PT0-003 · Question #187
A penetration tester completes a scan and sees the following Nmap output on a host: Nmap scan report for victim (10.10.10.10) Host is up (0.0001s latency) PORT STATE SERVICE 161/udp open snmp…
The correct answer is C. exploit/windows/smb/ms17_010_eternalblue. EternalBlue (MS17-010) and Windows 7 Exploitation Option C (ms17_010_eternalblue) is correct because EternalBlue is a critical SMB vulnerability (MS17-010) that directly targets Windows 7 SP0 systems - exactly what the Nmap output reveals - and exploits port 445 to deliver a…
Question
A penetration tester completes a scan and sees the following Nmap output on a host:
Nmap scan report for victim (10.10.10.10) Host is up (0.0001s latency) PORT STATE SERVICE 161/udp open snmp 445/tcp open microsoft-ds 3389/tcp open ms-wbt-server Running Microsoft Windows 7 OS CPE: cpe:/o:microsoft:windows_7::sp0 The tester wants to obtain shell access. Which of the following related exploits should the tester try first?
Options
- Aexploit/windows/smb/psexec
- Bexploit/windows/smb/ms08_067_netapi
- Cexploit/windows/smb/ms17_010_eternalblue
- Dauxiliary/scanner/snmp/snmp_login
How the community answered
(31 responses)- A3% (1)
- B16% (5)
- C71% (22)
- D10% (3)
Explanation
EternalBlue (MS17-010) and Windows 7 Exploitation
Option C (ms17_010_eternalblue) is correct because EternalBlue is a critical SMB vulnerability (MS17-010) that directly targets Windows 7 SP0 systems - exactly what the Nmap output reveals - and exploits port 445 to deliver a remote shell, making it the highest-impact, most direct path to shell access in this scenario.
Why the distractors are wrong:
- A (psexec) requires valid credentials to work; it's a post-exploitation or lateral movement tool, not a standalone exploit for gaining initial access
- B (ms08_067_netapi) targets a different vulnerability (MS08-067) primarily affecting Windows XP/2003, not Windows 7, so it's the wrong OS match
- D (snmp_login) is an auxiliary scanner, not an exploit - it only attempts credential enumeration via SNMP (port 161) and won't grant shell access
Memory Tip: Match the exploit to the OS - think "17 = Win7" (MS17-010 → Windows 7). EternalBlue was the NSA exploit weaponized in WannaCry and famously targets Windows 7/Server 2008 via SMB port 445. When you see Win7 + port 445, think EternalBlue first.
Topics
Community Discussion
No community discussion yet for this question.