SMB
Nmap discovered a Windows Directory server on the target port 445
┌──(kali㉿kali)-[~/archive/htb/labs/blackfield]
└─$ nmap -Pn --script smb-enum-shares -sV -p445 $IP
starting nmap 7.94 ( https://nmap.org ) at 2023-12-20 22:56 CET
Nmap scan report for dc01 (10.10.10.192)
Host is up (0.025s latency).
PORT STATE SERVICE VERSION
445/tcp open microsoft-ds?
service detection performed. please report any incorrect results at https://nmap.org/submit/ .
nmap done: 1 IP address (1 host up) scanned in 10.90 secondsAttempting to map the SMB shares fails likely due privileges-related issues
Null Session
┌──(kali㉿kali)-[~/archive/htb/labs/blackfield]
└─$ smbclient -L //dc01.blackfield.local/
Password for [WORKGROUP\kali]:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
forensic Disk Forensic / Audit share.
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
profiles$ Disk
SYSVOL Disk Logon server share
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to dc01.blackfield.local failed (Error NT_STATUS_IO_TIMEOUT)
Unable to connect with SMB1 -- no workgroup availableThere is 2 none default SMB shares available within the target SMB server;
//dc01.blackfield.local/forensic//dc01.blackfield.local/profiles$
//dc01.blackfield.local/forensic
┌──(kali㉿kali)-[~/archive/htb/labs/blackfield]
└─$ smbclient //dc01.blackfield.local/forensic
password for [workgroup\kali]:
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*
smb: \> dir
NT_STATUS_ACCESS_DENIED listing \*Despite allowing anonymous access, the //dc01.blackfield.local/forensic share does not allow listing
//dc01.blackfield.local/profiles$
┌──(kali㉿kali)-[~/archive/htb/labs/blackfield]
└─$ smbclient //dc01.blackfield.local/profiles$
Password for [WORKGROUP\kali]:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Wed Jun 3 18:47:12 2020
.. D 0 Wed Jun 3 18:47:12 2020
AAlleni D 0 Wed Jun 3 18:47:11 2020
ABarteski D 0 Wed Jun 3 18:47:11 2020
ABekesz D 0 Wed Jun 3 18:47:11 2020
ABenzies D 0 Wed Jun 3 18:47:11 2020
ABiemiller D 0 Wed Jun 3 18:47:11 2020
AChampken D 0 Wed Jun 3 18:47:11 2020
ACheretei D 0 Wed Jun 3 18:47:11 2020
ACsonaki D 0 Wed Jun 3 18:47:11 2020
AHigchens D 0 Wed Jun 3 18:47:11 2020
AJaquemai D 0 Wed Jun 3 18:47:11 2020
AKlado D 0 Wed Jun 3 18:47:11 2020
AKoffenburger D 0 Wed Jun 3 18:47:11 2020
AKollolli D 0 Wed Jun 3 18:47:11 2020
AKruppe D 0 Wed Jun 3 18:47:11 2020
AKubale D 0 Wed Jun 3 18:47:11 2020
ALamerz D 0 Wed Jun 3 18:47:11 2020
