InfoSec LAB

Sorcerer_Recon

Created: 2 min read

RustScan

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/sorcerer]
└─$ rustscan -a $IP
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
TreadStone was here 🚀
 
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 10000.
Open 192.168.113.100:22
Open 192.168.113.100:80
Open 192.168.113.100:111
Open 192.168.113.100:2049
Open 192.168.113.100:7742
Open 192.168.113.100:8080
Open 192.168.113.100:34625
Open 192.168.113.100:43449
Open 192.168.113.100:45551
Open 192.168.113.100:49951

Nmap

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/sorcerer]
└─$ nmap -p- -sC -sV -T5 --min-parallelism 100 --max-parallelism 256 $IP
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-28 20:06 CET
Warning: 192.168.113.100 giving up on port because retransmission cap hit (2).
Nmap scan report for 192.168.113.100
Host is up (0.024s latency).
Not shown: 64342 closed tcp ports (reset), 1183 filtered tcp ports (no-response)
PORT      STATE SERVICE  VERSION
22/tcp    open  ssh      OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 81:2a:42:24:b5:90:a1:ce:9b:ac:e7:4e:1d:6d:b4:c6 (RSA)
|   256 d0:73:2a:05:52:7f:89:09:37:76:e3:56:c8:ab:20:99 (ECDSA)
|_  256 3a:2d:de:33:b0:1e:f2:35:0f:8d:c8:d7:8f:f9:e0:0e (ED25519)
80/tcp    open  http     nginx
|_http-title: Site doesnt have a title (text/html).
111/tcp   open  rpcbind  2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100003  3           2049/udp   nfs
|   100003  3,4         2049/tcp   nfs
|   100005  1,2,3      34625/tcp   mountd
|   100005  1,2,3      39117/udp   mountd
|   100021  1,3,4      36944/udp   nlockmgr
|   100021  1,3,4      45551/tcp   nlockmgr
|   100227  3           2049/tcp   nfs_acl
|_  100227  3           2049/udp   nfs_acl
2049/tcp  open  nfs      3-4 (RPC #100003)
7742/tcp  open  http     nginx
|_http-title: SORCERER
8080/tcp  open  http     Apache Tomcat 7.0.4
|_http-title: Apache Tomcat/7.0.4
|_http-favicon: Apache Tomcat
34625/tcp open  mountd   1-3 (RPC #100005)
43449/tcp open  mountd   1-3 (RPC #100005)
45551/tcp open  nlockmgr 1-4 (RPC #100021)
49951/tcp open  mountd   1-3 (RPC #100005)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 37.91 seconds

The target system appears to be Debian

UDP

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/sorcerer]
└─$ sudo nmap -sU --top-ports 1000 $IP
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-28 20:06 CET
Nmap scan report for 192.168.113.100
Host is up (0.030s latency).
Not shown: 998 closed udp ports (port-unreach)
PORT     STATE SERVICE
111/udp  open  rpcbind
2049/udp open  nfs
 
Nmap done: 1 IP address (1 host up) scanned in 1019.12 seconds

Interactive Graph View

Backlinks