Posts for: #Smb-Null-Session

HTB: Resolute

ターゲット // Resolute
PlatformHTB
OSWindows
DifficultyMedium
IP10.129.96.155

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
47001/tcp open  winrm

Domain: megabank.local, Windows Server 2016.

[]

PG: Shenzi

ターゲット // Shenzi
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.243.55

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE      VERSION
21/tcp   open  ftp          FileZilla ftpd 0.9.41 beta
80/tcp   open  http         Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
135/tcp  open  msrpc        Microsoft Windows RPC
139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
443/tcp  open  ssl/http     Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
445/tcp  open  microsoft-ds
3306/tcp open  mysql        MariaDB (host not allowed)
5040/tcp open  unknown

Windows 10 box with an Apache/PHP stack on 80/443, FileZilla FTP, SMB, and a MariaDB that refuses remote connections. FTP rejects the obvious weak creds and MySQL is locked to localhost, so the two live doors are SMB and the web server.

[]