AMaceldon D 0 Wed Jun 3 18:47:11 2020
AMasalunga D 0 Wed Jun 3 18:47:11 2020
ANavay D 0 Wed Jun 3 18:47:11 2020
ANesterova D 0 Wed Jun 3 18:47:11 2020
ANeusse D 0 Wed Jun 3 18:47:11 2020
AOkleshen D 0 Wed Jun 3 18:47:11 2020
APustulka D 0 Wed Jun 3 18:47:11 2020
ARotella D 0 Wed Jun 3 18:47:11 2020
ASanwardeker D 0 Wed Jun 3 18:47:11 2020
AShadaia D 0 Wed Jun 3 18:47:11 2020
ASischo D 0 Wed Jun 3 18:47:11 2020
ASpruce D 0 Wed Jun 3 18:47:11 2020
ATakach D 0 Wed Jun 3 18:47:11 2020
ATaueg D 0 Wed Jun 3 18:47:11 2020
ATwardowski D 0 Wed Jun 3 18:47:11 2020
audit2020 D 0 Wed Jun 3 18:47:11 2020
AWangenheim D 0 Wed Jun 3 18:47:11 2020
AWorsey D 0 Wed Jun 3 18:47:11 2020
AZigmunt D 0 Wed Jun 3 18:47:11 2020
BBakajza D 0 Wed Jun 3 18:47:11 2020
BBeloucif D 0 Wed Jun 3 18:47:11 2020
BCarmitcheal D 0 Wed Jun 3 18:47:11 2020
BConsultant D 0 Wed Jun 3 18:47:11 2020
BErdossy D 0 Wed Jun 3 18:47:11 2020
BGeminski D 0 Wed Jun 3 18:47:11 2020
BLostal D 0 Wed Jun 3 18:47:11 2020
BMannise D 0 Wed Jun 3 18:47:11 2020
BNovrotsky D 0 Wed Jun 3 18:47:11 2020
BRigiero D 0 Wed Jun 3 18:47:11 2020
BSamkoses D 0 Wed Jun 3 18:47:11 2020
BZandonella D 0 Wed Jun 3 18:47:11 2020
CAcherman D 0 Wed Jun 3 18:47:12 2020
CAkbari D 0 Wed Jun 3 18:47:12 2020
CAldhowaihi D 0 Wed Jun 3 18:47:12 2020
CArgyropolous D 0 Wed Jun 3 18:47:12 2020
CDufrasne D 0 Wed Jun 3 18:47:12 2020
CGronk D 0 Wed Jun 3 18:47:11 2020
Chiucarello D 0 Wed Jun 3 18:47:11 2020
Chiuccariello D 0 Wed Jun 3 18:47:12 2020
CHoytal D 0 Wed Jun 3 18:47:12 2020
CKijauskas D 0 Wed Jun 3 18:47:12 2020
CKolbo D 0 Wed Jun 3 18:47:12 2020
CMakutenas D 0 Wed Jun 3 18:47:12 2020
CMorcillo D 0 Wed Jun 3 18:47:11 2020
CSchandall D 0 Wed Jun 3 18:47:12 2020
CSelters D 0 Wed Jun 3 18:47:12 2020
CTolmie D 0 Wed Jun 3 18:47:12 2020
DCecere D 0 Wed Jun 3 18:47:12 2020
DChintalapalli D 0 Wed Jun 3 18:47:12 2020
DCwilich D 0 Wed Jun 3 18:47:12 2020
DGarbatiuc D 0 Wed Jun 3 18:47:12 2020
DKemesies D 0 Wed Jun 3 18:47:12 2020
DMatuka D 0 Wed Jun 3 18:47:12 2020
DMedeme D 0 Wed Jun 3 18:47:12 2020
DMeherek D 0 Wed Jun 3 18:47:12 2020
DMetych D 0 Wed Jun 3 18:47:12 2020
DPaskalev D 0 Wed Jun 3 18:47:12 2020
DPriporov D 0 Wed Jun 3 18:47:12 2020
DRusanovskaya D 0 Wed Jun 3 18:47:12 2020
DVellela D 0 Wed Jun 3 18:47:12 2020
DVogleson D 0 Wed Jun 3 18:47:12 2020
DZwinak D 0 Wed Jun 3 18:47:12 2020
EBoley D 0 Wed Jun 3 18:47:12 2020
EEulau D 0 Wed Jun 3 18:47:12 2020
