## https://sploitus.com/exploit?id=9E9D06FB-9F70-5EE1-B7F7-88D823B3D470
# Windows 7 Chained CTF Lab
A multi-stage, boot-to-root cybersecurity training environment built on a deliberately misconfigured Windows 7 SP1 host. Ten sequential challenges chain together real-world vulnerability classes — from network reconnaissance to full NT AUTHORITY\SYSTEM compromise via EternalBlue (MS17-010).
Built during my Cybersecurity Internship at **NIELIT, Janakpuri, New Delhi** (Feb–Aug 2026). The lab manual produced from this project was adopted by NIELIT as reusable student training material.
## Overview
| Attribute | Details |
|---|---|
| Machine Name | MaxHack-PC |
| Difficulty | Medium to Hard |
| Platform | Windows 7 SP1 x64 |
| Category | Web Exploitation / Windows Privilege Escalation / Remote (SMB) Exploitation |
| Type | Chained attack path — 10 challenges, 4 flags |
**Scenario:** MaxHack Corp. deployed an internal XAMPP-based web portal on a Windows 7 SP1 host for internal testing. Poor operational security — a service on a non-standard port, a misleading banner, reused credentials, a disguised archive with plaintext credentials, an over-permissive scheduled task, and an unpatched SMB vulnerability — leaves multiple chained entry points for an attacker on the same network segment.
## Attack Chain
```
1. Network Recon (full-port Nmap scan) → discover hidden service on port 8088
2. Service Fingerprinting → defeat misleading HTTP banner, find hidden endpoint
3. Web / Directory Enumeration (Gobuster) → discover hidden portal
4. Steganography → extract flag from image
5. Cryptography (Base64) → decode hidden credentials
6. Hash Cracking (Hashcat / John) → crack weak MD5 password hash
7. Login Brute-Force (Hydra) → break unthrottled login form
8. File-Type / Forensic Analysis (file, binwalk) → uncover ZIP disguised as JPG, extract creds
9. Windows Privilege Escalation → hijack insecure scheduled task → Administrator
10. Remote SMB Exploitation (EternalBlue/MS17-010) → NT AUTHORITY\SYSTEM
```
Four flags are captured across key milestones in the chain.
## What This Lab Teaches
- Network reconnaissance and full-port Nmap scanning
- Service fingerprinting and identifying deceptive banners
- Web directory/portal enumeration (Gobuster)
- Steganography and hidden-data analysis
- Base64 encoding/decoding and cryptographic puzzle solving
- MD5 hash cracking (Hashcat / John the Ripper)
- HTTP login form brute-forcing (Hydra)
- File-signature (magic byte) analysis and disguised-file detection
- Windows privilege escalation via scheduled task hijacking and insecure ACLs
- Remote SMB exploitation using MS17-010 / EternalBlue via Metasploit
- Chained, multi-stage penetration testing methodology
## Lab Architecture
**Target Machine** — Windows 7 SP1 x64 (unpatched, vulnerable to MS17-010)
- XAMPP (Apache + PHP) on port 8088, RDP (3389), SMB (445)
- Host-Only Adapter, IP `192.168.56.101`
**Attacker Machine** — Kali Linux
- Same Host-Only network, IP `192.168.56.103`
- Tools: Nmap, Gobuster, Hydra, Hashcat/John the Ripper, Steghide, Binwalk, `file`/`xxd`, xfreerdp3, Metasploit Framework, curl
Full setup instructions, recommended hardware specs, and network configuration are in [`docs/lab-setup.md`](docs/lab-setup.md).
> **Note:** This lab intentionally runs an unpatched, wormable SMB vulnerability (EternalBlue). It must only be run on an isolated Host-Only virtual network with no external internet exposure.
