## Task 1 RECON
How many ports are open with a port number under 1000?
3

What is this machine vulnerable to? (Answer in the form of: ms??-???, ex: ms08-067)


## Task 2  Gain Access
Find the exploitation code we will run against the machine. What is the full path of the code? (Ex: exploit/........)


Show options and set the one required value. What is the name of this value? (All caps for submission)
Answer format: ******

Usually it would be fine to run this exploit as is; however, for the sake of learning, you should do one more thing before exploiting the target. Enter the following command and press enter:
set payload windows/x64/shell/reverse_tcp
With that done, run the exploit!

Confirm that the exploit has run correctly. You may have to press enter for the DOS shell to appear. Background this shell (CTRL + Z). If this failed, you may have to reboot the target VM. Try running it again before a reboot of the target. 

## Task 3  Escalate

Answer the questions below
Start Metasploit

No answer needed
Find the exploitation code we will run against the machine. What is the full path of the code? (Ex: exploit/........)
post/multi/manage/shell_to_meterpreter


Show options and set the one required value. What is the name of this value? (All caps for submission)
SESSION
Usually it would be fine to run this exploit as is; however, for the sake of learning, you should do one more thing before exploiting the target. Enter the following command and press enter:

set payload windows/x64/shell/reverse_tcp

With that done, run the exploit!

No answer needed
Confirm that the exploit has run correctly. You may have to press enter for the DOS shell to appear. Background this shell (CTRL + Z). If this failed, you may have to reboot the target VM. Try running it again before a reboot of the target. 


## Task 4  Cracking

Within our elevated meterpreter shell, run the command 'hashdump'. This will dump all of the passwords on the machine as long as we have the correct privileges to do so. What is the name of the non-default user? 

Jon
Copy this password hash to a file and research how to crack it. What is the cracked password?

alqfna22


## Task 5  Find flags!
pwd=print the current working directory
dir =lists the files in the current directory
cd .. =go back
cat =view the contents of the file

Answer the questions below
Flag1? This flag can be found at the system root. 
flag{access_the_machine}

Flag2? This flag can be found at the location where passwords are stored within Windows.
*Errata: Windows really doesn't like the location of this flag and can occasionally delete it. It may be necessary in some cases to terminate/restart the machine and rerun the exploit to find this flag. This relatively rare, however, it can happen. 
flag{sam_database_elevated_access}


flag3? This flag can be found in an excellent location to loot. After all, Administrators usually have pretty interesting things saved. 
flag{admin_documents_can_be_valuable}m