Summary
AllSignsPoint2Pwnage is a Windows-based room on TryHackMe that requires the user to enumerate open SMB shares and upload a webshell to get an initial foothold on the target. After that one can find higher-level credentials on the target which can be leveraged to gain an administrator shell and gradually extract the admin flag. This room is great for anyone who’s venturing into Windows pentesting and needs practical experience dealing with vulnerable systems. 0x00: Enumeration
- Started with running a TCP Scan on the target via Nmap. nmap -sC -sV -p- 10.48.128.241 Nmap scan report for 10.48.128.241 Host is up (0.039s latency). PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-syst: |_ SYST: Windows_NT | ftp-anon: Anonymous FTP login allowed (FTP code 230) |11-14-20 04:26PM 173 notice.txt 80/tcp open http Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.11) | http-methods: | Potentially risky methods: TRACE |_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 |_http-title: Simple Slide Show 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 443/tcp open ssl/http Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.11) |_http-title: Simple Slide Show |ssl-date: TLS randomness does not represent time |http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11 | ssl-cert: Subject: commonName=localhost | Not valid before: 2009-11-10T23:48:47 |Not valid after: 2019-11-08T23:48:47 | http-methods: | Potentially risky methods: TRACE | tls-alpn: | http/1.1 445/tcp open microsoft-ds? 3389/tcp open ms-wbt-server Microsoft Terminal Services | ssl-cert: Subject: commonName=DESKTOP-997GG7D | Not valid before: 2026-07-08T06:13:45 |Not valid after: 2027-01-07T06:13:45 |ssl-date: 2026-07-09T06:17:29+00:00; +2s from scanner time. | rdp-ntlm-info: | Target_Name: DESKTOP-997GG7D | NetBIOS_Domain_Name: DESKTOP-997GG7D | NetBIOS_Computer_Name: DESKTOP-997GG7D | DNS_Domain_Name: DESKTOP-997GG7D | DNS_Computer_Name: DESKTOP-997GG7D | Product_Version: 10.0.18362 | System_Time: 2026-07-09T06:17:20+00:00 5900/tcp open vnc VNC (protocol 3.8) | vnc-info: | Protocol version: 3.8 | Security types: | Ultra (17) | VNC Authentication (2) Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: | Message signing enabled but not required |clock-skew: mean: 1s, deviation: 0s, median: 0s | smb2-time: | date: 2026-07-09T06:17:22 | start_date: N/A
- As revealed in the scan output, the target had open FTP and SMB services running. It also had VNC running on port 5900, which is a tool used to remotely control a computer. The target also had an Apache web server running on port 80.
- I visited the webpage and saw a slideshow of several random images.
- I checked the page source and found the following JavaScript code.
- The code here revealed the /content.php file and the/images/ endpoint. - I visited the /images directory and found the following images that were running on the slideshow.
- Next, I moved to FTP enumeration. I got access to the FTP directory because anonymous login was enabled.
- There was a notice.txt file.
- There was a message left in notice.txt written as follows.
- It mentioned that the images FTP directory was moved to a Windows file share, which more probably than not referred to SMB shares. - Next, I moved on to SMB enumeration. 0x01: SMB Enumeration
- I used smbclient to list the available shares on the target.
- Here I could see several custom shares such as images andUsers . - I first checked the images share and found the following images as I had seen in the/images directory on the webpage. I wondered if we could upload a webshell here and gain an initial foothold.
- I got the PHP reverse shell from PentestMonkey, configured it with my custom IP address and port, and uploaded it to theimages SMB share.
- I navigated to the /images endpoint on the webpage and tried running the webshell but it immediately got flagged by Windows Defender and was deleted. - Next, I tried using a different webshell which executed commands and took the input via GET-based parameters.
- I uploaded the shell again to the SMB images share and it worked like a charm! 0x02: Web Shell - I was logged in as the sign user. I looked for theuser flag in thesign user directory. - The user flag was found in the user_flag.txt file. - Next, I checked out the Installs share inC:\ directory. - The following files were found in the directory. - There were a lot of interesting files to check out here. I viewed the contents of every file, starting with Install Guide.txt . - I couldn’t figure out how these instructions could be of any use to me, so I moved on to other files. - I checked the Install_www_and_deploy.bat script and found the following code. - This seemed like a batch script that was running the infamous PsExec tool by Impacket, authenticating with administrator credentials. Here, I could view the admin password in cleartext, which could be used to gain a high-privilege shell to the target. - I used Impacket’s WMIExec tool to get a shell on the target. I could have used PsExec, but considering Windows Defender was running on the target, it would have been easily flagged. impacket-wmiexec Administrator:RCYCc3GIjM0v98HDVJ1KOuUm4xsWUxqZabeofbbpAss9KCKpYfs2rCi@10.48.186.208 0x03: Admin Shell - I also had to find the sign user’s password as per the objectives stated in the room. It took me quite a few lookups on Google till I eventually found a way to get the password from the Windows Registry. reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword - I was able to fetch the user's password from the Winlogon registry key. - Next, I had to find the VNC password. My first instinct was to return to the Installs share as before and look through theultravnc.ini file. - As can be seen in the first lines of the file itself, we found the encoded password. - I took the encoded parts of the password and used this website to decode them. [Online VNC Password Decoder (Decryptor) — KeyDecryptor Tool](https://keydecryptor.com/decryption-tools/vnc) - I had successfully obtained the VNC password. The only objective that remained was the administrator flag. - I checked the Desktop folder of the Administrator and found the admin flag inadmin_flag.txt . - And with that, all the flags were obtained, and the room was solved! I hope you found this write-up useful. Make sure to drop a follow for more such content in the future. Get Kavin Jindal’s stories in your inbox Join Medium for free to get updates from this writer. Happy Hacking! #### By Kavin Jindal