InfoSec LAB

Flight_Recon

Created: 3 min read

RustScan

┌──(kali㉿kali)-[~/archive/htb/labs/flight]
└─$ rustscan -a $IP -b 25000
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Nmap? More like slowmap.🐢
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
open 10.10.11.187:53
open 10.10.11.187:80
open 10.10.11.187:88
open 10.10.11.187:139
open 10.10.11.187:135
open 10.10.11.187:389
open 10.10.11.187:445
open 10.10.11.187:464
open 10.10.11.187:593
open 10.10.11.187:636
open 10.10.11.187:3269
open 10.10.11.187:3268
open 10.10.11.187:5985
open 10.10.11.187:9389
open 10.10.11.187:49673
open 10.10.11.187:49668
open 10.10.11.187:49674
open 10.10.11.187:49690
open 10.10.11.187:49699

Nmap

┌──(kali㉿kali)-[~/archive/htb/labs/flight]
└─$ nmap -sC -sV -p- $IP    
Starting Nmap 7.94 ( https://nmap.org ) at 2023-12-11 09:50 CET
Nmap scan report for 10.10.11.187
Host is up (0.10s latency).
Not shown: 65516 filtered tcp ports (no-response)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
|_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1
|_http-title: g0 Aviation
| http-methods: 
|_  Potentially risky methods: TRACE
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2023-12-11 15:53:20Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: flight.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: flight.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49668/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49690/tcp open  msrpc         Microsoft Windows RPC
49699/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: G0; OS: Windows; CPE: cpe:/o:microsoft:windows
 
Host script results:
| smb2-time: 
|   date: 2023-12-11T15:54:16
|_  start_date: N/A
|_clock-skew: 6h59m55s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 299.56 seconds

The target system appears to be a Domain Controller in an Active Directory environment While the domain is flight.htb, the hostname is currently unknown

The domain information has been appended to the /etc/hosts file on Kali for local DNS resolution This is a temporal solution due to the hostname being unknown at this time and it will be updated as soon as the FQDN of the target system is uncovered

It turns out that the above scan result shows the hostname of the target system; G0 Easy to miss out

UDP

┌──(kali㉿kali)-[~/archive/htb/labs/flight]
└─$ sudo nmap -sU -top-ports 1000 $IP
starting nmap 7.94 ( https://nmap.org ) at 2023-12-11 09:49 CET
Nmap scan report for 10.10.11.187
Host is up (0.11s latency).
not shown: 996 open|filtered udp ports (no-response)
PORT    STATE SERVICE
53/udp  open  domain
88/udp  open  kerberos-sec
123/udp open  ntp
389/udp open  ldap
 
nmap done: 1 IP address (1 host up) scanned in 329.90 seconds

Interactive Graph View

Backlinks