┌──(kali㉿kali)-[~] └─$ nmap -sV -sT -sC -o nmapinitial 10.10.10.103 Starting Nmap 7.92 ( https://nmap.org ) at2022-08-0800:57 EDT Nmap scan report for10.10.10.103 Host is up (0.29s latency). Not shown: 976 filtered tcp ports (no-response), 11 filtered tcp ports (host-unreach) PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd |_ftp-bounce: bounce working! |_ftp-anon: Anonymous FTP login allowed (FTP code 230) | ftp-syst: |_ SYST: Windows_NT 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-title: Site doesn't have a title (text/html). 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=sizzle.htb.local | Not valid before: 2018-07-03T17:58:55 |_Not valid after: 2020-07-02T17:58:55 |_ssl-date: 2022-08-08T05:03:56+00:00; -1s from scanner time. 443/tcp open ssl/http Microsoft IIS httpd 10.0 |_http-title: Site doesn't have a title (text/html). | ssl-cert: Subject: commonName=sizzle.htb.local | Not valid before: 2018-07-03T17:58:55 |_Not valid after: 2020-07-02T17:58:55 |_ssl-date: 2022-08-08T05:03:54+00:00; -1s from scanner time. | tls-alpn: | h2 |_ http/1.1 |_http-server-header: Microsoft-IIS/10.0 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=sizzle.htb.local | Not valid before: 2018-07-03T17:58:55 |_Not valid after: 2020-07-02T17:58:55 |_ssl-date: 2022-08-08T05:03:54+00:00; -1s from scanner time. 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name) |_ssl-date: 2022-08-08T05:03:54+00:00; -1s from scanner time. | ssl-cert: Subject: commonName=sizzle.htb.local | Not valid before: 2018-07-03T17:58:55 |_Not valid after: 2020-07-02T17:58:55 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: HTB.LOCAL, Site: Default-First-Site-Name) |_ssl-date: 2022-08-08T05:03:53+00:00; -1s from scanner time. | ssl-cert: Subject: commonName=sizzle.htb.local | Not valid before: 2018-07-03T17:58:55 |_Not valid after: 2020-07-02T17:58:55 Service Info: Host: SIZZLE; OS: Windows; CPE: cpe:/o:microsoft:windows
┌──(kali㉿kali)-[~] └─$ ftp 10.10.10.103 Connected to 10.10.10.103. 220 Microsoft FTP Service Name (10.10.10.103:kali): anonymous 331 Anonymous access allowed, send identity (e-mail name) as password. Password: 230 User logged in. Remote system typeis Windows_NT. ftp> dir 229 Entering Extended Passive Mode (|||62993|) 125 Data connection already open; Transfer starting. 226 Transfer complete.
$ smbclient -L \\10.10.10.103 Password for [WORKGROUP\kali]:
Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share CertEnroll Disk Active Directory Certificate Services share Department Shares Disk IPC$ IPC Remote IPC NETLOGON Disk Logon server share Operations Disk SYSVOL Disk Logon server share Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 10.10.10.103 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available
find ./ -type d will list all the directories in the current directory.
So for each directory, I’ll try to write a file in it. If that returns true (it writes), I’ll echo the dir name and then remove the file. I’ll do that same again but this time making a directory. I find two dirs I can write in:
So for each directory, I’ll try to write a file in it. If that returns true (it writes), I’ll echo the dir name and then remove the file. I’ll do that same again but this time making a directory. I find two dirs I can write in: