Clue_Recon

RustScan

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/clue]
└─$ rustscan -a $IP
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
0day was here ♥
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 10000.
Open 192.168.220.240:22
Open 192.168.220.240:80
Open 192.168.220.240:139
Open 192.168.220.240:445
Open 192.168.220.240:3000
Open 192.168.220.240:8021
 

Nmap

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/clue]
└─$ nmap -p- -sC -sV -T5 --min-parallelism 100 --max-parallelism 256 $IP
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-25 16:48 CET
Nmap scan report for 192.168.220.240
Host is up (0.022s latency).
Not shown: 65529 filtered tcp ports (no-response)
PORT     STATE SERVICE          VERSION
22/tcp   open  ssh              OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 74:ba:20:23:89:92:62:02:9f:e7:3d:3b:83:d4:d9:6c (RSA)
|   256 54:8f:79:55:5a:b0:3a:69:5a:d5:72:39:64:fd:07:4e (ECDSA)
|_  256 7f:5d:10:27:62:ba:75:e9:bc:c8:4f:e2:72:87:d4:e2 (ED25519)
80/tcp   open  http             Apache httpd 2.4.38
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.38 (Debian)
139/tcp  open  netbios-ssn      Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn      Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)
3000/tcp open  http             Thin httpd
|_http-server-header: thin
|_http-title: Cassandra Web
8021/tcp open  freeswitch-event FreeSWITCH mod_event_socket
Service Info: Hosts: 127.0.0.1, CLUE; OS: Linux; CPE: cpe:/o:linux:linux_kernel
 
Host script results:
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.9.5-Debian)
|   Computer name: clue
|   NetBIOS computer name: CLUE\x00
|   Domain name: pg
|   FQDN: clue.pg
|_  System time: 2025-03-25T11:49:16-04:00
|_clock-skew: mean: 1h19m57s, deviation: 2h18m35s, median: -3s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-time: 
|   date: 2025-03-25T15:49:14
|_  start_date: N/A
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 101.76 seconds

The target system appears to be Debian The hostname is CLUE and pg appears to be a domain name

The /etc/hosts file on Kali has been updated for local DNS resolution

UDP

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/clue]
└─$ sudo nmap -sU --top-ports 10000 $IP
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-25 16:49 CET
Nmap scan report for 192.168.220.240
Host is up (0.021s latency).
All 10000 scanned ports on 192.168.220.240 are in ignored states.
Not shown: 10000 open|filtered udp ports (no-response)
 
Nmap done: 1 IP address (1 host up) scanned in 216.89 seconds