Open ports aren't the finish line — they're the starting point. This covers the full offensive chain: enumerating SMB before touching credentials, mapping version strings to CVEs across three verification methods, piping scan data straight into Metasploit's database, building an evasion profile that targets specific detection methods instead of guessing, and reaching internal networks through a pivot using three different techniques depending on what's available. Every example ran against real l...