This is a simple walkthrough for completing the Dancing target machine in Hackthebox.com.
Task 1
Question: What does the 3-letter acronym SMB stand for?
Answer: Server Message Block
![](https://carlosrecruits.com/wp-content/uploads/2024/02/adytize-cyber-security-training-0366-1024x768-1.webp)
Task 2
Question: What port does SMB use to operate at?
Answer: 445
![](https://carlosrecruits.com/wp-content/uploads/2024/02/adytize-cyber-security-training-0367-1024x768-1.webp)
Task 3
Question: What network communication model does SMB use, architecturally speaking?
Answer: Client-Server Model
![](https://carlosrecruits.com/wp-content/uploads/2024/02/adytize-cyber-security-training-0368-1024x768-1.webp)
Task 4
Question: What is the service name for port 445 that came up in our nmap scan?
Answer: microsoft-ds
![](https://carlosrecruits.com/wp-content/uploads/2024/02/adytize-cyber-security-training-0360-1024x768-1.webp)
Task 5
Question: What is the tool we use to connect to SMB shares from our Linux distribution?
Answer: smbclient
![](https://carlosrecruits.com/wp-content/uploads/2024/02/adytize-cyber-security-training-0369-1024x768-1.webp)
Task 6
Question: What is the ‘flag’ or ‘switch’ we can use with the SMB tool to ‘list’ the contents of the share?
Answer: -L
![](https://carlosrecruits.com/wp-content/uploads/2024/02/adytize-cyber-security-training-0362-1024x768-1.webp)
Task 7
Question: What is the name of the share we are able to access in the end?
Answer: workshares
![](https://carlosrecruits.com/wp-content/uploads/2024/02/adytize-cyber-security-training-0361-1024x768-1.webp)
Task 8
Question: What is the command we can use within the SMB shell to download the files we find?
Answer: get
![](https://carlosrecruits.com/wp-content/uploads/2024/02/adytize-cyber-security-training-0370-1024x768-1.webp)
Task 9
Submit Flag
Since we already know we can connect to this SMB share through port 445, lets try to access the shares. The first thing we can do is to go through each share to see if any of them are available without a password by just pressing the ‘ENTER’ key on your keyboard when prompted to enter a password.
![](https://carlosrecruits.com/wp-content/uploads/2024/02/adytize-cyber-security-training-0363-1024x768-1.webp)
As you can see from the screenshot above, the share named workshares gives us access to the contents without a password. In this share, there are two directories that stand out, which include Amy.J and James.P.
You can search these files with the ls command to show their content inside the directory. To navigate inside the folder, use the cd command as shown in the screenshot below.
![](https://carlosrecruits.com/wp-content/uploads/2024/02/adytize-cyber-security-training-0364-1024x768-1-copy.webp)
To download the file, use the get command followed by the file name as shown below.
![](https://carlosrecruits.com/wp-content/uploads/2024/02/adytize-cyber-security-training-0365-1024x768-1.webp)
The flag.txt file will be downloaded to your home folder.
SMBCLIENT Commands
smb: \> h ls dir lcd cd pwd get mget put mput rename more mask del rm mkdir md rmdir rd prompt recurse translate lowercase print printmode queue cancel stat quit q exit newer archive tar blocksize tarmode setmode help ? ! smb: \>
CarlosRecruits.com is an independent recruitment website launched in 2023 on a mission to match impactful people with meaningful organizations
Hi! My name is Carlos and I’ve been working in tech for the past 9 years.
I built this website to share my passion for recruitment and tech.
Clicking the heart tells me what you enjoy reading. Social sharing is appreciated (and always noticed).
That’s it. That is my pitch for you to stick around (or browse the site as you please).
If you want to get in contact with me, reach out to me via my socials 🙂
![](https://carlosrecruits.com/wp-content/uploads/2024/03/signed.webp)