EFeatherling D 0 Wed Jun 3 18:47:12 2020
EFrixione D 0 Wed Jun 3 18:47:12 2020
EJenorik D 0 Wed Jun 3 18:47:12 2020
EKmilanovic D 0 Wed Jun 3 18:47:12 2020
ElKatkowsky D 0 Wed Jun 3 18:47:12 2020
EmaCaratenuto D 0 Wed Jun 3 18:47:12 2020
EPalislamovic D 0 Wed Jun 3 18:47:12 2020
EPryar D 0 Wed Jun 3 18:47:12 2020
ESachhitello D 0 Wed Jun 3 18:47:12 2020
ESariotti D 0 Wed Jun 3 18:47:12 2020
ETurgano D 0 Wed Jun 3 18:47:12 2020
EWojtila D 0 Wed Jun 3 18:47:12 2020
FAlirezai D 0 Wed Jun 3 18:47:12 2020
FBaldwind D 0 Wed Jun 3 18:47:12 2020
FBroj D 0 Wed Jun 3 18:47:12 2020
FDeblaquire D 0 Wed Jun 3 18:47:12 2020
FDegeorgio D 0 Wed Jun 3 18:47:12 2020
FianLaginja D 0 Wed Jun 3 18:47:12 2020
FLasokowski D 0 Wed Jun 3 18:47:12 2020
FPflum D 0 Wed Jun 3 18:47:12 2020
FReffey D 0 Wed Jun 3 18:47:12 2020
GaBelithe D 0 Wed Jun 3 18:47:12 2020
Gareld D 0 Wed Jun 3 18:47:12 2020
GBatowski D 0 Wed Jun 3 18:47:12 2020
GForshalger D 0 Wed Jun 3 18:47:12 2020
GGomane D 0 Wed Jun 3 18:47:12 2020
GHisek D 0 Wed Jun 3 18:47:12 2020
GMaroufkhani D 0 Wed Jun 3 18:47:12 2020
GMerewether D 0 Wed Jun 3 18:47:12 2020
GQuinniey D 0 Wed Jun 3 18:47:12 2020
GRoswurm D 0 Wed Jun 3 18:47:12 2020
GWiegard D 0 Wed Jun 3 18:47:12 2020
HBlaziewske D 0 Wed Jun 3 18:47:12 2020
HColantino D 0 Wed Jun 3 18:47:12 2020
HConforto D 0 Wed Jun 3 18:47:12 2020
HCunnally D 0 Wed Jun 3 18:47:12 2020
HGougen D 0 Wed Jun 3 18:47:12 2020
HKostova D 0 Wed Jun 3 18:47:12 2020
IChristijr D 0 Wed Jun 3 18:47:12 2020
IKoledo D 0 Wed Jun 3 18:47:12 2020
IKotecky D 0 Wed Jun 3 18:47:12 2020
ISantosi D 0 Wed Jun 3 18:47:12 2020
JAngvall D 0 Wed Jun 3 18:47:12 2020
JBehmoiras D 0 Wed Jun 3 18:47:12 2020
JDanten D 0 Wed Jun 3 18:47:12 2020
JDjouka D 0 Wed Jun 3 18:47:12 2020
JKondziola D 0 Wed Jun 3 18:47:12 2020
JLeytushsenior D 0 Wed Jun 3 18:47:12 2020
JLuthner D 0 Wed Jun 3 18:47:12 2020
JMoorehendrickson D 0 Wed Jun 3 18:47:12 2020
JPistachio D 0 Wed Jun 3 18:47:12 2020
JScima D 0 Wed Jun 3 18:47:12 2020
JSebaali D 0 Wed Jun 3 18:47:12 2020
JShoenherr D 0 Wed Jun 3 18:47:12 2020
JShuselvt D 0 Wed Jun 3 18:47:12 2020
KAmavisca D 0 Wed Jun 3 18:47:12 2020
KAtolikian D 0 Wed Jun 3 18:47:12 2020
KBrokinn D 0 Wed Jun 3 18:47:12 2020
KCockeril D 0 Wed Jun 3 18:47:12 2020
KColtart D 0 Wed Jun 3 18:47:12 2020
KCyster D 0 Wed Jun 3 18:47:12 2020
KDorney D 0 Wed Jun 3 18:47:12 2020
KKoesno D 0 Wed Jun 3 18:47:12 2020
KLangfur D 0 Wed Jun 3 18:47:12 2020
