simon/CTF
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

laokoon

Browse Source
This commit is contained in:
Simon
2023-11-24 17:54:35 +01:00
parent adf3a00bd7
commit eaec057bb1
138 changed files with 6861 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

288
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_commands.log Normal file
View File

@@ -0,0 +1,288 @@
nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_quick_tcp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_quick_tcp_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -p- -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_full_tcp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_full_tcp_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sU -A --top-ports 100 -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_top_100_udp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_top_100_udp_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_quick_tcp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_quick_tcp_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -p- -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_full_tcp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_full_tcp_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sU -A --top-ports 100 -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_top_100_udp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_top_100_udp_nmap.xml" 10.129.243.131
dig -p 53 -x 10.129.243.131 @10.129.243.131
dig AXFR -p 53 @10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 53 --script="banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dns_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/xml/tcp_53_dns_nmap.xml" 10.129.243.131
feroxbuster -u http://10.129.243.131:80/ -t 10 -w /root/.local/share/AutoRecon/wordlists/dirbuster.txt -x "txt,html,php,asp,aspx,jsp" -v -k -n -q -e -o "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_feroxbuster_dirbuster.txt"
curl -sSikf http://10.129.243.131:80/.well-known/security.txt
curl -sSikf http://10.129.243.131:80/robots.txt
curl -sSik http://10.129.243.131:80/
nmap -vv --reason -Pn -T4 -sV -p 80 --script="banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/xml/tcp_80_http_nmap.xml" 10.129.243.131
whatweb --color=never --no-errors -a 3 -v http://10.129.243.131:80 2>&1
wkhtmltoimage --format png http://10.129.243.131:80/ /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_screenshot.png
nmap -vv --reason -Pn -T4 -sV -p 88 --script="banner,krb5-enum-users" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/tcp_88_kerberos_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/xml/tcp_88_kerberos_nmap.xml" 10.129.243.131
impacket-getArch -target 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 135 --script="banner,msrpc-enum,rpc-grind,rpcinfo" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/tcp_135_rpc_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/xml/tcp_135_rpc_nmap.xml" 10.129.243.131
impacket-rpcdump -port 135 10.129.243.131
enum4linux -a -M -l -d 10.129.243.131 2>&1
nbtscan -rvh 10.129.243.131 2>&1
nmap -vv --reason -Pn -T4 -sV -p 139 --script="banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/tcp_139_smb_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/xml/tcp_139_smb_nmap.xml" 10.129.243.131
smbclient -L //10.129.243.131 -N -I 10.129.243.131 2>&1
smbmap -H 10.129.243.131 -P 139 2>&1
nmap -vv --reason -Pn -T4 -sV -p 389 --script="banner,(ldap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp389/tcp_389_ldap_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp389/xml/tcp_389_ldap_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 445 --script="banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/tcp_445_smb_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/xml/tcp_445_smb_nmap.xml" 10.129.243.131
smbmap -H 10.129.243.131 -P 445 2>&1
nmap -vv --reason -Pn -T4 -sV -p 464 --script="banner,krb5-enum-users" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/tcp_464_kerberos_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/xml/tcp_464_kerberos_nmap.xml" 10.129.243.131
impacket-rpcdump -port 593 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 3268 --script="banner,(ldap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp3268/tcp_3268_ldap_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp3268/xml/tcp_3268_ldap_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 49667 --script="banner,msrpc-enum,rpc-grind,rpcinfo" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49667/tcp_49667_rpc_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49667/xml/tcp_49667_rpc_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 49673 --script="banner,msrpc-enum,rpc-grind,rpcinfo" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49673/tcp_49673_rpc_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49673/xml/tcp_49673_rpc_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 49695 --script="banner,msrpc-enum,rpc-grind,rpcinfo" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49695/tcp_49695_rpc_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49695/xml/tcp_49695_rpc_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 49843 --script="banner,msrpc-enum,rpc-grind,rpcinfo" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49843/tcp_49843_rpc_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49843/xml/tcp_49843_rpc_nmap.xml" 10.129.243.131
smbmap -u null -p "" -H 10.129.243.131 -P 139 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 445 2>&1
smbmap -H 10.129.243.131 -P 139 -R 2>&1
smbmap -H 10.129.243.131 -P 445 -R 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 445 -R 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 139 -R 2>&1
smbmap -H 10.129.243.131 -P 445 -x "ipconfig /all" 2>&1
smbmap -H 10.129.243.131 -P 139 -x "ipconfig /all" 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 445 -x "ipconfig /all" 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 139 -x "ipconfig /all" 2>&1
nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_quick_tcp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_quick_tcp_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -p- -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_full_tcp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_full_tcp_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sU -A --top-ports 100 -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_top_100_udp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_top_100_udp_nmap.xml" 10.129.243.131
dig -p 53 -x 10.129.243.131 @10.129.243.131
dig AXFR -p 53 @10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 53 --script="banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dns_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/xml/tcp_53_dns_nmap.xml" 10.129.243.131
feroxbuster -u http://10.129.243.131:80/ -t 10 -w /root/.local/share/AutoRecon/wordlists/dirbuster.txt -x "txt,html,php,asp,aspx,jsp" -v -k -n -q -e -o "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_feroxbuster_dirbuster.txt"
curl -sSikf http://10.129.243.131:80/.well-known/security.txt
curl -sSikf http://10.129.243.131:80/robots.txt
curl -sSik http://10.129.243.131:80/
nmap -vv --reason -Pn -T4 -sV -p 80 --script="banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/xml/tcp_80_http_nmap.xml" 10.129.243.131
whatweb --color=never --no-errors -a 3 -v http://10.129.243.131:80 2>&1
wkhtmltoimage --format png http://10.129.243.131:80/ /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_screenshot.png
nmap -vv --reason -Pn -T4 -sV -p 88 --script="banner,krb5-enum-users" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/tcp_88_kerberos_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/xml/tcp_88_kerberos_nmap.xml" 10.129.243.131
impacket-getArch -target 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 135 --script="banner,msrpc-enum,rpc-grind,rpcinfo" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/tcp_135_rpc_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/xml/tcp_135_rpc_nmap.xml" 10.129.243.131
impacket-rpcdump -port 135 10.129.243.131
enum4linux -a -M -l -d 10.129.243.131 2>&1
nbtscan -rvh 10.129.243.131 2>&1
nmap -vv --reason -Pn -T4 -sV -p 139 --script="banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/tcp_139_smb_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/xml/tcp_139_smb_nmap.xml" 10.129.243.131
smbclient -L //10.129.243.131 -N -I 10.129.243.131 2>&1
smbmap -H 10.129.243.131 -P 139 2>&1
nmap -vv --reason -Pn -T4 -sV -p 389 --script="banner,(ldap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp389/tcp_389_ldap_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp389/xml/tcp_389_ldap_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 445 --script="banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/tcp_445_smb_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/xml/tcp_445_smb_nmap.xml" 10.129.243.131
smbmap -H 10.129.243.131 -P 445 2>&1
nmap -vv --reason -Pn -T4 -sV -p 464 --script="banner,krb5-enum-users" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/tcp_464_kerberos_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/xml/tcp_464_kerberos_nmap.xml" 10.129.243.131
impacket-rpcdump -port 593 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 3268 --script="banner,(ldap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp3268/tcp_3268_ldap_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp3268/xml/tcp_3268_ldap_nmap.xml" 10.129.243.131
smbmap -u null -p "" -H 10.129.243.131 -P 139 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 445 2>&1
smbmap -H 10.129.243.131 -P 139 -R 2>&1
smbmap -H 10.129.243.131 -P 445 -R 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 139 -R 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 445 -R 2>&1
smbmap -H 10.129.243.131 -P 139 -x "ipconfig /all" 2>&1
smbmap -H 10.129.243.131 -P 445 -x "ipconfig /all" 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 139 -x "ipconfig /all" 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 445 -x "ipconfig /all" 2>&1
dig -p 53 -x 10.129.243.131 @10.129.243.131
dig AXFR -p 53 @10.129.243.131
nmap -vv --reason -Pn -T4 -sU -sV -p 53 --script="banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dns_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/xml/udp_53_dns_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sU -sV -p 123 --script="banner,(ntp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp123/udp_123_ntp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp123/xml/udp_123_ntp_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_quick_tcp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_quick_tcp_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -p- -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_full_tcp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_full_tcp_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sU -A --top-ports 100 -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_top_100_udp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_top_100_udp_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_quick_tcp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_quick_tcp_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -p- -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_full_tcp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_full_tcp_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sU -A --top-ports 100 -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_top_100_udp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_top_100_udp_nmap.xml" 10.129.243.131
dnsrecon -n 10.129.243.131 -d megacorp.htb 2>&1
dig -p 53 -x 10.129.243.131 @10.129.243.131
dig AXFR -p 53 @10.129.243.131 megacorp.htb
nmap -vv --reason -Pn -T4 -sV -p 53 --script="banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dns_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/xml/tcp_53_dns_nmap.xml" 10.129.243.131
gobuster dns -d megacorp.htb -r 10.129.243.131 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -o "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_megacorp.htb_subdomains_subdomains-top1million-110000.txt"
feroxbuster -u http://10.129.243.131:80/ -t 10 -w /root/.local/share/AutoRecon/wordlists/dirbuster.txt -x "txt,html,php,asp,aspx,jsp" -v -k -n -q -e -o "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_feroxbuster_dirbuster.txt"
curl -sSikf http://10.129.243.131:80/.well-known/security.txt
curl -sSikf http://10.129.243.131:80/robots.txt
curl -sSik http://10.129.243.131:80/
nmap -vv --reason -Pn -T4 -sV -p 80 --script="banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/xml/tcp_80_http_nmap.xml" 10.129.243.131
curl -sk -o /dev/null -H "Host: buoTkusKMRHQqExxyMge.megacorp.htb" http://megacorp.htb:80/ -w "%{size_download}"
whatweb --color=never --no-errors -a 3 -v http://10.129.243.131:80 2>&1
wkhtmltoimage --format png http://10.129.243.131:80/ /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_screenshot.png
nmap -vv --reason -Pn -T4 -sV -p 88 --script="banner,krb5-enum-users" --script-args krb5-enum-users.realm="megacorp.htb",userdb="/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/tcp_88_kerberos_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/xml/tcp_88_kerberos_nmap.xml" 10.129.243.131
impacket-getArch -target 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 135 --script="banner,msrpc-enum,rpc-grind,rpcinfo" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/tcp_135_rpc_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/xml/tcp_135_rpc_nmap.xml" 10.129.243.131
impacket-rpcdump -port 135 10.129.243.131
enum4linux -a -M -l -d 10.129.243.131 2>&1
nbtscan -rvh 10.129.243.131 2>&1
nmap -vv --reason -Pn -T4 -sV -p 139 --script="banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/tcp_139_smb_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/xml/tcp_139_smb_nmap.xml" 10.129.243.131
smbclient -L //10.129.243.131 -N -I 10.129.243.131 2>&1
smbmap -H 10.129.243.131 -P 139 2>&1
nmap -vv --reason -Pn -T4 -sV -p 389 --script="banner,(ldap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp389/tcp_389_ldap_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp389/xml/tcp_389_ldap_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 445 --script="banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/tcp_445_smb_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/xml/tcp_445_smb_nmap.xml" 10.129.243.131
smbmap -H 10.129.243.131 -P 445 2>&1
nmap -vv --reason -Pn -T4 -sV -p 464 --script="banner,krb5-enum-users" --script-args krb5-enum-users.realm="megacorp.htb",userdb="/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/tcp_464_kerberos_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/xml/tcp_464_kerberos_nmap.xml" 10.129.243.131
impacket-rpcdump -port 593 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 3268 --script="banner,(ldap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp3268/tcp_3268_ldap_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp3268/xml/tcp_3268_ldap_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 49667 --script="banner,msrpc-enum,rpc-grind,rpcinfo" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49667/tcp_49667_rpc_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49667/xml/tcp_49667_rpc_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 49695 --script="banner,msrpc-enum,rpc-grind,rpcinfo" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49695/tcp_49695_rpc_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49695/xml/tcp_49695_rpc_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sV -p 49843 --script="banner,msrpc-enum,rpc-grind,rpcinfo" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49843/tcp_49843_rpc_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49843/xml/tcp_49843_rpc_nmap.xml" 10.129.243.131
ffuf -u http://megacorp.htb:80/ -t 10 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H "Host: FUZZ.megacorp.htb" -fs 1034 -noninteractive -s | tee "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_megacorp.htb_vhosts_subdomains-top1million-110000.txt"
dig AXFR -p 53 @10.129.243.131
smbmap -u null -p "" -H 10.129.243.131 -P 445 2>&1
smbmap -H 10.129.243.131 -P 445 -R 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 445 -R 2>&1
smbmap -H 10.129.243.131 -P 445 -x "ipconfig /all" 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 445 -x "ipconfig /all" 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 139 2>&1
smbmap -H 10.129.243.131 -P 139 -R 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 139 -R 2>&1
smbmap -H 10.129.243.131 -P 139 -x "ipconfig /all" 2>&1
smbmap -u null -p "" -H 10.129.243.131 -P 139 -x "ipconfig /all" 2>&1
dnsrecon -n 10.129.243.131 -d megacorp.htb 2>&1
dig -p 53 -x 10.129.243.131 @10.129.243.131
dig AXFR -p 53 @10.129.243.131 megacorp.htb
nmap -vv --reason -Pn -T4 -sU -sV -p 53 --script="banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dns_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/xml/udp_53_dns_nmap.xml" 10.129.243.131
gobuster dns -d megacorp.htb -r 10.129.243.131 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -o "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_megacorp.htb_subdomains_subdomains-top1million-110000.txt"
nmap -vv --reason -Pn -T4 -sU -sV -p 88 --script="banner,krb5-enum-users" --script-args krb5-enum-users.realm="megacorp.htb",userdb="/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp88/udp_88_kerberos_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp88/xml/udp_88_kerberos_nmap.xml" 10.129.243.131
nmap -vv --reason -Pn -T4 -sU -sV -p 123 --script="banner,(ntp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp123/udp_123_ntp_nmap.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp123/xml/udp_123_ntp_nmap.xml" 10.129.243.131
dig AXFR -p 53 @10.129.243.131

56
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_errors.log Normal file
View File

@@ -0,0 +1,56 @@
[*] Service scan DNS Reverse Lookup (tcp/53/domain/dns-reverse-lookup) ran a command which returned a non-zero exit code (9).
[-] Command: dig -p 53 -x 10.129.243.131 @10.129.243.131
[-] Error Output:
[*] Service scan DNS Zone Transfer (tcp/53/domain/dns-zone-transfer) ran a command which returned a non-zero exit code (9).
[-] Command: dig AXFR -p 53 @10.129.243.131
[-] Error Output:
[*] Service scan wkhtmltoimage (tcp/80/http/wkhtmltoimage) ran a command which returned a non-zero exit code (1).
[-] Command: wkhtmltoimage --format png http://10.129.243.131:80/ /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_screenshot.png
[-] Error Output:
QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'
Loading page (1/2)
[> ] 0%
[==============================> ] 50%
[==============================> ] 50%
Warning: Failed to load https://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/themes/smoothness/jquery-ui.css (ignore)
Error: Failed to load https://fonts.googleapis.com/css?family=Open+Sans%7CMaven+Pro:500, with network status code 3 and http status code 0 - Host fonts.googleapis.com not found
Error: Failed to load https://cdnjs.cloudflare.com/ajax/libs/prefixfree/1.0.7/prefixfree.min.js, with network status code 3 and http status code 0 - Host cdnjs.cloudflare.com not found
libva info: VA-API version 1.17.0
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
libva info: Found init function __vaDriverInit_1_17
libva error: /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so init failed
libva info: va_openDriver() returns 1
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/i965_drv_video.so
libva info: Found init function __vaDriverInit_1_8
libva info: va_openDriver() returns 0
[============================================================] 100%
Rendering (2/2)
[> ] 0%
[===============> ] 25%
[============================================================] 100%
Done
Exit with code 1 due to network error: HostNotFoundError
[*] Service scan SMBClient (tcp/139/netbios-ssn/smbclient) ran a command which returned a non-zero exit code (1).
[-] Command: smbclient -L //10.129.243.131 -N -I 10.129.243.131 2>&1
[-] Error Output:
[*] Service scan DNS Reverse Lookup (tcp/53/domain/dns-reverse-lookup) ran a command which returned a non-zero exit code (9).
[-] Command: dig -p 53 -x 10.129.243.131 @10.129.243.131
[-] Error Output:
[*] Service scan DNS Zone Transfer (tcp/53/domain/dns-zone-transfer) ran a command which returned a non-zero exit code (9).
[-] Command: dig AXFR -p 53 @10.129.243.131
[-] Error Output:
[*] Service scan DnsRecon Default Scan (tcp/53/domain/dnsrecon) ran a command which returned a non-zero exit code (1).
[-] Command: dnsrecon -n 10.129.243.131 -d megacorp.htb 2>&1
[-] Error Output:

77
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_full_tcp_nmap.txt Normal file
View File

@@ -0,0 +1,77 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:23:46 2023 as: nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -p- -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_full_tcp_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_full_tcp_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.041s latency).
Scanned at 2023-10-28 14:23:47 CEST for 245s
Not shown: 65517 filtered tcp ports (no-response)
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Slandovia Energy
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2023-10-28 12:26:10Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: MEGACORP.LOCAL0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped syn-ack ttl 127
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: MEGACORP.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack ttl 127
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49695/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49843/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
TCP/IP fingerprint:
SCAN(V=7.93%E=4%D=10/28%OT=53%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=653CFE48%P=x86_64-pc-linux-gnu)
SEQ(SP=101%GCD=1%ISR=10D%TI=I%II=I%SS=S%TS=U)
SEQ(SP=101%GCD=1%ISR=10D%TI=I%II=I%TS=U)
OPS(O1=M550NW8NNS%O2=M550NW8NNS%O3=M550NW8%O4=M550NW8NNS%O5=M550NW8NNS%O6=M550NNS)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)
ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M550NW8NNS%CC=Y%Q=)
T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
U1(R=N)
IE(R=Y%DFI=N%TG=80%CD=Z)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=257 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 0s
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 25314/tcp): CLEAN (Timeout)
| Check 2 (port 10793/tcp): CLEAN (Timeout)
| Check 3 (port 25536/udp): CLEAN (Timeout)
| Check 4 (port 25523/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time:
| date: 2023-10-28T12:27:13
|_ start_date: N/A
| smb2-security-mode:
| 311:
|_ Message signing enabled and required
TRACEROUTE (using port 135/tcp)
HOP RTT ADDRESS
1 35.29 ms 10.10.14.1
2 35.21 ms megacorp.htb (10.129.243.131)
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:27:52 2023 -- 1 IP address (1 host up) scanned in 246.21 seconds

338
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_manual_commands.txt Normal file
View File

