September 7, 2026
GREYBOX VAPT
Nessus Vulnerability Assessment & Controlled Exploitation
By Sourabh Jala
2 min read
1. Objective
The objective was to perform a greybox vulnerability assessment using Nessus, review the discovered findings, and validate the exploitable vulnerability in the authorized TryHackMe lab environment.
2. Assessment Methodology
Connect to the TryHackMe lab through the provided VPN or AttackBox.
Identify the target and configure an Advanced Scan in Nessus.
Allow the Nessus scan to complete and review the vulnerability findings.
Prioritize the finding with the highest reported CVSS score.
Validate the SMB finding by accessing the exposed share with a NULL/anonymous session.
Retrieve flag.txt from the accessible share and verify its contents.
Capture evidence screenshots for the assessment results.
3. Nessus Scan Result
The submitted Nessus evidence shows two principal findings: a HIGH-severity Microsoft Windows SMB Shares Unprivileged Access issue with a CVSS score of 7.5, and a MEDIUM-severity Browsable Web Directories issue with a CVSS score of 5.3. The highest CVSS score obtained was therefore 7.5.
4. Vulnerability Identified
Nessus reported the vulnerability as "Microsoft Windows SMB Shares Unprivileged Access." The scan output indicated that a share named confidential could be accessed using a NULL session and that flag.txt was present in the share. This directly provided the path for controlled validation.
5. Evidence from Nessus
The Nessus plugin output provided sufficient evidence to proceed with validation. In particular, the finding showed that the confidential share was readable and that flag.txt was available through the SMB service.
6. Controlled Exploitation / Validation
The vulnerability was validated by connecting to the exposed SMB share using smbclient with a NULL session. The evidence screenshot shows successful anonymous authentication, listing of the confidential share, identification of flag.txt, and retrieval of the file.
7. Flag Retrieval
After retrieving the file, the contents were verified as:
FLAG{NESSUS_CRITICAL_DATA_LEAK}
The same flag is visible in the submitted evidence and was also used to answer the corresponding TryHackMe question.
8. Final Assessment Results
9. Conclusion
The greybox VAPT exercise successfully identified and validated an SMB access-control weakness. Nessus reported a highest CVSS score of 7.5 for the Microsoft Windows SMB Shares Unprivileged Access finding. The vulnerability was then validated in the lab by accessing the exposed confidential share through an anonymous SMB session and retrieving flag.txt.
The exercise demonstrates the importance of restricting unauthenticated SMB access, reviewing share permissions, and preventing sensitive files from being exposed through network shares.
10. Security Recommendations
Disable anonymous or NULL-session access where it is not explicitly required.
Review SMB share and NTFS permissions using least-privilege principles.
Restrict access to sensitive shares to authenticated and authorized users only.
Audit exposed SMB services and unnecessary network exposure on TCP 445.
Perform periodic vulnerability scans and remediate HIGH-severity findings promptly.
Avoid storing sensitive or challenge-related files in broadly accessible shares.
11. Evidence Summary
The report includes the Nessus severity/CVSS evidence, the Nessus plugin output identifying the exposed SMB share, the SMB retrieval evidence, and the final flag evidence from the submitted lab screenshots. These visuals are reproduced from the source document and organized here into a clearer assessment narrative.