Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
su
echo "10.10.10.29 bank.htb" >> /etc/hosts
mkdir -p htb/bank.htb
cd htb/bank.htb
mkdir {nmap,content,exploits,scripts}
# At the end of the room
# To clean up the last line from the /etc/hosts file
sed -i '$ d' /etc/hosts
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
ping -c 3 bank.htb
PING bank.htb (10.10.10.29) 56(84) bytes of data.
64 bytes from bank.htb (10.10.10.29): icmp_seq=1 ttl=63 time=56.0 ms
64 bytes from bank.htb (10.10.10.29): icmp_seq=2 ttl=63 time=54.0 ms
64 bytes from bank.htb (10.10.10.29): icmp_seq=3 ttl=63 time=56.3 ms
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system, while Windows systems usually have a TTL of 128 secs.
2.1 - How many TCP ports are listening and accessible on Bank?
Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-29 11:50 EDT
Initiating SYN Stealth Scan at 11:50
Scanning bank.htb (10.10.10.29) [65536 ports]
Discovered open port 53/tcp on 10.10.10.29
Discovered open port 80/tcp on 10.10.10.29
Discovered open port 22/tcp on 10.10.10.29
Completed SYN Stealth Scan at 11:50, 13.36s elapsed (65536 total ports)
Nmap scan report for bank.htb (10.10.10.29)
Host is up, received user-set (0.056s latency).
Scanned at 2023-07-29 11:50:07 EDT for 14s
Not shown: 65324 closed tcp ports (reset), 209 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
53/tcp open domain syn-ack ttl 63
80/tcp open http syn-ack ttl 63
command
result
sudo
run as root
sC
run default scripts
sV
enumerate versions
A
aggressive mode
T4
run a bit faster
oN
output to file with nmap formatting
It looks like there are 3 open TCP ports on the machine: 22, 53, 80.
3
2.2 - What virtual host returns a website that isn't the default Ubuntu Apache page?
Going to http:\\bank.htb page, we see an hypotetical redirect to http:\\bank.htb/login.php:
We can check and confirm it using BurpSuite:
Now, we try to find potential hidden directory using gobuster:
gobuster dir -u http://bank.htb/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
