Nmap scan report for 172.16.152.11
Host is up (0.055s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT    STATE SERVICE       VERSION
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2.time:
|   date: 2024.06.25T10:45:43
|_  start_date: N/A
| smb2.security-mode:
|   3:1:1:
|_    Message signing enabled but not required
|_nbstat: NetBIOS name: FILES02, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:f7:cb (VMware)
|_clock-skew: 1s

Nmap scan report for 172.16.152.12
Host is up (0.063s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2024.06.25T10:46:22+00:00; +2s from scanner time.
| rdp-ntlm-info:
|   Target_Name: MEDTECH
|   NetBIOS_Domain_Name: MEDTECH
|   NetBIOS_Computer_Name: DEV04
|   DNS_Domain_Name: medtech.com
|   DNS_Computer_Name: DEV04.medtech.com
|   DNS_Tree_Name: medtech.com
|   Product_Version: 10.0.20348
|_  System_Time: 2024.06.25T10:45:42+00:00
| ssl-cert: Subject: commonName=DEV04.medtech.com
| Not valid before: 2024.04.16T20:19:52
|_Not valid after:  2024.10.16T20:19:52
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 1s, deviation: 0s, median: 1s
| smb2.security-mode:
|   3:1:1:
|_    Message signing enabled but not required
| smb2.time:
|   date: 2024.06.25T10:45:43
|_  start_date: N/A
|_nbstat: NetBIOS name: DEV04, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:7f:da (VMware)

Nmap scan report for 172.16.152.13
Host is up (0.064s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT    STATE SERVICE       VERSION
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2.security-mode:
|   3:1:1:
|_    Message signing enabled but not required
|_nbstat: NetBIOS name: PROD01, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:d1:c2 (VMware)
|_clock-skew: 1s
| smb2.time:
|   date: 2024.06.25T10:45:43
|_  start_date: N/A

Nmap scan report for 172.16.152.14
Host is up (0.052s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0.
| ssh-hostkey:
|   3072 eb:0e:77:7c:69:f2:4a:a5:65:2a:1c:ec:ec:6e:79:19 (RSA)
|_  256 5f:4f:29:47:7a:14:65:4d:bc:f3:74:40:a7:45:7e:94 (ED25519.
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Post-scan script results:
| clock-skew:
|   1s:
|     172.16.152.11
|     172.16.152.12
|_    172.16.152.13
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 4 IP addresses (4 hosts up) scanned in 66.73 seconds


Nmap scan report for 172.16.152.82
Host is up (0.064s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=CLIENT01.medtech.com
| Not valid before: 2024.04.16T21:31:12
|_Not valid after:  2024.10.16T21:31:12
| rdp-ntlm-info:
|   Target_Name: MEDTECH
|   NetBIOS_Domain_Name: MEDTECH
|   NetBIOS_Computer_Name: CLIENT01
|   DNS_Domain_Name: medtech.com
|   DNS_Computer_Name: CLIENT01.medtech.com
|   DNS_Tree_Name: medtech.com
|   Product_Version: 10.0.22000
|_  System_Time: 2024.06.25T10:54:27+00:00
|_ssl-date: 2024.06.25T10:55:07+00:00; +2s from scanner time.
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 1s, deviation: 0s, median: 1s
| smb2.security-mode:
|   3:1:1:
|_    Message signing enabled but not required
|_nbstat: NetBIOS name: CLIENT01, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:34:40 (VMware)
| smb2.time:
|   date: 2024.06.25T10:54:27
|_  start_date: N/A

Nmap scan report for 172.16.152.83
Host is up (0.064s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT    STATE SERVICE       VERSION
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_nbstat: NetBIOS name: CLIENT02, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:3f:90 (VMware)
|_clock-skew: 1s
| smb2.security-mode:
|   3:1:1:
|_    Message signing enabled but not required
| smb2.time:
|   date: 2024.06.25T10:54:27
|_  start_date: N/A

Post-scan script results:
| clock-skew:
|   1s:
|     172.16.152.82
|_    172.16.152.83
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 2 IP addresses (2 hosts up) scanned in 74.33 seconds



