Node_Recon

RustScan

---

┌──(kali㉿kali)-[~/archive/htb/labs/node]
└─$ rustscan -a $IP --ulimit=5000
 
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
😵 https://admin.tryhackme.com
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
open 10.10.10.58:22
open 10.10.10.58:3000

Nmap

---

┌──(kali㉿kali)-[~/archive/htb/labs/node]
└─$ nmap -Pn -sC -sV -p22,3000 $IP    
Starting Nmap 7.93 ( https://nmap.org ) at 2022-10-19 20:49 CEST
Nmap scan report for 10.10.10.58
Host is up (0.050s latency).
 
PORT     STATE SERVICE         VERSION
22/tcp   open  ssh             OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 dc5e34a625db43eceb40f4967b8ed1da (RSA)
|   256 6c8e5e5f4fd5417d1895d1dc2e3fe59c (ECDSA)
|_  256 d878b85d85ffad7be6e2b5da1e526236 (ED25519)
3000/tcp open  hadoop-datanode Apache Hadoop
| hadoop-datanode-info: 
|_  Logs: /login
|_http-title: MyPlace
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 23.45 seconds

Nmap scan report shows that the application running on port 3000 is Apache Hadoop, which I find very stranrge.

I will perform an additional scan

Additional Scan

---

┌──(kali㉿kali)-[~/archive/htb/labs/node]
└─$ nmap -Pn -sV -p3000 $IP    
starting nmap 7.93 ( https://nmap.org ) at 2023-01-18 20:48 CET
Nmap scan report for 10.10.10.58
Host is up (0.031s latency).
 
PORT     STATE SERVICE VERSION
3000/tcp open  http    Node.js Express framework
 
service detection performed. please report any incorrect results at https://nmap.org/submit/ .
nmap done: 1 IP address (1 host up) scanned in 11.71 seconds

Scanning the port 3000 with only the -sV flag reveals a different result. It shows that it is a web application built on Node.js

I have no idea why it shows a different result if I supply the -sC flag to run some basic scripts