FOOTPRINTING

FTP

Which version of the FTP server is running on the target system? Submit the entire banner as the answer.
root@htb:~$ sudo nmap -sS -T4 10.129.202.5 -p-
 PORT      STATE SERVICE
 21/tcp    open  ftp
 22/tcp    open  ssh
 111/tcp   open  rpcbind
 139/tcp   open  netbios-ssn
 445/tcp   open  microsoft-ds
 2049/tcp  open  nfs
 40287/tcp open  unknown
 50947/tcp open  unknown
 50951/tcp open  unknown
 51319/tcp open  unknown
 
root@htb:~$ sudo nmap -sV -sC -T4 10.129.202.5 -p 21
 PORT   STATE SERVICE VERSION
 21/tcp open  ftp
 | fingerprint-strings: 
 |   GenericLines: 
 |     220 InFreight FTP v1.1
 |     Invalid command: try being more creative
 |_    Invalid command: try being more creative
 | ftp-anon: Anonymous FTP login allowed (FTP code 230)
 |_-rw-r--r--   1 ftpuser  ftpuser        39 Nov  8  2021 flag.txt
 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
 SF-Port21-TCP:V=7.94SVN%I=7%D=8/17%Time=68A2855C%P=x86_64-pc-linux-gnu%r(G
 SF:enericLines,74,"220\x20InFreight\x20FTP\x20v1\.1\r\n500\x20Invalid\x20c
 SF:ommand:\x20try\x20being\x20more\x20creative\r\n500\x20Invalid\x20comman
 SF:d:\x20try\x20being\x20more\x20creative\r\n");

root@htb:~$ ftp -p 10.129.202.5
 Connected to 10.129.202.5.
 220 InFreight FTP v1.1
 Name (10.129.202.5:root): anonymous 
 331 Anonymous login ok, send your complete email address as your password
 Password: 
 230 Anonymous access granted, restrictions apply
 Remote system type is UNIX.
 Using binary mode to transfer files.
Enumerate the FTP server and find the flag.txt file. Submit the contents of it as the answer.
root@htb:~$ sudo nmap -sS -T4 10.129.202.5 -p-
 PORT      STATE SERVICE
 21/tcp    open  ftp
 22/tcp    open  ssh
 111/tcp   open  rpcbind
 139/tcp   open  netbios-ssn
 445/tcp   open  microsoft-ds
 2049/tcp  open  nfs
 40287/tcp open  unknown
 50947/tcp open  unknown
 50951/tcp open  unknown
 51319/tcp open  unknown
 
root@htb:~$ sudo nmap -sV -sC -T4 10.129.202.5 -p 21
 PORT   STATE SERVICE VERSION
 21/tcp open  ftp
 | fingerprint-strings: 
 |   GenericLines: 
 |     220 InFreight FTP v1.1
 |     Invalid command: try being more creative
 |_    Invalid command: try being more creative
 | ftp-anon: Anonymous FTP login allowed (FTP code 230)
 |_-rw-r--r--   1 ftpuser  ftpuser        39 Nov  8  2021 flag.txt
 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
 SF-Port21-TCP:V=7.94SVN%I=7%D=8/17%Time=68A2855C%P=x86_64-pc-linux-gnu%r(G
 SF:enericLines,74,"220\x20InFreight\x20FTP\x20v1\.1\r\n500\x20Invalid\x20c
 SF:ommand:\x20try\x20being\x20more\x20creative\r\n500\x20Invalid\x20comman
 SF:d:\x20try\x20being\x20more\x20creative\r\n");

root@htb:~$ ftp -p 10.129.202.5
 Connected to 10.129.202.5.
 220 InFreight FTP v1.1
 Name (10.129.202.5:root): anonymous 
 331 Anonymous login ok, send your complete email address as your password
 Password: 
 230 Anonymous access granted, restrictions apply
 Remote system type is UNIX.
 Using binary mode to transfer files.
ftp> ls -R
229 Entering Extended Passive Mode (|||47094|)
150 Opening ASCII mode data connection for file list
-rw-r--r--   1 ftpuser  ftpuser        39 Nov  8  2021 flag.txt
226 Transfer complete

ftp> more flag.txt
 HTB{b7skjr4c76zhsds7fzhd4k3ujg7nhdjre}

SMB

What version of the SMB server is running on the target system? Submit the entire banner as the answer.
root@htb:~$ sudo nmap -sS -T4 10.129.202.5 -p-
 PORT      STATE SERVICE
 21/tcp    open  ftp
 22/tcp    open  ssh
 111/tcp   open  rpcbind
 139/tcp   open  netbios-ssn
 445/tcp   open  microsoft-ds
 2049/tcp  open  nfs
 34055/tcp open  unknown
 40999/tcp open  unknown
 41799/tcp open  unknown
 48525/tcp open  unknown

root@htb:~$ sudo nmap -sV -sC 10.129.202.5 -p 139,445
 PORT    STATE SERVICE     VERSION
 139/tcp open  netbios-ssn Samba smbd 4.6.2
 445/tcp open  netbios-ssn Samba smbd 4.6.2

