TryHackMe — Advent of Cyber 2 — Day 8
By: Trent Darrow
Tags: Nmap, Beginner, Walkthrough, Tryhackme, Port Scan

Good evening everyone,

The task for today mainly involves the use of nmap. I’ll spare you the entire help section of the tool and only show what each flag I use means. Anyhow, here is the intro for today’s challenge:

“After a few months of probation, intern Elf McEager has passed with glowing feedback from Elf McSkidy. During the meeting, Elf McEager asked for more access to The Best Festival Company’s (TBFC’s) internal network as he wishes to know more about the systems he has sworn to protect. Elf McSkidy was reluctant to agree. However, after Elf McEager’s heroic actions in recovering Christmas, Elf McSkidy soon thought this was a good idea. This was uncharted territory for Elf McEager — he had no idea how to begin finding out this information for his new responsibilities. Thankfully, TBFC has a wonderful up-skill program covering the use of Nmap for ElfMcEager to enrol in.”

Alrighty, Question 1: When was Snort created?

Well, this is one ‘google’ away.. I’ll let you figure that out..

Question 2: Using Nmap on MACHINE_IP , what are the port numbers of the three services running? (Please provide your answer in ascending order/lowest -> highest, separated by a comma)

Let’s begin with a simple nmap and see if we can hit all three ports.

#nmap 10.10.6.124

Well it looks like it did, output from the nmap:



Starting Nmap 7.80 (

Nmap scan report for 10.10.6.124

Host is up (0.23s latency).

Not shown: 997 closed ports

PORT STATE SERVICE

80/tcp open http

2222/tcp open EtherNetIP-1

3389/tcp open ms-wbt-server root@kali:/mnt/hgfs/shared_folder/tryhackme# nmap 10.10.6.124Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-13 18:51 EETNmap scan report for 10.10.6.124Host is up (0.23s latency).Not shown: 997 closed portsPORT STATE SERVICE80/tcp open http2222/tcp open EtherNetIP-13389/tcp open ms-wbt-server Nmap done: 1 IP address (1 host up) scanned in 59.32 seconds

Onto Question 3: Run a scan and provide the -Pn flag to ignore ICMP being used to determine if the host is up

Normally nmap will ping hosts to tell if there is a machine at that IP address, the -Pn flag tells nmap to ignore that step and start probing the ports. Alot of modern devices will have ICMP reply turned off, I know my Windows 10 machine is set by default to not respond.

-Pn: Treat all hosts as online -- skip host discovery

And next, Question 4: Experiment with different scan settings such as -A and -sV whilst comparing the outputs given.

Again, easy enough, I’ll run them for you and we can go over the differences.

-A: Enable OS detection, version detection, script scanning, and traceroute

-sV: Probe open ports to determine service/version info

Looking at the flag descriptions, we can see we should get a lot more information on the -A, but we also have to be cognizant of how much more data we will be sending over the wire and the rates of detections in certain environments. In a lab environment, this shouldn’t be an issue but with IDS/IPS appliances, we could end up being detected and blocked.

Let’s compare the two flag outputs, starting with -A:



Starting Nmap 7.80 (

Nmap scan report for 10.10.6.124

Host is up (0.23s latency).

Not shown: 997 closed ports

PORT STATE SERVICE VERSION

80/tcp open http Apache httpd 2.4.29 ((Ubuntu))

|_http-generator: Hugo 0.78.2

|_http-server-header: Apache/2.4.29 (Ubuntu)

|_http-title: TBFC's Internal Blog

2222/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)

| ssh-hostkey:

| 2048 cf:c9:99:d0:5c:09:27:cd:a1:a8:1b:c2:b1:d5:ef:a6 (RSA)

| 256 4c:d4:f9:20:6b:ce:fc:62:99:54:7d:c2:b4:b2:f2:b2 (ECDSA)

|_ 256 d0:e6:72:18:b5:20:89:75:d5:69:74:ac:cc:b8:3b:9b (ED25519)

3389/tcp open ms-wbt-server xrdp

No exact OS matches for host (If you know what OS is running on it, see

TCP/IP fingerprint:

OS:SCAN(V=7.80%E=4%D=12/13%OT=80%CT=1%CU=32242%PV=Y%DS=2%DC=T%G=Y%TM=5FD649

OS:1C%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=10E%TI=Z%CI=Z%II=I%TS=A)SE

OS:Q(SP=107%GCD=1%ISR=10E%TI=Z%CI=Z%TS=A)OPS(O1=M508ST11NW6%O2=M508ST11NW6%

OS:O3=M508NNT11NW6%O4=M508ST11NW6%O5=M508ST11NW6%O6=M508ST11)WIN(W1=F4B3%W2

OS:=F4B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(R=Y%DF=Y%T=40%W=F507%O=M508NNS