@@ -0,0 +1,338 @@
[*] domain on tcp/53
[-] Use dnsrecon to bruteforce subdomains of a DNS domain.
dnsrecon -n 10.129.243.131 -d <DOMAIN-NAME> -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t brt 2>&1 | tee /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dnsrecon_subdomain_bruteforce.txt
[-] Use dnsrecon to automatically query data from the DNS server. You must specify the target domain name.
dnsrecon -n 10.129.243.131 -d <DOMAIN-NAME> 2>&1 | tee /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dnsrecon_default_manual.txt
[*] http on tcp/80
[-] (feroxbuster) Multi-threaded recursive directory/file enumeration for web servers using various wordlists:
feroxbuster -u http://10.129.243.131:80 -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -o /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_feroxbuster_dirbuster.txt
[-] Credential bruteforcing commands (don't run these without modifying them):
hydra -L "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e nsr -s 80 -o "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_auth_hydra.txt" http-get://10.129.243.131/path/to/auth/area
medusa -U "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e ns -n 80 -O "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_auth_medusa.txt" -M http -h 10.129.243.131 -m DIR:/path/to/auth/area
hydra -L "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e nsr -s 80 -o "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_form_hydra.txt" http-post-form://10.129.243.131/path/to/login.php:"username=^USER^&password=^PASS^":"invalid-login-message"
medusa -U "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e ns -n 80 -O "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_form_medusa.txt" -M web-form -h 10.129.243.131 -m FORM:/path/to/login.php -m FORM-DATA:"post?username=&password=" -m DENY-SIGNAL:"invalid login message"
[-] (nikto) old but generally reliable web server enumeration tool:
nikto -ask=no -h http://10.129.243.131:80 2>&1 | tee "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_nikto.txt"
[-] (wpscan) WordPress Security Scanner (useful if WordPress is found):
wpscan --url http://10.129.243.131:80/ --no-update -e vp,vt,tt,cb,dbe,u,m --plugins-detection aggressive --plugins-version-detection aggressive -f cli-no-color 2>&1 | tee "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_wpscan.txt"
[*] msrpc on tcp/135
[-] RPC Client:
rpcclient -p 135 -U "" 10.129.243.131
[*] netbios-ssn on tcp/139
[-] Bruteforce SMB
crackmapexec smb 10.129.243.131 --port=139 -u "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -p "/usr/share/seclists/Passwords/darkweb2017-top100.txt"
[-] Nmap scans for SMB vulnerabilities that could potentially cause a DoS if scanned (according to Nmap). Be careful:
nmap -vv --reason -Pn -T4 -sV -p 139 --script="smb-vuln-* and dos" --script-args="unsafe=1" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/tcp_139_smb_vulnerabilities.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/xml/tcp_139_smb_vulnerabilities.xml" 10.129.243.131
[*] ldap on tcp/389
[-] ldapsearch command (modify before running):
ldapsearch -x -D "<username>" -w "<password>" -H ldap://10.129.243.131:389 -b "dc=example,dc=com" -s sub "(objectclass=*)" 2>&1 | tee > "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp389/tcp_389_ldap_all-entries.txt"
[*] microsoft-ds on tcp/445
[-] Bruteforce SMB
crackmapexec smb 10.129.243.131 --port=445 -u "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -p "/usr/share/seclists/Passwords/darkweb2017-top100.txt"
[-] Lookup SIDs
impacket-lookupsid '[username]:[password]@10.129.243.131'
[-] Nmap scans for SMB vulnerabilities that could potentially cause a DoS if scanned (according to Nmap). Be careful:
nmap -vv --reason -Pn -T4 -sV -p 445 --script="smb-vuln-* and dos" --script-args="unsafe=1" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/tcp_445_smb_vulnerabilities.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/xml/tcp_445_smb_vulnerabilities.xml" 10.129.243.131
[*] ldap on tcp/3268
[-] ldapsearch command (modify before running):
ldapsearch -x -D "<username>" -w "<password>" -H ldap://10.129.243.131:3268 -b "dc=example,dc=com" -s sub "(objectclass=*)" 2>&1 | tee > "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp3268/tcp_3268_ldap_all-entries.txt"
[*] wsman on tcp/5985
[-] Bruteforce logins:
crackmapexec winrm 10.129.243.131 -d '<domain>' -u '/usr/share/seclists/Usernames/top-usernames-shortlist.txt' -p '/usr/share/seclists/Passwords/darkweb2017-top100.txt'
[-] Check login (requires credentials):
crackmapexec winrm 10.129.243.131 -d '<domain>' -u '<username>' -p '<password>'
[-] Evil WinRM (gem install evil-winrm):
evil-winrm -u '<user>' -p '<password>' -i 10.129.243.131
evil-winrm -u '<user>' -H '<hash>' -i 10.129.243.131
[*] msrpc on tcp/49667
[-] RPC Client:
rpcclient -p 49667 -U "" 10.129.243.131
[*] msrpc on tcp/49673
[-] RPC Client:
rpcclient -p 49673 -U "" 10.129.243.131
[*] msrpc on tcp/49695
[-] RPC Client:
rpcclient -p 49695 -U "" 10.129.243.131
[*] msrpc on tcp/49843
[-] RPC Client:
rpcclient -p 49843 -U "" 10.129.243.131
[*] domain on tcp/53
[-] Use dnsrecon to bruteforce subdomains of a DNS domain.
dnsrecon -n 10.129.243.131 -d <DOMAIN-NAME> -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t brt 2>&1 | tee /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dnsrecon_subdomain_bruteforce.txt
[-] Use dnsrecon to automatically query data from the DNS server. You must specify the target domain name.
dnsrecon -n 10.129.243.131 -d <DOMAIN-NAME> 2>&1 | tee /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dnsrecon_default_manual.txt
[*] http on tcp/80
[-] (feroxbuster) Multi-threaded recursive directory/file enumeration for web servers using various wordlists:
feroxbuster -u http://10.129.243.131:80 -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -o /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_feroxbuster_dirbuster.txt
[-] Credential bruteforcing commands (don't run these without modifying them):
hydra -L "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e nsr -s 80 -o "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_auth_hydra.txt" http-get://10.129.243.131/path/to/auth/area
medusa -U "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e ns -n 80 -O "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_auth_medusa.txt" -M http -h 10.129.243.131 -m DIR:/path/to/auth/area
hydra -L "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e nsr -s 80 -o "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_form_hydra.txt" http-post-form://10.129.243.131/path/to/login.php:"username=^USER^&password=^PASS^":"invalid-login-message"
medusa -U "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e ns -n 80 -O "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_form_medusa.txt" -M web-form -h 10.129.243.131 -m FORM:/path/to/login.php -m FORM-DATA:"post?username=&password=" -m DENY-SIGNAL:"invalid login message"
[-] (nikto) old but generally reliable web server enumeration tool:
nikto -ask=no -h http://10.129.243.131:80 2>&1 | tee "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_nikto.txt"
[-] (wpscan) WordPress Security Scanner (useful if WordPress is found):
wpscan --url http://10.129.243.131:80/ --no-update -e vp,vt,tt,cb,dbe,u,m --plugins-detection aggressive --plugins-version-detection aggressive -f cli-no-color 2>&1 | tee "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_wpscan.txt"
[*] msrpc on tcp/135
[-] RPC Client:
rpcclient -p 135 -U "" 10.129.243.131
[*] netbios-ssn on tcp/139
[-] Bruteforce SMB
crackmapexec smb 10.129.243.131 --port=139 -u "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -p "/usr/share/seclists/Passwords/darkweb2017-top100.txt"
[-] Nmap scans for SMB vulnerabilities that could potentially cause a DoS if scanned (according to Nmap). Be careful:
nmap -vv --reason -Pn -T4 -sV -p 139 --script="smb-vuln-* and dos" --script-args="unsafe=1" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/tcp_139_smb_vulnerabilities.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/xml/tcp_139_smb_vulnerabilities.xml" 10.129.243.131
[*] ldap on tcp/389
[-] ldapsearch command (modify before running):
ldapsearch -x -D "<username>" -w "<password>" -H ldap://10.129.243.131:389 -b "dc=example,dc=com" -s sub "(objectclass=*)" 2>&1 | tee > "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp389/tcp_389_ldap_all-entries.txt"
[*] microsoft-ds on tcp/445
[-] Bruteforce SMB
crackmapexec smb 10.129.243.131 --port=445 -u "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -p "/usr/share/seclists/Passwords/darkweb2017-top100.txt"
[-] Lookup SIDs
impacket-lookupsid '[username]:[password]@10.129.243.131'
[-] Nmap scans for SMB vulnerabilities that could potentially cause a DoS if scanned (according to Nmap). Be careful:
nmap -vv --reason -Pn -T4 -sV -p 445 --script="smb-vuln-* and dos" --script-args="unsafe=1" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/tcp_445_smb_vulnerabilities.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/xml/tcp_445_smb_vulnerabilities.xml" 10.129.243.131
[*] ldap on tcp/3268
[-] ldapsearch command (modify before running):
ldapsearch -x -D "<username>" -w "<password>" -H ldap://10.129.243.131:3268 -b "dc=example,dc=com" -s sub "(objectclass=*)" 2>&1 | tee > "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp3268/tcp_3268_ldap_all-entries.txt"
[*] wsman on tcp/5985
[-] Bruteforce logins:
crackmapexec winrm 10.129.243.131 -d '<domain>' -u '/usr/share/seclists/Usernames/top-usernames-shortlist.txt' -p '/usr/share/seclists/Passwords/darkweb2017-top100.txt'
[-] Check login (requires credentials):
crackmapexec winrm 10.129.243.131 -d '<domain>' -u '<username>' -p '<password>'
[-] Evil WinRM (gem install evil-winrm):
evil-winrm -u '<user>' -p '<password>' -i 10.129.243.131
evil-winrm -u '<user>' -H '<hash>' -i 10.129.243.131
[*] domain on udp/53
[-] Use dnsrecon to bruteforce subdomains of a DNS domain.
dnsrecon -n 10.129.243.131 -d <DOMAIN-NAME> -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t brt 2>&1 | tee /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dnsrecon_subdomain_bruteforce.txt
[-] Use dnsrecon to automatically query data from the DNS server. You must specify the target domain name.
dnsrecon -n 10.129.243.131 -d <DOMAIN-NAME> 2>&1 | tee /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dnsrecon_default_manual.txt
[*] domain on tcp/53
[-] Use dnsrecon to bruteforce subdomains of a DNS domain.
dnsrecon -n 10.129.243.131 -d megacorp.htb -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t brt 2>&1 | tee /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dnsrecon_subdomain_bruteforce.txt
[-] Use dnsrecon to automatically query data from the DNS server. You must specify the target domain name.
dnsrecon -n 10.129.243.131 -d <DOMAIN-NAME> 2>&1 | tee /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dnsrecon_default_manual.txt
[*] http on tcp/80
[-] (feroxbuster) Multi-threaded recursive directory/file enumeration for web servers using various wordlists:
feroxbuster -u http://10.129.243.131:80 -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -o /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_feroxbuster_dirbuster.txt
[-] Credential bruteforcing commands (don't run these without modifying them):
hydra -L "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e nsr -s 80 -o "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_auth_hydra.txt" http-get://10.129.243.131/path/to/auth/area
medusa -U "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e ns -n 80 -O "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_auth_medusa.txt" -M http -h 10.129.243.131 -m DIR:/path/to/auth/area
hydra -L "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e nsr -s 80 -o "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_form_hydra.txt" http-post-form://10.129.243.131/path/to/login.php:"username=^USER^&password=^PASS^":"invalid-login-message"
medusa -U "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -P "/usr/share/seclists/Passwords/darkweb2017-top100.txt" -e ns -n 80 -O "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_form_medusa.txt" -M web-form -h 10.129.243.131 -m FORM:/path/to/login.php -m FORM-DATA:"post?username=&password=" -m DENY-SIGNAL:"invalid login message"
[-] (nikto) old but generally reliable web server enumeration tool:
nikto -ask=no -h http://10.129.243.131:80 2>&1 | tee "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_nikto.txt"
[-] (wpscan) WordPress Security Scanner (useful if WordPress is found):
wpscan --url http://10.129.243.131:80/ --no-update -e vp,vt,tt,cb,dbe,u,m --plugins-detection aggressive --plugins-version-detection aggressive -f cli-no-color 2>&1 | tee "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_wpscan.txt"
[*] msrpc on tcp/135
[-] RPC Client:
rpcclient -p 135 -U "" 10.129.243.131
[*] netbios-ssn on tcp/139
[-] Bruteforce SMB
crackmapexec smb 10.129.243.131 --port=139 -u "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -p "/usr/share/seclists/Passwords/darkweb2017-top100.txt"
[-] Nmap scans for SMB vulnerabilities that could potentially cause a DoS if scanned (according to Nmap). Be careful:
nmap -vv --reason -Pn -T4 -sV -p 139 --script="smb-vuln-* and dos" --script-args="unsafe=1" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/tcp_139_smb_vulnerabilities.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/xml/tcp_139_smb_vulnerabilities.xml" 10.129.243.131
[*] ldap on tcp/389
[-] ldapsearch command (modify before running):
ldapsearch -x -D "<username>" -w "<password>" -H ldap://10.129.243.131:389 -b "dc=example,dc=com" -s sub "(objectclass=*)" 2>&1 | tee > "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp389/tcp_389_ldap_all-entries.txt"
[*] microsoft-ds on tcp/445
[-] Bruteforce SMB
crackmapexec smb 10.129.243.131 --port=445 -u "/usr/share/seclists/Usernames/top-usernames-shortlist.txt" -p "/usr/share/seclists/Passwords/darkweb2017-top100.txt"
[-] Lookup SIDs
impacket-lookupsid '[username]:[password]@10.129.243.131'
[-] Nmap scans for SMB vulnerabilities that could potentially cause a DoS if scanned (according to Nmap). Be careful:
nmap -vv --reason -Pn -T4 -sV -p 445 --script="smb-vuln-* and dos" --script-args="unsafe=1" -oN "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/tcp_445_smb_vulnerabilities.txt" -oX "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/xml/tcp_445_smb_vulnerabilities.xml" 10.129.243.131
[*] ldap on tcp/3268
[-] ldapsearch command (modify before running):
ldapsearch -x -D "<username>" -w "<password>" -H ldap://10.129.243.131:3268 -b "dc=example,dc=com" -s sub "(objectclass=*)" 2>&1 | tee > "/home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp3268/tcp_3268_ldap_all-entries.txt"
[*] wsman on tcp/5985
[-] Bruteforce logins:
crackmapexec winrm 10.129.243.131 -d 'megacorp.htb' -u '/usr/share/seclists/Usernames/top-usernames-shortlist.txt' -p '/usr/share/seclists/Passwords/darkweb2017-top100.txt'
[-] Check login (requires credentials):
crackmapexec winrm 10.129.243.131 -d 'megacorp.htb' -u '<username>' -p '<password>'
[-] Evil WinRM (gem install evil-winrm):
evil-winrm -u '<user>' -p '<password>' -i 10.129.243.131
evil-winrm -u '<user>' -H '<hash>' -i 10.129.243.131
[*] msrpc on tcp/49667
[-] RPC Client:
rpcclient -p 49667 -U "" 10.129.243.131
[*] msrpc on tcp/49695
[-] RPC Client:
rpcclient -p 49695 -U "" 10.129.243.131
[*] msrpc on tcp/49843
[-] RPC Client:
rpcclient -p 49843 -U "" 10.129.243.131
[*] domain on udp/53
[-] Use dnsrecon to bruteforce subdomains of a DNS domain.
dnsrecon -n 10.129.243.131 -d megacorp.htb -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t brt 2>&1 | tee /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dnsrecon_subdomain_bruteforce.txt
[-] Use dnsrecon to automatically query data from the DNS server. You must specify the target domain name.
dnsrecon -n 10.129.243.131 -d <DOMAIN-NAME> 2>&1 | tee /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dnsrecon_default_manual.txt

8
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_patterns.log Normal file
View File

@@ -0,0 +1,8 @@
Identified Architecture: 64-bit
Identified HTTP Server: Microsoft-IIS/10.0
Identified Architecture: 64-bit
Identified HTTP Server: Microsoft-IIS/10.0

67
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_quick_tcp_nmap.txt Normal file
View File

@@ -0,0 +1,67 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:23:46 2023 as: nmap -vv --reason -Pn -T4 -sV -sC --version-all -A --osscan-guess -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_quick_tcp_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_quick_tcp_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.061s latency).
Scanned at 2023-10-28 14:23:46 CEST for 449s
Not shown: 988 filtered tcp ports (no-response)
PORT STATE SERVICE REASON VERSION
53/tcp open domain? syn-ack ttl 127
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-title: Slandovia Energy
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2023-10-28 12:23:58Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: MEGACORP.LOCAL0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped syn-ack ttl 127
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: MEGACORP.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack ttl 127
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
TCP/IP fingerprint:
SCAN(V=7.93%E=4%D=10/28%OT=53%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=653CFF13%P=x86_64-pc-linux-gnu)
SEQ(SP=108%GCD=1%ISR=10A%TS=U)
OPS(O1=M550NW8NNS%O2=M550NW8NNS%O3=M550NW8%O4=M550NW8NNS%O5=M550NW8NNS%O6=M550NNS)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)
ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M550NW8NNS%CC=Y%Q=)
T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
U1(R=N)
IE(R=Y%DFI=N%TG=80%CD=Z)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=264 (Good luck!)
IP ID Sequence Generation: Busy server or unknown class
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 311:
|_ Message signing enabled and required
|_clock-skew: 0s
| smb2-time:
| date: 2023-10-28T12:30:36
|_ start_date: N/A
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 25314/tcp): CLEAN (Timeout)
| Check 2 (port 10793/tcp): CLEAN (Timeout)
| Check 3 (port 25536/udp): CLEAN (Timeout)
| Check 4 (port 25523/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
TRACEROUTE (using port 53/tcp)
HOP RTT ADDRESS
1 74.01 ms 10.10.14.1
2 74.05 ms megacorp.htb (10.129.243.131)
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:31:15 2023 -- 1 IP address (1 host up) scanned in 449.29 seconds

38
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_top_100_udp_nmap.txt Normal file
View File

@@ -0,0 +1,38 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:23:46 2023 as: nmap -vv --reason -Pn -T4 -sU -A --top-ports 100 -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_top_100_udp_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_top_100_udp_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.055s latency).
Scanned at 2023-10-28 14:23:46 CEST for 1767s
Not shown: 97 open|filtered udp ports (no-response)
PORT STATE SERVICE REASON VERSION
53/udp open domain udp-response (generic dns response: SERVFAIL)
| fingerprint-strings:
| NBTStat:
|_ CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
88/udp open kerberos-sec udp-response Microsoft Windows Kerberos (server time: 2023-10-28 12:23:58Z)
123/udp open ntp udp-response ttl 127 NTP v3
| ntp-info:
|_ receive time stamp: 2023-10-28T12:30:46
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-UDP:V=7.93%I=7%D=10/28%Time=653CFD6C%P=x86_64-pc-linux-gnu%r(NBT
SF:Stat,32,"\x80\xf0\x80\x82\0\x01\0\0\0\0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAA
SF:AAAAAAAA\0\0!\0\x01");
Too many fingerprints match this host to give specific OS details
TCP/IP fingerprint:
SCAN(V=7.93%E=4%D=10/28%OT=%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=653D0439%P=x86_64-pc-linux-gnu)
U1(R=N)
IE(R=N)
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 14s
TRACEROUTE (using port 123/udp)
HOP RTT ADDRESS
1 44.38 ms 10.10.14.1
2 57.06 ms megacorp.htb (10.129.243.131)
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:53:13 2023 -- 1 IP address (1 host up) scanned in 1767.23 seconds

6
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/tcp_135_rpc_architecture.txt Normal file
View File

@@ -0,0 +1,6 @@
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Gathering OS architecture for 1 machines
[*] Socket connect timeout set to 2 secs
10.129.243.131 is 64-bit

12
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/tcp_135_rpc_nmap.txt Normal file
View File

@@ -0,0 +1,12 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv --reason -Pn -T4 -sV -p 135 --script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/tcp_135_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/xml/tcp_135_rpc_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.62s latency).
Scanned at 2023-10-28 14:27:56 CEST for 23s
PORT STATE SERVICE REASON VERSION
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:28:19 2023 -- 1 IP address (1 host up) scanned in 26.49 seconds

880
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/tcp_135_rpc_rpcdump.txt Normal file
View File

