InfoSec LAB

APT_MSRPC

Created: 7 min read

MSRPC

Nmap discovered a MSRPC service on the target port 135

┌──(kali㉿kali)-[~/archive/htb/labs/apt]
└─$ rpcclient $IP -N -U ''
Cannot connect to server.  Error was NT_STATUS_IO_TIMEOUT

The target MSRPC service doesn’t seem to allow anonymous access

RPC Endpoint

┌──(kali㉿kali)-[~/archive/htb/labs/apt]
└─$ impacket-rpcdump $IP
Impacket v0.11.0 - Copyright 2023 Fortra
 
[*] Retrieving endpoint list from 10.10.10.213
Protocol: [MS-RSP]: Remote Shutdown Protocol 
Provider: wininit.exe 
UUID    : D95AFE70-A6D5-4259-822E-2C84DA1DDB0D v1.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.213[49664]
          ncalrpc:[WindowsShutdown]
          ncacn_np:\\APT[\PIPE\InitShutdown]
          ncalrpc:[WMsgKRpc06F5B0]
 
Protocol: N/A 
Provider: winlogon.exe 
UUID    : 76F226C3-EC14-4325-8A99-6A46348418AF v1.0 
Bindings: 
          ncalrpc:[WindowsShutdown]
          ncacn_np:\\APT[\PIPE\InitShutdown]
          ncalrpc:[WMsgKRpc06F5B0]
          ncalrpc:[WMsgKRpc071C11]
 
Protocol: N/A 
Provider: N/A 
UUID    : D09BDEB5-6171-4A34-BFE2-06FA82652568 v1.0 
Bindings: 
          ncalrpc:[csebpub]
          ncalrpc:[LRPC-932188f70bc7c4c30b]
          ncalrpc:[LRPC-8c19541253fe9dfab3]
          ncacn_np:\\APT[\pipe\LSM_API_service]
          ncalrpc:[LSMApi]
          ncalrpc:[LRPC-1d28b333dcaf820af7]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
          ncalrpc:[LRPC-8c19541253fe9dfab3]
          ncacn_np:\\APT[\pipe\LSM_API_service]
          ncalrpc:[LSMApi]
          ncalrpc:[LRPC-1d28b333dcaf820af7]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
          ncalrpc:[LRPC-38502b7fa05e708539]
          ncalrpc:[dhcpcsvc]
          ncalrpc:[dhcpcsvc6]
          ncacn_ip_tcp:10.10.10.213[49665]
          ncacn_np:\\APT[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[LRPC-1920febf6c31ca0a65]
 
Protocol: N/A 
Provider: N/A 
UUID    : 697DCDA9-3BA9-4EB2-9247-E11F1901B0D2 v1.0 
Bindings: 
          ncalrpc:[LRPC-932188f70bc7c4c30b]
          ncalrpc:[LRPC-8c19541253fe9dfab3]
          ncacn_np:\\APT[\pipe\LSM_API_service]
          ncalrpc:[LSMApi]
          ncalrpc:[LRPC-1d28b333dcaf820af7]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
 
Protocol: N/A 
Provider: sysntfy.dll 
UUID    : C9AC6DB5-82B7-4E55-AE8A-E464ED7B4277 v1.0 Impl friendly name
Bindings: 
          ncalrpc:[LRPC-1d28b333dcaf820af7]
          ncalrpc:[actkernel]
          ncalrpc:[umpo]
          ncalrpc:[senssvc]
          ncalrpc:[OLE4F49E0D1DB5BA2D0B4CE06E30C84]
          ncalrpc:[IUserProfile2]
          ncalrpc:[IUserProfile2]
          ncalrpc:[LRPC-eecd9e94a0aaca8ab1]
          ncalrpc:[OLED41E83CF8CFE42AB066284DF9D2D]
          ncacn_ip_tcp:10.10.10.213[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\APT[\pipe\lsass]
 
Protocol: N/A 
Provider: nrpsrv.dll 
UUID    : 30ADC50C-5CBC-46CE-9A0E-91914789E23C v1.0 NRP server endpoint
Bindings: 
          ncalrpc:[LRPC-cac2d5a61e55017107]
          ncalrpc:[LRPC-38502b7fa05e708539]
          ncalrpc:[dhcpcsvc]
          ncalrpc:[dhcpcsvc6]
          ncacn_ip_tcp:10.10.10.213[49665]
          ncacn_np:\\APT[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[LRPC-1920febf6c31ca0a65]
 
