PG: UT99

Tue, 07 Mar 2023 00:00:00 +0000

ターゲット // UT99
Platform	OffSec Proving Grounds
OS	Windows
Difficulty	Medium
IP	`192.168.206.44`

Enumeration

Nmap

A full port sweep is deliberately noisy here — the box parks an InspIRCd instance on dozens of ports across the 6660-7007 range, enough to make autorecon choke. Trimmed to the services that actually matter:

▶ Nmap output

PORT STATE SERVICE VERSION
21/tcp open ftp FileZilla ftpd
80/tcp open http Apache httpd 2.4.16 (OpenSSL/1.0.1p PHP/5.6.12)
443/tcp open ssl/http Apache httpd 2.4.16 (OpenSSL/1.0.1p PHP/5.6.12)
3306/tcp open mysql MySQL (unauthorized)
6660-7007 open irc InspIRCd
64738/tcp open murmur Murmur 1.2.10

FTP wants credentials, MySQL refuses external connections, and the web app on 80/443 is a stock CMS with nothing exploitable after directory fuzzing. Everything obvious is a dead end. The name of the box — UT99 — plus the wall of IRC ports is the actual hint: this is about Unreal Tournament, and the IRC server is where the map lives.

Seh on ioctl

PG: UT99

Enumeration

Nmap