julle/oscp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a6375dde6925767545e58d73a335f2d5d631afcc
oscp/Labs/medtech/computers/172.16.152.0.md
T
julle 4cad18c2a5 first commit
2025-11-21 17:17:42 +01:00

10 KiB
Raw Blame History

Nmap scan report for 172.16.152.11 Host is up (0.055s latency). Not shown: 997 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results: | smb2.time: | date: 2024.06.25T10:45:43 |_ start_date: N/A | smb2.security-mode: | 3:1:1: |_ Message signing enabled but not required |_nbstat: NetBIOS name: FILES02, NetBIOS user: , NetBIOS MAC: 00:50:56:9e:f7:cb (VMware) |_clock-skew: 1s

Nmap scan report for 172.16.152.12 Host is up (0.063s latency). Not shown: 996 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 3389/tcp open ms-wbt-server Microsoft Terminal Services |ssl-date: 2024.06.25T10:46:22+00:00; +2s from scanner time. | rdp-ntlm-info: | Target_Name: MEDTECH | NetBIOS_Domain_Name: MEDTECH | NetBIOS_Computer_Name: DEV04 | DNS_Domain_Name: medtech.com | DNS_Computer_Name: DEV04.medtech.com | DNS_Tree_Name: medtech.com | Product_Version: 10.0.20348 | System_Time: 2024.06.25T10:45:42+00:00 | ssl-cert: Subject: commonName=DEV04.medtech.com | Not valid before: 2024.04.16T20:19:52 |_Not valid after: 2024.10.16T20:19:52 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results: |clock-skew: mean: 1s, deviation: 0s, median: 1s | smb2.security-mode: | 3:1:1: | Message signing enabled but not required | smb2.time: | date: 2024.06.25T10:45:43 |_ start_date: N/A |_nbstat: NetBIOS name: DEV04, NetBIOS user: , NetBIOS MAC: 00:50:56:9e:7f:da (VMware)

Nmap scan report for 172.16.152.13 Host is up (0.064s latency). Not shown: 997 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results: | smb2.security-mode: | 3:1:1: |_ Message signing enabled but not required |_nbstat: NetBIOS name: PROD01, NetBIOS user: , NetBIOS MAC: 00:50:56:9e:d1:c2 (VMware) |clock-skew: 1s | smb2.time: | date: 2024.06.25T10:45:43 | start_date: N/A

Nmap scan report for 172.16.152.14 Host is up (0.052s latency). Not shown: 999 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0. | ssh-hostkey: | 3072 eb:0e:77:7c:69:f2:4a:a5:65:2a:1c:ec:ec:6e:79:19 (RSA) |_ 256 5f:4f:29:47:7a:14:65:4d:bc:f3:74:40:a7:45:7e:94 (ED25519. Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Post-scan script results: | clock-skew: | 1s: | 172.16.152.11 | 172.16.152.12 |_ 172.16.152.13 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 4 IP addresses (4 hosts up) scanned in 66.73 seconds

Nmap scan report for 172.16.152.82 Host is up (0.064s latency). Not shown: 996 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 3389/tcp open ms-wbt-server Microsoft Terminal Services | ssl-cert: Subject: commonName=CLIENT01.medtech.com | Not valid before: 2024.04.16T21:31:12 |Not valid after: 2024.10.16T21:31:12 | rdp-ntlm-info: | Target_Name: MEDTECH | NetBIOS_Domain_Name: MEDTECH | NetBIOS_Computer_Name: CLIENT01 | DNS_Domain_Name: medtech.com | DNS_Computer_Name: CLIENT01.medtech.com | DNS_Tree_Name: medtech.com | Product_Version: 10.0.22000 | System_Time: 2024.06.25T10:54:27+00:00 |_ssl-date: 2024.06.25T10:55:07+00:00; +2s from scanner time. Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results: |clock-skew: mean: 1s, deviation: 0s, median: 1s | smb2.security-mode: | 3:1:1: | Message signing enabled but not required |nbstat: NetBIOS name: CLIENT01, NetBIOS user: , NetBIOS MAC: 00:50:56:9e:34:40 (VMware) | smb2.time: | date: 2024.06.25T10:54:27 | start_date: N/A

Nmap scan report for 172.16.152.83 Host is up (0.064s latency). Not shown: 997 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results: |nbstat: NetBIOS name: CLIENT02, NetBIOS user: , NetBIOS MAC: 00:50:56:9e:3f:90 (VMware) |clock-skew: 1s | smb2.security-mode: | 3:1:1: | Message signing enabled but not required | smb2.time: | date: 2024.06.25T10:54:27 | start_date: N/A

Post-scan script results: | clock-skew: | 1s: | 172.16.152.82 |_ 172.16.152.83 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 2 IP addresses (2 hosts up) scanned in 74.33 seconds

