HTB - Tactics

OS: Windows
Difficulty: Very Easy

After Nmap Enumeration
nmap -T4 --min-rate 5000 -p- -sC -sV -Pn 10.129.188.198

We get:

└─# nmap -T4 --min-rate 5000 -p- -sV -sC -Pn 10.129.188.198 
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-14 16:11 -0400
Nmap scan report for 10.129.188.198
Host is up (0.23s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT    STATE SERVICE       VERSION
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: -26s
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2026-09-14T20:12:21
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 88.82 seconds

We can see that port 445 is open, which indicates that the target is running the SMB (Server Message Block) protocol.

One way to obtain remote shell access over SMB is by using impacket-psexec.

To use impacket-psexec, we first need to install Impacket:

sudo apt update
sudo apt install impacket-scripts

This package provides access to several useful Impacket tools, not just impacket-psexec, which can be useful when attacking or interacting with Windows machines.

impacket-psexec allows us to execute commands remotely on a Windows machine over SMB. Normally, we need valid credentials, such as a username and password or an LM:NT hash, to authenticate to the target. However, for this particular machine, I decided to first test whether the Administrator account could be accessed with an empty password.

Surprisingly, it worked.

Since HTB asked me to find the flag located on the Administrator user’s Desktop, I simply navigated to the Administrator Desktop directory and read the flag.