@@ -0,0 +1,880 @@
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Retrieving endpoint list from 10.129.243.131
Protocol: [MS-RSP]: Remote Shutdown Protocol
Provider: wininit.exe
UUID : D95AFE70-A6D5-4259-822E-2C84DA1DDB0D v1.0
Bindings:
ncacn_ip_tcp:10.129.243.131[49664]
ncalrpc:[WindowsShutdown]
ncacn_np:\\DC[\PIPE\InitShutdown]
ncalrpc:[WMsgKRpc089280]
Protocol: N/A
Provider: winlogon.exe
UUID : 76F226C3-EC14-4325-8A99-6A46348418AF v1.0
Bindings:
ncalrpc:[WindowsShutdown]
ncacn_np:\\DC[\PIPE\InitShutdown]
ncalrpc:[WMsgKRpc089280]
ncalrpc:[WMsgKRpc08A621]
Protocol: N/A
Provider: N/A
UUID : D09BDEB5-6171-4A34-BFE2-06FA82652568 v1.0
Bindings:
ncalrpc:[csebpub]
ncalrpc:[LRPC-6b54d635557b62ca53]
ncalrpc:[LRPC-e71821bbfb97e6ac17]
ncalrpc:[LRPC-6b4af19739a6d01556]
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
ncalrpc:[LRPC-e71821bbfb97e6ac17]
ncalrpc:[LRPC-6b4af19739a6d01556]
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
ncalrpc:[LRPC-6b4af19739a6d01556]
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
ncalrpc:[LRPC-9e83194e1e5674c55f]
ncalrpc:[LRPC-a91e72435259adddfa]
Protocol: N/A
Provider: N/A
UUID : 697DCDA9-3BA9-4EB2-9247-E11F1901B0D2 v1.0
Bindings:
ncalrpc:[LRPC-6b54d635557b62ca53]
ncalrpc:[LRPC-e71821bbfb97e6ac17]
ncalrpc:[LRPC-6b4af19739a6d01556]
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 9B008953-F195-4BF9-BDE0-4471971E58ED v1.0
Bindings:
ncalrpc:[LRPC-e71821bbfb97e6ac17]
ncalrpc:[LRPC-6b4af19739a6d01556]
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : DD59071B-3215-4C59-8481-972EDADC0F6A v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 0D47017B-B33B-46AD-9E18-FE96456C5078 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 95406F0B-B239-4318-91BB-CEA3A46FF0DC v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 4ED8ABCC-F1E2-438B-981F-BB0E8ABC010C v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 0FF1F646-13BB-400A-AB50-9A78F2B7A85A v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 6982A06E-5FE2-46B1-B39C-A2C545BFA069 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 082A3471-31B6-422A-B931-A54401960C62 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : FAE436B0-B864-4A87-9EDA-298547CD82F2 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : E53D94CA-7464-4839-B044-09A2FB8B3AE5 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 178D84BE-9291-4994-82C6-3F909ACA5A03 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 4DACE966-A243-4450-AE3F-9B7BCB5315B8 v2.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 1832BCF6-CAB8-41D4-85D2-C9410764F75A v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : C521FACF-09A9-42C5-B155-72388595CBF0 v0.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 2C7FD9CE-E706-4B40-B412-953107EF9BB0 v0.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 88ABCBC3-34EA-76AE-8215-767520655A23 v0.0
Bindings:
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 76C217BC-C8B4-4201-A745-373AD9032B1A v1.0
Bindings:
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 55E6B932-1979-45D6-90C5-7F6270724112 v1.0
Bindings:
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 857FB1BE-084F-4FB5-B59C-4B2C4BE5F0CF v1.0
Bindings:
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : B8CADBAF-E84B-46B9-84F2-6F71C03F9E55 v1.0
Bindings:
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 20C40295-8DBA-48E6-AEBF-3E78EF3BB144 v1.0
Bindings:
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 2513BCBE-6CD4-4348-855E-7EFB3C336DD3 v1.0
Bindings:
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 0D3E2735-CEA0-4ECC-A9E2-41A2D81AED4E v1.0
Bindings:
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : C605F9FB-F0A3-4E2A-A073-73560F8D9E3E v1.0
Bindings:
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 1B37CA91-76B1-4F5E-A3C7-2ABFC61F2BB0 v1.0
Bindings:
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 8BFC3BE1-6DEF-4E2D-AF74-7C47CD0ADE4A v1.0
Bindings:
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 2D98A740-581D-41B9-AA0D-A88B9D5CE938 v1.0
Bindings:
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 0361AE94-0316-4C6C-8AD8-C594375800E2 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 5824833B-3C1A-4AD2-BDFD-C31D19E23ED2 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : BDAA0970-413B-4A3E-9E5D-F6DC9D7E0760 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 3B338D89-6CFA-44B8-847E-531531BC9992 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 8782D3B9-EBBD-4644-A3D8-E8725381919B v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 085B0334-E454-4D91-9B8C-4134F9E793F3 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 4BEC6BB8-B5C2-4B6F-B2C1-5DA5CF92D0D9 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: sysntfy.dll
UUID : C9AC6DB5-82B7-4E55-AE8A-E464ED7B4277 v1.0 Impl friendly name
Bindings:
ncalrpc:[LRPC-78c65697da0c3cb9e7]
ncalrpc:[LRPC-5d1d91fbc9832f3673]
ncalrpc:[IUserProfile2]
ncalrpc:[LRPC-7f9f9d7e564fa27a15]
ncalrpc:[senssvc]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
ncalrpc:[LRPC-2d7a6fcd1e6a5d90b0]
ncalrpc:[OLE59700168EED37EDF88950A0917DC]
Protocol: N/A
Provider: nsisvc.dll
UUID : 7EA70BCF-48AF-4F6A-8968-6A440754D5FA v1.0 NSI server endpoint
Bindings:
ncalrpc:[LRPC-9ec11ee764d799175d]
Protocol: N/A
Provider: nrpsrv.dll
UUID : 30ADC50C-5CBC-46CE-9A0E-91914789E23C v1.0 NRP server endpoint
Bindings:
ncalrpc:[LRPC-99bbae991f0f6e961a]
Protocol: N/A
Provider: N/A
UUID : E40F7B57-7A25-4CD3-A135-7F7D3DF9D16B v1.0 Network Connection Broker server endpoint
Bindings:
ncalrpc:[LRPC-95313533ddc887d499]
ncalrpc:[OLE11E1ADACE4D3F3328245D6CF61B4]
ncalrpc:[LRPC-4f7c4b35ddfa33800c]
ncalrpc:[LRPC-9e83194e1e5674c55f]
Protocol: N/A
Provider: N/A
UUID : 880FD55E-43B9-11E0-B1A8-CF4EDFD72085 v1.0 KAPI Service endpoint
Bindings:
ncalrpc:[LRPC-95313533ddc887d499]
ncalrpc:[OLE11E1ADACE4D3F3328245D6CF61B4]
ncalrpc:[LRPC-4f7c4b35ddfa33800c]
ncalrpc:[LRPC-9e83194e1e5674c55f]
Protocol: N/A
Provider: N/A
UUID : 5222821F-D5E2-4885-84F1-5F6185A0EC41 v1.0 Network Connection Broker server endpoint for NCB Reset module
Bindings:
ncalrpc:[LRPC-4f7c4b35ddfa33800c]
ncalrpc:[LRPC-9e83194e1e5674c55f]
Protocol: N/A
Provider: N/A
UUID : A500D4C6-0DD1-4543-BC0C-D5F93486EAF8 v1.0
Bindings:
ncalrpc:[LRPC-7d4055d4f64c73ef42]
ncalrpc:[LRPC-a91e72435259adddfa]
Protocol: N/A
Provider: dhcpcsvc.dll
UUID : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D5 v1.0 DHCP Client LRPC Endpoint
Bindings:
ncalrpc:[dhcpcsvc]
ncalrpc:[dhcpcsvc6]
Protocol: N/A
Provider: dhcpcsvc6.dll
UUID : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D6 v1.0 DHCPv6 Client LRPC Endpoint
Bindings:
ncalrpc:[dhcpcsvc6]
Protocol: [MS-EVEN6]: EventLog Remoting Protocol
Provider: wevtsvc.dll
UUID : F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C v1.0 Event log TCPIP
Bindings:
ncacn_ip_tcp:10.129.243.131[49665]
ncacn_np:\\DC[\pipe\eventlog]
ncalrpc:[eventlog]
Protocol: N/A
Provider: gpsvc.dll
UUID : 2EB08E3E-639F-4FBA-97B1-14F878961076 v1.0 Group Policy RPC Interface
Bindings:
ncalrpc:[LRPC-1e815b36ff28d761c1]
Protocol: N/A
Provider: N/A
UUID : 3A9EF155-691D-4449-8D05-09AD57031823 v1.0
Bindings:
ncacn_ip_tcp:10.129.243.131[49666]
ncalrpc:[LRPC-3e1dbf52587c9cea33]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\DC[\PIPE\atsvc]
ncalrpc:[LRPC-a6fa6dc5bb5e22a3a2]
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
Provider: schedsvc.dll
UUID : 86D35949-83C9-4044-B424-DB363231FD0C v1.0
Bindings:
ncacn_ip_tcp:10.129.243.131[49666]
ncalrpc:[LRPC-3e1dbf52587c9cea33]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\DC[\PIPE\atsvc]
ncalrpc:[LRPC-a6fa6dc5bb5e22a3a2]
Protocol: N/A
Provider: N/A
UUID : 33D84484-3626-47EE-8C6F-E7E98B113BE1 v2.0
Bindings:
ncalrpc:[LRPC-3e1dbf52587c9cea33]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\DC[\PIPE\atsvc]
ncalrpc:[LRPC-a6fa6dc5bb5e22a3a2]
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
Provider: taskcomp.dll
UUID : 378E52B0-C0A9-11CF-822D-00AA0051E40F v1.0
Bindings:
ncacn_np:\\DC[\PIPE\atsvc]
ncalrpc:[LRPC-a6fa6dc5bb5e22a3a2]
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
Provider: taskcomp.dll
UUID : 1FF70682-0A51-30E8-076D-740BE8CEE98B v1.0
Bindings:
ncacn_np:\\DC[\PIPE\atsvc]
ncalrpc:[LRPC-a6fa6dc5bb5e22a3a2]
Protocol: N/A
Provider: schedsvc.dll
UUID : 0A74EF1C-41A4-4E06-83AE-DC74FB1CDD53 v1.0
Bindings:
ncalrpc:[LRPC-a6fa6dc5bb5e22a3a2]
Protocol: N/A
Provider: MPSSVC.dll
UUID : 2FB92682-6599-42DC-AE13-BD2CA89BD11C v1.0 Fw APIs
Bindings:
ncalrpc:[LRPC-a3db541015ee3b4092]
ncalrpc:[LRPC-25295713f276d13d17]
ncalrpc:[LRPC-61500542b0c0f189c2]
ncalrpc:[LRPC-3a5ad18195f7896668]
Protocol: N/A
Provider: N/A
UUID : F47433C3-3E9D-4157-AAD4-83AA1F5C2D4C v1.0 Fw APIs
Bindings:
ncalrpc:[LRPC-25295713f276d13d17]
ncalrpc:[LRPC-61500542b0c0f189c2]
ncalrpc:[LRPC-3a5ad18195f7896668]
Protocol: N/A
Provider: MPSSVC.dll
UUID : 7F9D11BF-7FB9-436B-A812-B2D50C5D4C03 v1.0 Fw APIs
Bindings:
ncalrpc:[LRPC-61500542b0c0f189c2]
ncalrpc:[LRPC-3a5ad18195f7896668]
Protocol: N/A
Provider: BFE.DLL
UUID : DD490425-5325-4565-B774-7E27D6C09C24 v1.0 Base Firewall Engine API
Bindings:
ncalrpc:[LRPC-3a5ad18195f7896668]
Protocol: N/A
Provider: N/A
UUID : 7F1343FE-50A9-4927-A778-0C5859517BAC v1.0 DfsDs service
Bindings:
ncacn_np:\\DC[\PIPE\wkssvc]
ncalrpc:[LRPC-0a9c64a79e96914cf8]
Protocol: N/A
Provider: N/A
UUID : EB081A0D-10EE-478A-A1DD-50995283E7A8 v3.0 Witness Client Test Interface
Bindings:
ncalrpc:[LRPC-0a9c64a79e96914cf8]
Protocol: N/A
Provider: N/A
UUID : F2C9B409-C1C9-4100-8639-D8AB1486694A v1.0 Witness Client Upcall Server
Bindings:
ncalrpc:[LRPC-0a9c64a79e96914cf8]
Protocol: N/A
Provider: N/A
UUID : C2D1B5DD-FA81-4460-9DD6-E7658B85454B v1.0
Bindings:
ncalrpc:[LRPC-eeed9c661ca2875f9a]
ncalrpc:[OLEAC93DB631A747BCA540781AA6BEF]
Protocol: N/A
Provider: N/A
UUID : F44E62AF-DAB1-44C2-8013-049A9DE417D6 v1.0
Bindings:
ncalrpc:[LRPC-eeed9c661ca2875f9a]
ncalrpc:[OLEAC93DB631A747BCA540781AA6BEF]
Protocol: N/A
Provider: N/A
UUID : 7AEB6705-3AE6-471A-882D-F39C109EDC12 v1.0
Bindings:
ncalrpc:[LRPC-eeed9c661ca2875f9a]
ncalrpc:[OLEAC93DB631A747BCA540781AA6BEF]
Protocol: N/A
Provider: N/A
UUID : E7F76134-9EF5-4949-A2D6-3368CC0988F3 v1.0
Bindings:
ncalrpc:[LRPC-eeed9c661ca2875f9a]
ncalrpc:[OLEAC93DB631A747BCA540781AA6BEF]
Protocol: N/A
Provider: N/A
UUID : B37F900A-EAE4-4304-A2AB-12BB668C0188 v1.0
Bindings:
ncalrpc:[LRPC-eeed9c661ca2875f9a]
ncalrpc:[OLEAC93DB631A747BCA540781AA6BEF]
Protocol: N/A
Provider: N/A
UUID : ABFB6CA3-0C5E-4734-9285-0AEE72FE8D1C v1.0
Bindings:
ncalrpc:[LRPC-eeed9c661ca2875f9a]
ncalrpc:[OLEAC93DB631A747BCA540781AA6BEF]
Protocol: N/A
Provider: N/A
UUID : C49A5A70-8A7F-4E70-BA16-1E8F1F193EF1 v1.0 Adh APIs
Bindings:
ncalrpc:[OLE5FCB0823110EF79154A84BC1C955]
ncalrpc:[TeredoControl]
ncalrpc:[TeredoDiagnostics]
ncalrpc:[LRPC-2b9dd75a050dd32327]
Protocol: N/A
Provider: N/A
UUID : C36BE077-E14B-4FE9-8ABC-E856EF4F048B v1.0 Proxy Manager client server endpoint
Bindings:
ncalrpc:[TeredoControl]
ncalrpc:[TeredoDiagnostics]
ncalrpc:[LRPC-2b9dd75a050dd32327]
Protocol: N/A
Provider: N/A
UUID : 2E6035B2-E8F1-41A7-A044-656B439C4C34 v1.0 Proxy Manager provider server endpoint
Bindings:
ncalrpc:[TeredoControl]
ncalrpc:[TeredoDiagnostics]
ncalrpc:[LRPC-2b9dd75a050dd32327]
Protocol: N/A
Provider: iphlpsvc.dll
UUID : 552D076A-CB29-4E44-8B6A-D15E59E2C0AF v1.0 IP Transition Configuration endpoint
Bindings:
ncalrpc:[LRPC-2b9dd75a050dd32327]
Protocol: N/A
Provider: N/A
UUID : 0D3C7F20-1C8D-4654-A1B3-51563B298BDA v1.0 UserMgrCli
Bindings:
ncalrpc:[LRPC-0f23b80e8c8e8083c8]
ncalrpc:[OLE6A1CCA02AC4BF8BCCEB70B5744EE]
Protocol: N/A
Provider: N/A
UUID : B18FBAB6-56F8-4702-84E0-41053293A869 v1.0 UserMgrCli
Bindings:
ncalrpc:[LRPC-0f23b80e8c8e8083c8]
ncalrpc:[OLE6A1CCA02AC4BF8BCCEB70B5744EE]
Protocol: N/A
Provider: N/A
UUID : 51A227AE-825B-41F2-B4A9-1AC9557A1018 v1.0 Ngc Pop Key Service
Bindings:
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: N/A
Provider: N/A
UUID : 8FB74744-B2FF-4C00-BE0D-9EF9A191FE1B v1.0 Ngc Pop Key Service
Bindings:
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: N/A
Provider: N/A
UUID : B25A52BF-E5DD-4F4A-AEA6-8CA7272A0E86 v2.0 KeyIso
Bindings:
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: [MS-NRPC]: Netlogon Remote Protocol
Provider: netlogon.dll
UUID : 12345678-1234-ABCD-EF00-01234567CFFB v1.0
Bindings:
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: [MS-RAA]: Remote Authorization API Protocol
Provider: N/A
UUID : 0B1C2170-5732-4E0E-8CD3-D9B16F3B84D7 v0.0 RemoteAccessCheck
Bindings:
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: [MS-LSAT]: Local Security Authority (Translation Methods) Remote
Provider: lsasrv.dll
UUID : 12345778-1234-ABCD-EF00-0123456789AB v0.0
Bindings:
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: [MS-DRSR]: Directory Replication Service (DRS) Remote Protocol
Provider: ntdsai.dll
UUID : E3514235-4B06-11D1-AB04-00C04FC2DCD2 v4.0 MS NT Directory DRS Interface
Bindings:
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol
Provider: samsrv.dll
UUID : 12345778-1234-ABCD-EF00-0123456789AC v1.0
Bindings:
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: N/A
Provider: N/A
UUID : 1A0D010F-1C33-432C-B0F5-8CF4E8053099 v1.0 IdSegSrv service
Bindings:
ncalrpc:[LRPC-f4293e3b5b9ae5cb28]
Protocol: N/A
Provider: srvsvc.dll
UUID : 98716D03-89AC-44C7-BB8C-285824E51C4A v1.0 XactSrv service
Bindings:
ncalrpc:[LRPC-f4293e3b5b9ae5cb28]
Protocol: N/A
Provider: sysmain.dll
UUID : B58AA02E-2884-4E97-8176-4EE06D794184 v1.0
Bindings:
ncalrpc:[LRPC-6ba6be7619ad5499b5]
Protocol: N/A
Provider: N/A
UUID : DF4DF73A-C52D-4E3A-8003-8437FDF8302A v0.0 WM_WindowManagerRPC\Server
Bindings:
ncalrpc:[LRPC-e9c9cb51676dd7958e]
Protocol: N/A
Provider: IKEEXT.DLL
UUID : A398E520-D59A-4BDD-AA7A-3C1E0303A511 v1.0 IKE/Authip API
Bindings:
ncalrpc:[LRPC-a6cbf0f8554ac2dd0e]
Protocol: N/A
Provider: N/A
UUID : 650A7E26-EAB8-5533-CE43-9C1DFCE11511 v1.0 Vpn APIs
Bindings:
ncalrpc:[LRPC-78511121f1275f430c]
ncalrpc:[VpnikeRpc]
ncalrpc:[RasmanLrpc]
ncacn_np:\\DC[\PIPE\ROUTER]
Protocol: [MS-SCMR]: Service Control Manager Remote Protocol
Provider: services.exe
UUID : 367ABB81-9844-35F1-AD32-98F038001003 v2.0
Bindings:
ncacn_ip_tcp:10.129.243.131[49678]
Protocol: [MS-CMPO]: MSDTC Connection Manager:
Provider: msdtcprx.dll
UUID : 906B0CE0-C70B-1067-B317-00DD010662DA v1.0
Bindings:
ncalrpc:[LRPC-3bcaafee1590c0de20]
ncalrpc:[OLE17B51056E4D45A611212712C1451]
ncalrpc:[LRPC-9c5b8ea96b2f264739]
ncalrpc:[LRPC-9c5b8ea96b2f264739]
ncalrpc:[LRPC-9c5b8ea96b2f264739]
Protocol: N/A
Provider: N/A
UUID : F3F09FFD-FBCF-4291-944D-70AD6E0E73BB v1.0
Bindings:
ncalrpc:[LRPC-802031e034c1f025bd]
Protocol: [MS-DNSP]: Domain Name Service (DNS) Server Management
Provider: dns.exe
UUID : 50ABC2A4-574D-40B3-9D66-EE4FD5FBA076 v5.0
Bindings:
ncacn_ip_tcp:10.129.243.131[49695]
Protocol: [MS-FRS2]: Distributed File System Replication Protocol
Provider: dfsrmig.exe
UUID : 897E2E5F-93F3-4376-9C9C-FD2277495C27 v1.0 Frs2 Service
Bindings:
ncacn_ip_tcp:10.129.243.131[49843]
ncalrpc:[OLECF74F747061ABA28294F2BDC6FF0]
Protocol: N/A
Provider: N/A
UUID : BF4DC912-E52F-4904-8EBE-9317C1BDD497 v1.0
Bindings:
ncalrpc:[LRPC-92939372b55364a6c8]
ncalrpc:[OLE9D9AB6AB4D22AD38C10DD1548060]
[*] Received 405 endpoints.

36
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/xml/tcp_135_rpc_nmap.xml Normal file
View File

@@ -0,0 +1,36 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv -&#45;reason -Pn -T4 -sV -p 135 -&#45;script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/tcp_135_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/xml/tcp_135_rpc_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sV -p 135 -&#45;script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/tcp_135_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp135/xml/tcp_135_rpc_nmap.xml 10.129.243.131" start="1698496073" startstr="Sat Oct 28 14:27:53 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="1" services="135"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698496076"/>
<taskend task="NSE" time="1698496076"/>
<taskbegin task="NSE" time="1698496076"/>
<taskend task="NSE" time="1698496076"/>
<taskbegin task="SYN Stealth Scan" time="1698496076"/>
<taskend task="SYN Stealth Scan" time="1698496078" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698496078"/>
<taskend task="Service scan" time="1698496084" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698496084"/>
<taskend task="NSE" time="1698496099"/>
<taskbegin task="NSE" time="1698496099"/>
<taskend task="NSE" time="1698496099"/>
<host starttime="1698496076" endtime="1698496099"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><port protocol="tcp" portid="135"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="msrpc" product="Microsoft Windows RPC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
</ports>
<times srtt="624808" rttvar="624808" to="1250000"/>
</host>
<taskbegin task="NSE" time="1698496099"/>
<taskend task="NSE" time="1698496099"/>
<taskbegin task="NSE" time="1698496099"/>
<taskend task="NSE" time="1698496099"/>
<runstats><finished time="1698496099" timestr="Sat Oct 28 14:28:19 2023" summary="Nmap done at Sat Oct 28 14:28:19 2023; 1 IP address (1 host up) scanned in 26.49 seconds" elapsed="26.49" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

139
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/enum4linux.txt Normal file
View File

@@ -0,0 +1,139 @@
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sat Oct 28 14:27:53 2023
 =========================================( Target Information )=========================================
Target ........... 10.129.243.131
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
 ===========================( Enumerating Workgroup/Domain on 10.129.243.131 )===========================

[E] Can't find workgroup/domain

 ===============================( Nbtstat Information for 10.129.243.131 )===============================
Looking up status of 10.129.243.131
No reply from 10.129.243.131
 ==================================( Session Check on 10.129.243.131 )==================================

[+] Server 10.129.243.131 allows sessions using username '', password ''

 ==========================( Getting information via LDAP for 10.129.243.131 )==========================

[+] 10.129.243.131 appears to be a child DC

 ===============================( Getting domain SID for 10.129.243.131 )===============================
Domain Name: MEGACORP
Domain Sid: S-1-5-21-855300830-391258870-456067225

[+] Host is part of a domain (not a workgroup)

 ==================================( OS information on 10.129.243.131 )==================================

[E] Can't get OS info with smbclient

[+] Got OS info for 10.129.243.131 from srvinfo:
do_cmd: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED
 ======================================( Users on 10.129.243.131 )======================================

[E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED


[E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED

 ===============================( Machine Enumeration on 10.129.243.131 )===============================

[E] Not implemented in this version of enum4linux.

 ================================( Share Enumeration on 10.129.243.131 )================================
do_connect: Connection to 10.129.243.131 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Sharename Type Comment
--------- ---- -------
Reconnecting with SMB1 for workgroup listing.
Unable to connect with SMB1 -- no workgroup available

[+] Attempting to map shares on 10.129.243.131

 ===========================( Password Policy Information for 10.129.243.131 )===========================

[E] Unexpected error from polenum:

[+] Attaching to 10.129.243.131 using a NULL share
[+] Trying protocol 139/SMB...
[!] Protocol failed: Cannot request session (Called Name:10.129.243.131)
[+] Trying protocol 445/SMB...
[!] Protocol failed: SAMR SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights.

[E] Failed to get password policy with rpcclient

 ======================================( Groups on 10.129.243.131 )======================================

[+] Getting builtin groups:

[+]  Getting builtin group memberships:

[+]  Getting local groups:

[+]  Getting local group memberships:

[+]  Getting domain groups:

[+]  Getting domain group memberships:

 =================( Users on 10.129.243.131 via RID cycling (RIDS: 500-550,1000-1050) )=================

[E] Couldn't get SID: NT_STATUS_ACCESS_DENIED. RID cycling not possible.

 ==============================( Getting printer info for 10.129.243.131 )==============================
do_cmd: Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED
enum4linux complete on Sat Oct 28 14:28:33 2023

3
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/nbtscan.txt Normal file
View File

@@ -0,0 +1,3 @@
Doing NBT name scan for addresses from 10.129.243.131

8
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/smbclient.txt Normal file
View File

@@ -0,0 +1,8 @@
do_connect: Connection to 10.129.243.131 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Anonymous login successful
Sharename Type Comment
--------- ---- -------
Reconnecting with SMB1 for workgroup listing.
Unable to connect with SMB1 -- no workgroup available

3
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/smbmap-execute-command.txt Normal file
View File

@@ -0,0 +1,3 @@
[!] RPC Authentication error occurred
[!] Authentication error on 10.129.243.131

3
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/smbmap-list-contents.txt Normal file
View File

@@ -0,0 +1,3 @@
[!] RPC Authentication error occurred
[!] Authentication error on 10.129.243.131

3
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/smbmap-share-permissions.txt Normal file
View File

@@ -0,0 +1,3 @@
[!] RPC Authentication error occurred
[!] Authentication error on 10.129.243.131

22
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/tcp_139_smb_nmap.txt Normal file
View File

@@ -0,0 +1,22 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv --reason -Pn -T4 -sV -p 139 "--script=banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/tcp_139_smb_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/xml/tcp_139_smb_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.036s latency).
Scanned at 2023-10-28 14:27:57 CEST for 41s
PORT STATE SERVICE REASON VERSION
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
|_smb-enum-services: ERROR: Script execution failed (use -d to debug)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_smb2-time: ERROR: Script execution failed (use -d to debug)
|_smb-protocols: No dialects accepted. Something may be blocking the responses
|_smb2-security-mode: SMB: Couldn't find a NetBIOS name that works for the server. Sorry!
|_smb-mbenum: ERROR: Script execution failed (use -d to debug)
|_smb2-capabilities: SMB: Couldn't find a NetBIOS name that works for the server. Sorry!
|_smb-vuln-ms10-061: SMB: Couldn't find a NetBIOS name that works for the server. Sorry!
|_smb-print-text: false
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:28:38 2023 -- 1 IP address (1 host up) scanned in 45.20 seconds

43
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/xml/tcp_139_smb_nmap.xml Normal file
View File

@@ -0,0 +1,43 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv -&#45;reason -Pn -T4 -sV -p 139 &quot;-&#45;script=banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)&quot; -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/tcp_139_smb_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/xml/tcp_139_smb_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sV -p 139 &quot;-&#45;script=banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)&quot; -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/tcp_139_smb_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp139/xml/tcp_139_smb_nmap.xml 10.129.243.131" start="1698496073" startstr="Sat Oct 28 14:27:53 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="1" services="139"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698496077"/>
<taskend task="NSE" time="1698496077"/>
<taskbegin task="NSE" time="1698496077"/>
<taskend task="NSE" time="1698496077"/>
<taskbegin task="NSE" time="1698496077"/>
<taskend task="NSE" time="1698496077"/>
<taskbegin task="SYN Stealth Scan" time="1698496077"/>
<taskend task="SYN Stealth Scan" time="1698496077" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698496077"/>
<taskend task="Service scan" time="1698496084" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698496084"/>
<taskprogress task="NSE" time="1698496115" percent="97.14" remaining="1" etc="1698496116"/>
<taskend task="NSE" time="1698496116"/>
<taskbegin task="NSE" time="1698496116"/>
<taskend task="NSE" time="1698496118"/>
<taskbegin task="NSE" time="1698496118"/>
<taskend task="NSE" time="1698496118"/>
<host starttime="1698496077" endtime="1698496118"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><port protocol="tcp" portid="139"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="netbios-ssn" product="Microsoft Windows netbios-ssn" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service><script id="smb-enum-services" output="ERROR: Script execution failed (use -d to debug)"/></port>
</ports>
<hostscript><script id="smb2-time" output="ERROR: Script execution failed (use -d to debug)"/><script id="smb-protocols" output="No dialects accepted. Something may be blocking the responses"/><script id="smb2-security-mode" output="SMB: Couldn&apos;t find a NetBIOS name that works for the server. Sorry!">false</script><script id="smb-mbenum" output="ERROR: Script execution failed (use -d to debug)"/><script id="smb2-capabilities" output="SMB: Couldn&apos;t find a NetBIOS name that works for the server. Sorry!">false</script><script id="smb-vuln-ms10-061" output="SMB: Couldn&apos;t find a NetBIOS name that works for the server. Sorry!">false</script><script id="smb-print-text" output="false">false</script></hostscript><times srtt="35989" rttvar="35989" to="179945"/>
</host>
<taskbegin task="NSE" time="1698496118"/>
<taskend task="NSE" time="1698496118"/>
<taskbegin task="NSE" time="1698496118"/>
<taskend task="NSE" time="1698496118"/>
<taskbegin task="NSE" time="1698496118"/>
<taskend task="NSE" time="1698496118"/>
<runstats><finished time="1698496118" timestr="Sat Oct 28 14:28:38 2023" summary="Nmap done at Sat Oct 28 14:28:38 2023; 1 IP address (1 host up) scanned in 45.20 seconds" elapsed="45.20" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

108
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp3268/tcp_3268_ldap_nmap.txt Normal file
View File

@@ -0,0 +1,108 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv --reason -Pn -T4 -sV -p 3268 "--script=banner,(ldap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp3268/tcp_3268_ldap_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp3268/xml/tcp_3268_ldap_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.050s latency).
Scanned at 2023-10-28 14:27:57 CEST for 17s
PORT STATE SERVICE REASON VERSION
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: MEGACORP.LOCAL, Site: Default-First-Site-Name)
| ldap-rootdse:
| LDAP Results
| <ROOT>
| domainFunctionality: 7
| forestFunctionality: 7
| domainControllerFunctionality: 7
| rootDomainNamingContext: DC=MEGACORP,DC=LOCAL
| ldapServiceName: MEGACORP.LOCAL:dc$@MEGACORP.LOCAL
| isGlobalCatalogReady: TRUE
| supportedSASLMechanisms: GSSAPI
| supportedSASLMechanisms: GSS-SPNEGO
| supportedSASLMechanisms: EXTERNAL
| supportedSASLMechanisms: DIGEST-MD5
| supportedLDAPVersion: 3
| supportedLDAPVersion: 2
| supportedLDAPPolicies: MaxPoolThreads
| supportedLDAPPolicies: MaxPercentDirSyncRequests
| supportedLDAPPolicies: MaxDatagramRecv
| supportedLDAPPolicies: MaxReceiveBuffer
| supportedLDAPPolicies: InitRecvTimeout
| supportedLDAPPolicies: MaxConnections
| supportedLDAPPolicies: MaxConnIdleTime
| supportedLDAPPolicies: MaxPageSize
| supportedLDAPPolicies: MaxBatchReturnMessages
| supportedLDAPPolicies: MaxQueryDuration
| supportedLDAPPolicies: MaxDirSyncDuration
| supportedLDAPPolicies: MaxTempTableSize
| supportedLDAPPolicies: MaxResultSetSize
| supportedLDAPPolicies: MinResultSets
| supportedLDAPPolicies: MaxResultSetsPerConn
| supportedLDAPPolicies: MaxNotificationPerConn
| supportedLDAPPolicies: MaxValRange
| supportedLDAPPolicies: MaxValRangeTransitive
| supportedLDAPPolicies: ThreadMemoryLimit
| supportedLDAPPolicies: SystemMemoryLimitPercent
| supportedControl: 1.2.840.113556.1.4.319
| supportedControl: 1.2.840.113556.1.4.801
| supportedControl: 1.2.840.113556.1.4.473
| supportedControl: 1.2.840.113556.1.4.528
| supportedControl: 1.2.840.113556.1.4.417
| supportedControl: 1.2.840.113556.1.4.619
| supportedControl: 1.2.840.113556.1.4.841
| supportedControl: 1.2.840.113556.1.4.529
| supportedControl: 1.2.840.113556.1.4.805
| supportedControl: 1.2.840.113556.1.4.521
| supportedControl: 1.2.840.113556.1.4.970
| supportedControl: 1.2.840.113556.1.4.1338
| supportedControl: 1.2.840.113556.1.4.474
| supportedControl: 1.2.840.113556.1.4.1339
| supportedControl: 1.2.840.113556.1.4.1340
| supportedControl: 1.2.840.113556.1.4.1413
| supportedControl: 2.16.840.1.113730.3.4.9
| supportedControl: 2.16.840.1.113730.3.4.10
| supportedControl: 1.2.840.113556.1.4.1504
| supportedControl: 1.2.840.113556.1.4.1852
| supportedControl: 1.2.840.113556.1.4.802
| supportedControl: 1.2.840.113556.1.4.1907
| supportedControl: 1.2.840.113556.1.4.1948
| supportedControl: 1.2.840.113556.1.4.1974
| supportedControl: 1.2.840.113556.1.4.1341
| supportedControl: 1.2.840.113556.1.4.2026
| supportedControl: 1.2.840.113556.1.4.2064
| supportedControl: 1.2.840.113556.1.4.2065
| supportedControl: 1.2.840.113556.1.4.2066
| supportedControl: 1.2.840.113556.1.4.2090
| supportedControl: 1.2.840.113556.1.4.2205
| supportedControl: 1.2.840.113556.1.4.2204
| supportedControl: 1.2.840.113556.1.4.2206
| supportedControl: 1.2.840.113556.1.4.2211
| supportedControl: 1.2.840.113556.1.4.2239
| supportedControl: 1.2.840.113556.1.4.2255
| supportedControl: 1.2.840.113556.1.4.2256
| supportedControl: 1.2.840.113556.1.4.2309
| supportedControl: 1.2.840.113556.1.4.2330
| supportedControl: 1.2.840.113556.1.4.2354
| supportedCapabilities: 1.2.840.113556.1.4.800
| supportedCapabilities: 1.2.840.113556.1.4.1670
| supportedCapabilities: 1.2.840.113556.1.4.1791
| supportedCapabilities: 1.2.840.113556.1.4.1935
| supportedCapabilities: 1.2.840.113556.1.4.2080
| supportedCapabilities: 1.2.840.113556.1.4.2237
| subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=MEGACORP,DC=LOCAL
| serverName: CN=DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=MEGACORP,DC=LOCAL
| schemaNamingContext: CN=Schema,CN=Configuration,DC=MEGACORP,DC=LOCAL
| namingContexts: DC=MEGACORP,DC=LOCAL
| namingContexts: CN=Configuration,DC=MEGACORP,DC=LOCAL
| namingContexts: CN=Schema,CN=Configuration,DC=MEGACORP,DC=LOCAL
| namingContexts: DC=DomainDnsZones,DC=MEGACORP,DC=LOCAL
| namingContexts: DC=ForestDnsZones,DC=MEGACORP,DC=LOCAL
| isSynchronized: TRUE
| highestCommittedUSN: 77897
| dsServiceName: CN=NTDS Settings,CN=DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=MEGACORP,DC=LOCAL
| dnsHostName: DC.MEGACORP.LOCAL
| defaultNamingContext: DC=MEGACORP,DC=LOCAL
| currentTime: 20231028122804.0Z
|_ configurationNamingContext: CN=Configuration,DC=MEGACORP,DC=LOCAL
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:28:14 2023 -- 1 IP address (1 host up) scanned in 21.16 seconds

