HTB Dancing - Full

Technical Walkthrough

HTB Dancing - Full Walkthrough

Machine Information

• Name: Dancing
• IP: <TARGET>
• OS: Windows 10 / Server 2019 Build 17763 x64
• Difficulty: Very Easy (Starting Point - Tier 0)
• Category: SMB Misconfiguration

Enumeration

Step 1: Host Discovery & OS Identification

ping -c 2 <TARGET>

• Host is up, TTL=127 indicates Windows (default TTL 128, minus 1 hop)

Step 2: Port Scanning

Quick scan (default scripts + version detection):

nmap -sC -sV -oN nmap/initial <TARGET>

Results:

• 135/tcp - msrpc (Microsoft Windows RPC)
• 139/tcp - netbios-ssn
• 445/tcp - microsoft-ds (SMB)
• SMB signing enabled but not required
• Clock skew: +4h00m05s

Full port scan:

nmap -p<redacted> --min-rate 1000 -oN nmap/allports <TARGET>

Additional ports discovered:

• 5985/tcp - WS-Management (WinRM)
• 47001/tcp - WinRM
• 49664-49669/tcp - High RPC ports

Step 3: SMB Enumeration

Null session share listing:

smbclient -N -L //<TARGET>/

Shares found: ADMIN$, C$, IPC$, WorkShares

CrackMapExec enumeration with guest account:

crackmapexec smb <TARGET> --shares -u 'guest' -p ''

Results:

• Machine: DANCING
• Domain: Dancing
• WorkShares: READ, WRITE access with guest authentication
• ADMIN$ and C$: No access
• IPC$: READ access

Exploitation

Step 4: Accessing WorkShares

smbclient //<TARGET>/WorkShares -U '' -N

Browsing the share reveals two directories:

• Amy.J/ - contains worknotes.txt
• James.P/ - contains flag.txt

Step 5: Retrieving the Flag

smbclient //<TARGET>/WorkShares -U '' -N -c 'cd James.P; get flag.txt /tmp/flag.txt'
cat /tmp/flag.txt

FLAG: <hash redacted>

Bonus: worknotes.txt Contents

- start apache server on the linux machine
- secure the ftp server
- setup winrm on dancing

This hints at other machines in the Starting Point track and confirms WinRM is configured on this machine.

Vulnerability Explanation

What: SMB Share Misconfiguration

The "WorkShares" SMB share is configured to allow anonymous (null session) and guest access with both READ and WRITE permissions. This means anyone on the network can connect without credentials and access all files within the share.

Why It Works

Windows SMB can be configured to allow guest or anonymous access to specific shares. When shares contain sensitive data (like user files, credentials, or flags) and are accessible without authentication, it represents a critical security misconfiguration.

Impact

• Confidentiality: All files in the share are readable by anyone
• Integrity: Files can be modified or new files placed (WRITE access)
• Availability: Malicious files could be planted; legitimate files could be deleted

Remediation

1. Disable guest access to SMB shares
2. Require authentication for all share access
3. Apply principle of least privilege to share permissions
4. Enable SMB signing to prevent relay attacks
5. Audit share permissions regularly

Tools Used

Key Takeaways

1. Always enumerate SMB when ports 139/445 are open -- null sessions and guest access are common misconfigurations
2. CrackMapExec provides quick, structured SMB enumeration including share permissions
3. TTL-based OS fingerprinting is a fast way to identify the target OS (128=Windows, 64=Linux, 255=Solaris/FreeBSD)
4. Starting Point machines teach individual protocols -- Dancing focuses specifically on SMB
5. Check for anonymous access first before attempting brute-force or credential attacks

Flags

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Target: <TARGET> (DANCING)

Date: 2026-05-04

Attacker: Pwnbox (<TARGET>)

Machine Type: Windows 10 / Server 2019 Build 17763 x64

Phase 2: Vulnerability Analysis

Primary Vulnerability: Misconfigured SMB Share

• WorkShares share allows anonymous/guest READ+WRITE access
• Contains sensitive files including user flag
• No authentication required

Additional Attack Surface

• WinRM (port 5985) is open - could be used for remote management if credentials obtained
• SMB signing disabled - potential for relay attacks in domain environment

Phase 3: Exploitation

Attack Vector: Anonymous SMB Access

1. Connected to WorkShares using null session: smbclient //<TARGET>/WorkShares -U '' -N
2. Browsed directories: Amy.J and James.P
3. Downloaded flag.txt from James.P directory

Flag

<hash redacted>

Key Takeaways

• Always check for anonymous/guest SMB access
• CrackMapExec is excellent for quick SMB enumeration
• TTL values in ping responses quickly identify OS type
• Starting Point machines often have straightforward vulnerabilities focused on a single protocol

Notes

Target: <TARGET> (DANCING)

Date: 2026-05-04

Attacker: Pwnbox (<TARGET>)

Machine Type: Windows 10 / Server 2019 Build 17763 x64

Phase 1: Reconnaissance & Enumeration

Connectivity Check

• Target responds to ICMP ping
• TTL=127 confirms Windows OS (128 default - 1 hop)

Port Scan Results

Initial Scan (Top 1000 ports)

Full Port Scan (All 65535 ports)

SMB Enumeration

• Machine name: DANCING
• Domain: Dancing
• SMB Signing: False (disabled)
• SMBv1: False
• Guest authentication: ENABLED

Share Enumeration (via CrackMapExec with guest)

WorkShares Contents

WorkShares/
├── Amy.J/
│   └── worknotes.txt (94 bytes)
└── James.P/
    └── flag.txt (32 bytes)

worknotes.txt contents:

- start apache server on the linux machine
- secure the ftp server
- setup winrm on dancing

Phase 2: Vulnerability Analysis

Primary Vulnerability: Misconfigured SMB Share

• WorkShares share allows anonymous/guest READ+WRITE access
• Contains sensitive files including user flag
• No authentication required

Additional Attack Surface

• WinRM (port 5985) is open - could be used for remote management if credentials obtained
• SMB signing disabled - potential for relay attacks in domain environment

Phase 3: Exploitation

Attack Vector: Anonymous SMB Access

1. Connected to WorkShares using null session: smbclient //<TARGET>/WorkShares -U '' -N
2. Browsed directories: Amy.J and James.P
3. Downloaded flag.txt from James.P directory

Flag

<<secret redacted>>

Key Takeaways

• Always check for anonymous/guest SMB access
• CrackMapExec is excellent for quick SMB enumeration
• TTL values in ping responses quickly identify OS type
• Starting Point machines often have straightforward vulnerabilities focused on a single protocol