Crocodile
Initial Scan
nmap -sV -sT -sC -T4 -v 10.129.208.251
Starting Nmap 7.80 ( https://nmap.org ) at 2022-08-23 20:31 EDT
NSE: Loaded 151 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 20:31
Completed NSE at 20:31, 0.00s elapsed
Initiating NSE at 20:31
Completed NSE at 20:31, 0.00s elapsed
Initiating NSE at 20:31
Completed NSE at 20:31, 0.00s elapsed
Initiating Ping Scan at 20:31
Scanning 10.129.208.251 [2 ports]
Completed Ping Scan at 20:31, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 20:31
Completed Parallel DNS resolution of 1 host. at 20:31, 0.08s elapsed
Initiating Connect Scan at 20:31
Scanning 10.129.208.251 [1000 ports]
Discovered open port 80/tcp on 10.129.208.251
Discovered open port 21/tcp on 10.129.208.251
Completed Connect Scan at 20:31, 0.69s elapsed (1000 total ports)
Initiating Service scan at 20:31
Scanning 2 services on 10.129.208.251
Completed Service scan at 20:31, 6.09s elapsed (2 services on 1 host)
NSE: Script scanning 10.129.208.251.
Initiating NSE at 20:31
NSE: [ftp-bounce] PORT response: 500 Illegal PORT command.
Completed NSE at 20:31, 1.03s elapsed
Initiating NSE at 20:31
Completed NSE at 20:31, 0.18s elapsed
Initiating NSE at 20:31
Completed NSE at 20:31, 0.00s elapsed
Nmap scan report for 10.129.208.251
Host is up (0.047s latency).
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r-- 1 ftp ftp 33 Jun 08 2021 allowed.userlist
|_-rw-r--r-- 1 ftp ftp 62 Apr 20 2021 allowed.userlist.passwd
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.10.14.9
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 4
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-favicon: Unknown favicon MD5: 1248E68909EAE600881B8DB1AD07F356
| http-methods:
|_ Supported Methods: OPTIONS HEAD GET POST
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Smash - Bootstrap Business Template
Service Info: OS: Unix
NSE: Script Post-scanning.
Initiating NSE at 20:31
Completed NSE at 20:31, 0.00s elapsed
Initiating NSE at 20:31
Completed NSE at 20:31, 0.00s elapsed
Initiating NSE at 20:31
Completed NSE at 20:31, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.53 secondsTask 1
What nmap scanning switch employs the use of default scripts during a scan?
Task 2
What service version is found to be running on port 21?
Task 3
What FTP code is returned to us for the "Anonymous FTP login allowed" message?
Task 4
What command can we use to download the files we find on the FTP server?
Task 5
What is one of the higher-privilege sounding usernames in the list we retrieved?
Task 6
What version of Apache HTTP Server is running on the target host?
Task 7
What is the name of a handy web site analysis plug-in we can install in our browser?
Task 8
What switch can we use with gobuster to specify we are looking for specific filetypes?
Task 9
What file have we found that can provide us a foothold on the target?
Task 10
Submit root flag
Last updated