OS:NW6%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%

OS:DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%

OS:O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%

OS:W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%

OS:RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S) root@kali:/mnt/hgfs/shared_folder/tryhackme# nmap -A 10.10.6.124Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-13 18:59 EETNmap scan report for 10.10.6.124Host is up (0.23s latency).Not shown: 997 closed portsPORT STATE SERVICE VERSION80/tcp open http Apache httpd 2.4.29 ((Ubuntu))|_http-generator: Hugo 0.78.2|_http-server-header: Apache/2.4.29 (Ubuntu)|_http-title: TBFC's Internal Blog2222/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)| ssh-hostkey:| 2048 cf:c9:99:d0:5c:09:27:cd:a1:a8:1b:c2:b1:d5:ef:a6 (RSA)| 256 4c:d4:f9:20:6b:ce:fc:62:99:54:7d:c2:b4:b2:f2:b2 (ECDSA)|_ 256 d0:e6:72:18:b5:20:89:75:d5:69:74:ac:cc:b8:3b:9b (ED25519)3389/tcp open ms-wbt-server xrdpNo exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).TCP/IP fingerprint:OS:SCAN(V=7.80%E=4%D=12/13%OT=80%CT=1%CU=32242%PV=Y%DS=2%DC=T%G=Y%TM=5FD649OS:1C%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=10E%TI=Z%CI=Z%II=I%TS=A)SEOS:Q(SP=107%GCD=1%ISR=10E%TI=Z%CI=Z%TS=A)OPS(O1=M508ST11NW6%O2=M508ST11NW6%OS:O3=M508NNT11NW6%O4=M508ST11NW6%O5=M508ST11NW6%O6=M508ST11)WIN(W1=F4B3%W2OS:=F4B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(R=Y%DF=Y%T=40%W=F507%O=M508NNSOS:NW6%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%OS:DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%OS:O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%OS:W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%OS:RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S) Network Distance: 2 hops

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE (using port 199/tcp)

HOP RTT ADDRESS

1 228.62 ms 10.8.0.1

2 229.03 ms 10.10.6.124

Nmap done: 1 IP address (1 host up) scanned in 153.95 seconds OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ Nmap done: 1 IP address (1 host up) scanned in 153.95 seconds

We got alot of good information from this scan, but it is really noticeable on my current ‘high speed 1mbps’ internet just how long this took. Let’s run just the -Sv scan and take a look at how long this one takes.



Starting Nmap 7.80 (

Nmap scan report for 10.10.6.124

Host is up (0.22s latency).

Not shown: 997 closed ports

PORT STATE SERVICE VERSION

80/tcp open http Apache httpd 2.4.29 ((Ubuntu))

2222/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)

3389/tcp open ms-wbt-server xrdp

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel root@kali:/mnt/hgfs/shared_folder/tryhackme# nmap -sV 10.10.6.124Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-13 19:07 EETNmap scan report for 10.10.6.124Host is up (0.22s latency).Not shown: 997 closed portsPORT STATE SERVICE VERSION80/tcp open http Apache httpd 2.4.29 ((Ubuntu))2222/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)3389/tcp open ms-wbt-server xrdpService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Nmap done: 1 IP address (1 host up) scanned in 66.24 seconds Service detection performed. Please report any incorrect results at https://nmap.org/submit/ Nmap done: 1 IP address (1 host up) scanned in 66.24 seconds

Less than half the time. One thing I did for y’all just for comparison, was run tcpdump during both scans. The -A scan produced 3498 packets and a .pcap file size of 303290 bytes. The -sV scan produced 2456 packets and had a .pcap file size of only 165459 bytes. Quite the difference.

Anyhow let’s move onto the next question: Use Nmap to determine the name of the Linux distribution that is running, what is reported as the most likely distribution to be running?

Now we can look at the available flags to try, I’m going to use -O, the OS detection

-O: Enable OS detection

Well, -O didn’t help much for us, as we could guess from the output above, it gave us nearly the same result.



Starting Nmap 7.80 (

Nmap scan report for 10.10.6.124

Host is up (0.23s latency).

Not shown: 992 closed ports

PORT STATE SERVICE

80/tcp open http

544/tcp filtered kshell

1059/tcp filtered nimreg

1185/tcp filtered catchpole

1805/tcp filtered enl-name

2222/tcp open EtherNetIP-1

3389/tcp open ms-wbt-server

8086/tcp filtered d-s-n

No exact OS matches for host (If you know what OS is running on it, see

TCP/IP fingerprint:

OS:SCAN(V=7.80%E=4%D=12/13%OT=80%CT=1%CU=32814%PV=Y%DS=2%DC=I%G=Y%TM=5FD64C

OS:DD%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=D)SE

OS:Q(SP=105%GCD=1%ISR=106%TI=Z%CI=Z%TS=A)OPS(O1=M508ST11NW6%O2=M508ST11NW6%

OS:O3=M508NNT11NW6%O4=M508ST11NW6%O5=M508ST11NW6%O6=M508ST11)WIN(W1=F4B3%W2

OS:=F4B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(R=Y%DF=Y%T=40%W=F507%O=M508NNS

