InfoSec LAB

Apex_Recon

Created: 2 min read

RustScan

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/apex]
└─$ rustscan -a $IP
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
To scan or not to scan? That is the question.
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 10000.
Open 192.168.163.145:80
Open 192.168.163.145:445
Open 192.168.163.145:3306

Nmap

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/apex]
└─$ nmap -p- $IP 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-05 15:02 CET
Nmap scan report for 192.168.163.145
Host is up (0.023s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE
80/tcp   open  http
445/tcp  open  microsoft-ds
3306/tcp open  mysql
 
Nmap done: 1 IP address (1 host up) scanned in 167.52 seconds
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/apex]
└─$ nmap -Pn -sS -sC -sV -p80,445,3306 $IP
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-05 15:05 CET
Nmap scan report for 192.168.163.145
Host is up (0.020s latency).
 
Host script results:
PORT     STATE SERVICE     VERSION
	80/tcp   open  http        `Apache httpd 2.4.29 ((Ubuntu))`
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: APEX Hospital
445/tcp  open  netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: apex
|   NetBIOS computer name: APEX\x00
|   Domain name: \x00
|   FQDN: apex
|_  System time: 2025-02-05T09:05:22-05:00
|_clock-skew: mean: 1h40m00s, deviation: 2h53m15s, median: -1s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2025-02-05T14:05:21
|_  start_date: N/A
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
3306/tcp open  mysql       MySQL 5.5.5-10.1.48-MariaDB-0ubuntu0.18.04.1
| mysql-info: 
|   Protocol: 10
|   Version: 5.5.5-10.1.48-MariaDB-0ubuntu0.18.04.1
|   Thread ID: 43
|   Capabilities flags: 63487
|   Some Capabilities: IgnoreSigpipes, FoundRows, DontAllowDatabaseTableColumn, SupportsTransactions, Speaks41ProtocolNew, SupportsCompression, InteractiveClient, Support41Auth, LongPassword, IgnoreSpaceBeforeParenthesis, SupportsLoadDataLocal, LongColumnFlag, ODBCClient, Speaks41ProtocolOld, ConnectWithDatabase, SupportsMultipleStatments, SupportsMultipleResults, SupportsAuthPlugins
|   Status: Autocommit
|   Salt: bp--8rW<fljQ6Y>gmof0
|_  Auth Plugin Name: mysql_native_password
Service Info: Host: APEX
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 46.62 seconds

The target system appears to be Ubuntu The host name appears to be apex

UDP

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/apex]
└─$ sudo nmap -sU -Pn -top-ports 1000 $IP
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-05 15:02 CET
Nmap scan report for 192.168.163.145
Host is up (0.023s latency).
Not shown: 999 open|filtered udp ports (no-response)
PORT    STATE  SERVICE
445/udp closed microsoft-ds
 
Nmap done: 1 IP address (1 host up) scanned in 178.05 seconds

Interactive Graph View

Backlinks