Protocol: N/A 
Provider: N/A 
UUID    : A500D4C6-0DD1-4543-BC0C-D5F93486EAF8 v1.0 
Bindings: 
          ncalrpc:[LRPC-cac2d5a61e55017107]
          ncalrpc:[LRPC-38502b7fa05e708539]
          ncalrpc:[dhcpcsvc]
          ncalrpc:[dhcpcsvc6]
          ncacn_ip_tcp:10.10.10.213[49665]
          ncacn_np:\\APT[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[LRPC-1920febf6c31ca0a65]
 
Protocol: N/A 
Provider: dhcpcsvc.dll 
UUID    : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D5 v1.0 DHCP Client LRPC Endpoint
Bindings: 
          ncalrpc:[dhcpcsvc]
          ncalrpc:[dhcpcsvc6]
          ncacn_ip_tcp:10.10.10.213[49665]
          ncacn_np:\\APT[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[LRPC-1920febf6c31ca0a65]
 
Protocol: N/A 
Provider: dhcpcsvc6.dll 
UUID    : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D6 v1.0 DHCPv6 Client LRPC Endpoint
Bindings: 
          ncalrpc:[dhcpcsvc6]
          ncacn_ip_tcp:10.10.10.213[49665]
          ncacn_np:\\APT[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[LRPC-1920febf6c31ca0a65]
 
Protocol: [MS-EVEN6]: EventLog Remoting Protocol 
Provider: wevtsvc.dll 
UUID    : F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C v1.0 Event log TCPIP
Bindings: 
          ncacn_ip_tcp:10.10.10.213[49665]
          ncacn_np:\\APT[\pipe\eventlog]
          ncalrpc:[eventlog]
          ncalrpc:[LRPC-1920febf6c31ca0a65]
 
Protocol: N/A 
Provider: IKEEXT.DLL 
UUID    : A398E520-D59A-4BDD-AA7A-3C1E0303A511 v1.0 IKE/Authip API
Bindings: 
          ncalrpc:[LRPC-e489e3baf8605468fa]
          ncacn_ip_tcp:10.10.10.213[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\APT[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE4F49E0D1DB5BA2D0B4CE06E30C84]
          ncalrpc:[IUserProfile2]
 
Protocol: N/A 
Provider: N/A 
UUID    : 0D3C7F20-1C8D-4654-A1B3-51563B298BDA v1.0 UserMgrCli
Bindings: 
          ncalrpc:[LRPC-e489e3baf8605468fa]
          ncacn_ip_tcp:10.10.10.213[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\APT[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE4F49E0D1DB5BA2D0B4CE06E30C84]
          ncalrpc:[IUserProfile2]
 
Protocol: N/A 
Provider: N/A 
UUID    : B18FBAB6-56F8-4702-84E0-41053293A869 v1.0 UserMgrCli
Bindings: 
          ncalrpc:[LRPC-e489e3baf8605468fa]
          ncacn_ip_tcp:10.10.10.213[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\APT[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE4F49E0D1DB5BA2D0B4CE06E30C84]
          ncalrpc:[IUserProfile2]
 
Protocol: N/A 
Provider: N/A 
UUID    : 3A9EF155-691D-4449-8D05-09AD57031823 v1.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.213[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\APT[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE4F49E0D1DB5BA2D0B4CE06E30C84]
          ncalrpc:[IUserProfile2]
 
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol 
Provider: schedsvc.dll 
UUID    : 86D35949-83C9-4044-B424-DB363231FD0C v1.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.213[49666]
          ncalrpc:[ubpmtaskhostchannel]
          ncacn_np:\\APT[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE4F49E0D1DB5BA2D0B4CE06E30C84]
          ncalrpc:[IUserProfile2]
 
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol 
Provider: taskcomp.dll 
UUID    : 378E52B0-C0A9-11CF-822D-00AA0051E40F v1.0 
Bindings: 
          ncacn_np:\\APT[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE4F49E0D1DB5BA2D0B4CE06E30C84]
          ncalrpc:[IUserProfile2]
 
