InfoSec LAB

Slort_Recon

Created: 3 min read

RustScan

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/slort]
└─$ rustscan -a $IP
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: Where '404 Not Found' meets '200 OK'.
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 10000.
Open 192.168.134.53:21
Open 192.168.134.53:135
Open 192.168.134.53:139
Open 192.168.134.53:445
Open 192.168.134.53:4443
Open 192.168.134.53:5040
Open 192.168.134.53:8080
Open 192.168.134.53:3306
^C

Nmap

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/slort]
└─$ nmap -T4 -sT -p- $IP
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-07 19:25 CET
Nmap scan report for 192.168.134.53
Host is up (0.024s latency).
Not shown: 65521 closed tcp ports (conn-refused)
PORT      STATE SERVICE
21/tcp    open  ftp
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
445/tcp   open  microsoft-ds
3306/tcp  open  mysql
4443/tcp  open  pharos
5040/tcp  open  unknown
8080/tcp  open  http-proxy
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown
 
Nmap done: 1 IP address (1 host up) scanned in 20.00 seconds
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/slort]
└─$ nmap -T4 -sT -sC -sV -p- $IP
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-07 19:26 CET
Nmap scan report for 192.168.134.53
Host is up (0.019s latency).
Not shown: 65521 closed tcp ports (conn-refused)
Host script results:
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           FileZilla ftpd 0.9.41 beta
| ftp-syst: 
|_  SYST: UNIX emulated by FileZilla
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
| smb2-time: 
|   date: 2025-02-07T18:29:34
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
3306/tcp  open  mysql?
| fingerprint-strings: 
|   GenericLines, HTTPOptions, NULL, RTSPRequest, WMSRequest, oracle-tns: 
|_    Host '192.168.45.215' is not allowed to connect to this MariaDB server
4443/tcp  open  http          Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
| http-title: Welcome to XAMPP
|_Requested resource was http://192.168.134.53:4443/dashboard/
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
5040/tcp  open  unknown
8080/tcp  open  http          Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
| http-title: Welcome to XAMPP
|_Requested resource was http://192.168.134.53:8080/dashboard/
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port3306-TCP:V=7.94SVN%I=7%D=2/7%Time=67A6506F%P=x86_64-pc-linux-gnu%r(
SF:NULL,4D,"I\0\0\x01\xffj\x04Host\x20'192\.168\.45\.215'\x20is\x20not\x20
SF:allowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server")%r(Generic
SF:Lines,4D,"I\0\0\x01\xffj\x04Host\x20'192\.168\.45\.215'\x20is\x20not\x2
SF:0allowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server")%r(HTTPOp
SF:tions,4D,"I\0\0\x01\xffj\x04Host\x20'192\.168\.45\.215'\x20is\x20not\x2
SF:0allowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server")%r(RTSPRe
SF:quest,4D,"I\0\0\x01\xffj\x04Host\x20'192\.168\.45\.215'\x20is\x20not\x2
SF:0allowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server")%r(WMSReq
SF:uest,4D,"I\0\0\x01\xffj\x04Host\x20'192\.168\.45\.215'\x20is\x20not\x20
SF:allowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server")%r(oracle-
SF:tns,4D,"I\0\0\x01\xffj\x04Host\x20'192\.168\.45\.215'\x20is\x20not\x20a
SF:llowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 189.55 seconds

UDP

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/slort]
└─$ sudo nmap -sU -Pn -top-ports 1000 $IP
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-07 19:18 CET
Stats: 0:08:11 elapsed; 0 hosts completed (1 up), 1 undergoing UDP Scan
UDP Scan Timing: About 44.69% done; ETC: 19:36 (0:10:08 remaining)
Nmap scan report for 192.168.134.53
Host is up (0.022s latency).
Not shown: 991 closed udp ports (port-unreach)
PORT     STATE         SERVICE
123/udp  open|filtered ntp
137/udp  open|filtered netbios-ns
138/udp  open|filtered netbios-dgm
500/udp  open|filtered isakmp
1900/udp open|filtered upnp
4500/udp open|filtered nat-t-ike
5050/udp open|filtered mmcc
5353/udp open|filtered zeroconf
5355/udp open|filtered llmnr
 
Nmap done: 1 IP address (1 host up) scanned in 1167.48 seconds

False-positive

Interactive Graph View

Backlinks