hey guys hackersploit here back again
with another video and welcome back to
the hack the box series
a lot of you have been asking me to
restart it or to continue uh
with this series and to go through uh
the retired boxes
so i've only covered about two or three
boxes on the channel and i thought why
not go through it
chronologically so i'm going to be going
through all the retired boxes
and we're going to be continuing off
with legacy um so legacy is a windows
box
and it's a fairly simple it it
essentially relies on exploitation of a
cve
or a common vulnerability uh that we can
exploit so
we have the ip here and what i'm going
to do is i'm just going to start this
machine
because if you remember with the new
system that they have
here we're going to be starting with
legacy i'm just going to start the
machine here
and uh we'll just start that up and
i can get the nmap results for you here
which i already have so let me just
clear that out
and that results and there we are all
right so you can see that
um you can see my various scan options
here
uh so some service enumeration and an
aggressive scan and i pretty much
scanned
all the ports what we find is uh we have
a port 139 which is netbios and
port 445 which is uh microsoft ds so
it also tells us tells us the version
here so windows xp
microsoft ds and then 3389 we have a
closed
ms and wbt server
so as for the aggressive detection you
can see that we get
microsoft windows xp service pack 3 94
match and we also have microsoft windows
server 2003 service pack one or two
ninety two
so if we go for the highest uh the
highest percentage match here we can
actually try and search for exploits
so what we can do is we can go to
google.com
and we can search for uh windows xp
service pack 3 exploit
and we can see what exploits we have
right so we have quite a few exploits
but primarily
we want to look at the services that
this exploit is going to be
targeting or what services we have open
that are going to allow us to
essentially exploit the operating system
in this case we see we don't have any
other
we don't have any other services running
these are pretty standard uh microsoft
services so we are looking to exploit
either net bios or the microsoft bs
this year so we can take a look at the
uh exploit database here on exploit db
we
also search for uh say microsoft
ds exploits and let's search for
particular exploits here but we're
particularly dealing with windows
xp here and we can search for that and
um let's open up the first one but let's
take a look at the exploit database here
um so this is uh look this is privilege
escalation if
you can also go ahead and start
searching but let's take a look at this
one
right over here that has to do with smb
which is what we're looking at
particularly
um so microsoft service
uh server service relative path uh stack
corruption so this is a metasploit
module
uh we can use it by and it gives us the
the actual name of the
of the exploit so it's ms-08067
net api so if we just copy this module
uh this module name and let's open up
the meta split console here
so i'll do that right now so msf console
and let me just increase the my font
size so you can see what's going on
all right so we'll uh we'll let that
start up
for some reason i should have connected
to the database but in any case let's
use that module and we show the options
now
um you can see that what we need to
specify are the r hosts here and that's
essentially the target host ip here
so what we can do is we can actually
just copy this ip
and we want to do that so we say set our
hosts
like so and we can paste in the ip over
here
and we're going to leave the our port
because that is the smb service port
and we're going to also leave the smb
pipe as well
and we're just going to run and that's
going to start the
the reverse tcp handler it's going to
detect the target and let's see whether
we're able to
uh to actually exploit this and yes we
can see we get the stage sent
and we get a interpreter session open
all right so the first thing we want to
do is want to enumerate information
about the system we can see
we're running a 32-bit version of
windows
xp service pack 3 if we currently print
our working directory you can see we're
in
system 32 so i'll just try and go into
my c
drive directly and let me list the
contents here so we want to
head over to the uh we want to head over
to the documents and settings
directory and if we list the files in
here we have all the users that we can
access so we have the administrator
all users default user and john so if we
try and access the john directory
and we list the contents in here we need
to go into the desktop
so we'll enter the desktop as well and
we'll cut
the user.txt flag like so so that was
fairly simple
uh let us check if we can actually
access the administrator
um the administrator directory so we hit
enter and yes we can so that means we
can pretty much get
the root uh flag as well so i will catch
the contents of the root flag here
and there we are so we get the contents
of the root flag
and that was a fairly simple so again
this box is uh really really simple
all it involves is just enumeration of
the services
uh and the the operating system version
that you're running
and of course as you see given the
various uh submissions
in regards to the type of of box it is
it's
pretty much dealing with the cve here
more than anything else
so very little of custom exploitation
it's very little
of ctf-like and again quite little to do
with enumeration because everything
can be given to you in one simple nmap
scan
so that's going to be it for this box uh
i'll be seeing you
in the next in the next box when we'll
be taking a look at um
some of the other machines here so we'll
be moving along with it in an orderly
fashion so we'll be taking a look at
popcorn i believe or devil which is also
windows
box and then we'll move on to popcorn
beep so on and so forth so
i'll be seeing you in the next video
[Music]
you