## Challenge Writeups
| # | Challenge | Skill | Flag | Points | Writeup |
|---|---|---|---|---|---|
| 1 | Network Enumeration | Nmap scanning | — | 5 | [01-hidden-service.md](challenges/01-hidden-service.md) |
| 2 | Service Fingerprinting | Banner analysis | — | 5 | [02-service-fingerprinting.md](challenges/02-service-fingerprinting.md) |
| 3 | Hidden Web Portal | Web enumeration | — | 10 | [03-hidden-portal.md](challenges/03-hidden-portal.md) |
| 4 | Steganography | Image analysis | Flag 1 | 15 | [04-steganography.md](challenges/04-steganography.md) |
| 5 | Cryptography Puzzle | Base64 decoding | — | 10 | [05-cryptography.md](challenges/05-cryptography.md) |
| 6 | Hash Cracking | MD5 cracking | — | 10 | [06-hash-cracking.md](challenges/06-hash-cracking.md) |
| 7 | Login Bruteforce | Hydra | — | 10 | [07-login-bruteforce.md](challenges/07-login-bruteforce.md) |
| 8 | File-Type Enumeration | file / binwalk | — | 10 | [08-file-enumeration.md](challenges/08-file-enumeration.md) |
| 9 | Privilege Escalation | Scheduled task hijack | Flag 2 | 15 | [09-privilege-escalation.md](challenges/09-privilege-escalation.md) |
| 10 | SYSTEM Access | EternalBlue / MS17-010 | Flags 3 & 4 | 10 | [10-eternalblue.md](challenges/10-eternalblue.md) |
**Total: 100 points across 10 challenges, 4 flags.**
## Flags & Verification
| Flag | Challenge | Value | Location |
|---|---|---|---|
| Flag 1 | 4 — Steganography | `FLAG{hidden_in_image}` | `image.jpg` (steghide) |
| Flag 2 | 9 — Privilege Escalation | `FLAG{user_access}` | `C:\Users\dev\Desktop\user.txt` |
| Flag 3 | 10 — EternalBlue | `FLAG{system_control}` | `C:\Users\Administrator\Desktop\root.txt` |
| Flag 4 | 10 — EternalBlue (hard) | `FLAG{complete_compromise}` | `C:\Windows\System32\spool\drivers\color\config.dat` |
## User Accounts
| Username | Password | Purpose | Privilege Level |
|---|---|---|---|
| `admin` | `password` | Web login (dev_backup portal) | Web app user |
| `dev` | `P@ssw0rd!` | RDP access after Challenge 8 | Low-privilege → escalated to Admin |
| `Administrator` | — | Final target account (Flag 3) | Local Administrator |
| `SYSTEM` | — | Highest privilege, obtained via EternalBlue (Flag 4) | NT AUTHORITY\SYSTEM |
## Vulnerability Analysis & Remediation
Each challenge maps to a real CWE classification with a corresponding fix. Full table in [`docs/vulnerability-analysis.md`](docs/vulnerability-analysis.md). Example:
| Challenge | Vulnerability | CWE | Remediation |
|---|---|---|---|
| Hash Cracking | Weak, unsalted password hashing | CWE-916 | Use a modern salted hash (bcrypt, scrypt, Argon2) and enforce a strong password policy |
| Login Brute-Force | Missing rate limiting / account lockout | CWE-307 | Implement account lockout, progressive delays, CAPTCHA, MFA |
| SYSTEM Access (EternalBlue) | Missing critical security patch (unpatched SMBv1) | CWE-20 / CVE-2017-0144 | Apply MS17-010 promptly, disable SMBv1 entirely, segment legacy hosts |
## Screenshots
Evidence for each challenge (Nmap scan output, curl banner inspection, extracted flags, the Meterpreter SYSTEM shell, etc.) goes in [`screenshots/`](screenshots/) — see that folder's checklist for exactly what to capture per challenge.
## Full Project Report
The complete internship report — including detailed system requirements, full walkthrough guide, and vulnerability/remediation mapping for all 10 challenges — is available at [`docs/Internship_Report.pdf`](docs/Internship_Report.pdf).
## Author
**Rahul Sangam** — Cybersecurity Fresher | SOC Analyst
Internship: NIELIT, Janakpuri, New Delhi
[GitHub](https://github.com/RahulSangam) · rahul.sangam23@gmail.com
## References
- [Hack The Box](https://hackthebox.com) — Practical penetration testing challenges
- [TryHackMe](https://tryhackme.com) — Interactive cybersecurity learning platform
- [PortSwigger Web Security Academy](https://portswigger.net/web-security) — Web application security training
- [OWASP Top 10](https://owasp.org/www-project-top-ten/) — Industry-standard web vulnerability reference
- [MITRE ATT&CK Framework](https://attack.mitre.org)
- [Microsoft Security Bulletin MS17-010](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010)