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol 
Provider: taskcomp.dll 
UUID    : 1FF70682-0A51-30E8-076D-740BE8CEE98B v1.0 
Bindings: 
          ncacn_np:\\APT[\PIPE\atsvc]
          ncalrpc:[senssvc]
          ncalrpc:[OLE4F49E0D1DB5BA2D0B4CE06E30C84]
          ncalrpc:[IUserProfile2]
 
Protocol: N/A 
Provider: schedsvc.dll 
UUID    : 0A74EF1C-41A4-4E06-83AE-DC74FB1CDD53 v1.0 
Bindings: 
          ncalrpc:[senssvc]
          ncalrpc:[OLE4F49E0D1DB5BA2D0B4CE06E30C84]
          ncalrpc:[IUserProfile2]
 
Protocol: N/A 
Provider: gpsvc.dll 
UUID    : 2EB08E3E-639F-4FBA-97B1-14F878961076 v1.0 Group Policy RPC Interface
Bindings: 
          ncalrpc:[LRPC-6953e2be96c76a9cc3]
 
Protocol: N/A 
Provider: nsisvc.dll 
UUID    : 7EA70BCF-48AF-4F6A-8968-6A440754D5FA v1.0 NSI server endpoint
Bindings: 
          ncalrpc:[LRPC-274829bd5aa9c26ac0]
 
Protocol: N/A 
Provider: N/A 
UUID    : 7F1343FE-50A9-4927-A778-0C5859517BAC v1.0 DfsDs service
Bindings: 
          ncacn_np:\\APT[\PIPE\wkssvc]
          ncalrpc:[DNSResolver]
          ncalrpc:[LRPC-a2d606ce62be5b835d]
 
Protocol: N/A 
Provider: N/A 
UUID    : EB081A0D-10EE-478A-A1DD-50995283E7A8 v3.0 Witness Client Test Interface
Bindings: 
          ncalrpc:[LRPC-a2d606ce62be5b835d]
 
Protocol: N/A 
Provider: N/A 
UUID    : F2C9B409-C1C9-4100-8639-D8AB1486694A v1.0 Witness Client Upcall Server
Bindings: 
          ncalrpc:[LRPC-a2d606ce62be5b835d]
 
Protocol: N/A 
Provider: N/A 
UUID    : DF4DF73A-C52D-4E3A-8003-8437FDF8302A v0.0 WM_WindowManagerRPC\Server
Bindings: 
          ncalrpc:[LRPC-dc9444ca58af5d7496]
          ncalrpc:[LRPC-676dee13e7f4422953]
          ncalrpc:[LRPC-c381f911f5187dee1c]
 
Protocol: N/A 
Provider: MPSSVC.dll 
UUID    : 2FB92682-6599-42DC-AE13-BD2CA89BD11C v1.0 Fw APIs
Bindings: 
          ncalrpc:[LRPC-676dee13e7f4422953]
          ncalrpc:[LRPC-c381f911f5187dee1c]
 
Protocol: N/A 
Provider: N/A 
UUID    : F47433C3-3E9D-4157-AAD4-83AA1F5C2D4C v1.0 Fw APIs
Bindings: 
          ncalrpc:[LRPC-676dee13e7f4422953]
          ncalrpc:[LRPC-c381f911f5187dee1c]
 
Protocol: N/A 
Provider: MPSSVC.dll 
UUID    : 7F9D11BF-7FB9-436B-A812-B2D50C5D4C03 v1.0 Fw APIs
Bindings: 
          ncalrpc:[LRPC-676dee13e7f4422953]
          ncalrpc:[LRPC-c381f911f5187dee1c]
 
Protocol: N/A 
Provider: BFE.DLL 
UUID    : DD490425-5325-4565-B774-7E27D6C09C24 v1.0 Base Firewall Engine API
Bindings: 
          ncalrpc:[LRPC-c381f911f5187dee1c]
 