KMahalik D 0 Wed Jun 3 18:47:12 2020
KMasloch D 0 Wed Jun 3 18:47:12 2020
KMibach D 0 Wed Jun 3 18:47:12 2020
KParvankova D 0 Wed Jun 3 18:47:12 2020
KPregnolato D 0 Wed Jun 3 18:47:12 2020
KRasmor D 0 Wed Jun 3 18:47:12 2020
KShievitz D 0 Wed Jun 3 18:47:12 2020
KSojdelius D 0 Wed Jun 3 18:47:12 2020
KTambourgi D 0 Wed Jun 3 18:47:12 2020
KVlahopoulos D 0 Wed Jun 3 18:47:12 2020
KZyballa D 0 Wed Jun 3 18:47:12 2020
LBajewsky D 0 Wed Jun 3 18:47:12 2020
LBaligand D 0 Wed Jun 3 18:47:12 2020
LBarhamand D 0 Wed Jun 3 18:47:12 2020
LBirer D 0 Wed Jun 3 18:47:12 2020
LBobelis D 0 Wed Jun 3 18:47:12 2020
LChippel D 0 Wed Jun 3 18:47:12 2020
LChoffin D 0 Wed Jun 3 18:47:12 2020
LCominelli D 0 Wed Jun 3 18:47:12 2020
LDruge D 0 Wed Jun 3 18:47:12 2020
LEzepek D 0 Wed Jun 3 18:47:12 2020
LHyungkim D 0 Wed Jun 3 18:47:12 2020
LKarabag D 0 Wed Jun 3 18:47:12 2020
LKirousis D 0 Wed Jun 3 18:47:12 2020
LKnade D 0 Wed Jun 3 18:47:12 2020
LKrioua D 0 Wed Jun 3 18:47:12 2020
LLefebvre D 0 Wed Jun 3 18:47:12 2020
LLoeradeavilez D 0 Wed Jun 3 18:47:12 2020
LMichoud D 0 Wed Jun 3 18:47:12 2020
LTindall D 0 Wed Jun 3 18:47:12 2020
LYturbe D 0 Wed Jun 3 18:47:12 2020
MArcynski D 0 Wed Jun 3 18:47:12 2020
MAthilakshmi D 0 Wed Jun 3 18:47:12 2020
MAttravanam D 0 Wed Jun 3 18:47:12 2020
MBrambini D 0 Wed Jun 3 18:47:12 2020
MHatziantoniou D 0 Wed Jun 3 18:47:12 2020
MHoerauf D 0 Wed Jun 3 18:47:12 2020
MKermarrec D 0 Wed Jun 3 18:47:12 2020
MKillberg D 0 Wed Jun 3 18:47:12 2020
MLapesh D 0 Wed Jun 3 18:47:12 2020
MMakhsous D 0 Wed Jun 3 18:47:12 2020
MMerezio D 0 Wed Jun 3 18:47:12 2020
MNaciri D 0 Wed Jun 3 18:47:12 2020
MShanmugarajah D 0 Wed Jun 3 18:47:12 2020
MSichkar D 0 Wed Jun 3 18:47:12 2020
MTemko D 0 Wed Jun 3 18:47:12 2020
MTipirneni D 0 Wed Jun 3 18:47:12 2020
MTonuri D 0 Wed Jun 3 18:47:12 2020
MVanarsdel D 0 Wed Jun 3 18:47:12 2020
NBellibas D 0 Wed Jun 3 18:47:12 2020
NDikoka D 0 Wed Jun 3 18:47:12 2020
NGenevro D 0 Wed Jun 3 18:47:12 2020
NGoddanti D 0 Wed Jun 3 18:47:12 2020
NMrdirk D 0 Wed Jun 3 18:47:12 2020
NPulido D 0 Wed Jun 3 18:47:12 2020
NRonges D 0 Wed Jun 3 18:47:12 2020
NSchepkie D 0 Wed Jun 3 18:47:12 2020
NVanpraet D 0 Wed Jun 3 18:47:12 2020
OBelghazi D 0 Wed Jun 3 18:47:12 2020
OBushey D 0 Wed Jun 3 18:47:12 2020
OHardybala D 0 Wed Jun 3 18:47:12 2020
OLunas D 0 Wed Jun 3 18:47:12 2020
ORbabka D 0 Wed Jun 3 18:47:12 2020
PBourrat D 0 Wed Jun 3 18:47:12 2020
