Hackviser Walkthrough — Carnival (SMB Warmup)

By Hasnain — Campus Ambassador at Hackviser

Introduction

The Carnival warmup machine on Hackviser introduces fundamental concepts of the SMB (Server Message Block) protocol.

SMB is widely used in Windows environments for file and resource sharing. Misconfigured SMB shares frequently lead to information disclosure and unauthorized access — making this a critical skill for beginners.

Let’s explore the machine step‑by‑step.

Target Information

Target IP Address: 172.20.11.166

Step 1 — Port Scanning

We start with service discovery using Nmap.

nmap 172.20.11.166 -T5

Result

135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
5985/tcp open  wsman

The most important finding is:

✔ Port 445 → SMB Service

✅ Question: What stands for SMB service, which usually uses port 445?

Answer:

Server Message ****

Step 2 — Enumerating SMB Shares

We list available shares using anonymous authentication:

smbclient --no-pass -L 172.20.11.166

Result

Sharename       Type      Comment
-----------------------------------
Projects        Disk      Looks Interesting
Users           Disk

One share immediately stands out.

✅ Question: What is the name of the sharename with the comment “Looks interesting”?

Answer:

Pr*******

Step 3 — Connecting to the Share

We connect anonymously:

smbclient --no-pass \\\\172.20.11.166\\Projects

Upon connection, SMB provides a helpful hint.

✅ Question: What is the helper command that shows which commands we can run after the SMB connection?

Answer:

helP

Step 4 — Exploring Share Contents

Inside the share:

dir
cd Bird
ls

We discover several project files:

Abp.sln
NuGet.Config
global.json
.config

The .sln file reveals important context.

✅ Question: What is the name of the project?

Answer:

B***

Step 5 — Investigating Hidden Configuration

A hidden file named .config appears interesting.

more .config

This file contains sensitive information.

✅ Question: What is connection password inside the .config file?

Inside .config:

<password_here>

✔ Use the exact value shown in your lab

(Insert the real password when publishing / submitting)

Key Learning Points

This machine highlights a classic security mistake:

✔ Anonymous SMB access allowed ✔ Sensitive configuration files exposed ✔ Credentials stored in plaintext

Such issues are extremely common in real-world environments.

Conclusion

The Carnival warmup is excellent for learning:

• SMB enumeration
• Share access techniques
• Identifying sensitive files
• Recognizing credential exposure risks

Always remember:

Misconfigured file shares are goldmines for attackers.

Congratulations 🙌 Warmup successfully completed.