Protocol: [MS-NRPC]: Netlogon Remote Protocol 
Provider: netlogon.dll 
UUID    : 12345678-1234-ABCD-EF00-01234567CFFB v1.0 
Bindings: 
          ncalrpc:[NETLOGON_LRPC]
          ncacn_ip_tcp:10.10.10.213[49670]
          ncacn_np:\\APT[\pipe\26bf261de093392f]
          ncacn_http:10.10.10.213[49669]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLED41E83CF8CFE42AB066284DF9D2D]
          ncacn_ip_tcp:10.10.10.213[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\APT[\pipe\lsass]
 
Protocol: [MS-RAA]: Remote Authorization API Protocol 
Provider: N/A 
UUID    : 0B1C2170-5732-4E0E-8CD3-D9B16F3B84D7 v0.0 RemoteAccessCheck
Bindings: 
          ncalrpc:[NETLOGON_LRPC]
          ncacn_ip_tcp:10.10.10.213[49670]
          ncacn_np:\\APT[\pipe\26bf261de093392f]
          ncacn_http:10.10.10.213[49669]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLED41E83CF8CFE42AB066284DF9D2D]
          ncacn_ip_tcp:10.10.10.213[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\APT[\pipe\lsass]
          ncalrpc:[NETLOGON_LRPC]
          ncacn_ip_tcp:10.10.10.213[49670]
          ncacn_np:\\APT[\pipe\26bf261de093392f]
          ncacn_http:10.10.10.213[49669]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLED41E83CF8CFE42AB066284DF9D2D]
          ncacn_ip_tcp:10.10.10.213[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\APT[\pipe\lsass]
 
Protocol: N/A 
Provider: efssvc.dll 
UUID    : 04EEB297-CBF4-466B-8A2A-BFD6A2F10BBA v1.0 EFSK RPC Interface
Bindings: 
          ncacn_np:\\APT[\pipe\efsrpc]
          ncalrpc:[LRPC-8ecc3406d2d373af7a]
 
Protocol: N/A 
Provider: efssvc.dll 
UUID    : DF1941C5-FE89-4E79-BF10-463657ACF44D v1.0 EFS RPC Interface
Bindings: 
          ncacn_np:\\APT[\pipe\efsrpc]
          ncalrpc:[LRPC-8ecc3406d2d373af7a]
 
Protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol 
Provider: samsrv.dll 
UUID    : 12345778-1234-ABCD-EF00-0123456789AC v1.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.213[49670]
          ncacn_np:\\APT[\pipe\26bf261de093392f]
          ncacn_http:10.10.10.213[49669]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLED41E83CF8CFE42AB066284DF9D2D]
          ncacn_ip_tcp:10.10.10.213[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\APT[\pipe\lsass]
 
Protocol: [MS-LSAT]: Local Security Authority (Translation Methods) Remote 
Provider: lsasrv.dll 
UUID    : 12345778-1234-ABCD-EF00-0123456789AB v0.0 
Bindings: 
          ncacn_np:\\APT[\pipe\26bf261de093392f]
          ncacn_http:10.10.10.213[49669]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLED41E83CF8CFE42AB066284DF9D2D]
          ncacn_ip_tcp:10.10.10.213[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\APT[\pipe\lsass]
 
Protocol: [MS-DRSR]: Directory Replication Service (DRS) Remote Protocol 
Provider: ntdsai.dll 
UUID    : E3514235-4B06-11D1-AB04-00C04FC2DCD2 v4.0 MS NT Directory DRS Interface
Bindings: 
          ncacn_np:\\APT[\pipe\26bf261de093392f]
          ncacn_http:10.10.10.213[49669]
          ncalrpc:[NTDS_LPC]
          ncalrpc:[OLED41E83CF8CFE42AB066284DF9D2D]
          ncacn_ip_tcp:10.10.10.213[49667]
          ncalrpc:[samss lpc]
          ncalrpc:[SidKey Local End Point]
          ncalrpc:[protected_storage]
          ncalrpc:[lsasspirpc]
          ncalrpc:[lsapolicylookup]
          ncalrpc:[LSA_EAS_ENDPOINT]
          ncalrpc:[lsacap]
          ncalrpc:[LSARPC_ENDPOINT]
          ncalrpc:[securityevent]
          ncalrpc:[audit]
          ncacn_np:\\APT[\pipe\lsass]
 
