Tactics escalates the SMB knowledge from Dancing into a full Windows compromise. Here the Administrator account has no password set on a Windows host — but rather than just browsing shares, the attack reaches the C$ administrative share directly and ultimately leverages SMB to read the flag from the Administrator's desktop. This machine reinforces why administrator-level SMB access is a complete system compromise on Windows.
| Skill | Why it matters |
|---|---|
| Enumerating SMB with smbmap | smbmap shows share permissions at a glance — faster than smbclient for initial recon |
| Accessing C$ administrative share | C$ gives full filesystem access when authenticated as admin — equivalent to local access |
| No-password Administrator on SMB | A Windows host with an empty admin password on SMB is a complete compromise |
| Navigating the Windows filesystem via SMB | Retrieving files from user desktops, AppData, and system paths via smbclient |
Classic Windows SMB fingerprint — ports 135, 139, 445. The OS is Windows 10 Pro. No other ports open, so SMB is the entire attack surface.
smbmap is faster than smbclient for getting an overview of shares and their permissions. Try the Administrator account with an empty password first.
What you're seeing: READ, WRITE access to both ADMIN$ and C$ as Administrator with no password. This is a full system compromise — C$ maps directly to the root of the C drive.
| smbmap | smbclient | |
|---|---|---|
| Primary use | Quick permission overview across all shares | Interactive file access inside a share |
| Best for | Initial recon — "what can I access?" | Browsing, downloading, uploading files |
| Recursive listing | smbmap -H host -u user -p pass -R | recurse ON then ls |
| Download all files | smbmap --download share/path | mget * after prompt OFF |
| Empty password | -p "" | --no-pass or -N |
With admin SMB write access, there are multiple paths to RCE without needing any additional vulnerability:
| Technique | Tool | Requirement |
|---|---|---|
| PsExec-style execution | impacket-psexec | Admin write to ADMIN$ or C$ |
| SMBExec | impacket-smbexec | Admin SMB access |
| WMIExec | impacket-wmiexec | Admin credentials + WMI enabled |
| Scheduled task creation | net use + schtasks | Write access to C$ |
| Service creation | sc.exe over SMB | Admin credentials |
Admin SMB access with no password is a complete Windows system compromise. C$ access equals physical access — every file, every credential store, every configuration is readable and writable.
| Concept | Real-world relevance |
|---|---|
| Empty admin password on SMB | Windows machines in workgroups or with default builds frequently have this — always test before brute-forcing |
| C$ is full disk access | SAM, SYSTEM, NTDS.dit — all credential stores are in reach via C$ with admin access |
| smbmap for speed | Gets permissions across all shares in one command — essential for fast triage |
| Admin access = multiple RCE paths | PsExec, SMBExec, WMIExec all work — pick the one that evades AV/EDR in the specific environment |