42
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp3268/xml/tcp_3268_ldap_nmap.xml Normal file
View File

File diff suppressed because one or more lines are too long

108
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp389/tcp_389_ldap_nmap.txt Normal file
View File

@@ -0,0 +1,108 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv --reason -Pn -T4 -sV -p 389 "--script=banner,(ldap* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp389/tcp_389_ldap_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp389/xml/tcp_389_ldap_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.036s latency).
Scanned at 2023-10-28 14:27:57 CEST for 17s
PORT STATE SERVICE REASON VERSION
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: MEGACORP.LOCAL, Site: Default-First-Site-Name)
| ldap-rootdse:
| LDAP Results
| <ROOT>
| domainFunctionality: 7
| forestFunctionality: 7
| domainControllerFunctionality: 7
| rootDomainNamingContext: DC=MEGACORP,DC=LOCAL
| ldapServiceName: MEGACORP.LOCAL:dc$@MEGACORP.LOCAL
| isGlobalCatalogReady: TRUE
| supportedSASLMechanisms: GSSAPI
| supportedSASLMechanisms: GSS-SPNEGO
| supportedSASLMechanisms: EXTERNAL
| supportedSASLMechanisms: DIGEST-MD5
| supportedLDAPVersion: 3
| supportedLDAPVersion: 2
| supportedLDAPPolicies: MaxPoolThreads
| supportedLDAPPolicies: MaxPercentDirSyncRequests
| supportedLDAPPolicies: MaxDatagramRecv
| supportedLDAPPolicies: MaxReceiveBuffer
| supportedLDAPPolicies: InitRecvTimeout
| supportedLDAPPolicies: MaxConnections
| supportedLDAPPolicies: MaxConnIdleTime
| supportedLDAPPolicies: MaxPageSize
| supportedLDAPPolicies: MaxBatchReturnMessages
| supportedLDAPPolicies: MaxQueryDuration
| supportedLDAPPolicies: MaxDirSyncDuration
| supportedLDAPPolicies: MaxTempTableSize
| supportedLDAPPolicies: MaxResultSetSize
| supportedLDAPPolicies: MinResultSets
| supportedLDAPPolicies: MaxResultSetsPerConn
| supportedLDAPPolicies: MaxNotificationPerConn
| supportedLDAPPolicies: MaxValRange
| supportedLDAPPolicies: MaxValRangeTransitive
| supportedLDAPPolicies: ThreadMemoryLimit
| supportedLDAPPolicies: SystemMemoryLimitPercent
| supportedControl: 1.2.840.113556.1.4.319
| supportedControl: 1.2.840.113556.1.4.801
| supportedControl: 1.2.840.113556.1.4.473
| supportedControl: 1.2.840.113556.1.4.528
| supportedControl: 1.2.840.113556.1.4.417
| supportedControl: 1.2.840.113556.1.4.619
| supportedControl: 1.2.840.113556.1.4.841
| supportedControl: 1.2.840.113556.1.4.529
| supportedControl: 1.2.840.113556.1.4.805
| supportedControl: 1.2.840.113556.1.4.521
| supportedControl: 1.2.840.113556.1.4.970
| supportedControl: 1.2.840.113556.1.4.1338
| supportedControl: 1.2.840.113556.1.4.474
| supportedControl: 1.2.840.113556.1.4.1339
| supportedControl: 1.2.840.113556.1.4.1340
| supportedControl: 1.2.840.113556.1.4.1413
| supportedControl: 2.16.840.1.113730.3.4.9
| supportedControl: 2.16.840.1.113730.3.4.10
| supportedControl: 1.2.840.113556.1.4.1504
| supportedControl: 1.2.840.113556.1.4.1852
| supportedControl: 1.2.840.113556.1.4.802
| supportedControl: 1.2.840.113556.1.4.1907
| supportedControl: 1.2.840.113556.1.4.1948
| supportedControl: 1.2.840.113556.1.4.1974
| supportedControl: 1.2.840.113556.1.4.1341
| supportedControl: 1.2.840.113556.1.4.2026
| supportedControl: 1.2.840.113556.1.4.2064
| supportedControl: 1.2.840.113556.1.4.2065
| supportedControl: 1.2.840.113556.1.4.2066
| supportedControl: 1.2.840.113556.1.4.2090
| supportedControl: 1.2.840.113556.1.4.2205
| supportedControl: 1.2.840.113556.1.4.2204
| supportedControl: 1.2.840.113556.1.4.2206
| supportedControl: 1.2.840.113556.1.4.2211
| supportedControl: 1.2.840.113556.1.4.2239
| supportedControl: 1.2.840.113556.1.4.2255
| supportedControl: 1.2.840.113556.1.4.2256
| supportedControl: 1.2.840.113556.1.4.2309
| supportedControl: 1.2.840.113556.1.4.2330
| supportedControl: 1.2.840.113556.1.4.2354
| supportedCapabilities: 1.2.840.113556.1.4.800
| supportedCapabilities: 1.2.840.113556.1.4.1670
| supportedCapabilities: 1.2.840.113556.1.4.1791
| supportedCapabilities: 1.2.840.113556.1.4.1935
| supportedCapabilities: 1.2.840.113556.1.4.2080
| supportedCapabilities: 1.2.840.113556.1.4.2237
| subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=MEGACORP,DC=LOCAL
| serverName: CN=DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=MEGACORP,DC=LOCAL
| schemaNamingContext: CN=Schema,CN=Configuration,DC=MEGACORP,DC=LOCAL
| namingContexts: DC=MEGACORP,DC=LOCAL
| namingContexts: CN=Configuration,DC=MEGACORP,DC=LOCAL
| namingContexts: CN=Schema,CN=Configuration,DC=MEGACORP,DC=LOCAL
| namingContexts: DC=DomainDnsZones,DC=MEGACORP,DC=LOCAL
| namingContexts: DC=ForestDnsZones,DC=MEGACORP,DC=LOCAL
| isSynchronized: TRUE
| highestCommittedUSN: 77897
| dsServiceName: CN=NTDS Settings,CN=DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=MEGACORP,DC=LOCAL
| dnsHostName: DC.MEGACORP.LOCAL
| defaultNamingContext: DC=MEGACORP,DC=LOCAL
| currentTime: 20231028122804.0Z
|_ configurationNamingContext: CN=Configuration,DC=MEGACORP,DC=LOCAL
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:28:14 2023 -- 1 IP address (1 host up) scanned in 21.47 seconds

42
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp389/xml/tcp_389_ldap_nmap.xml Normal file
View File

File diff suppressed because one or more lines are too long

2
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/smbmap-execute-command.txt Normal file
View File

@@ -0,0 +1,2 @@
[!] Authentication error on 10.129.243.131

2
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/smbmap-list-contents.txt Normal file
View File

@@ -0,0 +1,2 @@
[!] Authentication error on 10.129.243.131

2
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/smbmap-share-permissions.txt Normal file
View File

@@ -0,0 +1,2 @@
[!] Authentication error on 10.129.243.131

50
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/tcp_445_smb_nmap.txt Normal file
View File

@@ -0,0 +1,50 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv --reason -Pn -T4 -sV -p 445 "--script=banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/tcp_445_smb_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/xml/tcp_445_smb_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.031s latency).
Scanned at 2023-10-28 14:27:57 CEST for 50s
PORT STATE SERVICE REASON VERSION
445/tcp open microsoft-ds? syn-ack ttl 127
|_smb-enum-services: ERROR: Script execution failed (use -d to debug)
Host script results:
| smb2-capabilities:
| 202:
| Distributed File System
| 210:
| Distributed File System
| Leasing
| Multi-credit operations
| 300:
| Distributed File System
| Leasing
| Multi-credit operations
| 302:
| Distributed File System
| Leasing
| Multi-credit operations
| 311:
| Distributed File System
| Leasing
|_ Multi-credit operations
|_smb-vuln-ms10-061: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR
|_smb-print-text: false
| smb2-security-mode:
| 311:
|_ Message signing enabled and required
| smb-protocols:
| dialects:
| 202
| 210
| 300
| 302
|_ 311
| smb2-time:
| date: 2023-10-28T12:28:09
|_ start_date: N/A
| smb-mbenum:
|_ ERROR: Failed to connect to browser service: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:28:47 2023 -- 1 IP address (1 host up) scanned in 54.80 seconds

78
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/xml/tcp_445_smb_nmap.xml Normal file
View File

@@ -0,0 +1,78 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv -&#45;reason -Pn -T4 -sV -p 445 &quot;-&#45;script=banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)&quot; -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/tcp_445_smb_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/xml/tcp_445_smb_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sV -p 445 &quot;-&#45;script=banner,(nbstat or smb* or ssl*) and not (brute or broadcast or dos or external or fuzzer)&quot; -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/tcp_445_smb_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp445/xml/tcp_445_smb_nmap.xml 10.129.243.131" start="1698496073" startstr="Sat Oct 28 14:27:53 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="1" services="445"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698496077"/>
<taskend task="NSE" time="1698496077"/>
<taskbegin task="NSE" time="1698496077"/>
<taskend task="NSE" time="1698496077"/>
<taskbegin task="NSE" time="1698496077"/>
<taskend task="NSE" time="1698496077"/>
<taskbegin task="SYN Stealth Scan" time="1698496077"/>
<taskend task="SYN Stealth Scan" time="1698496077" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698496078"/>
<taskend task="Service scan" time="1698496086" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698496086"/>
<taskprogress task="NSE" time="1698496117" percent="94.29" remaining="2" etc="1698496119"/>
<taskend task="NSE" time="1698496126"/>
<taskbegin task="NSE" time="1698496126"/>
<taskend task="NSE" time="1698496127"/>
<taskbegin task="NSE" time="1698496127"/>
<taskend task="NSE" time="1698496127"/>
<host starttime="1698496077" endtime="1698496127"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><port protocol="tcp" portid="445"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="microsoft-ds" method="table" conf="3"/><script id="smb-enum-services" output="ERROR: Script execution failed (use -d to debug)"/></port>
</ports>
<hostscript><script id="smb2-capabilities" output="&#xa; 202: &#xa; Distributed File System&#xa; 210: &#xa; Distributed File System&#xa; Leasing&#xa; Multi-credit operations&#xa; 300: &#xa; Distributed File System&#xa; Leasing&#xa; Multi-credit operations&#xa; 302: &#xa; Distributed File System&#xa; Leasing&#xa; Multi-credit operations&#xa; 311: &#xa; Distributed File System&#xa; Leasing&#xa; Multi-credit operations"><table key="202">
<elem>Distributed File System</elem>
</table>
<table key="210">
<elem>Distributed File System</elem>
<elem>Leasing</elem>
<elem>Multi-credit operations</elem>
</table>
<table key="300">
<elem>Distributed File System</elem>
<elem>Leasing</elem>
<elem>Multi-credit operations</elem>
</table>
<table key="302">
<elem>Distributed File System</elem>
<elem>Leasing</elem>
<elem>Multi-credit operations</elem>
</table>
<table key="311">
<elem>Distributed File System</elem>
<elem>Leasing</elem>
<elem>Multi-credit operations</elem>
</table>
</script><script id="smb-vuln-ms10-061" output="Could not negotiate a connection:SMB: Failed to receive bytes: ERROR">false</script><script id="smb-print-text" output="false">false</script><script id="smb2-security-mode" output="&#xa; 311: &#xa; Message signing enabled and required"><table key="311">
<elem>Message signing enabled and required</elem>
</table>
</script><script id="smb-protocols" output="&#xa; dialects: &#xa; 202&#xa; 210&#xa; 300&#xa; 302&#xa; 311"><table key="dialects">
<elem>202</elem>
<elem>210</elem>
<elem>300</elem>
<elem>302</elem>
<elem>311</elem>
</table>
</script><script id="smb2-time" output="&#xa; date: 2023-10-28T12:28:09&#xa; start_date: N/A"><elem key="date">2023-10-28T12:28:09</elem>
<elem key="start_date">N/A</elem>
</script><script id="smb-mbenum" output="&#xa; ERROR: Failed to connect to browser service: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR"/></hostscript><times srtt="31123" rttvar="31123" to="155615"/>
</host>
<taskbegin task="NSE" time="1698496127"/>
<taskend task="NSE" time="1698496127"/>
<taskbegin task="NSE" time="1698496127"/>
<taskend task="NSE" time="1698496127"/>
<taskbegin task="NSE" time="1698496127"/>
<taskend task="NSE" time="1698496127"/>
<runstats><finished time="1698496127" timestr="Sat Oct 28 14:28:47 2023" summary="Nmap done at Sat Oct 28 14:28:47 2023; 1 IP address (1 host up) scanned in 54.80 seconds" elapsed="54.80" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

11
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/tcp_464_kerberos_nmap.txt Normal file
View File

@@ -0,0 +1,11 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv --reason -Pn -T4 -sV -p 464 --script=banner,krb5-enum-users --script-args krb5-enum-users.realm=megacorp.htb,userdb=/usr/share/seclists/Usernames/top-usernames-shortlist.txt -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/tcp_464_kerberos_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/xml/tcp_464_kerberos_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.045s latency).
Scanned at 2023-10-28 14:27:55 CEST for 19s
PORT STATE SERVICE REASON VERSION
464/tcp open kpasswd5? syn-ack ttl 127
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:28:14 2023 -- 1 IP address (1 host up) scanned in 21.63 seconds

36
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/xml/tcp_464_kerberos_nmap.xml Normal file
View File

@@ -0,0 +1,36 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv -&#45;reason -Pn -T4 -sV -p 464 -&#45;script=banner,krb5-enum-users -&#45;script-args krb5-enum-users.realm=megacorp.htb,userdb=/usr/share/seclists/Usernames/top-usernames-shortlist.txt -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/tcp_464_kerberos_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/xml/tcp_464_kerberos_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sV -p 464 -&#45;script=banner,krb5-enum-users -&#45;script-args krb5-enum-users.realm=megacorp.htb,userdb=/usr/share/seclists/Usernames/top-usernames-shortlist.txt -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/tcp_464_kerberos_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp464/xml/tcp_464_kerberos_nmap.xml 10.129.243.131" start="1698496073" startstr="Sat Oct 28 14:27:53 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="1" services="464"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698496075"/>
<taskend task="NSE" time="1698496075"/>
<taskbegin task="NSE" time="1698496075"/>
<taskend task="NSE" time="1698496075"/>
<taskbegin task="SYN Stealth Scan" time="1698496075"/>
<taskend task="SYN Stealth Scan" time="1698496075" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698496075"/>
<taskend task="Service scan" time="1698496084" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698496084"/>
<taskend task="NSE" time="1698496094"/>
<taskbegin task="NSE" time="1698496094"/>
<taskend task="NSE" time="1698496094"/>
<host starttime="1698496075" endtime="1698496094"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><port protocol="tcp" portid="464"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="kpasswd5" method="table" conf="3"/></port>
</ports>
<times srtt="44884" rttvar="44884" to="224420"/>
</host>
<taskbegin task="NSE" time="1698496094"/>
<taskend task="NSE" time="1698496094"/>
<taskbegin task="NSE" time="1698496094"/>
<taskend task="NSE" time="1698496094"/>
<runstats><finished time="1698496094" timestr="Sat Oct 28 14:28:14 2023" summary="Nmap done at Sat Oct 28 14:28:14 2023; 1 IP address (1 host up) scanned in 21.63 seconds" elapsed="21.63" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

12
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49667/tcp_49667_rpc_nmap.txt Normal file
View File

@@ -0,0 +1,12 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv --reason -Pn -T4 -sV -p 49667 --script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49667/tcp_49667_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49667/xml/tcp_49667_rpc_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.44s latency).
Scanned at 2023-10-28 14:27:56 CEST for 71s
PORT STATE SERVICE REASON VERSION
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:29:07 2023 -- 1 IP address (1 host up) scanned in 73.96 seconds

36
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49667/xml/tcp_49667_rpc_nmap.xml Normal file
View File

@@ -0,0 +1,36 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv -&#45;reason -Pn -T4 -sV -p 49667 -&#45;script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49667/tcp_49667_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49667/xml/tcp_49667_rpc_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sV -p 49667 -&#45;script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49667/tcp_49667_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49667/xml/tcp_49667_rpc_nmap.xml 10.129.243.131" start="1698496073" startstr="Sat Oct 28 14:27:53 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="1" services="49667"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698496076"/>
<taskend task="NSE" time="1698496076"/>
<taskbegin task="NSE" time="1698496076"/>
<taskend task="NSE" time="1698496076"/>
<taskbegin task="SYN Stealth Scan" time="1698496076"/>
<taskend task="SYN Stealth Scan" time="1698496077" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698496077"/>
<taskend task="Service scan" time="1698496132" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698496132"/>
<taskend task="NSE" time="1698496147"/>
<taskbegin task="NSE" time="1698496147"/>
<taskend task="NSE" time="1698496147"/>
<host starttime="1698496076" endtime="1698496147"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><port protocol="tcp" portid="49667"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="msrpc" product="Microsoft Windows RPC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
</ports>
<times srtt="441625" rttvar="441625" to="1250000"/>
</host>
<taskbegin task="NSE" time="1698496147"/>
<taskend task="NSE" time="1698496147"/>
<taskbegin task="NSE" time="1698496147"/>
<taskend task="NSE" time="1698496147"/>
<runstats><finished time="1698496147" timestr="Sat Oct 28 14:29:07 2023" summary="Nmap done at Sat Oct 28 14:29:07 2023; 1 IP address (1 host up) scanned in 73.96 seconds" elapsed="73.96" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

12
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49673/tcp_49673_rpc_nmap.txt Normal file
View File

@@ -0,0 +1,12 @@
# Nmap 7.93 scan initiated Sat Oct 28 13:22:00 2023 as: nmap -vv --reason -Pn -T4 -sV -p 49673 --script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49673/tcp_49673_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49673/xml/tcp_49673_rpc_nmap.xml 10.129.243.131
Nmap scan report for 10.129.243.131
Host is up, received user-set (0.034s latency).
Scanned at 2023-10-28 13:22:15 CEST for 70s
PORT STATE SERVICE REASON VERSION
49673/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 13:23:25 2023 -- 1 IP address (1 host up) scanned in 84.39 seconds

37
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49673/xml/tcp_49673_rpc_nmap.xml Normal file
View File

@@ -0,0 +1,37 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 13:22:00 2023 as: nmap -vv -&#45;reason -Pn -T4 -sV -p 49673 -&#45;script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49673/tcp_49673_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49673/xml/tcp_49673_rpc_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sV -p 49673 -&#45;script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49673/tcp_49673_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49673/xml/tcp_49673_rpc_nmap.xml 10.129.243.131" start="1698492120" startstr="Sat Oct 28 13:22:00 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="1" services="49673"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698492122"/>
<taskend task="NSE" time="1698492122"/>
<taskbegin task="NSE" time="1698492122"/>
<taskend task="NSE" time="1698492122"/>
<taskbegin task="Parallel DNS resolution of 1 host." time="1698492122"/>
<taskend task="Parallel DNS resolution of 1 host." time="1698492135"/>
<taskbegin task="SYN Stealth Scan" time="1698492135"/>
<taskend task="SYN Stealth Scan" time="1698492135" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698492135"/>
<taskend task="Service scan" time="1698492190" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698492190"/>
<taskend task="NSE" time="1698492205"/>
<taskbegin task="NSE" time="1698492205"/>
<taskend task="NSE" time="1698492205"/>
<host starttime="1698492135" endtime="1698492205"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
</hostnames>
<ports><port protocol="tcp" portid="49673"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="msrpc" product="Microsoft Windows RPC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
</ports>
<times srtt="34493" rttvar="34493" to="172465"/>
</host>
<taskbegin task="NSE" time="1698492205"/>
<taskend task="NSE" time="1698492205"/>
<taskbegin task="NSE" time="1698492205"/>
<taskend task="NSE" time="1698492205"/>
<runstats><finished time="1698492205" timestr="Sat Oct 28 13:23:25 2023" summary="Nmap done at Sat Oct 28 13:23:25 2023; 1 IP address (1 host up) scanned in 84.39 seconds" elapsed="84.39" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

12
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49695/tcp_49695_rpc_nmap.txt Normal file
View File

@@ -0,0 +1,12 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv --reason -Pn -T4 -sV -p 49695 --script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49695/tcp_49695_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49695/xml/tcp_49695_rpc_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.46s latency).
Scanned at 2023-10-28 14:27:56 CEST for 71s
PORT STATE SERVICE REASON VERSION
49695/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:29:07 2023 -- 1 IP address (1 host up) scanned in 73.88 seconds

36
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49695/xml/tcp_49695_rpc_nmap.xml Normal file
View File

@@ -0,0 +1,36 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv -&#45;reason -Pn -T4 -sV -p 49695 -&#45;script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49695/tcp_49695_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49695/xml/tcp_49695_rpc_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sV -p 49695 -&#45;script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49695/tcp_49695_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49695/xml/tcp_49695_rpc_nmap.xml 10.129.243.131" start="1698496073" startstr="Sat Oct 28 14:27:53 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="1" services="49695"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698496076"/>
<taskend task="NSE" time="1698496076"/>
<taskbegin task="NSE" time="1698496076"/>
<taskend task="NSE" time="1698496076"/>
<taskbegin task="SYN Stealth Scan" time="1698496076"/>
<taskend task="SYN Stealth Scan" time="1698496077" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698496077"/>
<taskend task="Service scan" time="1698496132" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698496132"/>
<taskend task="NSE" time="1698496147"/>
<taskbegin task="NSE" time="1698496147"/>
<taskend task="NSE" time="1698496147"/>
<host starttime="1698496076" endtime="1698496147"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><port protocol="tcp" portid="49695"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="msrpc" product="Microsoft Windows RPC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
</ports>
<times srtt="460057" rttvar="460057" to="1250000"/>
</host>
<taskbegin task="NSE" time="1698496147"/>
<taskend task="NSE" time="1698496147"/>
<taskbegin task="NSE" time="1698496147"/>
<taskend task="NSE" time="1698496147"/>
<runstats><finished time="1698496147" timestr="Sat Oct 28 14:29:07 2023" summary="Nmap done at Sat Oct 28 14:29:07 2023; 1 IP address (1 host up) scanned in 73.88 seconds" elapsed="73.88" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

12
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49843/tcp_49843_rpc_nmap.txt Normal file
View File

@@ -0,0 +1,12 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv --reason -Pn -T4 -sV -p 49843 --script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49843/tcp_49843_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49843/xml/tcp_49843_rpc_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.46s latency).
Scanned at 2023-10-28 14:27:56 CEST for 71s
PORT STATE SERVICE REASON VERSION
49843/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:29:07 2023 -- 1 IP address (1 host up) scanned in 73.91 seconds

36
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49843/xml/tcp_49843_rpc_nmap.xml Normal file
View File

@@ -0,0 +1,36 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv -&#45;reason -Pn -T4 -sV -p 49843 -&#45;script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49843/tcp_49843_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49843/xml/tcp_49843_rpc_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sV -p 49843 -&#45;script=banner,msrpc-enum,rpc-grind,rpcinfo -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49843/tcp_49843_rpc_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp49843/xml/tcp_49843_rpc_nmap.xml 10.129.243.131" start="1698496073" startstr="Sat Oct 28 14:27:53 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="1" services="49843"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698496076"/>
<taskend task="NSE" time="1698496076"/>
<taskbegin task="NSE" time="1698496076"/>
<taskend task="NSE" time="1698496076"/>
<taskbegin task="SYN Stealth Scan" time="1698496076"/>
<taskend task="SYN Stealth Scan" time="1698496077" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698496077"/>
<taskend task="Service scan" time="1698496132" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698496132"/>
<taskend task="NSE" time="1698496147"/>
<taskbegin task="NSE" time="1698496147"/>
<taskend task="NSE" time="1698496147"/>
<host starttime="1698496076" endtime="1698496147"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><port protocol="tcp" portid="49843"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="msrpc" product="Microsoft Windows RPC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
</ports>
<times srtt="461435" rttvar="461435" to="1250000"/>
</host>
<taskbegin task="NSE" time="1698496147"/>
<taskend task="NSE" time="1698496147"/>
<taskbegin task="NSE" time="1698496147"/>
<taskend task="NSE" time="1698496147"/>
<runstats><finished time="1698496147" timestr="Sat Oct 28 14:29:07 2023" summary="Nmap done at Sat Oct 28 14:29:07 2023; 1 IP address (1 host up) scanned in 73.91 seconds" elapsed="73.91" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

26
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dns_nmap.txt Normal file
View File

@@ -0,0 +1,26 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv --reason -Pn -T4 -sV -p 53 "--script=banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dns_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/xml/tcp_53_dns_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.035s latency).
Scanned at 2023-10-28 14:27:57 CEST for 164s
PORT STATE SERVICE REASON VERSION
53/tcp open domain? syn-ack ttl 127
| dns-nsec-enum:
|_ No NSEC records found
| fingerprint-strings:
| SSLSessionReq:
|_ 1e8NgBanmCRTbV2FJOqv
| dns-nsec3-enum:
|_ DNSSEC NSEC3 not supported
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.93%I=7%D=10/28%Time=653CFE83%P=x86_64-pc-linux-gnu%r(SSL
SF:SessionReq,2C,"\0\*\x86L\x81\x82\0\x01\0\0\0\0\0\0\x141e8NgBanmCRTbV2FJ
SF:Oqv\x03com\0\0\x1c\0\x01");
Host script results:
| dns-brute:
|_ DNS Brute-force hostnames: No results.
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:30:41 2023 -- 1 IP address (1 host up) scanned in 168.63 seconds

19
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dns_reverse-lookup.txt Normal file
View File

@@ -0,0 +1,19 @@
;; communications error to 10.129.243.131#53: timed out
; <<>> DiG 9.18.11-2-Debian <<>> -p 53 -x 10.129.243.131 @10.129.243.131
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 27975
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;131.243.129.10.in-addr.arpa. IN PTR
;; Query time: 4536 msec
;; SERVER: 10.129.243.131#53(10.129.243.131) (UDP)
;; WHEN: Sat Oct 28 14:28:02 CEST 2023
;; MSG SIZE rcvd: 56

6
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dns_zone-transfer-domain.txt Normal file
View File

@@ -0,0 +1,6 @@
; <<>> DiG 9.18.11-2-Debian <<>> AXFR -p 53 @10.129.243.131 megacorp.htb
; (1 server found)
;; global options: +cmd
; Transfer failed.

