HTB - Tactics
OS: Windows Difficulty: Very Easy After Nmap Enumeration nmap -T4 --min-rate 5000 -p- -sC -sV -Pn 10.129.188.198 We get: └─# nmap -T4 --min-rate 5000 -p- -sV -sC -Pn 10.129.188.198 Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-14 16:11 -0400 Nmap scan report for 10.129.188.198 Host is up (0.23s latency). Not shown: 65532 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 135/tcp…
The target machine, identified as 10.129.188.198, runs the Windows operating system. By utilizing Nmap, the researcher discovered that ports 135, 139, and 445 are open. Port 445 suggests the presence of the Server Message Block (SMB) protocol.
To gain remote shell access over SMB, the researcher employed impacket-psexec, a tool provided by the Impacket package. This package includes several useful tools for interacting with Windows machines. Using impacket-psexec, remote commands could be executed on the target machine. Normally, valid credentials like usernames, passwords, or hash values are required for authentication. However, the researcher opted to test the Administrator account with an empty password, which was unexpectedly successful.
The ultimate goal of the operation was to locate the flag, which was reported to be on the Administrator user's Desktop. After gaining access, the researcher navigated to the Administrator Desktop directory and retrieved the flag.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
