Summary#

Legacy is a beginner level windows machine from hackthebox , this windows machine can be compromised by using only single level smb exploit which will directly jump into administrator user and can further get user flag

Inital Enumeration#

Using nmap we can do a full port service scanning and identify that the following ports as open

1
nmap -sCV -p- -oN nmap.txt 10.10.10.4 -vv

• *35/tcp msrpc syn-ack Microsoft WindowsRPC
• 139/tcp netbios-ssn syn-ack Microsoft Windows netbios-ssn
• 445/tcp microsoft-ds syn-ack Windows XP microsoft-ds

From the intial enumeration identified that the machine is windows xp , which already vulnerable to plenty of remote code executions

FootHold#

Using the following metasploit module against the machine. we were able to get foothold on the machine as administrator user and from the Administrator directory and from user john directoryh , flags were obtained

1
windows/smb/ms17_010_psexec