first commit
This commit is contained in:
@@ -0,0 +1,210 @@
|
||||
Nmap scan report for 172.16.152.11
|
||||
Host is up (0.055s latency).
|
||||
Not shown: 997 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
445/tcp open microsoft-ds?
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:45:43
|
||||
|_ start_date: N/A
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled but not required
|
||||
|_nbstat: NetBIOS name: FILES02, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:f7:cb (VMware)
|
||||
|_clock-skew: 1s
|
||||
|
||||
Nmap scan report for 172.16.152.12
|
||||
Host is up (0.063s latency).
|
||||
Not shown: 996 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
445/tcp open microsoft-ds?
|
||||
3389/tcp open ms-wbt-server Microsoft Terminal Services
|
||||
|_ssl-date: 2024.06.25T10:46:22+00:00; +2s from scanner time.
|
||||
| rdp-ntlm-info:
|
||||
| Target_Name: MEDTECH
|
||||
| NetBIOS_Domain_Name: MEDTECH
|
||||
| NetBIOS_Computer_Name: DEV04
|
||||
| DNS_Domain_Name: medtech.com
|
||||
| DNS_Computer_Name: DEV04.medtech.com
|
||||
| DNS_Tree_Name: medtech.com
|
||||
| Product_Version: 10.0.20348
|
||||
|_ System_Time: 2024.06.25T10:45:42+00:00
|
||||
| ssl-cert: Subject: commonName=DEV04.medtech.com
|
||||
| Not valid before: 2024.04.16T20:19:52
|
||||
|_Not valid after: 2024.10.16T20:19:52
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
|_clock-skew: mean: 1s, deviation: 0s, median: 1s
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled but not required
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:45:43
|
||||
|_ start_date: N/A
|
||||
|_nbstat: NetBIOS name: DEV04, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:7f:da (VMware)
|
||||
|
||||
Nmap scan report for 172.16.152.13
|
||||
Host is up (0.064s latency).
|
||||
Not shown: 997 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
445/tcp open microsoft-ds?
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled but not required
|
||||
|_nbstat: NetBIOS name: PROD01, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:d1:c2 (VMware)
|
||||
|_clock-skew: 1s
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:45:43
|
||||
|_ start_date: N/A
|
||||
|
||||
Nmap scan report for 172.16.152.14
|
||||
Host is up (0.052s latency).
|
||||
Not shown: 999 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0.
|
||||
| ssh-hostkey:
|
||||
| 3072 eb:0e:77:7c:69:f2:4a:a5:65:2a:1c:ec:ec:6e:79:19 (RSA)
|
||||
|_ 256 5f:4f:29:47:7a:14:65:4d:bc:f3:74:40:a7:45:7e:94 (ED25519.
|
||||
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
|
||||
|
||||
Post-scan script results:
|
||||
| clock-skew:
|
||||
| 1s:
|
||||
| 172.16.152.11
|
||||
| 172.16.152.12
|
||||
|_ 172.16.152.13
|
||||
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
|
||||
Nmap done: 4 IP addresses (4 hosts up) scanned in 66.73 seconds
|
||||
|
||||
|
||||
Nmap scan report for 172.16.152.82
|
||||
Host is up (0.064s latency).
|
||||
Not shown: 996 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
445/tcp open microsoft-ds?
|
||||
3389/tcp open ms-wbt-server Microsoft Terminal Services
|
||||
| ssl-cert: Subject: commonName=CLIENT01.medtech.com
|
||||
| Not valid before: 2024.04.16T21:31:12
|
||||
|_Not valid after: 2024.10.16T21:31:12
|
||||
| rdp-ntlm-info:
|
||||
| Target_Name: MEDTECH
|
||||
| NetBIOS_Domain_Name: MEDTECH
|
||||
| NetBIOS_Computer_Name: CLIENT01
|
||||
| DNS_Domain_Name: medtech.com
|
||||
| DNS_Computer_Name: CLIENT01.medtech.com
|
||||
| DNS_Tree_Name: medtech.com
|
||||
| Product_Version: 10.0.22000
|
||||
|_ System_Time: 2024.06.25T10:54:27+00:00
|
||||
|_ssl-date: 2024.06.25T10:55:07+00:00; +2s from scanner time.
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
|_clock-skew: mean: 1s, deviation: 0s, median: 1s
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled but not required
|
||||
|_nbstat: NetBIOS name: CLIENT01, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:34:40 (VMware)
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:54:27
|
||||
|_ start_date: N/A
|
||||
|
||||
Nmap scan report for 172.16.152.83
|
||||
Host is up (0.064s latency).
|
||||
Not shown: 997 filtered tcp ports (no-response)
|
||||
PORT STATE SERVICE VERSION
|
||||
135/tcp open msrpc Microsoft Windows RPC
|
||||
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
|
||||
445/tcp open microsoft-ds?
