InfoSec LAB

Nickel_Recon

Created: 3 min read

RustScan

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nickel]
└─$ rustscan -a $IP
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: Where '404 Not Found' meets '200 OK'.
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 10000.
Open 192.168.219.99:21
Open 192.168.219.99:22
Open 192.168.219.99:80
Open 192.168.219.99:135
Open 192.168.219.99:139
Open 192.168.219.99:445
Open 192.168.219.99:3389
Open 192.168.219.99:5040
Open 192.168.219.99:7680
Open 192.168.219.99:8089
Open 192.168.219.99:33333
Open 192.168.219.99:49665
Open 192.168.219.99:49664
Open 192.168.219.99:49667
Open 192.168.219.99:49668
Open 192.168.219.99:49666
Open 192.168.219.99:49669

Nmap

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nickel]
└─$ nmap -p- -sC -sV -T5 --min-parallelism 100 --max-parallelism 256 $IP
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-05 19:03 CET
Warning: 192.168.219.99 giving up on port because retransmission cap hit (2).
Nmap scan report for 192.168.219.99
Host is up (0.025s latency).
Not shown: 65512 closed tcp ports (reset)
Host script results:
PORT      STATE    SERVICE       VERSION
21/tcp    open     ftp           FileZilla ftpd 0.9.60 beta
| ftp-syst: 
|_  SYST: UNIX emulated by FileZilla
22/tcp    open     ssh           OpenSSH for_Windows_8.1 (protocol 2.0)
| ssh-hostkey: 
|   3072 86:84:fd:d5:43:27:05:cf:a7:f2:e9:e2:75:70:d5:f3 (RSA)
|   256 9c:93:cf:48:a9:4e:70:f4:60:de:e1:a9:c2:c0:b6:ff (ECDSA)
|_  256 00:4e:d7:3b:0f:9f:e3:74:4d:04:99:0b:b1:8b:de:a5 (ED25519)
80/tcp    open     http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Site doesnt have a title.
135/tcp   open     msrpc         Microsoft Windows RPC
139/tcp   open     netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open     microsoft-ds?
| smb2-time: 
|   date: 2025-03-05T18:06:54
|_  start_date: N/A
|_clock-skew: mean: -6s, deviation: 0s, median: -6s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
2351/tcp  filtered psrserver
3389/tcp  open     ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2025-03-05T18:07:54+00:00; -6s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: NICKEL
|   NetBIOS_Domain_Name: NICKEL
|   NetBIOS_Computer_Name: NICKEL
|   DNS_Domain_Name: nickel
|   DNS_Computer_Name: nickel
|   Product_Version: 10.0.18362
|_  System_Time: 2025-03-05T18:06:50+00:00
| ssl-cert: Subject: commonName=nickel
| Not valid before: 2025-03-04T18:03:25
|_Not valid after:  2025-09-03T18:03:25
5040/tcp  open     unknown
7680/tcp  open     pando-pub?
8089/tcp  open     http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Site doesnt have a title.
17262/tcp filtered unknown
/tcp filtered unknown
28241/tcp filtered unknown
33333/tcp open     http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Site doesnt have a title.
|_http-server-header: Microsoft-HTTPAPI/2.0
46035/tcp filtered unknown
49664/tcp open     msrpc         Microsoft Windows RPC
49665/tcp open     msrpc         Microsoft Windows RPC
49666/tcp open     msrpc         Microsoft Windows RPC
49667/tcp open     msrpc         Microsoft Windows RPC
49668/tcp open     msrpc         Microsoft Windows RPC
49669/tcp open     msrpc         Microsoft Windows RPC
51261/tcp filtered unknown
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
 
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 250.34 seconds

The target system appears to be a Windows host The hostname is NICKEL

UDP

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nickel]
└─$ sudo nmap -sU -Pn -top-ports 1000 $IP
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-05 18:25 CET
Nmap scan report for 192.168.219.99
Host is up (0.027s latency).
Not shown: 990 closed udp ports (port-unreach)
PORT     STATE         SERVICE
123/udp  open|filtered ntp
137/udp  open|filtered netbios-ns
138/udp  open|filtered netbios-dgm
500/udp  open|filtered isakmp
1900/udp open|filtered upnp
3389/udp open|filtered ms-wbt-server
4500/udp open|filtered nat-t-ike
5050/udp open|filtered mmcc
5353/udp open|filtered zeroconf
5355/udp open|filtered llmnr
 
Nmap done: 1 IP address (1 host up) scanned in 722.81 seconds

Interactive Graph View

Backlinks