Internal - Proving Grounds Practice
Enumeration
Nmap
Initial Nmap scan revealed SMB and other common ports were open.
At first I tried SMB Null session but it was not available. So I re-run the nmap scan with vuln script and found out that the machine is vulnerable to CVE-2009-3103 through SMB.
Exploitation (Directyly SYSTEM)
CVE-2009-3103
After some research I found an exploit on github.
It was explaining how to use metasploit for this CVE. So I simply used it and got a SYSTEM shell.