|
||||
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
|
||||
|
||||
Host script results:
|
||||
|_nbstat: NetBIOS name: CLIENT02, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:9e:3f:90 (VMware)
|
||||
|_clock-skew: 1s
|
||||
| smb2.security-mode:
|
||||
| 3:1:1:
|
||||
|_ Message signing enabled but not required
|
||||
| smb2.time:
|
||||
| date: 2024.06.25T10:54:27
|
||||
|_ start_date: N/A
|
||||
|
||||
Post-scan script results:
|
||||
| clock-skew:
|
||||
| 1s:
|
||||
| 172.16.152.82
|
||||
|_ 172.16.152.83
|
||||
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
|
||||
Nmap done: 2 IP addresses (2 hosts up) scanned in 74.33 seconds
|
||||
|
||||
|
||||
|
||||
---smb----
|
||||
|
||||
➜ websrv crackmapexec smb 172.16.152.10.83 -u joe -d medtech.com -p "Flowers1" --shares
|
||||
SMB 172.16.152.10 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01. (domain:medtech.com) (signing:True) (SMBv1:False)
|
||||
SMB 172.16.152.83 445 CLIENT02 [*] Windows 11 Build 22000 x64 (name:CLIENT02. (domain:medtech.com) (signing:False) (SMBv1:False)
|
||||
SMB 172.16.152.12 445 DEV04 [*] Windows Server 2022 Build 20348 x64 (name:DEV04. (domain:medtech.com) (signing:False) (SMBv1:False)
|
||||
SMB 172.16.152.11 445 FILES02 [*] Windows Server 2022 Build 20348 x64 (name:FILES02. (domain:medtech.com) (signing:False) (SMBv1:False)
|
||||
SMB 172.16.152.82 445 CLIENT01 [*] Windows 11 Build 22000 x64 (name:CLIENT01. (domain:medtech.com) (signing:False) (SMBv1:False)
|
||||
SMB 172.16.152.13 445 PROD01 [*] Windows Server 2022 Build 20348 x64 (name:PROD01. (domain:medtech.com) (signing:False) (SMBv1:False)
|
||||
SMB 172.16.152.10 445 DC01 [+] medtech.com\joe:Flowers1
|
||||
SMB 172.16.152.83 445 CLIENT02 [+] medtech.com\joe:Flowers1
|
||||
SMB 172.16.152.12 445 DEV04 [+] medtech.com\joe:Flowers1
|
||||
SMB 172.16.152.11 445 FILES02 [+] medtech.com\joe:Flowers1 (Pwn3d!)
|
||||
SMB 172.16.152.12 445 DEV04 [+] Enumerated shares
|
||||
SMB 172.16.152.12 445 DEV04 Share Permissions Remark
|
||||
SMB 172.16.152.12 445 DEV04 ----- ----------- ------
|
||||
SMB 172.16.152.12 445 DEV04 ADMIN$ Remote Admin
|
||||
SMB 172.16.152.12 445 DEV04 C$ Default share
|
||||
SMB 172.16.152.12 445 DEV04 IPC$ READ Remote IPC
|
||||
SMB 172.16.152.83 445 CLIENT02 [+] Enumerated shares
|
||||
SMB 172.16.152.83 445 CLIENT02 Share Permissions Remark
|
||||
SMB 172.16.152.83 445 CLIENT02 ----- ----------- ------
|
||||
SMB 172.16.152.83 445 CLIENT02 ADMIN$ Remote Admin
|
||||
SMB 172.16.152.83 445 CLIENT02 C READ
|
||||
SMB 172.16.152.83 445 CLIENT02 C$ Default share
|
||||
SMB 172.16.152.83 445 CLIENT02 IPC$ READ Remote IPC
|
||||
SMB 172.16.152.83 445 CLIENT02 Windows READ
|
||||
SMB 172.16.152.10 445 DC01 [+] Enumerated shares
|
||||
SMB 172.16.152.10 445 DC01 Share Permissions Remark
|
||||
SMB 172.16.152.10 445 DC01 ----- ----------- ------
|
||||
SMB 172.16.152.10 445 DC01 ADMIN$ READ Remote Admin
|
||||
SMB 172.16.152.10 445 DC01 C$ READ,WRITE Default share
|
||||
SMB 172.16.152.10 445 DC01 IPC$ READ Remote IPC
|
||||
SMB 172.16.152.10 445 DC01 NETLOGON READ Logon server share
|
||||
SMB 172.16.152.10 445 DC01 SYSVOL READ Logon server share
|
||||
SMB 172.16.152.82 445 CLIENT01 [+] medtech.com\joe:Flowers1
|
||||
SMB 172.16.152.13 445 PROD01 [+] medtech.com\joe:Flowers1
|
||||
SMB 172.16.152.82 445 CLIENT01 [+] Enumerated shares
|
||||
SMB 172.16.152.82 445 CLIENT01 Share Permissions Remark
|
||||
SMB 172.16.152.82 445 CLIENT01 ----- ----------- ------
|
||||
SMB 172.16.152.82 445 CLIENT01 ADMIN$ Remote Admin
|
||||
SMB 172.16.152.82 445 CLIENT01 C$ Default share
|
||||
SMB 172.16.152.82 445 CLIENT01 IPC$ READ Remote IPC
|
||||
SMB 172.16.152.13 445 PROD01 [+] Enumerated shares
|
||||
SMB 172.16.152.13 445 PROD01 Share Permissions Remark
|
||||
SMB 172.16.152.13 445 PROD01 ----- ----------- ------
|
||||
SMB 172.16.152.13 445 PROD01 ADMIN$ Remote Admin
|
||||
SMB 172.16.152.13 445 PROD01 C$ Default share
|
||||
SMB 172.16.152.13 445 PROD01 IPC$ READ Remote IPC
|
||||
SMB 172.16.152.11 445 FILES02 [+] Enumerated shares
|
||||
SMB 172.16.152.11 445 FILES02 Share Permissions Remark
|
||||
SMB 172.16.152.11 445 FILES02 ----- ----------- ------
|
||||
SMB 172.16.152.11 445 FILES02 ADMIN$ READ,WRITE Remote Admin
|
||||
SMB 172.16.152.11 445 FILES02 C READ,WRITE
|
||||
SMB 172.16.152.11 445 FILES02 C$ READ,WRITE Default share
|
||||
SMB 172.16.152.11 445 FILES02 IPC$ READ Remote IPC
|
||||
SMB 172.16.152.11 445 FILES02 TEMP READ,WRITE
|
||||
Reference in New Issue
Block a user