ターゲット // Shenzi
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.243.55

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE      VERSION
21/tcp   open  ftp          FileZilla ftpd 0.9.41 beta
80/tcp   open  http         Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
135/tcp  open  msrpc        Microsoft Windows RPC
139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
443/tcp  open  ssl/http     Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
445/tcp  open  microsoft-ds
3306/tcp open  mysql        MariaDB (host not allowed)
5040/tcp open  unknown

Windows 10 box with an Apache/PHP stack on 80/443, FileZilla FTP, SMB, and a MariaDB that refuses remote connections. FTP rejects the obvious weak creds and MySQL is locked to localhost, so the two live doors are SMB and the web server.