# Blue

This is my write-up for the machine **Blue** on Hack The Box located at <https://app.hackthebox.com/machines/Blue>.

I started off with a basic nmap scan:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-742e7a9402c89def2177930f2bae74f34e1d3d43%2Fimage.png?alt=media)

I noticed that the ports 135 and 445 were open. To me this meant that SMB could potentially be running on the system. I ran `smbmap -H 10.10.10.40` as well as `enum4linux -a 10.10.10.40`, and ended up getting no solid leads from there. Something hit me while I was working on this machine. I had a recollection of hearing the term "eternalblue" being mentioned in a security context. This combined with the idea that Hack The Box machines are names after some aspect of the machine itself, gave me the idea that maybe it could be "eternalblue". I searched **Metasploit** for "blue" and found this:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-09d4bb8544fd0b6461f464b0873470df0da0cab2%2Fimage.png?alt=media)

I used this module, and after a couple minutes I had a meterpreter session:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-900641cd98b85d19e31ba5d7f1f9a2ffaf22a0d3%2Fimage.png?alt=media)

I was able to then find the **user.txt** shell:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-4b3fc9d882f1e526eb8a5d26384b8813c20710a2%2Fimage.png?alt=media)

I was then able to get the **root.txt** file as well:

![](https://3737186621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MayTgZ_oSfxCsFiprCi%2Fuploads%2Fgit-blob-13b6e17fc43cd90d519272e20cb1fbdd85e79a70%2Fimage.png?alt=media)
