Object_Recon

RustScan

---

┌──(kali㉿kali)-[~/archive/htb/labs/object]
└─$ rustscan -a $IP -b 25000
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
please contribute more quotes to our github https://github.com/rustscan/rustscan
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
open 10.10.11.132:80
open 10.10.11.132:5985
open 10.10.11.132:8080

Nmap

---

┌──(kali㉿kali)-[~/archive/htb/labs/object]
└─$ nmap -sC -sV -p- $IP   
Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-20 15:05 CEST
Nmap scan report for 10.10.11.132
Host is up (0.027s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
80/tcp   open  http    Microsoft IIS httpd 10.0
|_http-title: Mega Engines
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
8080/tcp open  http    Jetty 9.4.43.v20210629
|_http-server-header: Jetty(9.4.43.v20210629)
| http-robots.txt: 1 disallowed entry 
|_/
|_http-title: Site doesn't have a title (text/html;charset=utf-8).
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 116.30 seconds

UDP

---

┌──(kali㉿kali)-[~/archive/htb/labs/object]
└─$ sudo nmap -sU -top-ports 1000 $IP                              
[sudo] password for kali: 
starting nmap 7.94 ( https://nmap.org ) at 2023-09-20 15:08 CEST
Nmap scan report for 10.10.11.132
Host is up (0.027s latency).
not shown: 997 open|filtered udp ports (no-response)
PORT    STATE SERVICE
53/udp  open  domain
88/udp  open  kerberos-sec
123/udp open  ntp
 
nmap done: 1 IP address (1 host up) scanned in 9.72 seconds
 
┌──(kali㉿kali)-[~/archive/htb/labs/object]
└─$ sudo nmap -sC -sV -sU -p53,88,123 $IP
starting nmap 7.94 ( https://nmap.org ) at 2023-09-20 15:09 CEST
Nmap scan report for 10.10.11.132
Host is up (0.028s latency).
 
PORT    STATE SERVICE      VERSION
53/udp  open  domain       (generic dns response: NOTIMP)
| fingerprint-strings: 
|   nbtstat: 
|_    CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
88/udp  open  kerberos-sec microsoft windows kerberos (server time: 2023-09-20 07:49:17Z)
123/udp open  ntp          NTP v3
| ntp-info: 
|_  
1 service unrecognized despite returning data. if you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
sf-port53-udp:V=7.94%I=7%D=9/20%Time=650AEF12%P=x86_64-pc-linux-gnu%r(DNSS
sf:tatusRequest,C,"\0\0\x90\x04\0\0\0\0\0\0\0\0")%r(NBTStat,32,"\x80\xf0\x
sf:80\x82\0\x01\0\0\0\0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01
sf:");
service info: OS: Windows; CPE: cpe:/o:microsoft:windows
 
host script results:
|_clock-skew: -5h19m58s
 
service detection performed. please report any incorrect results at https://nmap.org/submit/ .
nmap done: 1 IP address (1 host up) scanned in 32.79 seconds

The target system appears to be a Domain Controller in an Active Directory environment