| ターゲット // Knife | |
|---|---|
| Platform | HTB |
| OS | Linux |
| Difficulty | Easy |
| IP | 10.129.44.1 |
Enumeration
Nmap
| |
▶ Nmap output
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH
80/tcp open http Apache httpd 2.4.6
OS: Linux (Ubuntu, kernel 5.4.0-80-generic)
Posts for: #Easy
PG: Internal
| ターゲット // Internal | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Windows |
| Difficulty | Easy |
| IP | 192.168.x.x |
Enumeration
Nmap
The exposed surface is minimal — SMB is the only port in play:
▶ Nmap output
PORT STATE SERVICE VERSION
445/tcp open microsoft-ds
An old Windows host exposing SMB. Post-exploitation sysinfo confirms the target: Windows Server 2008 (6.0 Build 6001, SP1), x86, workgroup member. That 32-bit architecture matters — it kills one of the two rabbit holes below.
PG: Algernon
| ターゲット // Algernon | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Windows |
| Difficulty | Easy |
| IP | 192.168.197.65 |
Enumeration
Nmap
▶ Full nmap output
21/tcp open ftp Microsoft ftpd
80/tcp open http Microsoft IIS httpd 10.0
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
5040/tcp open unknown
9998/tcp open http Microsoft IIS httpd 10.0
17001/tcp open remoting MS .NET Remoting services
Port 21 - FTP
Anonymous access is allowed. Downloaded the FTP contents:
PG: Wombo
| ターゲット // Wombo | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Linux |
| Difficulty | Easy |
| IP | 192.168.105.69 |
Enumeration
Nmap
▶ Nmap output
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u7
80/tcp open http nginx 1.10.3
6379/tcp open redis Redis key-value store 5.0.9
8080/tcp open http-proxy
27017/tcp open mongod?
Multiple services, but Redis on 6379 with no authentication is the obvious target. Port 8080 runs NodeBB – a rabbit hole.
PG: ClamAV
| ターゲット // ClamAV | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Linux |
| Difficulty | Easy |
| IP | 192.168.57.42 |
Enumeration
Nmap
▶ Full nmap output (TCP)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)
25/tcp open smtp Sendmail 8.13.4/8.13.4/Debian-3sarge3
80/tcp open http Apache httpd 1.3.33 ((Debian GNU/Linux))
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
199/tcp open smux Linux SNMP multiplexer
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
60000/tcp open ssh OpenSSH 3.8.1p1 Debian 8.sarge.6 (protocol 2.0)
▶ Full nmap output (UDP)
PORT STATE SERVICE VERSION
137/udp open netbios-ns Samba nmbd netbios-ns (workgroup: WORKGROUP)
161/udp open snmp SNMPv1 server (public)
[ 警告 ]
Don’t forget to enumerate UDP. This box has SNMP v1 on UDP 161 which reveals critical information.
Ports 199 (smux – the SNMP multiplexer, tied to the SNMP service on UDP 161) and 60000 (a second OpenSSH listener) are open but weren’t part of the path.