Protocol: N/A 
Provider: N/A 
UUID    : 1A0D010F-1C33-432C-B0F5-8CF4E8053099 v1.0 IdSegSrv service
Bindings: 
          ncalrpc:[LRPC-1e629246c3db23d0cc]
 
Protocol: N/A 
Provider: srvsvc.dll 
UUID    : 98716D03-89AC-44C7-BB8C-285824E51C4A v1.0 XactSrv service
Bindings: 
          ncalrpc:[LRPC-1e629246c3db23d0cc]
 
Protocol: N/A 
Provider: N/A 
UUID    : E38F5360-8572-473E-B696-1B46873BEEAB v1.0 
Bindings: 
          ncalrpc:[LRPC-64406a2e345b137dd7]
 
Protocol: N/A 
Provider: N/A 
UUID    : 4C9DBF19-D39E-4BB9-90EE-8F7179B20283 v1.0 
Bindings: 
          ncalrpc:[LRPC-64406a2e345b137dd7]
 
Protocol: [MS-SCMR]: Service Control Manager Remote Protocol 
Provider: services.exe 
UUID    : 367ABB81-9844-35F1-AD32-98F038001003 v2.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.213[49675]
 
Protocol: [MS-CMPO]: MSDTC Connection Manager: 
Provider: msdtcprx.dll 
UUID    : 906B0CE0-C70B-1067-B317-00DD010662DA v1.0 
Bindings: 
          ncalrpc:[LRPC-c7abf0ddd95d286acc]
          ncalrpc:[OLECA45ACA07949F01E73A328CF03B3]
          ncalrpc:[LRPC-94869335bf0deca8dc]
          ncalrpc:[LRPC-94869335bf0deca8dc]
          ncalrpc:[LRPC-94869335bf0deca8dc]
 
Protocol: N/A 
Provider: winlogon.exe 
UUID    : 12E65DD8-887F-41EF-91BF-8D816C42C2E7 v1.0 Secure Desktop LRPC interface
Bindings: 
          ncalrpc:[WMsgKRpc071C11]
 
Protocol: [MS-DNSP]: Domain Name Service (DNS) Server Management 
Provider: dns.exe 
UUID    : 50ABC2A4-574D-40B3-9D66-EE4FD5FBA076 v5.0 
Bindings: 
          ncacn_ip_tcp:10.10.10.213[49695]
 
Protocol: [MS-FRS2]: Distributed File System Replication Protocol 
Provider: dfsrmig.exe 
UUID    : 897E2E5F-93F3-4376-9C9C-FD2277495C27 v1.0 Frs2 Service
Bindings: 
          ncacn_ip_tcp:10.10.10.213[58348]
          ncalrpc:[OLEC275F2559CB185D3DA588ACABB0D]
 
[*] Received 270 endpoints.

impacket-rpcdump enumerated a total of 270 RPC endpoints

Interestingly, there are a few services that are mostly available for Windows Active Directory environment, such as;

  • MS-DRSR for directory replication
  • MS-DNSP for DNS
  • gpsvc.dll: DLL responsible for Group Policy service
  • dhcpcsvc and dhcpcsvc6 for DHCP service

This might be implications that the target system is either part of a Windows domain or the domain controller itself

IOXIDResolver

┌──(kali㉿kali)-[~/archive/htb/labs/apt]
└─$ python3 IOXIDResolver.py -t $IP
[*] Retrieving network interface of 10.10.10.213
address: apt
address: 10.10.10.213
address: dead:beef::24b
address: dead:beef::b885:d62a:d679:573f
address: dead:beef::183f:801c:80e2:9c63

IOXIDResolver found the hostname as well as 3 additional IPv6 addresses I will run some basic scans against these IPv6 addresses

IPv6

┌──(kali㉿kali)-[~/archive/htb/labs/apt]
└─$ rustscan -a dead:beef::24b -b 25000
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Nmap? More like slowmap.🐢
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
Open [dead:beef::24b]:53
Open [dead:beef::24b]:80
Open [dead:beef::24b]:88
Open [dead:beef::24b]:135
Open [dead:beef::24b]:389
Open [dead:beef::24b]:445
Open [dead:beef::24b]:464
Open [dead:beef::24b]:593
Open [dead:beef::24b]:636
Open [dead:beef::24b]:3269
Open [dead:beef::24b]:3268
Open [dead:beef::24b]:5985
Open [dead:beef::24b]:9389
Open [dead:beef::24b]:47001
Open [dead:beef::24b]:49664
Open [dead:beef::24b]:49666
Open [dead:beef::24b]:49665
Open [dead:beef::24b]:49667
Open [dead:beef::24b]:49669
Open [dead:beef::24b]:49670
Open [dead:beef::24b]:49675
Open [dead:beef::24b]:49695
Open [dead:beef::24b]:58348
 