11
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dns_zone-transfer.txt Normal file
View File

@@ -0,0 +1,11 @@
;; communications error to 10.129.243.131#53: timed out
; <<>> DiG 9.18.11-2-Debian <<>> AXFR -p 53 @10.129.243.131
; (1 server found)
;; global options: +cmd
;; Query time: 4756 msec
;; SERVER: 10.129.243.131#53(10.129.243.131) (UDP)
;; WHEN: Sat Oct 28 14:28:03 CEST 2023
;; MSG SIZE rcvd: 28

3
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dnsrecon_default.txt Normal file
View File

@@ -0,0 +1,3 @@
[*] std: Performing General Enumeration against: megacorp.htb...
[-] Could not resolve domain: megacorp.htb

0
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_megacorp.htb_subdomains_subdomains-top1million-110000.txt Normal file
View File

45
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/xml/tcp_53_dns_nmap.xml Normal file
View File

@@ -0,0 +1,45 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv -&#45;reason -Pn -T4 -sV -p 53 &quot;-&#45;script=banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)&quot; -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dns_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/xml/tcp_53_dns_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sV -p 53 &quot;-&#45;script=banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)&quot; -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/tcp_53_dns_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp53/xml/tcp_53_dns_nmap.xml 10.129.243.131" start="1698496073" startstr="Sat Oct 28 14:27:53 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="1" services="53"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698496077"/>
<taskend task="NSE" time="1698496077"/>
<taskbegin task="NSE" time="1698496077"/>
<taskend task="NSE" time="1698496077"/>
<taskbegin task="NSE" time="1698496077"/>
<taskend task="NSE" time="1698496077"/>
<taskbegin task="SYN Stealth Scan" time="1698496077"/>
<taskend task="SYN Stealth Scan" time="1698496077" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698496077"/>
<taskend task="Service scan" time="1698496225" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698496225"/>
<taskend task="NSE" time="1698496240"/>
<taskbegin task="NSE" time="1698496240"/>
<taskend task="NSE" time="1698496241"/>
<taskbegin task="NSE" time="1698496241"/>
<taskend task="NSE" time="1698496241"/>
<host starttime="1698496077" endtime="1698496241"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><port protocol="tcp" portid="53"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="domain" servicefp="SF-Port53-TCP:V=7.93%I=7%D=10/28%Time=653CFE83%P=x86_64-pc-linux-gnu%r(SSLSessionReq,2C,&quot;\0\*\x86L\x81\x82\0\x01\0\0\0\0\0\0\x141e8NgBanmCRTbV2FJOqv\x03com\0\0\x1c\0\x01&quot;);" method="table" conf="3"/><script id="dns-nsec-enum" output="&#xa; No NSEC records found&#xa;"/><script id="fingerprint-strings" output="&#xa; SSLSessionReq: &#xa; 1e8NgBanmCRTbV2FJOqv"><elem key="SSLSessionReq">&#xa; 1e8NgBanmCRTbV2FJOqv</elem>
</script><script id="dns-nsec3-enum" output="&#xa; DNSSEC NSEC3 not supported&#xa;"/></port>
</ports>
<hostscript><script id="dns-brute" output="&#xa; DNS Brute-force hostnames: No results."><table key="DNS Brute-force hostnames">
</table>
</script></hostscript><times srtt="35361" rttvar="35361" to="176805"/>
</host>
<taskbegin task="NSE" time="1698496241"/>
<taskend task="NSE" time="1698496241"/>
<taskbegin task="NSE" time="1698496241"/>
<taskend task="NSE" time="1698496241"/>
<taskbegin task="NSE" time="1698496241"/>
<taskend task="NSE" time="1698496241"/>
<runstats><finished time="1698496241" timestr="Sat Oct 28 14:30:41 2023" summary="Nmap done at Sat Oct 28 14:30:41 2023; 1 IP address (1 host up) scanned in 168.63 seconds" elapsed="168.63" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

880
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp593/tcp_593_rpc_rpcdump.txt Normal file
View File

@@ -0,0 +1,880 @@
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Retrieving endpoint list from 10.129.243.131
Protocol: [MS-RSP]: Remote Shutdown Protocol
Provider: wininit.exe
UUID : D95AFE70-A6D5-4259-822E-2C84DA1DDB0D v1.0
Bindings:
ncacn_ip_tcp:10.129.243.131[49664]
ncalrpc:[WindowsShutdown]
ncacn_np:\\DC[\PIPE\InitShutdown]
ncalrpc:[WMsgKRpc089280]
Protocol: N/A
Provider: winlogon.exe
UUID : 76F226C3-EC14-4325-8A99-6A46348418AF v1.0
Bindings:
ncalrpc:[WindowsShutdown]
ncacn_np:\\DC[\PIPE\InitShutdown]
ncalrpc:[WMsgKRpc089280]
ncalrpc:[WMsgKRpc08A621]
Protocol: N/A
Provider: N/A
UUID : D09BDEB5-6171-4A34-BFE2-06FA82652568 v1.0
Bindings:
ncalrpc:[csebpub]
ncalrpc:[LRPC-6b54d635557b62ca53]
ncalrpc:[LRPC-e71821bbfb97e6ac17]
ncalrpc:[LRPC-6b4af19739a6d01556]
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
ncalrpc:[LRPC-e71821bbfb97e6ac17]
ncalrpc:[LRPC-6b4af19739a6d01556]
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
ncalrpc:[LRPC-6b4af19739a6d01556]
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
ncalrpc:[LRPC-9e83194e1e5674c55f]
ncalrpc:[LRPC-a91e72435259adddfa]
Protocol: N/A
Provider: N/A
UUID : 697DCDA9-3BA9-4EB2-9247-E11F1901B0D2 v1.0
Bindings:
ncalrpc:[LRPC-6b54d635557b62ca53]
ncalrpc:[LRPC-e71821bbfb97e6ac17]
ncalrpc:[LRPC-6b4af19739a6d01556]
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 9B008953-F195-4BF9-BDE0-4471971E58ED v1.0
Bindings:
ncalrpc:[LRPC-e71821bbfb97e6ac17]
ncalrpc:[LRPC-6b4af19739a6d01556]
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : DD59071B-3215-4C59-8481-972EDADC0F6A v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 0D47017B-B33B-46AD-9E18-FE96456C5078 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 95406F0B-B239-4318-91BB-CEA3A46FF0DC v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 4ED8ABCC-F1E2-438B-981F-BB0E8ABC010C v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 0FF1F646-13BB-400A-AB50-9A78F2B7A85A v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 6982A06E-5FE2-46B1-B39C-A2C545BFA069 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 082A3471-31B6-422A-B931-A54401960C62 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : FAE436B0-B864-4A87-9EDA-298547CD82F2 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : E53D94CA-7464-4839-B044-09A2FB8B3AE5 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 178D84BE-9291-4994-82C6-3F909ACA5A03 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 4DACE966-A243-4450-AE3F-9B7BCB5315B8 v2.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 1832BCF6-CAB8-41D4-85D2-C9410764F75A v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : C521FACF-09A9-42C5-B155-72388595CBF0 v0.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 2C7FD9CE-E706-4B40-B412-953107EF9BB0 v0.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 88ABCBC3-34EA-76AE-8215-767520655A23 v0.0
Bindings:
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 76C217BC-C8B4-4201-A745-373AD9032B1A v1.0
Bindings:
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 55E6B932-1979-45D6-90C5-7F6270724112 v1.0
Bindings:
ncalrpc:[LRPC-baa5dfd3c285fa9f38]
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 857FB1BE-084F-4FB5-B59C-4B2C4BE5F0CF v1.0
Bindings:
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : B8CADBAF-E84B-46B9-84F2-6F71C03F9E55 v1.0
Bindings:
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 20C40295-8DBA-48E6-AEBF-3E78EF3BB144 v1.0
Bindings:
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 2513BCBE-6CD4-4348-855E-7EFB3C336DD3 v1.0
Bindings:
ncalrpc:[LRPC-56be5249e855b3e1a2]
ncalrpc:[OLE389FDE0EE0F1B1F4D79C4FE9A2C8]
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 0D3E2735-CEA0-4ECC-A9E2-41A2D81AED4E v1.0
Bindings:
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : C605F9FB-F0A3-4E2A-A073-73560F8D9E3E v1.0
Bindings:
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 1B37CA91-76B1-4F5E-A3C7-2ABFC61F2BB0 v1.0
Bindings:
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 8BFC3BE1-6DEF-4E2D-AF74-7C47CD0ADE4A v1.0
Bindings:
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 2D98A740-581D-41B9-AA0D-A88B9D5CE938 v1.0
Bindings:
ncalrpc:[LRPC-b02c899b61b7b8f1c9]
ncalrpc:[actkernel]
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 0361AE94-0316-4C6C-8AD8-C594375800E2 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 5824833B-3C1A-4AD2-BDFD-C31D19E23ED2 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : BDAA0970-413B-4A3E-9E5D-F6DC9D7E0760 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 3B338D89-6CFA-44B8-847E-531531BC9992 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 8782D3B9-EBBD-4644-A3D8-E8725381919B v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 085B0334-E454-4D91-9B8C-4134F9E793F3 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: N/A
UUID : 4BEC6BB8-B5C2-4B6F-B2C1-5DA5CF92D0D9 v1.0
Bindings:
ncalrpc:[umpo]
Protocol: N/A
Provider: sysntfy.dll
UUID : C9AC6DB5-82B7-4E55-AE8A-E464ED7B4277 v1.0 Impl friendly name
Bindings:
ncalrpc:[LRPC-78c65697da0c3cb9e7]
ncalrpc:[LRPC-5d1d91fbc9832f3673]
ncalrpc:[IUserProfile2]
ncalrpc:[LRPC-7f9f9d7e564fa27a15]
ncalrpc:[senssvc]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
ncalrpc:[LRPC-2d7a6fcd1e6a5d90b0]
ncalrpc:[OLE59700168EED37EDF88950A0917DC]
Protocol: N/A
Provider: nsisvc.dll
UUID : 7EA70BCF-48AF-4F6A-8968-6A440754D5FA v1.0 NSI server endpoint
Bindings:
ncalrpc:[LRPC-9ec11ee764d799175d]
Protocol: N/A
Provider: nrpsrv.dll
UUID : 30ADC50C-5CBC-46CE-9A0E-91914789E23C v1.0 NRP server endpoint
Bindings:
ncalrpc:[LRPC-99bbae991f0f6e961a]
Protocol: N/A
Provider: N/A
UUID : E40F7B57-7A25-4CD3-A135-7F7D3DF9D16B v1.0 Network Connection Broker server endpoint
Bindings:
ncalrpc:[LRPC-95313533ddc887d499]
ncalrpc:[OLE11E1ADACE4D3F3328245D6CF61B4]
ncalrpc:[LRPC-4f7c4b35ddfa33800c]
ncalrpc:[LRPC-9e83194e1e5674c55f]
Protocol: N/A
Provider: N/A
UUID : 880FD55E-43B9-11E0-B1A8-CF4EDFD72085 v1.0 KAPI Service endpoint
Bindings:
ncalrpc:[LRPC-95313533ddc887d499]
ncalrpc:[OLE11E1ADACE4D3F3328245D6CF61B4]
ncalrpc:[LRPC-4f7c4b35ddfa33800c]
ncalrpc:[LRPC-9e83194e1e5674c55f]
Protocol: N/A
Provider: N/A
UUID : 5222821F-D5E2-4885-84F1-5F6185A0EC41 v1.0 Network Connection Broker server endpoint for NCB Reset module
Bindings:
ncalrpc:[LRPC-4f7c4b35ddfa33800c]
ncalrpc:[LRPC-9e83194e1e5674c55f]
Protocol: N/A
Provider: N/A
UUID : A500D4C6-0DD1-4543-BC0C-D5F93486EAF8 v1.0
Bindings:
ncalrpc:[LRPC-7d4055d4f64c73ef42]
ncalrpc:[LRPC-a91e72435259adddfa]
Protocol: N/A
Provider: dhcpcsvc.dll
UUID : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D5 v1.0 DHCP Client LRPC Endpoint
Bindings:
ncalrpc:[dhcpcsvc]
ncalrpc:[dhcpcsvc6]
Protocol: N/A
Provider: dhcpcsvc6.dll
UUID : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D6 v1.0 DHCPv6 Client LRPC Endpoint
Bindings:
ncalrpc:[dhcpcsvc6]
Protocol: [MS-EVEN6]: EventLog Remoting Protocol
Provider: wevtsvc.dll
UUID : F6BEAFF7-1E19-4FBB-9F8F-B89E2018337C v1.0 Event log TCPIP
Bindings:
ncacn_ip_tcp:10.129.243.131[49665]
ncacn_np:\\DC[\pipe\eventlog]
ncalrpc:[eventlog]
Protocol: N/A
Provider: gpsvc.dll
UUID : 2EB08E3E-639F-4FBA-97B1-14F878961076 v1.0 Group Policy RPC Interface
Bindings:
ncalrpc:[LRPC-1e815b36ff28d761c1]
Protocol: N/A
Provider: N/A
UUID : 3A9EF155-691D-4449-8D05-09AD57031823 v1.0
Bindings:
ncacn_ip_tcp:10.129.243.131[49666]
ncalrpc:[LRPC-3e1dbf52587c9cea33]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\DC[\PIPE\atsvc]
ncalrpc:[LRPC-a6fa6dc5bb5e22a3a2]
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
Provider: schedsvc.dll
UUID : 86D35949-83C9-4044-B424-DB363231FD0C v1.0
Bindings:
ncacn_ip_tcp:10.129.243.131[49666]
ncalrpc:[LRPC-3e1dbf52587c9cea33]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\DC[\PIPE\atsvc]
ncalrpc:[LRPC-a6fa6dc5bb5e22a3a2]
Protocol: N/A
Provider: N/A
UUID : 33D84484-3626-47EE-8C6F-E7E98B113BE1 v2.0
Bindings:
ncalrpc:[LRPC-3e1dbf52587c9cea33]
ncalrpc:[ubpmtaskhostchannel]
ncacn_np:\\DC[\PIPE\atsvc]
ncalrpc:[LRPC-a6fa6dc5bb5e22a3a2]
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
Provider: taskcomp.dll
UUID : 378E52B0-C0A9-11CF-822D-00AA0051E40F v1.0
Bindings:
ncacn_np:\\DC[\PIPE\atsvc]
ncalrpc:[LRPC-a6fa6dc5bb5e22a3a2]
Protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
Provider: taskcomp.dll
UUID : 1FF70682-0A51-30E8-076D-740BE8CEE98B v1.0
Bindings:
ncacn_np:\\DC[\PIPE\atsvc]
ncalrpc:[LRPC-a6fa6dc5bb5e22a3a2]
Protocol: N/A
Provider: schedsvc.dll
UUID : 0A74EF1C-41A4-4E06-83AE-DC74FB1CDD53 v1.0
Bindings:
ncalrpc:[LRPC-a6fa6dc5bb5e22a3a2]
Protocol: N/A
Provider: MPSSVC.dll
UUID : 2FB92682-6599-42DC-AE13-BD2CA89BD11C v1.0 Fw APIs
Bindings:
ncalrpc:[LRPC-a3db541015ee3b4092]
ncalrpc:[LRPC-25295713f276d13d17]
ncalrpc:[LRPC-61500542b0c0f189c2]
ncalrpc:[LRPC-3a5ad18195f7896668]
Protocol: N/A
Provider: N/A
UUID : F47433C3-3E9D-4157-AAD4-83AA1F5C2D4C v1.0 Fw APIs
Bindings:
ncalrpc:[LRPC-25295713f276d13d17]
ncalrpc:[LRPC-61500542b0c0f189c2]
ncalrpc:[LRPC-3a5ad18195f7896668]
Protocol: N/A
Provider: MPSSVC.dll
UUID : 7F9D11BF-7FB9-436B-A812-B2D50C5D4C03 v1.0 Fw APIs
Bindings:
ncalrpc:[LRPC-61500542b0c0f189c2]
ncalrpc:[LRPC-3a5ad18195f7896668]
Protocol: N/A
Provider: BFE.DLL
UUID : DD490425-5325-4565-B774-7E27D6C09C24 v1.0 Base Firewall Engine API
Bindings:
ncalrpc:[LRPC-3a5ad18195f7896668]
Protocol: N/A
Provider: N/A
UUID : 7F1343FE-50A9-4927-A778-0C5859517BAC v1.0 DfsDs service
Bindings:
ncacn_np:\\DC[\PIPE\wkssvc]
ncalrpc:[LRPC-0a9c64a79e96914cf8]
Protocol: N/A
Provider: N/A
UUID : EB081A0D-10EE-478A-A1DD-50995283E7A8 v3.0 Witness Client Test Interface
Bindings:
ncalrpc:[LRPC-0a9c64a79e96914cf8]
Protocol: N/A
Provider: N/A
UUID : F2C9B409-C1C9-4100-8639-D8AB1486694A v1.0 Witness Client Upcall Server
Bindings:
ncalrpc:[LRPC-0a9c64a79e96914cf8]
Protocol: N/A
Provider: N/A
UUID : C2D1B5DD-FA81-4460-9DD6-E7658B85454B v1.0
Bindings:
ncalrpc:[LRPC-eeed9c661ca2875f9a]
ncalrpc:[OLEAC93DB631A747BCA540781AA6BEF]
Protocol: N/A
Provider: N/A
UUID : F44E62AF-DAB1-44C2-8013-049A9DE417D6 v1.0
Bindings:
ncalrpc:[LRPC-eeed9c661ca2875f9a]
ncalrpc:[OLEAC93DB631A747BCA540781AA6BEF]
Protocol: N/A
Provider: N/A
UUID : 7AEB6705-3AE6-471A-882D-F39C109EDC12 v1.0
Bindings:
ncalrpc:[LRPC-eeed9c661ca2875f9a]
ncalrpc:[OLEAC93DB631A747BCA540781AA6BEF]
Protocol: N/A
Provider: N/A
UUID : E7F76134-9EF5-4949-A2D6-3368CC0988F3 v1.0
Bindings:
ncalrpc:[LRPC-eeed9c661ca2875f9a]
ncalrpc:[OLEAC93DB631A747BCA540781AA6BEF]
Protocol: N/A
Provider: N/A
UUID : B37F900A-EAE4-4304-A2AB-12BB668C0188 v1.0
Bindings:
ncalrpc:[LRPC-eeed9c661ca2875f9a]
ncalrpc:[OLEAC93DB631A747BCA540781AA6BEF]
Protocol: N/A
Provider: N/A
UUID : ABFB6CA3-0C5E-4734-9285-0AEE72FE8D1C v1.0
Bindings:
ncalrpc:[LRPC-eeed9c661ca2875f9a]
ncalrpc:[OLEAC93DB631A747BCA540781AA6BEF]
Protocol: N/A
Provider: N/A
UUID : C49A5A70-8A7F-4E70-BA16-1E8F1F193EF1 v1.0 Adh APIs
Bindings:
ncalrpc:[OLE5FCB0823110EF79154A84BC1C955]
ncalrpc:[TeredoControl]
ncalrpc:[TeredoDiagnostics]
ncalrpc:[LRPC-2b9dd75a050dd32327]
Protocol: N/A
Provider: N/A
UUID : C36BE077-E14B-4FE9-8ABC-E856EF4F048B v1.0 Proxy Manager client server endpoint
Bindings:
ncalrpc:[TeredoControl]
ncalrpc:[TeredoDiagnostics]
ncalrpc:[LRPC-2b9dd75a050dd32327]
Protocol: N/A
Provider: N/A
UUID : 2E6035B2-E8F1-41A7-A044-656B439C4C34 v1.0 Proxy Manager provider server endpoint
Bindings:
ncalrpc:[TeredoControl]
ncalrpc:[TeredoDiagnostics]
ncalrpc:[LRPC-2b9dd75a050dd32327]
Protocol: N/A
Provider: iphlpsvc.dll
UUID : 552D076A-CB29-4E44-8B6A-D15E59E2C0AF v1.0 IP Transition Configuration endpoint
Bindings:
ncalrpc:[LRPC-2b9dd75a050dd32327]
Protocol: N/A
Provider: N/A
UUID : 0D3C7F20-1C8D-4654-A1B3-51563B298BDA v1.0 UserMgrCli
Bindings:
ncalrpc:[LRPC-0f23b80e8c8e8083c8]
ncalrpc:[OLE6A1CCA02AC4BF8BCCEB70B5744EE]
Protocol: N/A
Provider: N/A
UUID : B18FBAB6-56F8-4702-84E0-41053293A869 v1.0 UserMgrCli
Bindings:
ncalrpc:[LRPC-0f23b80e8c8e8083c8]
ncalrpc:[OLE6A1CCA02AC4BF8BCCEB70B5744EE]
Protocol: N/A
Provider: N/A
UUID : 51A227AE-825B-41F2-B4A9-1AC9557A1018 v1.0 Ngc Pop Key Service
Bindings:
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: N/A
Provider: N/A
UUID : 8FB74744-B2FF-4C00-BE0D-9EF9A191FE1B v1.0 Ngc Pop Key Service
Bindings:
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: N/A
Provider: N/A
UUID : B25A52BF-E5DD-4F4A-AEA6-8CA7272A0E86 v2.0 KeyIso
Bindings:
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: [MS-NRPC]: Netlogon Remote Protocol
Provider: netlogon.dll
UUID : 12345678-1234-ABCD-EF00-01234567CFFB v1.0
Bindings:
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: [MS-RAA]: Remote Authorization API Protocol
Provider: N/A
UUID : 0B1C2170-5732-4E0E-8CD3-D9B16F3B84D7 v0.0 RemoteAccessCheck
Bindings:
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
ncalrpc:[NETLOGON_LRPC]
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: [MS-LSAT]: Local Security Authority (Translation Methods) Remote
Provider: lsasrv.dll
UUID : 12345778-1234-ABCD-EF00-0123456789AB v0.0
Bindings:
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: [MS-DRSR]: Directory Replication Service (DRS) Remote Protocol
Provider: ntdsai.dll
UUID : E3514235-4B06-11D1-AB04-00C04FC2DCD2 v4.0 MS NT Directory DRS Interface
Bindings:
ncacn_np:\\DC[\pipe\f646315b4c642943]
ncacn_http:10.129.243.131[49674]
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol
Provider: samsrv.dll
UUID : 12345778-1234-ABCD-EF00-0123456789AC v1.0
Bindings:
ncacn_ip_tcp:10.129.243.131[49673]
ncalrpc:[NTDS_LPC]
ncalrpc:[OLE30FBECD9DCFCCBF8301B42E8A091]
ncacn_ip_tcp:10.129.243.131[49667]
ncalrpc:[samss lpc]
ncalrpc:[SidKey Local End Point]
ncalrpc:[protected_storage]
ncalrpc:[lsasspirpc]
ncalrpc:[lsapolicylookup]
ncalrpc:[LSA_EAS_ENDPOINT]
ncalrpc:[lsacap]
ncalrpc:[LSARPC_ENDPOINT]
ncalrpc:[securityevent]
ncalrpc:[audit]
ncacn_np:\\DC[\pipe\lsass]
Protocol: N/A
Provider: N/A
UUID : 1A0D010F-1C33-432C-B0F5-8CF4E8053099 v1.0 IdSegSrv service
Bindings:
ncalrpc:[LRPC-f4293e3b5b9ae5cb28]
Protocol: N/A
Provider: srvsvc.dll
UUID : 98716D03-89AC-44C7-BB8C-285824E51C4A v1.0 XactSrv service
Bindings:
ncalrpc:[LRPC-f4293e3b5b9ae5cb28]
Protocol: N/A
Provider: sysmain.dll
UUID : B58AA02E-2884-4E97-8176-4EE06D794184 v1.0
Bindings:
ncalrpc:[LRPC-6ba6be7619ad5499b5]
Protocol: N/A
Provider: N/A
UUID : DF4DF73A-C52D-4E3A-8003-8437FDF8302A v0.0 WM_WindowManagerRPC\Server
Bindings:
ncalrpc:[LRPC-e9c9cb51676dd7958e]
Protocol: N/A
Provider: IKEEXT.DLL
UUID : A398E520-D59A-4BDD-AA7A-3C1E0303A511 v1.0 IKE/Authip API
Bindings:
ncalrpc:[LRPC-a6cbf0f8554ac2dd0e]
Protocol: N/A
Provider: N/A
UUID : 650A7E26-EAB8-5533-CE43-9C1DFCE11511 v1.0 Vpn APIs
Bindings:
ncalrpc:[LRPC-78511121f1275f430c]
ncalrpc:[VpnikeRpc]
ncalrpc:[RasmanLrpc]
ncacn_np:\\DC[\PIPE\ROUTER]
Protocol: [MS-SCMR]: Service Control Manager Remote Protocol
Provider: services.exe
UUID : 367ABB81-9844-35F1-AD32-98F038001003 v2.0
Bindings:
ncacn_ip_tcp:10.129.243.131[49678]
Protocol: [MS-CMPO]: MSDTC Connection Manager:
Provider: msdtcprx.dll
UUID : 906B0CE0-C70B-1067-B317-00DD010662DA v1.0
Bindings:
ncalrpc:[LRPC-3bcaafee1590c0de20]
ncalrpc:[OLE17B51056E4D45A611212712C1451]
ncalrpc:[LRPC-9c5b8ea96b2f264739]
ncalrpc:[LRPC-9c5b8ea96b2f264739]
ncalrpc:[LRPC-9c5b8ea96b2f264739]
Protocol: N/A
Provider: N/A
UUID : F3F09FFD-FBCF-4291-944D-70AD6E0E73BB v1.0
Bindings:
ncalrpc:[LRPC-802031e034c1f025bd]
Protocol: [MS-DNSP]: Domain Name Service (DNS) Server Management
Provider: dns.exe
UUID : 50ABC2A4-574D-40B3-9D66-EE4FD5FBA076 v5.0
Bindings:
ncacn_ip_tcp:10.129.243.131[49695]
Protocol: [MS-FRS2]: Distributed File System Replication Protocol
Provider: dfsrmig.exe
UUID : 897E2E5F-93F3-4376-9C9C-FD2277495C27 v1.0 Frs2 Service
Bindings:
ncacn_ip_tcp:10.129.243.131[49843]
ncalrpc:[OLECF74F747061ABA28294F2BDC6FF0]
Protocol: N/A
Provider: N/A
UUID : BF4DC912-E52F-4904-8EBE-9317C1BDD497 v1.0
Bindings:
ncalrpc:[LRPC-92939372b55364a6c8]
ncalrpc:[OLE9D9AB6AB4D22AD38C10DD1548060]
[*] Received 405 endpoints.

