Enumeration Link: https://tryhackme.com/room/vulnversity
Author: https://tryhackme.com/p/tryhackme
Host: 10.10.150.136
Let’s start with rustscan scan against the host for full port scan and version fingerprinting and default scripts.
┌──(root💀b0x)-[/mnt/hgfs/THM/Vulnversity] [141/147] └─# rustscan -a 10.10.150.136 --ulimit 5000 -b 4500 -- -A The Modern Day Port Scanner. ________________________________________ : https://discord.gg/GFrQsGy : : https://github.com/RustScan/RustScan : -------------------------------------- 🌍HACK THE PLANET🌍 [~] The config file is expected to be at "/root/.rustscan.toml" [~] Automatically increasing ulimit value to 5000....
Enumeration Host: 10.10.140.200
As always, let’s start with a quick NMAP (-A) scan against the host
┌──(root💀b0x)-[/mnt/hgfs/THM/Ignite] └─# nmap -A 10.10.140.200 -Pn -n Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( https://nmap.org ) at 2021-04-09 11:31 PKT Nmap scan report for 10.10.140.200 Host is up (0.19s latency). Not shown: 999 closed ports PORT STATE SERVICE VERSION 80/tcp open ssl/http Apache/2....
Enumeration IP: 10.10.25.58 Host: internal.thm
Let’s start with the nmap full port scan and see the open ports
Nmap full port scan ┌──(root💀b0x)-[/mnt/hgfs/THM/Internal] [7/117] └─# nmap -p- -v -iL ip -oN nmapFullPort.nmap Starting Nmap 7.91 ( https://nmap.org ) at 2021-04-07 13:15 PKT Initiating Ping Scan at 13:15 Scanning 10.10.25.58 [4 ports] Completed Ping Scan at 13:15, 0.22s elapsed (1 total hosts) Initiating SYN Stealth Scan at 13:15 Scanning internal....
Enumeration IP: 10.10.51.225
We can scan the host using rustscan (like nmap; but faster!) for open ports:
rustscan -a 10.10.51.225 --timeout 5000 --tries 2 --ulimit 5000 -- -sC -sV -a specifies the Host IP address --timeout specifies the timeout before saying the port is closed --tries how many times to try and connect to the port --ulimit specifies how many sockets to open at a time -- for passing arguments for nmap -sC -sV nmap arguments telling rustscan to run default scripts and version fingerprinting Scan results:...