# Dancing (Tier 0)

## <mark style="color:blue;">Description</mark>

* **Tier&#x20;**<mark style="color:green;">**->**</mark> 0
* **Difficult** <mark style="color:green;">**->**</mark> Very Easy
* **OS** <mark style="color:green;">**->**</mark> Windows
* **Tags&#x20;**<mark style="color:green;">**->**</mark> Protocols / SMB / Reconnaissance / Anonymous-Guest Access

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FCWXcAimC0SZ7FgoqqjW0%2Fimage.png?alt=media&#x26;token=7596cfbe-7897-4947-be9a-bad2d957310a" alt=""><figcaption><p><a href="https://app.hackthebox.com/starting-point?tier=0">https://app.hackthebox.com/starting-point?tier=0</a></p></figcaption></figure>

## <mark style="color:blue;">Write-up</mark>

* With a little research, I started answering the first questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FxEFucDTpqlnflLTn85VM%2Fimage.png?alt=media&#x26;token=1aff2692-1db9-4aa1-98e1-1f46147abf69" alt=""><figcaption></figcaption></figure>

> Answer: _**Server Message Block**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FWnZZmiF09f01RN2mGEvH%2Fimage.png?alt=media&#x26;token=ff3c41d3-25e8-4584-8998-f0f604cf71fb" alt=""><figcaption></figcaption></figure>

> Answer: _**445**_

***

* Then I did an initial port scan using [_Nmap_](../../../networks/tools-and-utilities#nmap)

<pre class="language-bash" data-line-numbers><code class="lang-bash"><strong>nmap -p- -Pn --min-rate 2000 10.129.76.14
</strong></code></pre>

<div data-full-width="false"><figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FDHOar52GJXIzDh9pKCLd%2Fimage.png?alt=media&#x26;token=78acc4ed-c9c7-4b83-81e3-fbede5e433df" alt=""><figcaption></figcaption></figure></div>

***

* With this and a little research, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FMAkbexPVxLy7AxgpAW6V%2Fimage.png?alt=media&#x26;token=84e9b23a-ab24-4351-bef1-0046b3c9a5ff" alt=""><figcaption></figcaption></figure>

> Answer: _**microsoft-ds**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FPuXBZZ0FYoj0jFTOUmCg%2Fimage.png?alt=media&#x26;token=61fd8059-0965-427a-9919-c526e2420599" alt=""><figcaption></figcaption></figure>

> Answer: _**-L**_

***

* After this, I did an exhaustive scan to get information on the services running on the open ports

{% code overflow="wrap" lineNumbers="true" %}
```bash
nmap -p135,139,445,5985,47001,49664,49665,49666,49667,49668,49669 -sVC 10.129.76.14
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FZ5GN4pwmJ2r8kQ6o2iMz%2Fimage.png?alt=media&#x26;token=57a2df5f-85f8-441c-bd6e-e9e3d8e29c6c" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F1oVziaKpO4Rfio1o8rrz%2Fimage.png?alt=media&#x26;token=f7722fff-9afd-414b-a223-b0e5f5605d3f" alt=""><figcaption></figcaption></figure>

***

* I focused on port 445, which by default is used for the SMB protocol. I tried connecting using the [_sbmclient_](../../../networks/tools-and-utilities#smbclient) tool to access the service to list the contents being shared. When asked for a password, I left it blank, and fortunately, I got the list of shares from the target machine

{% code lineNumbers="true" %}
```bash
smbclient -L 10.129.76.14 
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FbdbX5byvGDJqiGmnRdTi%2Fimage.png?alt=media&#x26;token=3adf8b8d-8a33-4e63-9a83-097352548a16" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
To learn more about the SMB protocol, you can go [here](../../networks/protocols/smb)
{% endhint %}

***

* With this, I answered the next question

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FW0v3y4P0hWIHmyRSS8VZ%2Fimage.png?alt=media&#x26;token=4d971c2a-1a40-4179-8717-a3f966856013" alt=""><figcaption></figcaption></figure>

> Answer: **4**

***

* After this, I tried accessing the shared folders, and when doing it with the one named _WorkShares_, I gained access without being asked for a password

{% code lineNumbers="true" %}
```bash
smbclient //10.129.76.14/WorkShares
```
{% endcode %}

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2Fu4TMXtDz9ZjcGLhl86XD%2Fimage.png?alt=media&#x26;token=23599000-8c46-4aa9-8984-a6a1bfdb1f24" alt=""><figcaption></figcaption></figure>

***

* With this and a little research, I answered the next questions

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FKEHxFCDjfWLjvn0PAdGo%2Fimage.png?alt=media&#x26;token=2d7ef4c2-a639-4797-ab9a-87a27c453469" alt=""><figcaption></figcaption></figure>

> Answer: _**WorkShares**_

***

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FE2RCpv0EwT1frgUq0ZRU%2Fimage.png?alt=media&#x26;token=8f8fe6a9-48ac-435d-866a-5da3b98261f1" alt=""><figcaption></figcaption></figure>

> Answer: _**get**_

***

* Then I listed the content of the shared folder, where I found some folders that seemed to belong to users of the target system. So I explored them, and when reaching the _James.P_ directory, I listed its content and found a _flag.txt_ file

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FqDrsYsE20xyqAjYyUoxL%2Fimage.png?alt=media&#x26;token=e11790ec-01d5-46fd-a97b-878a607182f7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FHxCPKLLhJdD8v9hRM1ic%2Fimage.png?alt=media&#x26;token=4aff4e6e-58d4-4339-b10c-a0d9a1545955" alt=""><figcaption></figcaption></figure>

***

* Knowing this, I used the internal `get` command to download the file from the SMB server, and then I closed the connection. Finally, I checked the content of the file, retrieving from it the root flag

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FVHKWjHMRCQv0nQeW4jRx%2Fimage.png?alt=media&#x26;token=593f466a-e0ab-4a31-9018-7b2a1bf1f119" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2FeWSz0UhvAHhZLO1vbmnk%2Fimage.png?alt=media&#x26;token=85e613b7-ac87-48b9-af86-0e5d957858a8" alt=""><figcaption></figcaption></figure>

***

* With this, I got the root flag and pwned the machine

<figure><img src="https://1571945027-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtgxeteB8N7iEoJU7WZh6%2Fuploads%2F3oa3RDLa7uSJpCRcdQzl%2Fimage.png?alt=media&#x26;token=1ce7004e-2aca-45b1-b7ca-3b791c67715b" alt=""><figcaption></figcaption></figure>

> Answer: _**5f61c10dffbc77a704d76016a22f1664**_
