Enumeration
it is an assumed breach box and we're given creds for the user pentest start with nmap
┌─[]─[10.10.16.173]─[jimmex@attacker]─[~/htb/labs/pirate]
└──╼ [★]$ nmap -sC -sV -vv 10.129.244.95
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-14 14:33 PDT
< snip>
Scanning pirate.htb (10.129.244.95) [1000 ports]
Discovered open port 139/tcp on 10.129.244.95
Discovered open port 135/tcp on 10.129.244.95
Discovered open port 443/tcp on 10.129.244.95
Discovered open port 445/tcp on 10.129.244.95
Discovered open port 80/tcp on ...