University_Recon

RustScan

---

┌──(kali㉿kali)-[~/archive/htb/labs/university]
└─$ rustscan -a $IP
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Port scanning: Making networking exciting since... whenever.
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 10000.
Open 10.129.37.136:53
Open 10.129.37.136:80
Open 10.129.37.136:88
Open 10.129.37.136:135
Open 10.129.37.136:139
Open 10.129.37.136:389
Open 10.129.37.136:445
Open 10.129.37.136:464
Open 10.129.37.136:593
Open 10.129.37.136:636
Open 10.129.37.136:2179
Open 10.129.37.136:3268
Open 10.129.37.136:3269
Open 10.129.37.136:5985
Open 10.129.37.136:9389

Nmap

---

┌──(kali㉿kali)-[~/archive/htb/labs/university]
└─$ nmap -Pn -sC -sV -p- $IP      
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-26 21:02 CEST
Nmap scan report for 10.129.37.136
Host is up (0.028s latency).
Not shown: 65508 closed tcp ports (reset)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          nginx 1.24.0
|_http-title: Did not follow redirect to http://university.htb/
|_http-server-header: nginx/1.24.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-10-27 02:02:30Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: university.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
2179/tcp  open  vmrdp?
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: university.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49671/tcp open  msrpc         Microsoft Windows RPC
49672/tcp open  msrpc         Microsoft Windows RPC
49676/tcp open  msrpc         Microsoft Windows RPC
49697/tcp open  msrpc         Microsoft Windows RPC
56163/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
 
Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 6h59m53s
| smb2-time: 
|   date: 2024-10-27T02:03:27
|_  start_date: N/A
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 94.46 seconds

The target system appears to be a Domain Controller in an Active Directory environment The domain is university.htb The FQDN of the target system is UNKNOWN at the time.

UDP

---

┌──(kali㉿kali)-[~/archive/htb/labs/university]
└─$ sudo nmap -Pn -sU --top-port 1000 $IP
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-26 21:01 CEST
Nmap scan report for 10.129.37.136
Host is up (0.088s latency).
Not shown: 976 closed udp ports (port-unreach)
PORT      STATE         SERVICE
53/udp    open          domain
88/udp    open          kerberos-sec
123/udp   open          ntp
137/udp   open|filtered netbios-ns
138/udp   open|filtered netbios-dgm
389/udp   open|filtered ldap
464/udp   open|filtered kpasswd5
500/udp   open|filtered isakmp
4500/udp  open|filtered nat-t-ike
5353/udp  open|filtered zeroconf
5355/udp  open|filtered llmnr
61481/udp open|filtered unknown
61550/udp open|filtered unknown
61685/udp open|filtered unknown
61961/udp open|filtered unknown
62154/udp open|filtered unknown
62287/udp open|filtered unknown
63420/udp open|filtered unknown
63555/udp open|filtered unknown
64080/udp open|filtered unknown
64481/udp open|filtered unknown
64513/udp open|filtered unknown
64590/udp open|filtered unknown
64727/udp open|filtered unknown
 
Nmap done: 1 IP address (1 host up) scanned in 1268.49 seconds