InfoSec LAB

Timelapse_SMB

Created: 3 min read

SMB

Nmap discovered a Windows Directory server on the target port 139 and 445

┌──(kali㉿kali)-[~/archive/htb/labs/timelapse]
└─$ nmap --script smb-enum-shares -sV -p139,445 -Pn $IP
starting nmap 7.94 ( https://nmap.org ) at 2023-10-24 16:35 CEST
Nmap scan report for dc01 (10.10.11.152)
Host is up (0.13s latency).
 
PORT    STATE SERVICE       VERSION
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds?
service info: OS: Windows; CPE: cpe:/o:microsoft:windows
 
service detection performed. please report any incorrect results at https://nmap.org/submit/ .
nmap done: 1 IP address (1 host up) scanned in 31.80 seconds

Attempting to perform an additional Nmap scan to map the shares failed likely due to lack of privileges

Null Session

┌──(kali㉿kali)-[~/archive/htb/labs/timelapse]
└─$ smbclient -L //dc01.timelapse.htb/                           
Password for [WORKGROUP\kali]:
 
	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share 
	Shares          Disk      
	SYSVOL          Disk      Logon server share 
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to dc01.timelapse.htb failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

The target SMB server does allow anonymous access as I am able to list the shares There is the ADMIN$ share available as well as the none default Shares share.

//dc01.timelapse.htb/Shares

┌──(kali㉿kali)-[~/archive/htb/labs/timelapse]
└─$ smbclient //dc01.timelapse.htb/Shares
password for [workgroup\kali]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   d        0  mon oct 25 17:39:15 2021
  ..                                  d        0  mon oct 25 17:39:15 2021
  dev                                 d        0  mon oct 25 21:40:06 2021
  helpdesk                            d        0  mon oct 25 17:48:42 2021
 
		6367231 blocks of size 4096. 1238906 blocks available

Accessing the Shares share reveals 2 directories; Dev and HelpDesk

smb: \> ls Dev\
  .                                   d        0  mon oct 25 21:40:06 2021
  ..                                  d        0  mon oct 25 21:40:06 2021
  winrm_backup.zip                    a     2611  mon oct 25 17:46:42 2021
 
		6367231 blocks of size 4096. 1623198 blocks available

The Dev directory contains a backup archive; winrm_backup.zip

smb: \> ls HelpDesk\
  .                                   d        0  mon oct 25 17:48:42 2021
  ..                                  d        0  mon oct 25 17:48:42 2021
  laps.x64.msi                        a  1118208  mon oct 25 16:57:50 2021
  laps_datasheet.docx                 a   104422  mon oct 25 16:57:46 2021
  laps_operationsguide.docx           a   641378  mon oct 25 16:57:40 2021
  laps_technicalspecification.docx      a    72683  mon oct 25 16:57:44 2021
 
		6367231 blocks of size 4096. 1623198 blocks available

the helpdesk directory contains multiple files regarding laps

┌──(kali㉿kali)-[~/…/htb/labs/timelapse/smb]
└─$ smbget -r smb://dc01.timelapse.htb/Shares        
password for [kali] connecting to //dc01.timelapse.htb/shares: 
Using workgroup WORKGROUP, user kali
smb://dc01.timelapse.htb/Shares/Dev/winrm_backup.zip                                                                                    
smb://dc01.timelapse.htb/Shares/HelpDesk/LAPS.x64.msi                                                                                   
smb://dc01.timelapse.htb/Shares/HelpDesk/LAPS_Datasheet.docx                                                                            
smb://dc01.timelapse.htb/Shares/HelpDesk/LAPS_OperationsGuide.docx                                                                      
smb://dc01.timelapse.htb/Shares/HelpDesk/LAPS_TechnicalSpecification.docx                                                               
Downloaded 1.85MB in 18 seconds

I will download the entire share to Kali for further analysis

Interactive Graph View

Backlinks