 Host script results:
 | smb2-security-mode: 
 |   3:1:1: 
 |_    Message signing enabled but not required
 |_nbstat: NetBIOS name: DEVSMB, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
 | smb2-time: 
 |   date: 2025-09-01T04:06:00
 |_  start_date: N/A
 |_clock-skew: -1s
What is the name of the accessible share on the target?
root@htb:~$ sudo nmap -sS -T4 10.129.202.5 -p-
 PORT      STATE SERVICE
 21/tcp    open  ftp
 22/tcp    open  ssh
 111/tcp   open  rpcbind
 139/tcp   open  netbios-ssn
 445/tcp   open  microsoft-ds
 2049/tcp  open  nfs
 34055/tcp open  unknown
 40999/tcp open  unknown
 41799/tcp open  unknown
 48525/tcp open  unknown

root@htb:~$ sudo nmap -sV -sC 10.129.202.5 -p 139,445
 PORT    STATE SERVICE     VERSION
 139/tcp open  netbios-ssn Samba smbd 4.6.2
 445/tcp open  netbios-ssn Samba smbd 4.6.2

 Host script results:
 | smb2-security-mode: 
 |   3:1:1: 
 |_    Message signing enabled but not required
 |_nbstat: NetBIOS name: DEVSMB, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
 | smb2-time: 
 |   date: 2025-09-01T04:06:00
 |_  start_date: N/A
 |_clock-skew: -1s
root@htb:~$ smbclient -N -L //10.129.202.5
 Sharename       Type      Comment
 ---------       ----      -------
 print$          Disk      Printer Drivers
 sambashare      Disk      InFreight SMB v3.1
 IPC$            IPC       IPC Service (InlaneFreight SMB server (Samba, Ubuntu))

 Reconnecting with SMB1 for workgroup listing.
 smbXcli_negprot_smb1_done: No compatible protocol selected by server.
 protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
 Unable to connect with SMB1 -- no workgroup available
Connect to the discovered share and find the flag.txt file. Submit the contents as the answer.
Find out which domain the server belongs to.
Find additional information about the specific share we found previously and submit the customized version of that specific share as the answer.
What is the full system path of that specific share? (format: "/directory/names")

NFS

Enumerate the NFS service and submit the contents of the flag.txt in the "nfs" share as the answer.
Enumerate the NFS service and submit the contents of the flag.txt in the "nfsshare" share as the answer.

DNS

Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain.
Identify if its possible to perform a zone transfer and submit the TXT record as the answer. (Format: HTB{...})
What is the IPv4 address of the hostname DC1?
What is the FQDN of the host where the last octet ends with "x.x.x.203"?

SMTP

Enumerate the SMTP service and submit the banner, including its version as the answer.
Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer.

IMAP/POP3

Figure out the exact organization name from the IMAP/POP3 service and submit it as the answer.
What is the FQDN that the IMAP and POP3 servers are assigned to?
Enumerate the IMAP service and submit the flag as the answer. (Format: HTB{...})
What is the customized version of the POP3 server?
What is the admin email address?
Try to access the emails on the IMAP server and submit the flag as the answer. (Format: HTB{...})

SNMP

Enumerate the SNMP service and obtain the email address of the admin. Submit it as the answer.
What is the customized version of the SNMP server?
Enumerate the custom script that is running on the system and submit its output as the answer.

MYSQL

Enumerate the MySQL server and determine the version in use. (Format: MySQL X.X.XX)
During our penetration test, we found weak credentials "robin:robin". We should try these against the MySQL server. What is the email address of the customer "Otto Lang"?

MSSQL

Enumerate the target using the concepts taught in this section. List the hostname of MSSQL server.
Connect to the MSSQL instance running on the target using the account (backdoor:Password1), then list the non-default database present on the server.

ORACLE TNS

Enumerate the target Oracle database and submit the password hash of the user DBSNMP as the answer.

The sys.user$ table is a core data dictionary table within the SYS schema and is not accessible to regular users. Access to this table is restricted because it contains sensitive information, including hashed passwords. Only users with high-level administrative privileges—such as those granted the DBA role or direct SELECT ANY TABLE privileges—can query it. Oracle enforces these restrictions to protect the security and integrity of the database, preventing unauthorized users from viewing or tampering with critical system data.

IPMI

What username is configured for accessing the host via IPMI?
What is the account's cleartext password?
PreviousNETWORK ENUMERATION W/ NMAPNextUSING THE METASPLOIT FRAMEWORK

Last updated