---smb----

➜ websrv crackmapexec smb 172.16.152.10.83 -u joe -d medtech.com -p "Flowers1" --shares SMB 172.16.152.10 445 DC01 [] Windows Server 2022 Build 20348 x64 (name:DC01. (domain:medtech.com) (signing:True) (SMBv1:False) SMB 172.16.152.83 445 CLIENT02 [] Windows 11 Build 22000 x64 (name:CLIENT02. (domain:medtech.com) (signing:False) (SMBv1:False) SMB 172.16.152.12 445 DEV04 [] Windows Server 2022 Build 20348 x64 (name:DEV04. (domain:medtech.com) (signing:False) (SMBv1:False) SMB 172.16.152.11 445 FILES02 [] Windows Server 2022 Build 20348 x64 (name:FILES02. (domain:medtech.com) (signing:False) (SMBv1:False) SMB 172.16.152.82 445 CLIENT01 [] Windows 11 Build 22000 x64 (name:CLIENT01. (domain:medtech.com) (signing:False) (SMBv1:False) SMB 172.16.152.13 445 PROD01 [] Windows Server 2022 Build 20348 x64 (name:PROD01. (domain:medtech.com) (signing:False) (SMBv1:False) SMB 172.16.152.10 445 DC01 [+] medtech.com\joe:Flowers1 SMB 172.16.152.83 445 CLIENT02 [+] medtech.com\joe:Flowers1 SMB 172.16.152.12 445 DEV04 [+] medtech.com\joe:Flowers1 SMB 172.16.152.11 445 FILES02 [+] medtech.com\joe:Flowers1 (Pwn3d!) SMB 172.16.152.12 445 DEV04 [+] Enumerated shares SMB 172.16.152.12 445 DEV04 Share Permissions Remark SMB 172.16.152.12 445 DEV04 ----- ----------- ------ SMB 172.16.152.12 445 DEV04 ADMIN$ Remote Admin SMB 172.16.152.12 445 DEV04 C$ Default share SMB 172.16.152.12 445 DEV04 IPC$ READ Remote IPC SMB 172.16.152.83 445 CLIENT02 [+] Enumerated shares SMB 172.16.152.83 445 CLIENT02 Share Permissions Remark SMB 172.16.152.83 445 CLIENT02 ----- ----------- ------ SMB 172.16.152.83 445 CLIENT02 ADMIN$ Remote Admin SMB 172.16.152.83 445 CLIENT02 C READ
SMB 172.16.152.83 445 CLIENT02 C$ Default share SMB 172.16.152.83 445 CLIENT02 IPC$ READ Remote IPC SMB 172.16.152.83 445 CLIENT02 Windows READ
SMB 172.16.152.10 445 DC01 [+] Enumerated shares SMB 172.16.152.10 445 DC01 Share Permissions Remark SMB 172.16.152.10 445 DC01 ----- ----------- ------ SMB 172.16.152.10 445 DC01 ADMIN$ READ Remote Admin SMB 172.16.152.10 445 DC01 C$ READ,WRITE Default share SMB 172.16.152.10 445 DC01 IPC$ READ Remote IPC SMB 172.16.152.10 445 DC01 NETLOGON READ Logon server share SMB 172.16.152.10 445 DC01 SYSVOL READ Logon server share SMB 172.16.152.82 445 CLIENT01 [+] medtech.com\joe:Flowers1 SMB 172.16.152.13 445 PROD01 [+] medtech.com\joe:Flowers1 SMB 172.16.152.82 445 CLIENT01 [+] Enumerated shares SMB 172.16.152.82 445 CLIENT01 Share Permissions Remark SMB 172.16.152.82 445 CLIENT01 ----- ----------- ------ SMB 172.16.152.82 445 CLIENT01 ADMIN$ Remote Admin SMB 172.16.152.82 445 CLIENT01 C$ Default share SMB 172.16.152.82 445 CLIENT01 IPC$ READ Remote IPC SMB 172.16.152.13 445 PROD01 [+] Enumerated shares SMB 172.16.152.13 445 PROD01 Share Permissions Remark SMB 172.16.152.13 445 PROD01 ----- ----------- ------ SMB 172.16.152.13 445 PROD01 ADMIN$ Remote Admin SMB 172.16.152.13 445 PROD01 C$ Default share SMB 172.16.152.13 445 PROD01 IPC$ READ Remote IPC SMB 172.16.152.11 445 FILES02 [+] Enumerated shares SMB 172.16.152.11 445 FILES02 Share Permissions Remark SMB 172.16.152.11 445 FILES02 ----- ----------- ------ SMB 172.16.152.11 445 FILES02 ADMIN$ READ,WRITE Remote Admin SMB 172.16.152.11 445 FILES02 C READ,WRITE SMB 172.16.152.11 445 FILES02 C$ READ,WRITE Default share SMB 172.16.152.11 445 FILES02 IPC$ READ Remote IPC SMB 172.16.152.11 445 FILES02 TEMP READ,WRITE

Reference in New Issue View Git Blame Copy Permalink