PBozzelle D 0 Wed Jun 3 18:47:12 2020
PBranti D 0 Wed Jun 3 18:47:12 2020
PCapperella D 0 Wed Jun 3 18:47:12 2020
PCurtz D 0 Wed Jun 3 18:47:12 2020
PDoreste D 0 Wed Jun 3 18:47:12 2020
PGegnas D 0 Wed Jun 3 18:47:12 2020
PMasulla D 0 Wed Jun 3 18:47:12 2020
PMendlinger D 0 Wed Jun 3 18:47:12 2020
PParakat D 0 Wed Jun 3 18:47:12 2020
PProvencer D 0 Wed Jun 3 18:47:12 2020
PTesik D 0 Wed Jun 3 18:47:12 2020
PVinkovich D 0 Wed Jun 3 18:47:12 2020
PVirding D 0 Wed Jun 3 18:47:12 2020
PWeinkaus D 0 Wed Jun 3 18:47:12 2020
RBaliukonis D 0 Wed Jun 3 18:47:12 2020
RBochare D 0 Wed Jun 3 18:47:12 2020
RKrnjaic D 0 Wed Jun 3 18:47:12 2020
RNemnich D 0 Wed Jun 3 18:47:12 2020
RPoretsky D 0 Wed Jun 3 18:47:12 2020
RStuehringer D 0 Wed Jun 3 18:47:12 2020
RSzewczuga D 0 Wed Jun 3 18:47:12 2020
RVallandas D 0 Wed Jun 3 18:47:12 2020
RWeatherl D 0 Wed Jun 3 18:47:12 2020
RWissor D 0 Wed Jun 3 18:47:12 2020
SAbdulagatov D 0 Wed Jun 3 18:47:12 2020
SAjowi D 0 Wed Jun 3 18:47:12 2020
SAlguwaihes D 0 Wed Jun 3 18:47:12 2020
SBonaparte D 0 Wed Jun 3 18:47:12 2020
SBouzane D 0 Wed Jun 3 18:47:12 2020
SChatin D 0 Wed Jun 3 18:47:12 2020
SDellabitta D 0 Wed Jun 3 18:47:12 2020
SDhodapkar D 0 Wed Jun 3 18:47:12 2020
SEulert D 0 Wed Jun 3 18:47:12 2020
SFadrigalan D 0 Wed Jun 3 18:47:12 2020
SGolds D 0 Wed Jun 3 18:47:12 2020
SGrifasi D 0 Wed Jun 3 18:47:12 2020
SGtlinas D 0 Wed Jun 3 18:47:12 2020
SHauht D 0 Wed Jun 3 18:47:12 2020
SHederian D 0 Wed Jun 3 18:47:12 2020
SHelregel D 0 Wed Jun 3 18:47:12 2020
SKrulig D 0 Wed Jun 3 18:47:12 2020
SLewrie D 0 Wed Jun 3 18:47:12 2020
SMaskil D 0 Wed Jun 3 18:47:12 2020
Smocker D 0 Wed Jun 3 18:47:12 2020
SMoyta D 0 Wed Jun 3 18:47:12 2020
SRaustiala D 0 Wed Jun 3 18:47:12 2020
SReppond D 0 Wed Jun 3 18:47:12 2020
SSicliano D 0 Wed Jun 3 18:47:12 2020
SSilex D 0 Wed Jun 3 18:47:12 2020
SSolsbak D 0 Wed Jun 3 18:47:12 2020
STousignaut D 0 Wed Jun 3 18:47:12 2020
support D 0 Wed Jun 3 18:47:12 2020
svc_backup D 0 Wed Jun 3 18:47:12 2020
SWhyte D 0 Wed Jun 3 18:47:12 2020
SWynigear D 0 Wed Jun 3 18:47:12 2020
TAwaysheh D 0 Wed Jun 3 18:47:12 2020
TBadenbach D 0 Wed Jun 3 18:47:12 2020
TCaffo D 0 Wed Jun 3 18:47:12 2020
TCassalom D 0 Wed Jun 3 18:47:12 2020
TEiselt D 0 Wed Jun 3 18:47:12 2020
TFerencdo D 0 Wed Jun 3 18:47:12 2020
TGaleazza D 0 Wed Jun 3 18:47:12 2020
TKauten D 0 Wed Jun 3 18:47:12 2020
TKnupke D 0 Wed Jun 3 18:47:12 2020
TLintlop D 0 Wed Jun 3 18:47:12 2020
