InfoSec LAB

Blueprint_Recon

Created: 4 min read

RustScan

┌──(kali㉿kali)-[~/archive/thm/blueprint]
└─$ rustscan --no-banner --scripts none -a $IP 
 
Open 10.10.136.191:80
Open 10.10.136.191:135
Open 10.10.136.191:139
Open 10.10.136.191:443
Open 10.10.136.191:445
Open 10.10.136.191:3306
Open 10.10.136.191:8080
Open 10.10.136.191:49152
Open 10.10.136.191:49153
Open 10.10.136.191:49154
Open 10.10.136.191:49159
Open 10.10.136.191:49160
Open 10.10.136.191:49158
10.10.136.191 -> [80,135,139,443,445,3306,8080,49152,49153,49154,49159,49160,49158]

Nmap

┌──(kali㉿kali)-[~/archive/thm/blueprint]
└─$ nmap -Pn -p- -T5 --min-parallelism 100 --max-parallelism 100 $IP --open 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-05 11:49 CEST
Warning: 10.10.136.191 giving up on port because retransmission cap hit (2).
Nmap scan report for 10.10.136.191
Host is up (0.20s latency).
Not shown: 41398 closed tcp ports (reset), 24124 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE
80/tcp    open  http
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
443/tcp   open  https
445/tcp   open  microsoft-ds
3306/tcp  open  mysql
8080/tcp  open  http-proxy
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49158/tcp open  unknown
49159/tcp open  unknown
49160/tcp open  unknown
 
Nmap done: 1 IP address (1 host up) scanned in 238.50 seconds
 
┌──(kali㉿kali)-[~/archive/thm/blueprint]
└─$ nmap -Pn -sC -sV -p80,135,139,443,445,3306,8080,49152,49153,49154,49159,49160,49158 $IP
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-05 11:54 CEST
Nmap scan report for 10.10.136.191
Host is up (0.25s latency).
 
PORT      STATE SERVICE      VERSION
80/tcp    open  http         Microsoft IIS httpd 7.5
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: 404 - File or directory not found.
|_http-server-header: Microsoft-IIS/7.5
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
443/tcp   open  ssl/http     Apache httpd 2.4.23 (OpenSSL/1.0.2h PHP/5.6.28)
| tls-alpn: 
|_  http/1.1
| http-methods: 
|_  Potentially risky methods: TRACE
| http-ls: Volume /
| SIZE  TIME              FILENAME
| -     2019-04-11 22:52  oscommerce-2.3.4/
| -     2019-04-11 22:52  oscommerce-2.3.4/catalog/
| -     2019-04-11 22:52  oscommerce-2.3.4/docs/
|_
|_ssl-date: TLS randomness does not represent time
|_http-title: Index of /
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after:  2019-11-08T23:48:47
|_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2h PHP/5.6.28
445/tcp   open  microsoft-ds Windows 7 Home Basic 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP)
3306/tcp  open  mysql        MariaDB 10.3.23 or earlier (unauthorized)
8080/tcp  open  http         Apache httpd 2.4.23 (OpenSSL/1.0.2h PHP/5.6.28)
| http-methods: 
|_  Potentially risky methods: TRACE
| http-ls: Volume /
| SIZE  TIME              FILENAME
| -     2019-04-11 22:52  oscommerce-2.3.4/
| -     2019-04-11 22:52  oscommerce-2.3.4/catalog/
| -     2019-04-11 22:52  oscommerce-2.3.4/docs/
|_
|_http-title: Index of /
|_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2h PHP/5.6.28
49152/tcp open  msrpc        Microsoft Windows RPC
49153/tcp open  msrpc        Microsoft Windows RPC
49154/tcp open  msrpc        Microsoft Windows RPC
49158/tcp open  msrpc        Microsoft Windows RPC
49159/tcp open  msrpc        Microsoft Windows RPC
49160/tcp open  msrpc        Microsoft Windows RPC
Service Info: Hosts: www.example.com, BLUEPRINT, localhost; OS: Windows; CPE: cpe:/o:microsoft:windows
 
Host script results:
|_clock-skew: mean: -20m04s, deviation: 34m38s, median: -4s
|_nbstat: NetBIOS name: BLUEPRINT, NetBIOS user: <unknown>, NetBIOS MAC: 02:02:2c:2f:e8:3b (unknown)
| smb2-security-mode: 
|   2:1:0: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2025-07-05T09:55:36
|_  start_date: 2025-07-05T09:47:37
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb-os-discovery: 
|   OS: Windows 7 Home Basic 7601 Service Pack 1 (Windows 7 Home Basic 6.1)
|   OS CPE: cpe:/o:microsoft:windows_7::sp1
|   Computer name: BLUEPRINT
|   NetBIOS computer name: BLUEPRINT\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2025-07-05T10:55:35+01:00
 
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 82.66 seconds

The target system is a Windows host The hostname is BLUEPRINT.

UDP

┌──(kali㉿kali)-[~/archive/thm/blueprint]
└─$ sudo nmap -Pn -sU -top-ports 1000 $IP
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-05 11:49 CEST
Nmap scan report for 10.10.136.191
Host is up (0.057s latency).
Not shown: 991 closed udp ports (port-unreach)
PORT      STATE         SERVICE
123/udp   open|filtered ntp
137/udp   open          netbios-ns
138/udp   open|filtered netbios-dgm
161/udp   open|filtered snmp
500/udp   open|filtered isakmp
1900/udp  open|filtered upnp
4500/udp  open|filtered nat-t-ike
5355/udp  open|filtered llmnr
42172/udp open|filtered unknown
 
Nmap done: 1 IP address (1 host up) scanned in 1394.12 seconds

Interactive Graph View

Backlinks