https://ioctl.lol/tags/smb/Recent content in Smb on ioctlHugoenioctlTue, 07 Mar 2023 00:00:00 +0000https://ioctl.lol/ctf/offsec/internal/Tue, 07 Mar 2023 00:00:00 +0000https://ioctl.lol/ctf/offsec/internal/<div class="box-info"> <table> <tr><th colspan="2">ターゲット // Internal</th></tr> <tr><td>Platform</td><td>OffSec Proving Grounds</td></tr> <tr><td>OS</td><td>Windows</td></tr> <tr><td>Difficulty</td><td>Easy</td></tr> <tr><td>IP</td><td><code>192.168.x.x</code></td></tr> </table> </div> <style> .box-info table { max-width: 400px; margin: 1.5em 0; } .box-info th { text-align: center; font-size: 1.1em; letter-spacing: 0.08em; } </style> <hr> <h2 id="enumeration">Enumeration</h2> <h3 id="nmap">Nmap</h3> <p>The exposed surface is minimal — SMB is the only port in play:</p> <details class="collapse-section"> <summary>▶ Nmap output</summary> <div class="collapse-content"> <pre tabindex="0"><code>PORT STATE SERVICE VERSION 445/tcp open microsoft-ds </code></pre> </div> </details> <style> .collapse-section { border: 1px dashed var(--accent-alpha-20); padding: 0.5em 1em; margin: 1em 0; cursor: pointer; } .collapse-section[open] summary { margin-bottom: 0.8em; border-bottom: 1px dashed var(--accent-alpha-20); padding-bottom: 0.5em; } .collapse-section summary { font-weight: 700; color: var(--accent); outline: none; } .collapse-content { padding-top: 0.5em; } </style> <p>An old Windows host exposing SMB. Post-exploitation <code>sysinfo</code> confirms the target: <strong>Windows Server 2008 (6.0 Build 6001, SP1), x86, workgroup member.</strong> That 32-bit architecture matters — it kills one of the two rabbit holes below.</p>