┌──(kali㉿kali)-[~/archive/htb/labs/apt]
└─$ rustscan -a dead:beef::b885:d62a:d679:573f -b 25000
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
😵 https://admin.tryhackme.com
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
Open [dead:beef::b885:d62a:d679:573f]:53
Open [dead:beef::b885:d62a:d679:573f]:88
Open [dead:beef::b885:d62a:d679:573f]:80
Open [dead:beef::b885:d62a:d679:573f]:135
Open [dead:beef::b885:d62a:d679:573f]:389
Open [dead:beef::b885:d62a:d679:573f]:445
Open [dead:beef::b885:d62a:d679:573f]:464
Open [dead:beef::b885:d62a:d679:573f]:593
Open [dead:beef::b885:d62a:d679:573f]:636
Open [dead:beef::b885:d62a:d679:573f]:3268
Open [dead:beef::b885:d62a:d679:573f]:3269
Open [dead:beef::b885:d62a:d679:573f]:5985
Open [dead:beef::b885:d62a:d679:573f]:9389
Open [dead:beef::b885:d62a:d679:573f]:47001
Open [dead:beef::b885:d62a:d679:573f]:49665
Open [dead:beef::b885:d62a:d679:573f]:49664
Open [dead:beef::b885:d62a:d679:573f]:49667
Open [dead:beef::b885:d62a:d679:573f]:49669
Open [dead:beef::b885:d62a:d679:573f]:49666
Open [dead:beef::b885:d62a:d679:573f]:49670
Open [dead:beef::b885:d62a:d679:573f]:49675
Open [dead:beef::b885:d62a:d679:573f]:49695
Open [dead:beef::b885:d62a:d679:573f]:58348
 
┌──(kali㉿kali)-[~/archive/htb/labs/apt]
└─$ rustscan -a dead:beef::183f:801c:80e2:9c63 -b 25000
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
😵 https://admin.tryhackme.com
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
Open [dead:beef::183f:801c:80e2:9c63]:53
Open [dead:beef::183f:801c:80e2:9c63]:80
Open [dead:beef::183f:801c:80e2:9c63]:88
Open [dead:beef::183f:801c:80e2:9c63]:135
Open [dead:beef::183f:801c:80e2:9c63]:389
Open [dead:beef::183f:801c:80e2:9c63]:445
Open [dead:beef::183f:801c:80e2:9c63]:464
Open [dead:beef::183f:801c:80e2:9c63]:593
Open [dead:beef::183f:801c:80e2:9c63]:636
Open [dead:beef::183f:801c:80e2:9c63]:3269
Open [dead:beef::183f:801c:80e2:9c63]:3268
Open [dead:beef::183f:801c:80e2:9c63]:5985
Open [dead:beef::183f:801c:80e2:9c63]:9389
Open [dead:beef::183f:801c:80e2:9c63]:47001
Open [dead:beef::183f:801c:80e2:9c63]:49670
Open [dead:beef::183f:801c:80e2:9c63]:49664
Open [dead:beef::183f:801c:80e2:9c63]:49665
Open [dead:beef::183f:801c:80e2:9c63]:49666
Open [dead:beef::183f:801c:80e2:9c63]:49675
Open [dead:beef::183f:801c:80e2:9c63]:49667
Open [dead:beef::183f:801c:80e2:9c63]:49669
Open [dead:beef::183f:801c:80e2:9c63]:49695
Open [dead:beef::183f:801c:80e2:9c63]:58348

Those IPv6 addresses have many ports open Judging by the open ports, the target system does indeed appears to be a Domain Controller in an Active Directory environment Proceeding to conducting an additional Recon operation

Interactive Graph View

Backlinks