ターゲット // Hetemit
PlatformOffSec Proving Grounds
OSLinux
DifficultyMedium
IP192.168.149.117

Enumeration

Nmap

▶ Nmap output
PORT      STATE SERVICE     VERSION
21/tcp    open  ftp         vsftpd 3.0.3
22/tcp    open  ssh         OpenSSH 8.0 (protocol 2.0)
80/tcp    open  http        Apache httpd 2.4.37 ((centos))
139/tcp   open  netbios-ssn Samba smbd 4.6.2
445/tcp   open  netbios-ssn Samba smbd 4.6.2
50000/tcp open  http        Werkzeug httpd 1.0.1 (Python 3.6.8)

Six ports. FTP allows anonymous login but has nothing useful, port 80 is a stock Apache/CentOS test page, and SSH is a dead end. The two things worth chasing are SMB (for a username) and the Werkzeug dev server on 50000.