Exploit for Windows-pentest-lab CVE-2019-0708

## https://sploitus.com/exploit?id=676794E0-8312-580C-95A3-B5064D7FE3DF
# Windows-pentest-lab
Penetration testing and vulnerability assessment  on windows 7 
# 🛡️ Windows OS Penetration Testing & Vulnerability Assessment

![Platform](https://img.shields.io/badge/Platform-Windows%207-blue)
![Tool](https://img.shields.io/badge/Tool-Metasploit-red)
![Tool](https://img.shields.io/badge/Tool-Nmap-brightgreen)
![Status](https://img.shields.io/badge/Status-Completed-success)
![Type](https://img.shields.io/badge/Type-Penetration%20Testing-orange)

> A full penetration testing engagement on a Windows 7 system conducted in an isolated lab environment. This project covers the complete PTES methodology — from reconnaissance through post-exploitation — and documents all findings with evidence and remediation recommendations.

---

## 📋 Project Summary

| Field | Details |
|-------|---------|
| Target OS | Windows 7 Professional SP1 |
| Environment | Isolated Lab (no production systems) |
| Testing Type | Black-box + Grey-box |
| Critical CVEs | MS17-010, CVE-2019-0708, MS08-067 |
| Access Achieved | NT AUTHORITY\SYSTEM |
| Report | [Download Full Report](report/Windows_Pentest_Report.docx) |

---

## 🗂️ Repository Structure

```
windows-pentest-lab/
├── README.md
├── report/
│   └── Windows_Pentest_Report.docx
├── methodology/
│   ├── 01_reconnaissance.md
│   ├── 02_scanning.md
│   ├── 03_vulnerability_assessment.md
│   ├── 04_exploitation.md
│   └── 05_post_exploitation.md
├── tools/
│   └── tools_used.md
└── findings/
    └── vulnerability_summary.md
```

---

## 🔍 Methodology

```mermaid
graph TD
    A[🔎 Reconnaissance] --> B[📡 Scanning & Enumeration]
    B --> C[🔬 Vulnerability Assessment]
    C --> D[💥 Exploitation]
    D --> E[🕵️ Post-Exploitation]
    E --> F[📄 Reporting]
```

---

## 🚨 Key Findings

| # | Vulnerability | CVE | Severity | CVSS |
|---|--------------|-----|----------|------|
| 1 | EternalBlue SMB RCE | MS17-010 | 🔴 CRITICAL | 9.8 |
| 2 | BlueKeep RDP RCE | CVE-2019-0708 | 🔴 CRITICAL | 9.8 |
| 3 | NetAPI RCE | MS08-067 | 🔴 CRITICAL | 10.0 |
| 4 | RDP DoS/RCE | MS12-020 | 🟠 HIGH | 9.3 |
| 5 | Privilege Escalation | MS16-032 | 🟠 HIGH | 7.8 |
| 6 | Weak Admin Password | N/A | 🟠 HIGH | 8.1 |
| 7 | SMBv1 Enabled | N/A | 🟠 HIGH | 7.5 |
| 8 | No Firewall Rules | N/A | 🟡 MEDIUM | 6.5 |
| 9 | No Antivirus/EDR | N/A | 🟡 MEDIUM | 6.2 |
| 10 | Guest Account Enabled | N/A | 🟢 LOW | 5.3 |

---

## 🛠️ Tools Used

| Tool | Purpose |
|------|---------|
| Nmap | Port scanning, OS fingerprinting |
| Metasploit Framework | Exploitation, Meterpreter sessions |
| Nessus | Automated vulnerability scanning |
| Netcat | Reverse shells, banner grabbing |
| Mimikatz | Credential extraction from LSASS |
| Wireshark | Network traffic analysis |

---

## ✅ Top Recommendations

- 🔴 **Upgrade from Windows 7** — EOL since January 2020, no security patches available
- 🔴 **Disable SMBv1** — Primary attack vector for EternalBlue
- 🔴 **Patch immediately** — MS17-010, MS08-067, CVE-2019-0708
- 🟠 **Enforce strong passwords** — Minimum 14 characters with complexity
- 🟠 **Enable Host-based Firewall** — Block ports 445, 135, 3389 from untrusted networks
- 🟡 **Deploy EDR solution** — No endpoint protection was detected during testing

---

## ⚠️ Disclaimer

> This project was conducted **entirely in an isolated lab environment** for educational purposes only. No real systems were harmed. All techniques described are for **authorized security research only**. Unauthorized use of these techniques on systems you do not own is **illegal**.

---