2
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp5985/tcp_5985_winrm-detection.txt Normal file
View File

@@ -0,0 +1,2 @@
WinRM was possibly detected running on tcp port 5985.
Check _manual_commands.txt for manual commands you can run against this service.

50
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_curl.html Normal file
View File

@@ -0,0 +1,50 @@
HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Fri, 20 Aug 2021 13:39:48 GMT
Accept-Ranges: bytes
ETag: "0eaf6d7c895d71:0"
Server: Microsoft-IIS/10.0
Date: Sat, 28 Oct 2023 13:05:55 GMT
Content-Length: 1034
<!DOCTYPE html>
<html lang="en" >
<head>
<meta charset="UTF-8">
<title>Slandovia Energy</title>
<link rel='stylesheet' href='https://ajax.googleapis.com/ajax/libs/jqueryui/1.11.2/themes/smoothness/jquery-ui.css'><link rel="stylesheet" href="./style.css">
<script src="https://cdnjs.cloudflare.com/ajax/libs/prefixfree/1.0.7/prefixfree.min.js"></script>
</head>
<body>
<!-- partial:index.partial.html -->
<link href='https://fonts.googleapis.com/css?family=Open+Sans|Maven+Pro:500' rel='stylesheet' type='text/css'>
<div class="deco topdeco">
<span></span>
<span></span>
<span></span>
<span></span>
</div>
<h1>MegaCorp</h1>
<h3>
Slandovia Energy Grid
</h3>
<section class="list-wrap">
<label for="search-text">Check Status</label>
<input type="text" id="search-text" placeholder="search" class="search-box">
<span class="list-count"></span>
<ul id="list">
<span class="empty-item">no results</span>
</ul>
</section>
<!-- partial -->
<script src="./script.js"></script>
</body>
</html>

21
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_feroxbuster_dirbuster.txt Normal file
View File

@@ -0,0 +1,21 @@
200 GET 25l 72w 692c http://10.129.243.131/script.js
200 GET 215l 294w 3166c http://10.129.243.131/style.css
200 GET 41l 66w 1034c http://10.129.243.131/
200 GET 41l 66w 1034c http://10.129.243.131/Index.html
200 GET 8l 168w 1092c http://10.129.243.131/LICENSE.txt
200 GET 1l 14w 116c http://10.129.243.131/Search.php
200 GET 41l 66w 1034c http://10.129.243.131/index.html
200 GET 8l 168w 1092c http://10.129.243.131/license.txt
200 GET 1l 14w 116c http://10.129.243.131/search.php
200 GET 25l 72w 692c http://10.129.243.131/script.js
200 GET 215l 294w 3166c http://10.129.243.131/style.css
200 GET 41l 66w 1034c http://10.129.243.131/
200 GET 41l 66w 1034c http://10.129.243.131/Index.html
200 GET 8l 168w 1092c http://10.129.243.131/LICENSE.txt
200 GET 1l 14w 116c http://10.129.243.131/Search.php
200 GET 41l 66w 1034c http://10.129.243.131/index.html
200 GET 8l 168w 1092c http://10.129.243.131/license.txt
200 GET 1l 14w 116c http://10.129.243.131/search.php
200 GET 8l 168w 1092c http://10.129.243.131/License.txt
200 GET 1l 14w 116c http://10.129.243.131/SEARCH.php
200 GET 41l 66w 1034c http://10.129.243.131/INDEX.html

0
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_megacorp.htb_vhosts_subdomains-top1million-110000.txt Normal file
View File

106
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_nmap.txt Normal file
View File

@@ -0,0 +1,106 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv --reason -Pn -T4 -sV -p 80 "--script=banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)" -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/xml/tcp_80_http_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.033s latency).
Scanned at 2023-10-28 14:27:58 CEST for 128s
Bug in http-security-headers: no string output.
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0
| http-headers:
| Content-Length: 1034
| Content-Type: text/html
| Last-Modified: Fri, 20 Aug 2021 13:39:48 GMT
| Accept-Ranges: bytes
| ETag: "0eaf6d7c895d71:0"
| Server: Microsoft-IIS/10.0
| Date: Sat, 28 Oct 2023 13:05:55 GMT
| Connection: close
|
|_ (Request type: HEAD)
|_http-config-backup: ERROR: Script execution failed (use -d to debug)
|_http-server-header: Microsoft-IIS/10.0
|_http-wordpress-enum: Nothing found amongst the top 100 resources,use --script-args search-limit=<number|all> for deeper analysis)
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-php-version: Logo query returned unknown hash a38e7a4db6688b811d52e1eab13a9b5c
|_Credits query returned unknown hash a38e7a4db6688b811d52e1eab13a9b5c
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-litespeed-sourcecode-download: Request with null byte did not work. This web server might not be vulnerable
| http-comments-displayer:
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=megacorp.htb
|
| Path: http://megacorp.htb:80/style.css
| Line number: 117
| Comment:
| /*
| The following are styles purely for the surroundings
| */
|
| Path: http://megacorp.htb:80/
| Line number: 11
| Comment:
| <!-- partial:index.partial.html -->
|
| Path: http://megacorp.htb:80/
| Line number: 37
| Comment:
| <!-- partial -->
|
| Path: http://megacorp.htb:80/style.css
| Line number: 1
| Comment:
|_ /* this declares a better box model */
|_http-fetch: Please enter the complete path of the directory to save data in.
|_http-errors: Couldn't find any error pages.
|_http-mobileversion-checker: No mobile version detected.
| http-vhosts:
|_128 names had status 200
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-jsonp-detection: Couldn't find any JSONP endpoints.
| http-sitemap-generator:
| Directory structure:
| /
| Other: 1; css: 1; js: 1
| Longest directory structure:
| Depth: 0
| Dir: /
| Total files found (by extension):
|_ Other: 1; css: 1; js: 1
| http-useragent-tester:
| Status for browser useragent: 200
| Allowed User Agents:
| Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)
| libwww
| lwp-trivial
| libcurl-agent/1.0
| PHP/
| Python-urllib/2.5
| GT::WWW
| Snoopy
| MFC_Tear_Sample
| HTTP::Lite
| PHPCrawl
| URI::Fetch
| Zend_Http_Client
| http client
| PECL::HTTP
| Wget/1.13.4 (linux-gnu)
|_ WWW-Mechanize/1.34
|_http-drupal-enum: Nothing found amongst the top 100 resources,use --script-args number=<number|all> for deeper analysis)
|_http-devframework: Couldn't determine the underlying framework or CMS. Try increasing 'httpspider.maxpagecount' value to spider more pages.
| http-referer-checker:
| Spidering limited to: maxpagecount=30
|_ https://cdnjs.cloudflare.com:443/ajax/libs/prefixfree/1.0.7/prefixfree.min.js
|_http-feed: Couldn't find any feeds.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-chrono: Request times for /; avg: 159.55ms; min: 156.41ms; max: 162.52ms
|_http-date: Sat, 28 Oct 2023 13:05:55 GMT; +37m49s from local time.
|_http-title: Slandovia Energy
|_http-wordpress-users: [Error] Wordpress installation was not found. We couldn't find wp-login.php
|_http-malware-host: Host appears to be clean
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:30:06 2023 -- 1 IP address (1 host up) scanned in 133.76 seconds

BIN
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_screenshot.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 2.0 MiB

46
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_whatweb.txt Normal file
View File

@@ -0,0 +1,46 @@
WhatWeb report for http://10.129.243.131:80
Status : 200 OK
Title : Slandovia Energy
IP : 10.129.243.131
Country : RESERVED, ZZ
Summary : HTML5, HTTPServer[Microsoft-IIS/10.0], Microsoft-IIS[10.0], Script
Detected Plugins:
[ HTML5 ]
HTML version 5, detected by the doctype declaration
[ HTTPServer ]
HTTP server header string. This plugin also attempts to
identify the operating system from the server header.
String : Microsoft-IIS/10.0 (from server string)
[ Microsoft-IIS ]
Microsoft Internet Information Services (IIS) for Windows
Server is a flexible, secure and easy-to-manage Web server
for hosting anything on the Web. From media streaming to
web application hosting, IIS's scalable and open
architecture is ready to handle the most demanding tasks.
Version : 10.0
Website : http://www.iis.net/
[ Script ]
This plugin detects instances of script HTML elements and
returns the script language/type.
HTTP Headers:
HTTP/1.1 200 OK
Content-Type: text/html
Last-Modified: Fri, 20 Aug 2021 13:39:48 GMT
Accept-Ranges: bytes
ETag: "0eaf6d7c895d71:0"
Server: Microsoft-IIS/10.0
Date: Sat, 28 Oct 2023 13:05:55 GMT
Connection: close
Content-Length: 1034

81
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/xml/tcp_80_http_nmap.xml Normal file
View File

@@ -0,0 +1,81 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:27:53 2023 as: nmap -vv -&#45;reason -Pn -T4 -sV -p 80 &quot;-&#45;script=banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)&quot; -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/xml/tcp_80_http_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sV -p 80 &quot;-&#45;script=banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)&quot; -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/tcp_80_http_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp80/xml/tcp_80_http_nmap.xml 10.129.243.131" start="1698496073" startstr="Sat Oct 28 14:27:53 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="1" services="80"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698496077"/>
<taskend task="NSE" time="1698496077"/>
<taskbegin task="NSE" time="1698496077"/>
<taskend task="NSE" time="1698496077"/>
<taskbegin task="NSE" time="1698496077"/>
<taskend task="NSE" time="1698496077"/>
<taskbegin task="SYN Stealth Scan" time="1698496077"/>
<taskend task="SYN Stealth Scan" time="1698496078" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698496078"/>
<taskend task="Service scan" time="1698496084" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698496084"/>
<taskprogress task="NSE" time="1698496115" percent="99.67" remaining="1" etc="1698496115"/>
<taskprogress task="NSE" time="1698496145" percent="99.67" remaining="1" etc="1698496145"/>
<taskprogress task="NSE" time="1698496175" percent="99.67" remaining="1" etc="1698496175"/>
<taskprogress task="NSE" time="1698496205" percent="99.67" remaining="1" etc="1698496205"/>
<taskend task="NSE" time="1698496206"/>
<taskbegin task="NSE" time="1698496206"/>
<taskend task="NSE" time="1698496206"/>
<taskbegin task="NSE" time="1698496206"/>
<taskend task="NSE" time="1698496206"/>
<host starttime="1698496078" endtime="1698496206"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="http" product="Microsoft IIS httpd" version="10.0" ostype="Windows" method="probed" conf="10"><cpe>cpe:/a:microsoft:internet_information_services:10.0</cpe><cpe>cpe:/o:microsoft:windows</cpe></service><script id="http-headers" output="&#xa; Content-Length: 1034&#xa; Content-Type: text/html&#xa; Last-Modified: Fri, 20 Aug 2021 13:39:48 GMT&#xa; Accept-Ranges: bytes&#xa; ETag: &quot;0eaf6d7c895d71:0&quot;&#xa; Server: Microsoft-IIS/10.0&#xa; Date: Sat, 28 Oct 2023 13:05:55 GMT&#xa; Connection: close&#xa; &#xa; (Request type: HEAD)&#xa;"/><script id="http-config-backup" output="ERROR: Script execution failed (use -d to debug)"/><script id="http-server-header" output="Microsoft-IIS/10.0"><elem>Microsoft-IIS/10.0</elem>
</script><script id="http-wordpress-enum" output="Nothing found amongst the top 100 resources,use -&#45;script-args search-limit=&lt;number|all&gt; for deeper analysis)"/><script id="http-stored-xss" output="Couldn&apos;t find any stored XSS vulnerabilities."/><script id="http-php-version" output="Logo query returned unknown hash a38e7a4db6688b811d52e1eab13a9b5c&#xa;Credits query returned unknown hash a38e7a4db6688b811d52e1eab13a9b5c"/><script id="http-methods" output="&#xa; Supported Methods: OPTIONS TRACE GET HEAD POST&#xa; Potentially risky methods: TRACE"><table key="Supported Methods">
<elem>OPTIONS</elem>
<elem>TRACE</elem>
<elem>GET</elem>
<elem>HEAD</elem>
<elem>POST</elem>
</table>
<table key="Potentially risky methods">
<elem>TRACE</elem>
</table>
</script><script id="http-litespeed-sourcecode-download" output="Request with null byte did not work. This web server might not be vulnerable"/><script id="http-comments-displayer" output="&#xa;Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=megacorp.htb&#xa; &#xa; Path: http://megacorp.htb:80/style.css&#xa; Line number: 117&#xa; Comment: &#xa; /*&#xa; The following are styles purely for the surroundings&#xa; */&#xa; &#xa; Path: http://megacorp.htb:80/&#xa; Line number: 11&#xa; Comment: &#xa; &lt;!-&#45; partial:index.partial.html -&#45;&gt;&#xa; &#xa; Path: http://megacorp.htb:80/&#xa; Line number: 37&#xa; Comment: &#xa; &lt;!-&#45; partial -&#45;&gt;&#xa; &#xa; Path: http://megacorp.htb:80/style.css&#xa; Line number: 1&#xa; Comment: &#xa; /* this declares a better box model */&#xa;"/><script id="http-fetch" output="Please enter the complete path of the directory to save data in."><elem key="ERROR">Please enter the complete path of the directory to save data in.</elem>
</script><script id="http-errors" output="Couldn&apos;t find any error pages."/><script id="http-mobileversion-checker" output="No mobile version detected."/><script id="http-vhosts" output="&#xa;128 names had status 200"/><script id="http-dombased-xss" output="Couldn&apos;t find any DOM based XSS."/><script id="http-jsonp-detection" output="Couldn&apos;t find any JSONP endpoints."/><script id="http-sitemap-generator" output="&#xa; Directory structure:&#xa; /&#xa; Other: 1; css: 1; js: 1&#xa; Longest directory structure:&#xa; Depth: 0&#xa; Dir: /&#xa; Total files found (by extension):&#xa; Other: 1; css: 1; js: 1&#xa;"/><script id="http-useragent-tester" output="&#xa; Status for browser useragent: 200&#xa; Allowed User Agents: &#xa; Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)&#xa; libwww&#xa; lwp-trivial&#xa; libcurl-agent/1.0&#xa; PHP/&#xa; Python-urllib/2.5&#xa; GT::WWW&#xa; Snoopy&#xa; MFC_Tear_Sample&#xa; HTTP::Lite&#xa; PHPCrawl&#xa; URI::Fetch&#xa; Zend_Http_Client&#xa; http client&#xa; PECL::HTTP&#xa; Wget/1.13.4 (linux-gnu)&#xa; WWW-Mechanize/1.34"><elem key="Status for browser useragent">200</elem>
<table key="Allowed User Agents">
<elem>Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)</elem>
<elem>libwww</elem>
<elem>lwp-trivial</elem>
<elem>libcurl-agent/1.0</elem>
<elem>PHP/</elem>
<elem>Python-urllib/2.5</elem>
<elem>GT::WWW</elem>
<elem>Snoopy</elem>
<elem>MFC_Tear_Sample</elem>
<elem>HTTP::Lite</elem>
<elem>PHPCrawl</elem>
<elem>URI::Fetch</elem>
<elem>Zend_Http_Client</elem>
<elem>http client</elem>
<elem>PECL::HTTP</elem>
<elem>Wget/1.13.4 (linux-gnu)</elem>
<elem>WWW-Mechanize/1.34</elem>
</table>
</script><script id="http-drupal-enum" output="Nothing found amongst the top 100 resources,use -&#45;script-args number=&lt;number|all&gt; for deeper analysis)"/><script id="http-devframework" output="Couldn&apos;t determine the underlying framework or CMS. Try increasing &apos;httpspider.maxpagecount&apos; value to spider more pages."/><script id="http-referer-checker" output="&#xa;Spidering limited to: maxpagecount=30&#xa; https://cdnjs.cloudflare.com:443/ajax/libs/prefixfree/1.0.7/prefixfree.min.js&#xa;"/><script id="http-feed" output="Couldn&apos;t find any feeds."/><script id="http-csrf" output="Couldn&apos;t find any CSRF vulnerabilities."/><script id="http-chrono" output="Request times for /; avg: 159.55ms; min: 156.41ms; max: 162.52ms"/><script id="http-security-headers" output=""></script><script id="http-date" output="Sat, 28 Oct 2023 13:05:55 GMT; +37m49s from local time."><elem key="date">2023-10-28T13:05:55+00:00</elem>
<elem key="delta">2269.0</elem>
</script><script id="http-title" output="Slandovia Energy"><elem key="title">Slandovia Energy</elem>
</script><script id="http-wordpress-users" output="[Error] Wordpress installation was not found. We couldn&apos;t find wp-login.php"/><script id="http-malware-host" output="Host appears to be clean"/></port>
</ports>
<times srtt="32870" rttvar="32870" to="164350"/>
</host>
<taskbegin task="NSE" time="1698496206"/>
<taskend task="NSE" time="1698496206"/>
<taskbegin task="NSE" time="1698496206"/>
<taskend task="NSE" time="1698496206"/>
<taskbegin task="NSE" time="1698496206"/>
<taskend task="NSE" time="1698496206"/>
<runstats><finished time="1698496206" timestr="Sat Oct 28 14:30:06 2023" summary="Nmap done at Sat Oct 28 14:30:06 2023; 1 IP address (1 host up) scanned in 133.76 seconds" elapsed="133.76" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

12
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/tcp_88_kerberos_nmap.txt Normal file
View File

@@ -0,0 +1,12 @@
# Nmap 7.93 scan initiated Sat Oct 28 15:03:54 2023 as: nmap -vv --reason -T4 -sV -p 88 --script=banner,krb5-enum-users -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/tcp_88_kerberos_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/xml/tcp_88_kerberos_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received echo-reply ttl 127 (0.063s latency).
Scanned at 2023-10-28 15:03:54 CEST for 17s
PORT STATE SERVICE REASON VERSION
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2023-10-28 13:04:01Z)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 15:04:11 2023 -- 1 IP address (1 host up) scanned in 17.28 seconds

43
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/xml/tcp_88_kerberos_nmap.xml Normal file
View File

