HTB - Tactics
OS: Windows Difficulty: Very Easy After Nmap Enumeration nmap -T4 —min-rate 5000 -p- -sC -sV -Pn 10.129.188.198 We get: └─# nmap -T4 —min-rate 5000 -p- -sV -sC -Pn 10.129.188.198 Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-14 16:11 -0400 Nmap scan report for 10.129.188.198 Host is up (0.23s latency). Not shown: 65532 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |clock-skew: -26s | smb2-security-mode: | 3.1.1: | Message signing enabled but not required | smb2-time: | date: 2026-09-14T20:12:21 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 88.82 seconds We can see that port 445 is open, which indicates that the target is running the SMB (Server Message Block) protocol. One way to obtain remote shell access over SMB is by using impacket-psexec. To use impacket-psexec, we first need to install Impacket: sudo apt update sudo apt install impacket-scripts This package provides access to several useful Impacket tools, not just impacket-psexec, which can be useful when attacking or interacting with Windows machines. impacket-psexec allows us to execute commands remotely on a Windows machine over SMB. Normally, we need valid credentials, such as a username and password or an LM:NT hash, to authenticate to the target. However, for this particular machine, I decided to first test whether the Administrator account could be accessed with an empty password. Surprisingly, it worked. Since HTB asked me to find the flag located on the Administrator user’s Desktop, I simply navigated to the Administrator Desktop directory and read the flag.