| ターゲット // Reel | |
|---|---|
| Platform | HTB |
| OS | Windows |
| Difficulty | Hard |
| IP | 10.129.50.115 |
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
593/tcp open http-rpc-epmap
FTP + SMTP on a Windows AD box – this screams phishing.
| ターゲット // Blackfield | |
|---|---|
| Platform | HTB |
| OS | Windows |
| Difficulty | Hard |
| IP | 10.129.229.17 |
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
389/tcp open ldap
445/tcp open microsoft-ds
593/tcp open ncacn_http
3268/tcp open ldap
5985/tcp open http
Domain: blackfield.local, DC01.
| ターゲット // Peppo | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Linux |
| Difficulty | Hard |
| IP | 192.168.100.60 |
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
113/tcp open ident
5432/tcp open postgresql PostgreSQL DB 12.3 - 12.4
8080/tcp open http WEBrick httpd 1.4.2 (Ruby 2.6.6 (2020-03-31))
Four services, and most of them are noise. The Redmine app on 8080 and PostgreSQL on 5432 both look inviting but lead nowhere. The pivotal service is the easy-to-overlook one: ident on port 113.
| ターゲット // MeatHead | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Windows |
| Difficulty | Hard |
| IP | 192.168.206.70 |
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
1221/tcp open ftp Microsoft ftpd
1435/tcp open ms-sql-s Microsoft SQL Server 2017 14.00.1000.00; RTM
3389/tcp open ms-wbt-server Microsoft Terminal Services
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (WinRM)
Windows Server 2019 box — the 445 fingerprint reads 2008 R2 - 2012, but that SMB banner is unreliable; systeminfo from the shell later confirms Server 2019. The interesting detail is the two services parked on non-standard ports: FTP on 1221 and MSSQL on 1435. IIS on 80 serves nothing useful, so the FTP is the way in.
| ターゲット // Shifty | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Linux |
| Difficulty | Hard |
| IP | 192.168.244.59 |
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
80/tcp open http nginx 1.10.3
5000/tcp open http Werkzeug httpd 1.0.1 (Python 3.5.3)
11211/tcp open memcached Memcached 1.4.33 (uptime 388 seconds)
Four ports, but two of them talk to each other. Port 5000 is a Flask app (Werkzeug/Python), and port 11211 is memcached — sitting wide open with no auth. That pairing is the whole box.