TMusselli D 0 Wed Jun 3 18:47:12 2020
TOust D 0 Wed Jun 3 18:47:12 2020
TSlupka D 0 Wed Jun 3 18:47:12 2020
TStausland D 0 Wed Jun 3 18:47:12 2020
TZumpella D 0 Wed Jun 3 18:47:12 2020
UCrofskey D 0 Wed Jun 3 18:47:12 2020
UMarylebone D 0 Wed Jun 3 18:47:12 2020
UPyrke D 0 Wed Jun 3 18:47:12 2020
VBublavy D 0 Wed Jun 3 18:47:12 2020
VButziger D 0 Wed Jun 3 18:47:12 2020
VFuscca D 0 Wed Jun 3 18:47:12 2020
VLitschauer D 0 Wed Jun 3 18:47:12 2020
VMamchuk D 0 Wed Jun 3 18:47:12 2020
VMarija D 0 Wed Jun 3 18:47:12 2020
VOlaosun D 0 Wed Jun 3 18:47:12 2020
VPapalouca D 0 Wed Jun 3 18:47:12 2020
WSaldat D 0 Wed Jun 3 18:47:12 2020
WVerzhbytska D 0 Wed Jun 3 18:47:12 2020
WZelazny D 0 Wed Jun 3 18:47:12 2020
XBemelen D 0 Wed Jun 3 18:47:12 2020
XDadant D 0 Wed Jun 3 18:47:12 2020
XDebes D 0 Wed Jun 3 18:47:12 2020
XKonegni D 0 Wed Jun 3 18:47:12 2020
XRykiel D 0 Wed Jun 3 18:47:12 2020
YBleasdale D 0 Wed Jun 3 18:47:12 2020
YHuftalin D 0 Wed Jun 3 18:47:12 2020
YKivlen D 0 Wed Jun 3 18:47:12 2020
YKozlicki D 0 Wed Jun 3 18:47:12 2020
YNyirenda D 0 Wed Jun 3 18:47:12 2020
YPredestin D 0 Wed Jun 3 18:47:12 2020
YSeturino D 0 Wed Jun 3 18:47:12 2020
YSkoropada D 0 Wed Jun 3 18:47:12 2020
YVonebers D 0 Wed Jun 3 18:47:12 2020
YZarpentine D 0 Wed Jun 3 18:47:12 2020
ZAlatti D 0 Wed Jun 3 18:47:12 2020
ZKrenselewski D 0 Wed Jun 3 18:47:12 2020
ZMalaab D 0 Wed Jun 3 18:47:12 2020
ZMiick D 0 Wed Jun 3 18:47:12 2020
ZScozzari D 0 Wed Jun 3 18:47:12 2020
ZTimofeeff D 0 Wed Jun 3 18:47:12 2020
ZWausik D 0 Wed Jun 3 18:47:12 2020
5102079 blocks of size 4096. 1693865 blocks availableThe //dc01.blackfield.local/profiles$ share, on the other hand, allows listing and there are a lot of directories with what appears to be usernames. This may imply that these are home directories of possible domain users
┌──(kali㉿kali)-[~/archive/htb/labs/blackfield]
└─$ mkdir -p smb/profiles$ ; cd smb/profiles$
┌──(kali㉿kali)-[~/…/labs/blackfield/smb/profiles$]
└─$ smbget --recursive smb://dc01.blackfield.local/profiles$
Password for [WORKGROUP\kali]:
Using domain: WORKGROUP, user: kali
Downloaded 0b in 35 secondsSince there are a lot of directories to go through, I will download the whole share to Kali
Interestingly, none of them contain data, indicated by 0b
┌──(kali㉿kali)-[~/…/labs/blackfield/smb/profiles$]
└─$ ls >> ../../users.txtWhile this is rather strange, the usernames in the directories may be enough to continue