@@ -0,0 +1,43 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 15:03:54 2023 as: nmap -vv -&#45;reason -T4 -sV -p 88 -&#45;script=banner,krb5-enum-users -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/tcp_88_kerberos_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/xml/tcp_88_kerberos_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -T4 -sV -p 88 -&#45;script=banner,krb5-enum-users -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/tcp_88_kerberos_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/tcp88/xml/tcp_88_kerberos_nmap.xml 10.129.243.131" start="1698498234" startstr="Sat Oct 28 15:03:54 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="1" services="88"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698498234"/>
<taskend task="NSE" time="1698498234"/>
<taskbegin task="NSE" time="1698498234"/>
<taskend task="NSE" time="1698498234"/>
<taskbegin task="Ping Scan" time="1698498234"/>
<hosthint><status state="up" reason="unknown-response" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
</hostnames>
</hosthint>
<taskend task="Ping Scan" time="1698498234" extrainfo="1 total hosts"/>
<taskbegin task="SYN Stealth Scan" time="1698498234"/>
<taskend task="SYN Stealth Scan" time="1698498234" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698498234"/>
<taskend task="Service scan" time="1698498241" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698498241"/>
<taskend task="NSE" time="1698498251"/>
<taskbegin task="NSE" time="1698498251"/>
<taskend task="NSE" time="1698498251"/>
<host starttime="1698498234" endtime="1698498251"><status state="up" reason="echo-reply" reason_ttl="127"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><port protocol="tcp" portid="88"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="kerberos-sec" product="Microsoft Windows Kerberos" extrainfo="server time: 2023-10-28 13:04:01Z" ostype="Windows" method="probed" conf="10"><cpe>cpe:/a:microsoft:kerberos</cpe><cpe>cpe:/o:microsoft:windows</cpe></service></port>
</ports>
<times srtt="63304" rttvar="49640" to="261864"/>
</host>
<taskbegin task="NSE" time="1698498251"/>
<taskend task="NSE" time="1698498251"/>
<taskbegin task="NSE" time="1698498251"/>
<taskend task="NSE" time="1698498251"/>
<runstats><finished time="1698498251" timestr="Sat Oct 28 15:04:11 2023" summary="Nmap done at Sat Oct 28 15:04:11 2023; 1 IP address (1 host up) scanned in 17.28 seconds" elapsed="17.28" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

13
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp123/udp_123_ntp_nmap.txt Normal file
View File

@@ -0,0 +1,13 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:53:13 2023 as: nmap -vv --reason -Pn -T4 -sU -sV -p 123 "--script=banner,(ntp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp123/udp_123_ntp_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp123/xml/udp_123_ntp_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.061s latency).
Scanned at 2023-10-28 14:53:15 CEST for 10s
PORT STATE SERVICE REASON VERSION
123/udp open ntp udp-response ttl 127 NTP v3
| ntp-info:
|_ receive time stamp: 2023-10-28T12:53:27
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:53:25 2023 -- 1 IP address (1 host up) scanned in 11.83 seconds

43
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp123/xml/udp_123_ntp_nmap.xml Normal file
View File

@@ -0,0 +1,43 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:53:13 2023 as: nmap -vv -&#45;reason -Pn -T4 -sU -sV -p 123 &quot;-&#45;script=banner,(ntp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)&quot; -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp123/udp_123_ntp_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp123/xml/udp_123_ntp_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sU -sV -p 123 &quot;-&#45;script=banner,(ntp* or ssl*) and not (brute or broadcast or dos or external or fuzzer)&quot; -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp123/udp_123_ntp_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp123/xml/udp_123_ntp_nmap.xml 10.129.243.131" start="1698497593" startstr="Sat Oct 28 14:53:13 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="udp" protocol="udp" numservices="1" services="123"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698497594"/>
<taskend task="NSE" time="1698497594"/>
<taskbegin task="NSE" time="1698497594"/>
<taskend task="NSE" time="1698497594"/>
<taskbegin task="NSE" time="1698497594"/>
<taskend task="NSE" time="1698497594"/>
<taskbegin task="UDP Scan" time="1698497595"/>
<taskend task="UDP Scan" time="1698497595" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698497595"/>
<taskend task="Service scan" time="1698497595" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698497595"/>
<taskend task="NSE" time="1698497605"/>
<taskbegin task="NSE" time="1698497605"/>
<taskend task="NSE" time="1698497605"/>
<taskbegin task="NSE" time="1698497605"/>
<taskend task="NSE" time="1698497605"/>
<host starttime="1698497595" endtime="1698497605"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><port protocol="udp" portid="123"><state state="open" reason="udp-response" reason_ttl="127"/><service name="ntp" product="NTP" version="v3" method="probed" conf="10"/><script id="ntp-info" output="&#xa; receive time stamp: 2023-10-28T12:53:27"><elem key="receive time stamp">2023-10-28T12:53:27</elem>
</script></port>
</ports>
<times srtt="61240" rttvar="61240" to="306200"/>
</host>
<taskbegin task="NSE" time="1698497605"/>
<taskend task="NSE" time="1698497605"/>
<taskbegin task="NSE" time="1698497605"/>
<taskend task="NSE" time="1698497605"/>
<taskbegin task="NSE" time="1698497605"/>
<taskend task="NSE" time="1698497605"/>
<runstats><finished time="1698497605" timestr="Sat Oct 28 14:53:25 2023" summary="Nmap done at Sat Oct 28 14:53:25 2023; 1 IP address (1 host up) scanned in 11.83 seconds" elapsed="11.83" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

27
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dns_nmap.txt Normal file
View File

@@ -0,0 +1,27 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:53:13 2023 as: nmap -vv --reason -Pn -T4 -sU -sV -p 53 "--script=banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)" -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dns_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/xml/udp_53_dns_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set (0.065s latency).
Scanned at 2023-10-28 14:53:15 CEST for 36s
PORT STATE SERVICE REASON VERSION
53/udp open domain udp-response ttl 127 (generic dns response: SERVFAIL)
| fingerprint-strings:
| NBTStat:
|_ CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|_dns-cache-snoop: 0 of 100 tested domains are cached.
| dns-nsec-enum:
|_ No NSEC records found
| dns-nsec3-enum:
|_ DNSSEC NSEC3 not supported
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-UDP:V=7.93%I=7%D=10/28%Time=653D044F%P=x86_64-pc-linux-gnu%r(NBT
SF:Stat,32,"\x80\xf0\x80\x82\0\x01\0\0\0\0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAA
SF:AAAAAAAA\0\0!\0\x01");
Host script results:
| dns-brute:
|_ DNS Brute-force hostnames: No results.
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:53:51 2023 -- 1 IP address (1 host up) scanned in 37.94 seconds

19
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dns_reverse-lookup.txt Normal file
View File

@@ -0,0 +1,19 @@
;; communications error to 10.129.243.131#53: timed out
; <<>> DiG 9.18.11-2-Debian <<>> -p 53 -x 10.129.243.131 @10.129.243.131
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 35295
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;131.243.129.10.in-addr.arpa. IN PTR
;; Query time: 4543 msec
;; SERVER: 10.129.243.131#53(10.129.243.131) (UDP)
;; WHEN: Sat Oct 28 14:53:23 CEST 2023
;; MSG SIZE rcvd: 56

6
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dns_zone-transfer-domain.txt Normal file
View File

@@ -0,0 +1,6 @@
; <<>> DiG 9.18.11-2-Debian <<>> AXFR -p 53 @10.129.243.131 megacorp.htb
; (1 server found)
;; global options: +cmd
; Transfer failed.

11
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dns_zone-transfer.txt Normal file
View File

@@ -0,0 +1,11 @@
;; communications error to 10.129.243.131#53: timed out
; <<>> DiG 9.18.11-2-Debian <<>> AXFR -p 53 @10.129.243.131
; (1 server found)
;; global options: +cmd
;; Query time: 4127 msec
;; SERVER: 10.129.243.131#53(10.129.243.131) (UDP)
;; WHEN: Sat Oct 28 14:53:23 CEST 2023
;; MSG SIZE rcvd: 28

3
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dnsrecon_default.txt Normal file
View File

@@ -0,0 +1,3 @@
[*] std: Performing General Enumeration against: megacorp.htb...
[-] Could not resolve domain: megacorp.htb

0
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_megacorp.htb_subdomains_subdomains-top1million-110000.txt Normal file
View File

45
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/xml/udp_53_dns_nmap.xml Normal file
View File

@@ -0,0 +1,45 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:53:13 2023 as: nmap -vv -&#45;reason -Pn -T4 -sU -sV -p 53 &quot;-&#45;script=banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)&quot; -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dns_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/xml/udp_53_dns_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sU -sV -p 53 &quot;-&#45;script=banner,(dns* or ssl*) and not (brute or broadcast or dos or external or fuzzer)&quot; -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/udp_53_dns_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp53/xml/udp_53_dns_nmap.xml 10.129.243.131" start="1698497593" startstr="Sat Oct 28 14:53:13 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="udp" protocol="udp" numservices="1" services="53"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698497595"/>
<taskend task="NSE" time="1698497595"/>
<taskbegin task="NSE" time="1698497595"/>
<taskend task="NSE" time="1698497595"/>
<taskbegin task="NSE" time="1698497595"/>
<taskend task="NSE" time="1698497595"/>
<taskbegin task="UDP Scan" time="1698497595"/>
<taskend task="UDP Scan" time="1698497595" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698497595"/>
<taskend task="Service scan" time="1698497615" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698497615"/>
<taskend task="NSE" time="1698497631"/>
<taskbegin task="NSE" time="1698497631"/>
<taskend task="NSE" time="1698497631"/>
<taskbegin task="NSE" time="1698497631"/>
<taskend task="NSE" time="1698497631"/>
<host starttime="1698497595" endtime="1698497631"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><port protocol="udp" portid="53"><state state="open" reason="udp-response" reason_ttl="127"/><service name="domain" extrainfo="generic dns response: SERVFAIL" servicefp="SF-Port53-UDP:V=7.93%I=7%D=10/28%Time=653D044F%P=x86_64-pc-linux-gnu%r(NBTStat,32,&quot;\x80\xf0\x80\x82\0\x01\0\0\0\0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01&quot;);" method="probed" conf="10"/><script id="fingerprint-strings" output="&#xa; NBTStat: &#xa; CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"><elem key="NBTStat">&#xa; CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</elem>
</script><script id="dns-cache-snoop" output="0 of 100 tested domains are cached.&#xa;"/><script id="dns-nsec-enum" output="&#xa; No NSEC records found&#xa;"/><script id="dns-nsec3-enum" output="&#xa; DNSSEC NSEC3 not supported&#xa;"/></port>
</ports>
<hostscript><script id="dns-brute" output="&#xa; DNS Brute-force hostnames: No results."><table key="DNS Brute-force hostnames">
</table>
</script></hostscript><times srtt="65039" rttvar="65039" to="325195"/>
</host>
<taskbegin task="NSE" time="1698497631"/>
<taskend task="NSE" time="1698497631"/>
<taskbegin task="NSE" time="1698497631"/>
<taskend task="NSE" time="1698497631"/>
<taskbegin task="NSE" time="1698497631"/>
<taskend task="NSE" time="1698497631"/>
<runstats><finished time="1698497631" timestr="Sat Oct 28 14:53:51 2023" summary="Nmap done at Sat Oct 28 14:53:51 2023; 1 IP address (1 host up) scanned in 37.94 seconds" elapsed="37.94" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

12
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp88/udp_88_kerberos_nmap.txt Normal file
View File

@@ -0,0 +1,12 @@
# Nmap 7.93 scan initiated Sat Oct 28 14:53:13 2023 as: nmap -vv --reason -Pn -T4 -sU -sV -p 88 --script=banner,krb5-enum-users --script-args krb5-enum-users.realm=megacorp.htb,userdb=/usr/share/seclists/Usernames/top-usernames-shortlist.txt -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp88/udp_88_kerberos_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp88/xml/udp_88_kerberos_nmap.xml 10.129.243.131
Nmap scan report for megacorp.htb (10.129.243.131)
Host is up, received user-set.
Scanned at 2023-10-28 14:53:15 CEST for 6s
PORT STATE SERVICE REASON VERSION
88/udp open kerberos-sec udp-response Microsoft Windows Kerberos (server time: 2023-10-28 12:53:21Z)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Oct 28 14:53:21 2023 -- 1 IP address (1 host up) scanned in 7.62 seconds

35
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp88/xml/udp_88_kerberos_nmap.xml Normal file
View File

@@ -0,0 +1,35 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:53:13 2023 as: nmap -vv -&#45;reason -Pn -T4 -sU -sV -p 88 -&#45;script=banner,krb5-enum-users -&#45;script-args krb5-enum-users.realm=megacorp.htb,userdb=/usr/share/seclists/Usernames/top-usernames-shortlist.txt -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp88/udp_88_kerberos_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp88/xml/udp_88_kerberos_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sU -sV -p 88 -&#45;script=banner,krb5-enum-users -&#45;script-args krb5-enum-users.realm=megacorp.htb,userdb=/usr/share/seclists/Usernames/top-usernames-shortlist.txt -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp88/udp_88_kerberos_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/udp88/xml/udp_88_kerberos_nmap.xml 10.129.243.131" start="1698497593" startstr="Sat Oct 28 14:53:13 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="udp" protocol="udp" numservices="1" services="88"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698497594"/>
<taskend task="NSE" time="1698497594"/>
<taskbegin task="NSE" time="1698497594"/>
<taskend task="NSE" time="1698497594"/>
<taskbegin task="UDP Scan" time="1698497594"/>
<taskend task="UDP Scan" time="1698497596" extrainfo="1 total ports"/>
<taskbegin task="Service scan" time="1698497596"/>
<taskend task="Service scan" time="1698497601" extrainfo="1 service on 1 host"/>
<taskbegin task="NSE" time="1698497601"/>
<taskend task="NSE" time="1698497601"/>
<taskbegin task="NSE" time="1698497601"/>
<taskend task="NSE" time="1698497601"/>
<host starttime="1698497595" endtime="1698497601"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><port protocol="udp" portid="88"><state state="open" reason="udp-response" reason_ttl="0"/><service name="kerberos-sec" product="Microsoft Windows Kerberos" extrainfo="server time: 2023-10-28 12:53:21Z" ostype="Windows" method="probed" conf="10"><cpe>cpe:/a:microsoft:kerberos</cpe><cpe>cpe:/o:microsoft:windows</cpe></service></port>
</ports>
</host>
<taskbegin task="NSE" time="1698497601"/>
<taskend task="NSE" time="1698497601"/>
<taskbegin task="NSE" time="1698497601"/>
<taskend task="NSE" time="1698497601"/>
<runstats><finished time="1698497601" timestr="Sat Oct 28 14:53:21 2023" summary="Nmap done at Sat Oct 28 14:53:21 2023; 1 IP address (1 host up) scanned in 7.62 seconds" elapsed="7.62" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

103
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_full_tcp_nmap.xml Normal file
View File

@@ -0,0 +1,103 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:23:46 2023 as: nmap -vv -&#45;reason -Pn -T4 -sV -sC -&#45;version-all -A -&#45;osscan-guess -p- -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_full_tcp_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_full_tcp_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sV -sC -&#45;version-all -A -&#45;osscan-guess -p- -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_full_tcp_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_full_tcp_nmap.xml 10.129.243.131" start="1698495826" startstr="Sat Oct 28 14:23:46 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="65535" services="1-65535"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698495826"/>
<taskend task="NSE" time="1698495826"/>
<taskbegin task="NSE" time="1698495826"/>
<taskend task="NSE" time="1698495826"/>
<taskbegin task="NSE" time="1698495826"/>
<taskend task="NSE" time="1698495826"/>
<taskbegin task="SYN Stealth Scan" time="1698495826"/>
<taskprogress task="SYN Stealth Scan" time="1698495857" percent="20.07" remaining="124" etc="1698495980"/>
<taskprogress task="SYN Stealth Scan" time="1698495887" percent="47.75" remaining="67" etc="1698495954"/>
<taskend task="SYN Stealth Scan" time="1698495964" extrainfo="65535 total ports"/>
<taskbegin task="Service scan" time="1698495964"/>
<taskend task="Service scan" time="1698496026" extrainfo="18 services on 1 host"/>
<taskbegin task="Traceroute" time="1698496030"/>
<taskend task="Traceroute" time="1698496030"/>
<taskbegin task="Parallel DNS resolution of 1 host." time="1698496030"/>
<taskend task="Parallel DNS resolution of 1 host." time="1698496030"/>
<taskbegin task="NSE" time="1698496030"/>
<taskprogress task="NSE" time="1698496061" percent="99.96" remaining="1" etc="1698496061"/>
<taskend task="NSE" time="1698496070"/>
<taskbegin task="NSE" time="1698496070"/>
<taskend task="NSE" time="1698496072"/>
<taskbegin task="NSE" time="1698496072"/>
<taskend task="NSE" time="1698496072"/>
<host starttime="1698495827" endtime="1698496072"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><extraports state="filtered" count="65517">
<extrareasons reason="no-response" count="65517" proto="tcp" ports="1-52,54-79,81-87,89-134,136-138,140-388,390-444,446-463,465-592,594-635,637-3267,3270-5984,5986-9388,9390-49666,49668-49673,49675-49694,49696-49842,49844-65535"/>
</extraports>
<port protocol="tcp" portid="53"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="domain" product="Simple DNS Plus" ostype="Windows" method="probed" conf="10"><cpe>cpe:/a:jh_software:simple_dns_plus</cpe><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="http" product="Microsoft IIS httpd" version="10.0" ostype="Windows" method="probed" conf="10"><cpe>cpe:/a:microsoft:internet_information_services:10.0</cpe><cpe>cpe:/o:microsoft:windows</cpe></service><script id="http-server-header" output="Microsoft-IIS/10.0"><elem>Microsoft-IIS/10.0</elem>
</script><script id="http-title" output="Slandovia Energy"><elem key="title">Slandovia Energy</elem>
</script><script id="http-methods" output="&#xa; Supported Methods: OPTIONS TRACE GET HEAD POST&#xa; Potentially risky methods: TRACE"><table key="Supported Methods">
<elem>OPTIONS</elem>
<elem>TRACE</elem>
<elem>GET</elem>
<elem>HEAD</elem>
<elem>POST</elem>
</table>
<table key="Potentially risky methods">
<elem>TRACE</elem>
</table>
</script></port>
<port protocol="tcp" portid="88"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="kerberos-sec" product="Microsoft Windows Kerberos" extrainfo="server time: 2023-10-28 12:26:10Z" ostype="Windows" method="probed" conf="10"><cpe>cpe:/a:microsoft:kerberos</cpe><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="135"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="msrpc" product="Microsoft Windows RPC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="139"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="netbios-ssn" product="Microsoft Windows netbios-ssn" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="389"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="ldap" product="Microsoft Windows Active Directory LDAP" extrainfo="Domain: MEGACORP.LOCAL0., Site: Default-First-Site-Name" hostname="DC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="445"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="microsoft-ds" method="table" conf="3"/></port>
<port protocol="tcp" portid="464"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="kpasswd5" method="table" conf="3"/></port>
<port protocol="tcp" portid="593"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="ncacn_http" product="Microsoft Windows RPC over HTTP" version="1.0" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="636"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="tcpwrapped" method="probed" conf="8"/></port>
<port protocol="tcp" portid="3268"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="ldap" product="Microsoft Windows Active Directory LDAP" extrainfo="Domain: MEGACORP.LOCAL0., Site: Default-First-Site-Name" hostname="DC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="3269"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="tcpwrapped" method="probed" conf="8"/></port>
<port protocol="tcp" portid="5985"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="http" product="Microsoft HTTPAPI httpd" version="2.0" extrainfo="SSDP/UPnP" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service><script id="http-title" output="Not Found"><elem key="title">Not Found</elem>
</script><script id="http-server-header" output="Microsoft-HTTPAPI/2.0"><elem>Microsoft-HTTPAPI/2.0</elem>
</script></port>
<port protocol="tcp" portid="9389"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="mc-nmf" product=".NET Message Framing" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="49667"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="msrpc" product="Microsoft Windows RPC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="49674"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="ncacn_http" product="Microsoft Windows RPC over HTTP" version="1.0" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="49695"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="msrpc" product="Microsoft Windows RPC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="49843"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="msrpc" product="Microsoft Windows RPC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
</ports>
<os><portused state="open" proto="tcp" portid="53"/>
<osfingerprint fingerprint="SCAN(V=7.93%E=4%D=10/28%OT=53%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=653CFE48%P=x86_64-pc-linux-gnu)&#xa;SEQ(SP=101%GCD=1%ISR=10D%TI=I%II=I%SS=S%TS=U)&#xa;SEQ(SP=101%GCD=1%ISR=10D%TI=I%II=I%TS=U)&#xa;OPS(O1=M550NW8NNS%O2=M550NW8NNS%O3=M550NW8%O4=M550NW8NNS%O5=M550NW8NNS%O6=M550NNS)&#xa;WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)&#xa;ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M550NW8NNS%CC=Y%Q=)&#xa;T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=)&#xa;T2(R=N)&#xa;T3(R=N)&#xa;T4(R=N)&#xa;U1(R=N)&#xa;IE(R=Y%DFI=N%TG=80%CD=Z)&#xa;"/>
</os>
<distance value="2"/>
<tcpsequence index="257" difficulty="Good luck!" values="B4943AA1,36C5D9AD,82F2AEBF,32C656E8,F76AF91D,329F58B7"/>
<ipidsequence class="Incremental" values="3D69,3D70,3D77,3D7C,3D81,3D86"/>
<tcptssequence class="none returned (unsupported)"/>
<hostscript><script id="clock-skew" output="0s"><elem key="count">1</elem>
<elem key="stddev">0</elem>
<elem key="mean">0</elem>
<elem key="median">0</elem>
</script><script id="p2p-conficker" output="&#xa; Checking for Conficker.C or higher...&#xa; Check 1 (port 25314/tcp): CLEAN (Timeout)&#xa; Check 2 (port 10793/tcp): CLEAN (Timeout)&#xa; Check 3 (port 25536/udp): CLEAN (Timeout)&#xa; Check 4 (port 25523/udp): CLEAN (Timeout)&#xa; 0/4 checks are positive: Host is CLEAN or ports are blocked&#xa;"/><script id="smb2-time" output="&#xa; date: 2023-10-28T12:27:13&#xa; start_date: N/A"><elem key="date">2023-10-28T12:27:13</elem>
<elem key="start_date">N/A</elem>
</script><script id="smb2-security-mode" output="&#xa; 311: &#xa; Message signing enabled and required"><table key="311">
<elem>Message signing enabled and required</elem>
</table>
</script></hostscript><trace port="135" proto="tcp">
<hop ttl="1" ipaddr="10.10.14.1" rtt="35.29"/>
<hop ttl="2" ipaddr="10.129.243.131" rtt="35.21" host="megacorp.htb"/>
</trace>
<times srtt="40934" rttvar="10374" to="100000"/>
</host>
<taskbegin task="NSE" time="1698496072"/>
<taskend task="NSE" time="1698496072"/>
<taskbegin task="NSE" time="1698496072"/>
<taskend task="NSE" time="1698496072"/>
<taskbegin task="NSE" time="1698496072"/>
<taskend task="NSE" time="1698496072"/>
<runstats><finished time="1698496072" timestr="Sat Oct 28 14:27:52 2023" summary="Nmap done at Sat Oct 28 14:27:52 2023; 1 IP address (1 host up) scanned in 246.21 seconds" elapsed="246.21" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

92
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_quick_tcp_nmap.xml Normal file
View File

