EternalBlue – Full Walkthrough

1. Introduction

Hey everyone 👋

In this walkthrough, we’ll be exploiting a vulnerable Windows 7 machine as part of one of the practical penetration testing tasks assigned during my internship at HackersDaddy.

This machine is vulnerable to MS17-010, a critical SMBv1 remote code execution vulnerability that can be exploited using EternalBlue.

Our objective here is to:

• enumerate the target machine
• identify exposed services
• validate the vulnerability
• gain remote access
• and retrieve both challenge flags

During this process, we’ll move from simple SMB enumeration all the way to obtaining a SYSTEM-level shell on the target machine.

So let’s jump straight into the exploitation process ⚡

2. Verifying Connectivity With the Target

Before starting reconnaissance, let’s first verify whether the target machine is reachable.

The target responds successfully, confirming proper network communication between the attacker and victim machines.

3. Configuring the Hosts File

Since we’ll be interacting with the target multiple times throughout enumeration and exploitation, repeatedly typing the IP address can become inconvenient.

To simplify the workflow, let’s configure a hostname entry inside the local hosts file.

Now let’s add an entry similar to:

192.168.x.x eternal_blue

This allows the target machine to be referenced using the hostname "eternal_blue" instead of repeatedly typing the IP address during scans, enumeration, and exploitation.

After saving the file, let’s verify that hostname resolution works properly.

Perfect ⚡

The hostname now resolves correctly and communicates successfully with the target machine.

4. Performing Initial Reconnaissance

Now that communication with the target is working properly, let’s begin reconnaissance using Nmap.

This scan:

• runs default NSE scripts
• performs version detection
• and stores the results locally

After the scan completes, several important services are revealed.

We can see:

• SMB service exposed on port 445
• NetBIOS services enabled
• Windows 7 Professional SP1 running on the target
• and evidence of SMBv1 support

At this point, the target already looks highly suspicious because SMBv1 is historically associated with several dangerous vulnerabilities.

5. Enumerating SMB Shares

Since SMB is exposed, let’s enumerate the available SMB shares.

When prompted for a password, simply press Enter.

Anonymous SMB enumeration is allowed on the target.

After enumeration completes, several SMB shares are displayed including:

• ADMIN$
• C$
• IPC$
• Users
• secret

Now this is where things get interesting 👀

The SMB share named "secret" exposes a challenge flag directly inside its comment field.

This confirms successful SMB enumeration and also demonstrates how sensitive information can leak through poorly configured SMB shares.

6. Validating the MS17-010 Vulnerability

Now that we know:

• SMBv1 is enabled
• and the target is running Windows 7

let’s verify whether the machine is vulnerable to MS17-010.

We can perform this validation using Nmap SMB vulnerability scripts.

After the scan completes, the output confirms that the target is vulnerable to:

MS17-010 (CVE-2017-0144)

This is the famous SMBv1 remote code execution vulnerability that EternalBlue exploits.

At this point, we already have a clear exploitation path.

7. Reviewing EternalBlue

Before exploitation, let’s quickly review the exploit associated with MS17-010.

The exploit commonly used against this vulnerability is known as EternalBlue.

EternalBlue became globally infamous after being weaponized during attacks such as WannaCry and NotPetya.

ExploitDB contains public references and technical details related to the exploit.

From ExploitDB, we can confirm that a Metasploit module exists for exploiting this vulnerability.

8. Launching Metasploit Framework

Now let’s move into the exploitation phase.

First, launch Metasploit Framework.

Once Metasploit loads successfully, let’s search for EternalBlue-related modules.

Among the results, we can identify the following exploit module:

exploit/windows/smb/ms17_010_eternalblue

Perfect ⚡

9. Selecting the EternalBlue Module

Now let’s load the EternalBlue exploit module.

After loading the module, let’s inspect the required configuration options.

The module requires:

• target host details

10. Configuring the Exploit

Now let’s configure the target host.

After configuring the target, let’s verify the settings once again.

Everything now looks properly configured and ready for exploitation.

11. Exploiting the Target

Now comes the interesting part ⚡

Let’s launch the exploit.

During execution:

• the vulnerability gets validated
• SMB memory structures are manipulated
• EternalBlue triggers remote memory corruption
• and the payload gets delivered to the target machine

Within a few seconds, the exploit successfully opens a Meterpreter session.

That confirms successful remote code execution against the vulnerable Windows machine.

12. Exploring Meterpreter

Now that we have a Meterpreter session, let’s quickly look at some available Meterpreter functionalities.

Meterpreter provides several powerful post-exploitation features including:

• filesystem interaction
• shell spawning
• process migration
• screenshot capture
• keylogging
• privilege management
• and persistence capabilities

Now let’s gather some basic information about the compromised system.

The output confirms:

• Windows 7 Professional SP1
• x64 architecture
• target hostname
• WORKGROUP domain details

13. Spawning a Native Windows Shell

Now let’s spawn a native Windows command shell from Meterpreter.

Perfect ⚡

We now have direct command-line interaction with the operating system.

The shell successfully lands inside:

C:\Windows\system32>

14. Verifying SYSTEM-Level Access

Before moving further, let’s verify our privilege level.

The output returns:

nt authority\system

This confirms:

• complete SYSTEM-level compromise
• highest privilege level on Windows
• unrestricted administrative access over the target machine

15. Enumerating the Filesystem

Now let’s start enumerating the filesystem and look for the remaining challenge flag.

We’ll begin from the root of the C: drive.

Several directories and files become visible including:

• Program Files
• Users
• Windows
• secret
• flag.txt

The file named flag.txt immediately looks promising.

So let’s inspect it.

However, the content only displays a misleading message:

flag is not encrypted

So this is clearly not the actual flag.

16. Investigating the Secret Directory

Now let’s move into the "secret" directory because it looks suspicious.

Inside the directory, two files are discovered:

• flag.txt
• flag-2.txt

The first file displays ASCII-art style content and appears intentionally misleading.

However, the second file contains the valid enumeration flag but it is the same flag obtained during the SMB share enumeration.

17. Enumerating the Victim User Directory

Now let’s continue enumeration inside the Users directory.

Several standard Windows user folders become visible:

• Desktop
• Documents
• Downloads
• Pictures
• Videos

The Desktop directory contains another file named flag.txt.

However, this once again displays misleading ASCII-art content rather than the actual flag.

18. Retrieving the Final Flag

Since the Desktop directory did not contain the real flag, let’s continue enumeration inside the Documents directory.

Inside the directory, we can see a file named proof.txt

Now let’s inspect it.

Perfect ⚡

The file reveals the final challenge flag.

This confirms successful SYSTEM-level compromise of the vulnerable Windows 7 target through EternalBlue exploitation.

19. Attack Chain Summary

Let’s quickly recap the full attack chain:

• Connectivity verification
• Host resolution configuration
• Nmap reconnaissance
• SMB share enumeration
• MS17-010 vulnerability validation
• EternalBlue exploit research
• Metasploit exploitation
• Meterpreter shell access
• SYSTEM privilege verification
• Filesystem enumeration

20. Final Thoughts

This machine was an excellent demonstration of how dangerous legacy SMBv1 services can become when critical vulnerabilities remain unpatched.

The challenge provided practical exposure to:

• SMB enumeration
• vulnerability validation
• EternalBlue exploitation
• Metasploit usage
• post-exploitation enumeration
• and Windows privilege verification

Overall, this was a great hands-on exercise in building a complete attack chain from reconnaissance all the way to SYSTEM-level compromise ⚡