VulnLab: Baby2

Today we are going to look at a medium box on VulnLab, Baby2. As usual we start off with a port scan:

Lets add the domain name to our /etc/hosts:

nxc smb 10.10.122.38

Checking for an null sessions we find that SMB allows for null:

We can see what we can read or read/write to with netexec (newest version of crackmapexec):

nxc smb 10.10.122.38 -u anonymous -p '' --shares

We get some usernames:

smbclient \\\\10.10.122.38\\homes

Lets put these users into …

active directory hacking pentesting vulnlab