@@ -0,0 +1,92 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:23:46 2023 as: nmap -vv -&#45;reason -Pn -T4 -sV -sC -&#45;version-all -A -&#45;osscan-guess -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_quick_tcp_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_quick_tcp_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sV -sC -&#45;version-all -A -&#45;osscan-guess -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_quick_tcp_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_quick_tcp_nmap.xml 10.129.243.131" start="1698495826" startstr="Sat Oct 28 14:23:46 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="1000" services="1,3-4,6-7,9,13,17,19-26,30,32-33,37,42-43,49,53,70,79-85,88-90,99-100,106,109-111,113,119,125,135,139,143-144,146,161,163,179,199,211-212,222,254-256,259,264,280,301,306,311,340,366,389,406-407,416-417,425,427,443-445,458,464-465,481,497,500,512-515,524,541,543-545,548,554-555,563,587,593,616-617,625,631,636,646,648,666-668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800-801,808,843,873,880,888,898,900-903,911-912,981,987,990,992-993,995,999-1002,1007,1009-1011,1021-1100,1102,1104-1108,1110-1114,1117,1119,1121-1124,1126,1130-1132,1137-1138,1141,1145,1147-1149,1151-1152,1154,1163-1166,1169,1174-1175,1183,1185-1187,1192,1198-1199,1201,1213,1216-1218,1233-1234,1236,1244,1247-1248,1259,1271-1272,1277,1287,1296,1300-1301,1309-1311,1322,1328,1334,1352,1417,1433-1434,1443,1455,1461,1494,1500-1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687-1688,1700,1717-1721,1723,1755,1761,1782-1783,1801,1805,1812,1839-1840,1862-1864,1875,1900,1914,1935,1947,1971-1972,1974,1984,1998-2010,2013,2020-2022,2030,2033-2035,2038,2040-2043,2045-2049,2065,2068,2099-2100,2103,2105-2107,2111,2119,2121,2126,2135,2144,2160-2161,2170,2179,2190-2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381-2383,2393-2394,2399,2401,2492,2500,2522,2525,2557,2601-2602,2604-2605,2607-2608,2638,2701-2702,2710,2717-2718,2725,2800,2809,2811,2869,2875,2909-2910,2920,2967-2968,2998,3000-3001,3003,3005-3007,3011,3013,3017,3030-3031,3052,3071,3077,3128,3168,3211,3221,3260-3261,3268-3269,3283,3300-3301,3306,3322-3325,3333,3351,3367,3369-3372,3389-3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689-3690,3703,3737,3766,3784,3800-3801,3809,3814,3826-3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000-4006,4045,4111,4125-4126,4129,4224,4242,4279,4321,4343,4443-4446,4449,4550,4567,4662,4848,4899-4900,4998,5000-5004,5009,5030,5033,5050-5051,5054,5060-5061,5080,5087,5100-5102,5120,5190,5200,5214,5221-5222,5225-5226,5269,5280,5298,5357,5405,5414,5431-5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678-5679,5718,5730,5800-5802,5810-5811,5815,5822,5825,5850,5859,5862,5877,5900-5904,5906-5907,5910-5911,5915,5922,5925,5950,5952,5959-5963,5987-5989,5998-6007,6009,6025,6059,6100-6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565-6567,6580,6646,6666-6669,6689,6692,6699,6779,6788-6789,6792,6839,6881,6901,6969,7000-7002,7004,7007,7019,7025,7070,7100,7103,7106,7200-7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777-7778,7800,7911,7920-7921,7937-7938,7999-8002,8007-8011,8021-8022,8031,8042,8045,8080-8090,8093,8099-8100,8180-8181,8192-8194,8200,8222,8254,8290-8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651-8652,8654,8701,8800,8873,8888,8899,8994,9000-9003,9009-9011,9040,9050,9071,9080-9081,9090-9091,9099-9103,9110-9111,9200,9207,9220,9290,9415,9418,9485,9500,9502-9503,9535,9575,9593-9595,9618,9666,9876-9878,9898,9900,9917,9929,9943-9944,9968,9998-10004,10009-10010,10012,10024-10025,10082,10180,10215,10243,10566,10616-10617,10621,10626,10628-10629,10778,11110-11111,11967,12000,12174,12265,12345,13456,13722,13782-13783,14000,14238,14441-14442,15000,15002-15004,15660,15742,16000-16001,16012,16016,16018,16080,16113,16992-16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221-20222,20828,21571,22939,23502,24444,24800,25734-25735,26214,27000,27352-27353,27355-27356,27715,28201,30000,30718,30951,31038,31337,32768-32785,33354,33899,34571-34573,35500,38292,40193,40911,41511,42510,44176,44442-44443,44501,45100,48080,49152-49161,49163,49165,49167,49175-49176,49400,49999-50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055-55056,55555,55600,56737-56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698495826"/>
<taskend task="NSE" time="1698495826"/>
<taskbegin task="NSE" time="1698495826"/>
<taskend task="NSE" time="1698495826"/>
<taskbegin task="NSE" time="1698495826"/>
<taskend task="NSE" time="1698495826"/>
<taskbegin task="SYN Stealth Scan" time="1698495826"/>
<taskend task="SYN Stealth Scan" time="1698495831" extrainfo="1000 total ports"/>
<taskbegin task="Service scan" time="1698495831"/>
<taskend task="Service scan" time="1698496226" extrainfo="12 services on 1 host"/>
<taskbegin task="Traceroute" time="1698496232"/>
<taskend task="Traceroute" time="1698496232"/>
<taskbegin task="Parallel DNS resolution of 1 host." time="1698496232"/>
<taskend task="Parallel DNS resolution of 1 host." time="1698496232"/>
<taskbegin task="NSE" time="1698496232"/>
<taskprogress task="NSE" time="1698496263" percent="99.94" remaining="1" etc="1698496263"/>
<taskend task="NSE" time="1698496272"/>
<taskbegin task="NSE" time="1698496272"/>
<taskend task="NSE" time="1698496275"/>
<taskbegin task="NSE" time="1698496275"/>
<taskend task="NSE" time="1698496275"/>
<host starttime="1698495826" endtime="1698496275"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><extraports state="filtered" count="988">
<extrareasons reason="no-response" count="988" proto="tcp" ports="1,3-4,6-7,9,13,17,19-26,30,32-33,37,42-43,49,70,79,81-85,89-90,99-100,106,109-111,113,119,125,143-144,146,161,163,179,199,211-212,222,254-256,259,264,280,301,306,311,340,366,406-407,416-417,425,427,443-444,458,465,481,497,500,512-515,524,541,543-545,548,554-555,563,587,616-617,625,631,646,648,666-668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800-801,808,843,873,880,888,898,900-903,911-912,981,987,990,992-993,995,999-1002,1007,1009-1011,1021-1100,1102,1104-1108,1110-1114,1117,1119,1121-1124,1126,1130-1132,1137-1138,1141,1145,1147-1149,1151-1152,1154,1163-1166,1169,1174-1175,1183,1185-1187,1192,1198-1199,1201,1213,1216-1218,1233-1234,1236,1244,1247-1248,1259,1271-1272,1277,1287,1296,1300-1301,1309-1311,1322,1328,1334,1352,1417,1433-1434,1443,1455,1461,1494,1500-1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687-1688,1700,1717-1721,1723,1755,1761,1782-1783,1801,1805,1812,1839-1840,1862-1864,1875,1900,1914,1935,1947,1971-1972,1974,1984,1998-2010,2013,2020-2022,2030,2033-2035,2038,2040-2043,2045-2049,2065,2068,2099-2100,2103,2105-2107,2111,2119,2121,2126,2135,2144,2160-2161,2170,2179,2190-2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381-2383,2393-2394,2399,2401,2492,2500,2522,2525,2557,2601-2602,2604-2605,2607-2608,2638,2701-2702,2710,2717-2718,2725,2800,2809,2811,2869,2875,2909-2910,2920,2967-2968,2998,3000-3001,3003,3005-3007,3011,3013,3017,3030-3031,3052,3071,3077,3128,3168,3211,3221,3260-3261,3283,3300-3301,3306,3322-3325,3333,3351,3367,3369-3372,3389-3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689-3690,3703,3737,3766,3784,3800-3801,3809,3814,3826-3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000-4006,4045,4111,4125-4126,4129,4224,4242,4279,4321,4343,4443-4446,4449,4550,4567,4662,4848,4899-4900,4998,5000-5004,5009,5030,5033,5050-5051,5054,5060-5061,5080,5087,5100-5102,5120,5190,5200,5214,5221-5222,5225-5226,5269,5280,5298,5357,5405,5414,5431-5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678-5679,5718,5730,5800-5802,5810-5811,5815,5822,5825,5850,5859,5862,5877,5900-5904,5906-5907,5910-5911,5915,5922,5925,5950,5952,5959-5963,5987-5989,5998-6007,6009,6025,6059,6100-6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565-6567,6580,6646,6666-6669,6689,6692,6699,6779,6788-6789,6792,6839,6881,6901,6969,7000-7002,7004,7007,7019,7025,7070,7100,7103,7106,7200-7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777-7778,7800,7911,7920-7921,7937-7938,7999-8002,8007-8011,8021-8022,8031,8042,8045,8080-8090,8093,8099-8100,8180-8181,8192-8194,8200,8222,8254,8290-8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651-8652,8654,8701,8800,8873,8888,8899,8994,9000-9003,9009-9011,9040,9050,9071,9080-9081,9090-9091,9099-9103,9110-9111,9200,9207,9220,9290,9415,9418,9485,9500,9502-9503,9535,9575,9593-9595,9618,9666,9876-9878,9898,9900,9917,9929,9943-9944,9968,9998-10004,10009-10010,10012,10024-10025,10082,10180,10215,10243,10566,10616-10617,10621,10626,10628-10629,10778,11110-11111,11967,12000,12174,12265,12345,13456,13722,13782-13783,14000,14238,14441-14442,15000,15002-15004,15660,15742,16000-16001,16012,16016,16018,16080,16113,16992-16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221-20222,20828,21571,22939,23502,24444,24800,25734-25735,26214,27000,27352-27353,27355-27356,27715,28201,30000,30718,30951,31038,31337,32768-32785,33354,33899,34571-34573,35500,38292,40193,40911,41511,42510,44176,44442-44443,44501,45100,48080,49152-49161,49163,49165,49167,49175-49176,49400,49999-50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055-55056,55555,55600,56737-56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389"/>
</extraports>
<port protocol="tcp" portid="53"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="domain" method="table" conf="3"/></port>
<port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="http" product="Microsoft IIS httpd" version="10.0" ostype="Windows" method="probed" conf="10"><cpe>cpe:/a:microsoft:internet_information_services:10.0</cpe><cpe>cpe:/o:microsoft:windows</cpe></service><script id="http-title" output="Slandovia Energy"><elem key="title">Slandovia Energy</elem>
</script><script id="http-methods" output="&#xa; Supported Methods: OPTIONS TRACE GET HEAD POST&#xa; Potentially risky methods: TRACE"><table key="Supported Methods">
<elem>OPTIONS</elem>
<elem>TRACE</elem>
<elem>GET</elem>
<elem>HEAD</elem>
<elem>POST</elem>
</table>
<table key="Potentially risky methods">
<elem>TRACE</elem>
</table>
</script></port>
<port protocol="tcp" portid="88"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="kerberos-sec" product="Microsoft Windows Kerberos" extrainfo="server time: 2023-10-28 12:23:58Z" ostype="Windows" method="probed" conf="10"><cpe>cpe:/a:microsoft:kerberos</cpe><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="135"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="msrpc" product="Microsoft Windows RPC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="139"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="netbios-ssn" product="Microsoft Windows netbios-ssn" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="389"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="ldap" product="Microsoft Windows Active Directory LDAP" extrainfo="Domain: MEGACORP.LOCAL0., Site: Default-First-Site-Name" hostname="DC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="445"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="microsoft-ds" method="table" conf="3"/></port>
<port protocol="tcp" portid="464"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="kpasswd5" method="table" conf="3"/></port>
<port protocol="tcp" portid="593"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="ncacn_http" product="Microsoft Windows RPC over HTTP" version="1.0" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="636"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="tcpwrapped" method="probed" conf="8"/></port>
<port protocol="tcp" portid="3268"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="ldap" product="Microsoft Windows Active Directory LDAP" extrainfo="Domain: MEGACORP.LOCAL0., Site: Default-First-Site-Name" hostname="DC" ostype="Windows" method="probed" conf="10"><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="tcp" portid="3269"><state state="open" reason="syn-ack" reason_ttl="127"/><service name="tcpwrapped" method="probed" conf="8"/></port>
</ports>
<os><portused state="open" proto="tcp" portid="53"/>
<osfingerprint fingerprint="SCAN(V=7.93%E=4%D=10/28%OT=53%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=653CFF13%P=x86_64-pc-linux-gnu)&#xa;SEQ(SP=108%GCD=1%ISR=10A%TS=U)&#xa;OPS(O1=M550NW8NNS%O2=M550NW8NNS%O3=M550NW8%O4=M550NW8NNS%O5=M550NW8NNS%O6=M550NNS)&#xa;WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)&#xa;ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M550NW8NNS%CC=Y%Q=)&#xa;T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=)&#xa;T2(R=N)&#xa;T3(R=N)&#xa;T4(R=N)&#xa;U1(R=N)&#xa;IE(R=Y%DFI=N%TG=80%CD=Z)&#xa;"/>
</os>
<distance value="2"/>
<tcpsequence index="264" difficulty="Good luck!" values="E2152,8373986E,1EB3F007,1E18CD74,E83696E7,925808C"/>
<ipidsequence class="Busy server or unknown class" values="D7D7,D7F5,D80F,D829,D840,D850"/>
<tcptssequence class="none returned (unsupported)"/>
<hostscript><script id="smb2-security-mode" output="&#xa; 311: &#xa; Message signing enabled and required"><table key="311">
<elem>Message signing enabled and required</elem>
</table>
</script><script id="clock-skew" output="0s"><elem key="mean">0</elem>
<elem key="median">0</elem>
<elem key="stddev">0</elem>
<elem key="count">1</elem>
</script><script id="smb2-time" output="&#xa; date: 2023-10-28T12:30:36&#xa; start_date: N/A"><elem key="date">2023-10-28T12:30:36</elem>
<elem key="start_date">N/A</elem>
</script><script id="p2p-conficker" output="&#xa; Checking for Conficker.C or higher...&#xa; Check 1 (port 25314/tcp): CLEAN (Timeout)&#xa; Check 2 (port 10793/tcp): CLEAN (Timeout)&#xa; Check 3 (port 25536/udp): CLEAN (Timeout)&#xa; Check 4 (port 25523/udp): CLEAN (Timeout)&#xa; 0/4 checks are positive: Host is CLEAN or ports are blocked&#xa;"/></hostscript><trace port="53" proto="tcp">
<hop ttl="1" ipaddr="10.10.14.1" rtt="74.01"/>
<hop ttl="2" ipaddr="10.129.243.131" rtt="74.05" host="megacorp.htb"/>
</trace>
<times srtt="60872" rttvar="16656" to="127496"/>
</host>
<taskbegin task="NSE" time="1698496275"/>
<taskend task="NSE" time="1698496275"/>
<taskbegin task="NSE" time="1698496275"/>
<taskend task="NSE" time="1698496275"/>
<taskbegin task="NSE" time="1698496275"/>
<taskend task="NSE" time="1698496275"/>
<runstats><finished time="1698496275" timestr="Sat Oct 28 14:31:15 2023" summary="Nmap done at Sat Oct 28 14:31:15 2023; 1 IP address (1 host up) scanned in 449.29 seconds" elapsed="449.29" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

112
LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_top_100_udp_nmap.xml Normal file
View File

@@ -0,0 +1,112 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.93 scan initiated Sat Oct 28 14:23:46 2023 as: nmap -vv -&#45;reason -Pn -T4 -sU -A -&#45;top-ports 100 -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_top_100_udp_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_top_100_udp_nmap.xml 10.129.243.131 -->
<nmaprun scanner="nmap" args="nmap -vv -&#45;reason -Pn -T4 -sU -A -&#45;top-ports 100 -oN /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/_top_100_udp_nmap.txt -oX /home/simon/CTF/LaokoonHaxorcist/fullpwn/results/10.129.243.131/scans/xml/_top_100_udp_nmap.xml 10.129.243.131" start="1698495826" startstr="Sat Oct 28 14:23:46 2023" version="7.93" xmloutputversion="1.05">
<scaninfo type="udp" protocol="udp" numservices="100" services="7,9,17,19,49,53,67-69,80,88,111,120,123,135-139,158,161-162,177,427,443,445,497,500,514-515,518,520,593,623,626,631,996-999,1022-1023,1025-1030,1433-1434,1645-1646,1701,1718-1719,1812-1813,1900,2000,2048-2049,2222-2223,3283,3456,3703,4444,4500,5000,5060,5353,5632,9200,10000,17185,20031,30718,31337,32768-32769,32771,32815,33281,49152-49154,49156,49181-49182,49185-49186,49188,49190-49194,49200-49201,65024"/>
<verbose level="2"/>
<debugging level="0"/>
<taskbegin task="NSE" time="1698495826"/>
<taskend task="NSE" time="1698495826"/>
<taskbegin task="NSE" time="1698495826"/>
<taskend task="NSE" time="1698495826"/>
<taskbegin task="NSE" time="1698495826"/>
<taskend task="NSE" time="1698495826"/>
<taskbegin task="UDP Scan" time="1698495826"/>
<taskend task="UDP Scan" time="1698495832" extrainfo="100 total ports"/>
<taskbegin task="Service scan" time="1698495832"/>
<taskprogress task="Service scan" time="1698495930" percent="4.00" remaining="2352" etc="1698498282"/>
<taskprogress task="Service scan" time="1698496028" percent="34.00" remaining="381" etc="1698496408"/>
<taskprogress task="Service scan" time="1698496125" percent="64.00" remaining="165" etc="1698496290"/>
<taskend task="Service scan" time="1698496223" extrainfo="100 services on 1 host"/>
<taskbegin task="Traceroute" time="1698496227"/>
<taskend task="Traceroute" time="1698496229"/>
<taskbegin task="Parallel DNS resolution of 1 host." time="1698496229"/>
<taskend task="Parallel DNS resolution of 1 host." time="1698496229"/>
<taskbegin task="NSE" time="1698496229"/>
<taskprogress task="NSE" time="1698496260" percent="98.60" remaining="1" etc="1698496260"/>
<taskprogress task="NSE" time="1698496290" percent="98.62" remaining="1" etc="1698496291"/>
<taskprogress task="NSE" time="1698496320" percent="98.64" remaining="2" etc="1698496321"/>
<taskprogress task="NSE" time="1698496350" percent="98.69" remaining="2" etc="1698496352"/>
<taskprogress task="NSE" time="1698496380" percent="98.71" remaining="2" etc="1698496382"/>
<taskprogress task="NSE" time="1698496410" percent="98.72" remaining="3" etc="1698496412"/>
<taskprogress task="NSE" time="1698496440" percent="98.80" remaining="3" etc="1698496443"/>
<taskprogress task="NSE" time="1698496470" percent="98.82" remaining="3" etc="1698496473"/>
<taskprogress task="NSE" time="1698496500" percent="98.83" remaining="4" etc="1698496503"/>
<taskprogress task="NSE" time="1698496530" percent="98.89" remaining="4" etc="1698496533"/>
<taskprogress task="NSE" time="1698496560" percent="98.91" remaining="4" etc="1698496564"/>
<taskprogress task="NSE" time="1698496590" percent="98.92" remaining="4" etc="1698496594"/>
<taskprogress task="NSE" time="1698496620" percent="98.95" remaining="5" etc="1698496624"/>
<taskprogress task="NSE" time="1698496650" percent="99.00" remaining="5" etc="1698496654"/>
<taskprogress task="NSE" time="1698496680" percent="99.02" remaining="5" etc="1698496684"/>
<taskprogress task="NSE" time="1698496710" percent="99.04" remaining="5" etc="1698496715"/>
<taskprogress task="NSE" time="1698496740" percent="99.10" remaining="5" etc="1698496745"/>
<taskprogress task="NSE" time="1698496770" percent="99.11" remaining="5" etc="1698496775"/>
<taskprogress task="NSE" time="1698496800" percent="99.15" remaining="5" etc="1698496805"/>
<taskprogress task="NSE" time="1698496830" percent="99.18" remaining="5" etc="1698496835"/>
<taskprogress task="NSE" time="1698496860" percent="99.22" remaining="5" etc="1698496865"/>
<taskprogress task="NSE" time="1698496890" percent="99.26" remaining="5" etc="1698496895"/>
<taskprogress task="NSE" time="1698496920" percent="99.28" remaining="6" etc="1698496925"/>
<taskprogress task="NSE" time="1698496950" percent="99.30" remaining="6" etc="1698496955"/>
<taskprogress task="NSE" time="1698496980" percent="99.35" remaining="5" etc="1698496985"/>
<taskprogress task="NSE" time="1698497010" percent="99.37" remaining="5" etc="1698497015"/>
<taskprogress task="NSE" time="1698497040" percent="99.40" remaining="5" etc="1698497045"/>
<taskprogress task="NSE" time="1698497070" percent="99.44" remaining="5" etc="1698497075"/>
<taskprogress task="NSE" time="1698497100" percent="99.47" remaining="5" etc="1698497105"/>
<taskprogress task="NSE" time="1698497130" percent="99.51" remaining="5" etc="1698497134"/>
<taskprogress task="NSE" time="1698497160" percent="99.53" remaining="5" etc="1698497164"/>
<taskprogress task="NSE" time="1698497190" percent="99.56" remaining="5" etc="1698497194"/>
<taskprogress task="NSE" time="1698497220" percent="99.59" remaining="5" etc="1698497224"/>
<taskprogress task="NSE" time="1698497250" percent="99.61" remaining="4" etc="1698497254"/>
<taskprogress task="NSE" time="1698497280" percent="99.66" remaining="4" etc="1698497284"/>
<taskprogress task="NSE" time="1698497310" percent="99.69" remaining="4" etc="1698497313"/>
<taskprogress task="NSE" time="1698497340" percent="99.73" remaining="4" etc="1698497343"/>
<taskprogress task="NSE" time="1698497370" percent="99.75" remaining="3" etc="1698497373"/>
<taskprogress task="NSE" time="1698497400" percent="99.79" remaining="3" etc="1698497402"/>
<taskprogress task="NSE" time="1698497430" percent="99.82" remaining="3" etc="1698497432"/>
<taskprogress task="NSE" time="1698497460" percent="99.85" remaining="2" etc="1698497462"/>
<taskprogress task="NSE" time="1698497490" percent="99.87" remaining="2" etc="1698497492"/>
<taskprogress task="NSE" time="1698497520" percent="99.92" remaining="2" etc="1698497521"/>
<taskprogress task="NSE" time="1698497550" percent="99.96" remaining="1" etc="1698497551"/>
<taskprogress task="NSE" time="1698497580" percent="99.99" remaining="1" etc="1698497580"/>
<taskend task="NSE" time="1698497588"/>
<taskbegin task="NSE" time="1698497588"/>
<taskend task="NSE" time="1698497593"/>
<taskbegin task="NSE" time="1698497593"/>
<taskend task="NSE" time="1698497593"/>
<host starttime="1698495826" endtime="1698497593"><status state="up" reason="user-set" reason_ttl="0"/>
<address addr="10.129.243.131" addrtype="ipv4"/>
<hostnames>
<hostname name="megacorp.htb" type="PTR"/>
</hostnames>
<ports><extraports state="open|filtered" count="97">
<extrareasons reason="no-response" count="97" proto="udp" ports="7,9,17,19,49,67-69,80,111,120,135-139,158,161-162,177,427,443,445,497,500,514-515,518,520,593,623,626,631,996-999,1022-1023,1025-1030,1433-1434,1645-1646,1701,1718-1719,1812-1813,1900,2000,2048-2049,2222-2223,3283,3456,3703,4444,4500,5000,5060,5353,5632,9200,10000,17185,20031,30718,31337,32768-32769,32771,32815,33281,49152-49154,49156,49181-49182,49185-49186,49188,49190-49194,49200-49201,65024"/>
</extraports>
<port protocol="udp" portid="53"><state state="open" reason="udp-response" reason_ttl="0"/><service name="domain" extrainfo="generic dns response: SERVFAIL" servicefp="SF-Port53-UDP:V=7.93%I=7%D=10/28%Time=653CFD6C%P=x86_64-pc-linux-gnu%r(NBTStat,32,&quot;\x80\xf0\x80\x82\0\x01\0\0\0\0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01&quot;);" method="probed" conf="10"/><script id="fingerprint-strings" output="&#xa; NBTStat: &#xa; CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"><elem key="NBTStat">&#xa; CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</elem>
</script></port>
<port protocol="udp" portid="88"><state state="open" reason="udp-response" reason_ttl="0"/><service name="kerberos-sec" product="Microsoft Windows Kerberos" extrainfo="server time: 2023-10-28 12:23:58Z" ostype="Windows" method="probed" conf="10"><cpe>cpe:/a:microsoft:kerberos</cpe><cpe>cpe:/o:microsoft:windows</cpe></service></port>
<port protocol="udp" portid="123"><state state="open" reason="udp-response" reason_ttl="127"/><service name="ntp" product="NTP" version="v3" method="probed" conf="10"/><script id="ntp-info" output="&#xa; receive time stamp: 2023-10-28T12:30:46"><elem key="receive time stamp">2023-10-28T12:30:46</elem>
</script></port>
</ports>
<os><osfingerprint fingerprint="SCAN(V=7.93%E=4%D=10/28%OT=%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=653D0439%P=x86_64-pc-linux-gnu)&#xa;U1(R=N)&#xa;IE(R=N)&#xa;"/>
</os>
<distance value="2"/>
<hostscript><script id="clock-skew" output="14s"><elem key="count">1</elem>
<elem key="stddev">0</elem>
<elem key="median">14</elem>
<elem key="mean">14</elem>
</script></hostscript><trace port="123" proto="udp">
<hop ttl="1" ipaddr="10.10.14.1" rtt="44.38"/>
<hop ttl="2" ipaddr="10.129.243.131" rtt="57.06" host="megacorp.htb"/>
</trace>
<times srtt="54857" rttvar="14239" to="111813"/>
</host>
<taskbegin task="NSE" time="1698497593"/>
<taskend task="NSE" time="1698497593"/>
<taskbegin task="NSE" time="1698497593"/>
<taskend task="NSE" time="1698497593"/>
<taskbegin task="NSE" time="1698497593"/>
<taskend task="NSE" time="1698497593"/>
<runstats><finished time="1698497593" timestr="Sat Oct 28 14:53:13 2023" summary="Nmap done at Sat Oct 28 14:53:13 2023; 1 IP address (1 host up) scanned in 1767.23 seconds" elapsed="1767.23" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>