---smb----

➜  websrv crackmapexec smb 172.16.152.10.83 -u joe -d medtech.com -p "Flowers1" --shares
SMB         172.16.152.10   445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01. (domain:medtech.com) (signing:True) (SMBv1:False)
SMB         172.16.152.83   445    CLIENT02         [*] Windows 11 Build 22000 x64 (name:CLIENT02. (domain:medtech.com) (signing:False) (SMBv1:False)
SMB         172.16.152.12   445    DEV04            [*] Windows Server 2022 Build 20348 x64 (name:DEV04. (domain:medtech.com) (signing:False) (SMBv1:False)
SMB         172.16.152.11   445    FILES02          [*] Windows Server 2022 Build 20348 x64 (name:FILES02. (domain:medtech.com) (signing:False) (SMBv1:False)
SMB         172.16.152.82   445    CLIENT01         [*] Windows 11 Build 22000 x64 (name:CLIENT01. (domain:medtech.com) (signing:False) (SMBv1:False)
SMB         172.16.152.13   445    PROD01           [*] Windows Server 2022 Build 20348 x64 (name:PROD01. (domain:medtech.com) (signing:False) (SMBv1:False)
SMB         172.16.152.10   445    DC01             [+] medtech.com\joe:Flowers1
SMB         172.16.152.83   445    CLIENT02         [+] medtech.com\joe:Flowers1
SMB         172.16.152.12   445    DEV04            [+] medtech.com\joe:Flowers1
SMB         172.16.152.11   445    FILES02          [+] medtech.com\joe:Flowers1 (Pwn3d!)
SMB         172.16.152.12   445    DEV04            [+] Enumerated shares
SMB         172.16.152.12   445    DEV04            Share           Permissions     Remark
SMB         172.16.152.12   445    DEV04            -----           -----------     ------
SMB         172.16.152.12   445    DEV04            ADMIN$                          Remote Admin
SMB         172.16.152.12   445    DEV04            C$                              Default share
SMB         172.16.152.12   445    DEV04            IPC$            READ            Remote IPC
SMB         172.16.152.83   445    CLIENT02         [+] Enumerated shares
SMB         172.16.152.83   445    CLIENT02         Share           Permissions     Remark
SMB         172.16.152.83   445    CLIENT02         -----           -----------     ------
SMB         172.16.152.83   445    CLIENT02         ADMIN$                          Remote Admin
SMB         172.16.152.83   445    CLIENT02         C               READ      
SMB         172.16.152.83   445    CLIENT02         C$                              Default share
SMB         172.16.152.83   445    CLIENT02         IPC$            READ            Remote IPC
SMB         172.16.152.83   445    CLIENT02         Windows         READ      
SMB         172.16.152.10   445    DC01             [+] Enumerated shares
SMB         172.16.152.10   445    DC01             Share           Permissions     Remark
SMB         172.16.152.10   445    DC01             -----           -----------     ------
SMB         172.16.152.10   445    DC01             ADMIN$          READ            Remote Admin
SMB         172.16.152.10   445    DC01             C$              READ,WRITE      Default share
SMB         172.16.152.10   445    DC01             IPC$            READ            Remote IPC
SMB         172.16.152.10   445    DC01             NETLOGON        READ            Logon server share
SMB         172.16.152.10   445    DC01             SYSVOL          READ            Logon server share
SMB         172.16.152.82   445    CLIENT01         [+] medtech.com\joe:Flowers1
SMB         172.16.152.13   445    PROD01           [+] medtech.com\joe:Flowers1
SMB         172.16.152.82   445    CLIENT01         [+] Enumerated shares
SMB         172.16.152.82   445    CLIENT01         Share           Permissions     Remark
SMB         172.16.152.82   445    CLIENT01         -----           -----------     ------
SMB         172.16.152.82   445    CLIENT01         ADMIN$                          Remote Admin
SMB         172.16.152.82   445    CLIENT01         C$                              Default share
SMB         172.16.152.82   445    CLIENT01         IPC$            READ            Remote IPC
SMB         172.16.152.13   445    PROD01           [+] Enumerated shares
SMB         172.16.152.13   445    PROD01           Share           Permissions     Remark
SMB         172.16.152.13   445    PROD01           -----           -----------     ------
SMB         172.16.152.13   445    PROD01           ADMIN$                          Remote Admin
SMB         172.16.152.13   445    PROD01           C$                              Default share
SMB         172.16.152.13   445    PROD01           IPC$            READ            Remote IPC
SMB         172.16.152.11   445    FILES02          [+] Enumerated shares
SMB         172.16.152.11   445    FILES02          Share           Permissions     Remark
SMB         172.16.152.11   445    FILES02          -----           -----------     ------
SMB         172.16.152.11   445    FILES02          ADMIN$          READ,WRITE      Remote Admin
SMB         172.16.152.11   445    FILES02          C               READ,WRITE
SMB         172.16.152.11   445    FILES02          C$              READ,WRITE      Default share
SMB         172.16.152.11   445    FILES02          IPC$            READ            Remote IPC
SMB         172.16.152.11   445    FILES02          TEMP            READ,WRITE