【HackTheBox】dancing（SMB）

Let's talk about stepping on the pit
openvpn file name .ovpn
Open with this command vpn
The result is

Cannot be opened , Straight out

Or it's a dead cycle , Keep waiting

It took about an hour , Keep trying

Last , yes tcp Switch to udp, It's solved

1、SMB What does that mean? ?

Server Message Block – SMB, Is a file sharing protocol . When the original document is in your A On the computer , And you want to use your mobile phone under the LAN 、iPad Or another computer to access A This file on your computer , You may need to use SMB share .

Server Message Block

2、SMB What port to use for operation ?


TCP port 139 yes NETBIOS Upper SMB. NETBIOS Is a transport layer protocol , It aims to use the Internet to Windows Used in the operating system .
TCP 445 Is based on IP Of SMB. This is a newer version , Can be in IP Normal use on the network SMB.

445

3、 stay Nmap Ports that appear in the scan 445 What is the name of your service ?

microsoft-ds

4、SMB Tools can be used “ List ” Shared content “ sign ” or “ switch ” What is it? ?

stay linux in , You can use the command line tool smbclient Connect ,smbclient Will try to connect to the remote host , And check if any authentication is required

Use -L The command displays the resources shared by the server
-L

smbclient -L 10.129.193.22

This one is really stupid , I tried for a long time , Maybe the target host is not very stable
smbclient -L=10.129.193.22 I tried this

The other three are shared by default , You can use your own physical machine to input commands net share You know the

All we care about WorkShares This

5、 If the password is empty , What is the name of the share we can eventually access ?

because s ending , I just tried the one above sharename
WorkShares

So we get ,WorkShares You don't need a password

Connect the shared file
smbclient \\\\10.129.193.22\\WorkShares

In the same way, it can be connected to other
smbclient \\\\10.129.193.22\\C$

Finally connected

worknotes.txt It's not ours flag
Look at another directory , There are flag.txt
Direct use more You can see flag 了

6、 We can do it in SMB shell What commands are used in to download the files we find ?

get