TryHackMe - Blue (MS17-010 / EternalBlue Analysis)

Detailed write-up and threat mitigation guide for the Blue machine on TryHackMe, focusing on exploiting and securing the legacy SMBv1 protocol.

📖 Full Walkthrough & Methodology

The full article explaining the attack methodology, Nmap output analysis, and step-by-step remediation is published on Medium: 👉 Read the full article on Medium

🛠️ Tools Used

• Nmap: Network reconnaissance and vulnerability detection (smb-vuln-ms17-010)
• Metasploit Framework: Exploitation (exploit/windows/smb/ms17_010_eternalblue)
• Meterpreter: Post-exploitation verification (NT AUTHORITY\SYSTEM)

🛡️ Quick Remediation Summary

1. Apply Microsoft Security Bulletin MS17-010.
2. Disable SMBv1 domain-wide via Group Policy.
3. Block incoming traffic on TCP port 445 at firewall boundaries.