (0.010s latency).</span><br><span class="line">Not shown: 65517 closed tcp ports (reset)</span><br><span class="line">PORT STATE SERVICE VERSION</span><br><span class="line">135/tcp open msrpc Microsoft Windows RPC</span><br><span class="line">139/tcp open netbios-ssn Microsoft Windows netbios-ssn</span><br><span class="line">445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)</span><br><span class="line">7802/tcp filtered vns-tp</span><br><span class="line">9516/tcp filtered unknown</span><br><span class="line">12689/tcp filtered unknown</span><br><span class="line">16166/tcp filtered unknown</span><br><span class="line">21693/tcp filtered unknown</span><br><span class="line">27945/tcp filtered unknown</span><br><span class="line">30198/tcp filtered unknown</span><br><span class="line">49152/tcp open msrpc Microsoft Windows RPC</span><br><span class="line">49153/tcp open msrpc Microsoft Windows RPC</span><br><span class="line">49154/tcp open msrpc Microsoft Windows RPC</span><br><span class="line">49155/tcp open msrpc Microsoft Windows RPC</span><br><span class="line">49156/tcp open msrpc Microsoft Windows RPC</span><br><span class="line">49157/tcp open msrpc Microsoft Windows RPC</span><br><span class="line">52337/tcp filtered unknown</span><br><span class="line">62111/tcp filtered unknown</span><br><span class="line">Service Info: Host: HARIS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows</span><br><span class="line">Host script results:</span><br><span class="line">| smb-security-mode: </span><br><span class="line">| account_used: guest</span><br><span class="line">| authentication_level: user</span><br><span class="line">| challenge_response: supported</span><br><span class="line">|_ message_signing: disabled (dangerous, but default)</span><br><span class="line">| smb2-time: </span><br><span class="line">| <span class="built_in">date</span>: 2026-02-04T13:51:23</span><br><span class="line">|_ start_date: 2026-02-04T13:48:30</span><br><span class="line">| smb-os-discovery: </span><br><span class="line">| OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)</span><br><span class="line">| OS CPE: cpe:/o:microsoft:windows_7::sp1:professional</span><br><span class="line">| Computer name: haris-PC</span><br><span class="line">| NetBIOS computer name: HARIS-PC\x00</span><br><span class="line">| Workgroup: WORKGROUP\x00</span><br><span class="line">|_ System <span class="keyword">time</span>: 2026-02-04T13:51:26+00:00</span><br><span class="line">|_clock-skew: mean: 3s, deviation: 2s, median: 1s</span><br><span class="line">| smb2-security-mode: </span><br><span class="line">| 2.1: </span><br><span class="line">|_ Message signing enabled but not required</span><br><span class="line">Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .</span><br><span class="line">Nmap <span class="keyword">done</span>: 1 IP address (1 host up) scanned <span class="keyword">in</span> 84.07 seconds</span><br></pre></td></tr></table></figure>
167169

0 commit comments

Comments
 (0)