--- title: Host & Network Penetration Testing: Exploitation CTF 2 —... description: A step-by-step walkthrough of the eJPT Exploitation CTF 2 lab from INE, targeting a Windows machine to capture four flags. The chain starts with SMB... canonical: https://daily.dev/posts/host-network-penetration-testing-exploitation-ctf-2-ejpt-ine--tlzhkrkra twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Host & Network Penetration Testing: Exploitation CTF 2 — eJPT (INE) | daily.dev og:description: A step-by-step walkthrough of the eJPT Exploitation CTF 2 lab from INE, targeting a Windows machine to capture four flags. The chain starts with SMB... og:url: https://daily.dev/posts/host-network-penetration-testing-exploitation-ctf-2-ejpt-ine--tlzhkrkra og:image: https://api.daily.dev/og/posts/tlzhKRkRa.png og:image:alt: Host & Network Penetration Testing: Exploitation CTF 2 — eJPT (INE) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Host & Network Penetration Testing: Exploitation CTF 2 — eJPT (INE) **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 4 min read · 0 upvotes · 0 comments ## Summary A step-by-step walkthrough of the eJPT Exploitation CTF 2 lab from INE, targeting a Windows machine to capture four flags. The chain starts with SMB brute-forcing user tom's weak password using Metasploit's smb_login module, discovering NTLM hashes in an SMB share. Those hashes are used in a Pass-the-Hash attack to access nancy's SMB share, which reveals credentials for david. David's credentials unlock FTP access to the IIS web root, enabling an ASPX webshell upload that provides remote command execution to read the final flag. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Host & Network Penetration Testing: Post-Exploitation CTF 2 — eJPT \(INE\)](https://daily.dev/posts/host-network-penetration-testing-post-exploitation-ctf-2-ejpt-ine--sews33qql) · InfoSec Write-ups · 0 upvotes · 0 comments - [Host & Network Penetration Testing: System-Host Based Attacks CTF 1 — eJPT \(INE\)](https://daily.dev/posts/host-network-penetration-testing-system-host-based-attacks-ctf-1-ejpt-ine--s4h656wvc) · InfoSec Write-ups · 1 upvotes · 0 comments - [Host & Network Penetration Testing: Exploitation CTF 1 — eJPT \(INE\)](https://daily.dev/posts/host-network-penetration-testing-exploitation-ctf-1-ejpt-ine--gcomrsqby) · InfoSec Write-ups · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/host-network-penetration-testing-exploitation-ctf-2-ejpt-ine--tlzhkrkra) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Host & Network Penetration Testing: Exploitation CTF 2 — eJPT (INE)","url":"https://daily.dev/posts/host-network-penetration-testing-exploitation-ctf-2-ejpt-ine--tlzhkrkra","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/host-network-penetration-testing-exploitation-ctf-2-ejpt-ine--tlzhkrkra"},"datePublished":"2026-07-04T06:13:12.125Z","dateModified":"2026-07-04T06:13:34.289Z","description":"A step-by-step walkthrough of the eJPT Exploitation CTF 2 lab from INE, targeting a Windows machine to capture four flags. The chain starts with SMB...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/13a7d91364bc14b3c5b22d7d12276267?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/13a7d91364bc14b3c5b22d7d12276267?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoSec Write-ups","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoSec Write-ups","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/f0dc21b5bbfd46fda36f7b4b53dd1705","url":"https://daily.dev/sources/infosecwriteups"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/host-network-penetration-testing-exploitation-ctf-2-ejpt-ine--tlzhkrkra","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoSec Write-ups","item":"https://daily.dev/sources/infosecwriteups"},{"@type":"ListItem","position":3,"name":"Host & Network Penetration Testing: Exploitation CTF 2 — eJPT (INE)"}]} ```