| ターゲット // Boolean | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Linux |
| Difficulty | Medium |
| IP | 192.168.159.231 |
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp open http (Boolean web app)
33017/tcp open http Apache httpd 2.4.38 ((Debian))
SSH is a dead end without creds. Two HTTP surfaces: the main Boolean app on port 80 and a separate Apache “Development” vhost on port 33017.
| ターゲット // Access | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Windows |
| Difficulty | Medium |
| IP | 192.168.x.x |
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Apache httpd 2.4.48 (XAMPP, PHP 8.0.7)
88/tcp open kerberos-sec Microsoft Windows Kerberos
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn
389/tcp open ldap AD LDAP (Domain: access.offsec)
445/tcp open microsoft-ds
464/tcp open kpasswd5
3268/tcp open ldap AD Global Catalog
5985/tcp open http WinRM (Microsoft HTTPAPI 2.0)
9389/tcp open mc-nmf .NET Message Framing (ADWS)
This is a domain controller (Kerberos, LDAP, DNS, ADWS) that also happens to run a XAMPP/Apache stack on port 80 — the classic “web app pinned to a DC” setup, which usually means the web foothold and the AD kill chain are the same box.
| ターゲット // Pelican | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Linux |
| Difficulty | Medium |
| IP | 192.168.53.98 |
PORT STATE SERVICE
22/tcp open ssh
139/tcp open netbios-ssn
445/tcp open microsoft-ds
631/tcp open ipp
2181/tcp open eforward
2222/tcp open EtherNetIP-1
8080/tcp open http-proxy
8081/tcp open blackice-icecap
44091/tcp open unknown
Nmap reveals nginx on 8081 redirecting to Exhibitor’s web UI:
| ターゲット // Poison | |
|---|---|
| Platform | HTB |
| OS | FreeBSD |
| Difficulty | Medium |
| IP | 10.129.1.254 |
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2 (FreeBSD 20161230; protocol 2.0)
80/tcp open http Apache httpd 2.4.29 ((FreeBSD) PHP/5.6.32)
OS: FreeBSD
| ターゲット // Resolute | |
|---|---|
| Platform | HTB |
| OS | Windows |
| Difficulty | Medium |
| IP | 10.129.96.155 |
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
Domain: megabank.local, Windows Server 2016.
| ターゲット // Seal | |
|---|---|
| Platform | HTB |
| OS | Linux |
| Difficulty | Medium |
| IP | 10.129.95.190 |
PORT STATE SERVICE
22/tcp open ssh
443/tcp open https
8080/tcp open http-proxy
A GitBucket instance with open registration. After registering, we get access to repository info and commit history.
| ターゲット // Shenzi | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Windows |
| Difficulty | Medium |
| IP | 192.168.243.55 |
PORT STATE SERVICE VERSION
21/tcp open ftp FileZilla ftpd 0.9.41 beta
80/tcp open http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
443/tcp open ssl/http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
445/tcp open microsoft-ds
3306/tcp open mysql MariaDB (host not allowed)
5040/tcp open unknown
Windows 10 box with an Apache/PHP stack on 80/443, FileZilla FTP, SMB, and a MariaDB that refuses remote connections. FTP rejects the obvious weak creds and MySQL is locked to localhost, so the two live doors are SMB and the web server.
| ターゲット // Hutch | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Windows |
| Difficulty | Medium |
| IP | 192.168.160.122 |
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hutch.offsec.)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hutch.offsec.)
3269/tcp open tcpwrapped
This is a Windows Server 2019 domain controller (hutch.offsec).
| ターゲット // AuthBy | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Windows |
| Difficulty | Medium |
| IP | 192.168.100.46 |
PORT STATE SERVICE VERSION
21/tcp open ftp zFTPServer 6.0 build 2011-10-17
242/tcp open http Apache httpd 2.2.21 ((Win32) PHP/5.3.8)
3145/tcp open zftp-admin zFTPServer admin
3389/tcp open ssl/ms-wbt-server?
Windows Server 2008 box. An ancient zFTPServer on 21, an HTTP app on the non-standard port 242 sitting behind HTTP Basic auth, the zFTPServer admin interface on 3145, and RDP on 3389. The name of the box is the hint: authentication is the whole game here.
| ターゲット // Billyboss | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Windows |
| Difficulty | Medium |
| IP | 192.168.134.61 |
The two ports that matter — a Nexus web service and SMB:
PORT STATE SERVICE VERSION
445/tcp open microsoft-ds
8081/tcp open http Sonatype Nexus Repository Manager OSS 3.21.0-05
A Windows host with a web service on port 8081 — Sonatype Nexus Repository Manager OSS 3.21.0-05. SMB (445) is also exposed, which becomes relevant for privilege escalation later.