OS:NW6%CC=Y%Q=)ECN(R=N)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N

OS:)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=

OS:S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF

OS:=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=

OS:G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S) root@kali:/mnt/hgfs/shared_folder/tryhackme# nmap -O 10.10.6.124Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-13 19:16 EETNmap scan report for 10.10.6.124Host is up (0.23s latency).Not shown: 992 closed portsPORT STATE SERVICE80/tcp open http544/tcp filtered kshell1059/tcp filtered nimreg1185/tcp filtered catchpole1805/tcp filtered enl-name2222/tcp open EtherNetIP-13389/tcp open ms-wbt-server8086/tcp filtered d-s-nNo exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).TCP/IP fingerprint:OS:SCAN(V=7.80%E=4%D=12/13%OT=80%CT=1%CU=32814%PV=Y%DS=2%DC=I%G=Y%TM=5FD64COS:DD%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=D)SEOS:Q(SP=105%GCD=1%ISR=106%TI=Z%CI=Z%TS=A)OPS(O1=M508ST11NW6%O2=M508ST11NW6%OS:O3=M508NNT11NW6%O4=M508ST11NW6%O5=M508ST11NW6%O6=M508ST11)WIN(W1=F4B3%W2OS:=F4B3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(R=Y%DF=Y%T=40%W=F507%O=M508NNSOS:NW6%CC=Y%Q=)ECN(R=N)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=NOS:)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=OS:S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DFOS:=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=OS:G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S) Network Distance: 2 hops

Nmap done: 1 IP address (1 host up) scanned in 91.94 seconds OS detection performed. Please report any incorrect results at https://nmap.org/submit/ Nmap done: 1 IP address (1 host up) scanned in 91.94 seconds

We can look at the services though and they are mentioning Ubuntu, I’m going with that.

Onto the next one: Use Nmap’s Network Scripting Engine (NSE) to retrieve the “HTTP-TITLE” of the webserver. Based on the value returned, what do we think this website might be used for?

We can utilize this directory to take a look at the many different scripts we can run: https://nmap.org/nsedoc/scripts/

Ironically enough the script we are going to run is “http-title”



Starting Nmap 7.80 (

Nmap scan report for 10.10.6.124

Host is up (0.34s latency). root@kali:/mnt/hgfs/shared_folder/tryhackme# nmap -script http-title -p 80 10.10.6.124Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-13 19:24 EETNmap scan report for 10.10.6.124Host is up (0.34s latency). PORT STATE SERVICE

80/tcp open http

|_http-title: TBFC's Internal Blog Nmap done: 1 IP address (1 host up) scanned in 3.40 seconds

The title is: TBFC's Internal Blog, we can take a wild guess that the website might be used for his blog..

Final question: Now use different scripts against the remaining services to discover any further information about them

Now we could go all day just on the http/port 80, but we will run just 1 script scan against 2222 and 3389 each.

For the port 2222, ssh, we used the ssh-auth-methods script which tells us which authentication methods it supports. Interesting enough, with this machine, I had to use -sV with the script it would not return the script results.



Starting Nmap 7.80 (

Nmap scan report for 10.10.6.124

Host is up (0.24s latency). root@kali:/mnt/hgfs/shared_folder/tryhackme# nmap --script ssh-auth-methods -p 2222 -Pn -sV 10.10.6.124Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-13 19:31 EETNmap scan report for 10.10.6.124Host is up (0.24s latency). PORT STATE SERVICE VERSION

2222/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)

| ssh-auth-methods:

| Supported authentication methods:

| publickey

|_ password

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Nmap done: 1 IP address (1 host up) scanned in 3.11 seconds Service detection performed. Please report any incorrect results at https://nmap.org/submit/ Nmap done: 1 IP address (1 host up) scanned in 3.11 seconds

For port 3389, all we have is ms-wbt-server. Normally this is the RDP or remote desktop protocol. Let’s see what script we can play with.

We were able to use the rdp-enum-encryption script.



Starting Nmap 7.80 (

Nmap scan report for 10.10.6.124

Host is up (0.22s latency). root@kali:/mnt/hgfs/shared_folder/tryhackme# nmap --script rdp-enum-encryption -sV -Pn -p 3389 10.10.6.124Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-13 19:37 EETNmap scan report for 10.10.6.124Host is up (0.22s latency). PORT STATE SERVICE VERSION

3389/tcp open ms-wbt-server xrdp

| rdp-enum-encryption:

| Security layer

| CredSSP (NLA): SUCCESS

| CredSSP with Early User Auth: SUCCESS

| Native RDP: SUCCESS

| RDSTLS: SUCCESS

| SSL: SUCCESS

| RDP Encryption level: High

| 128-bit RC4: SUCCESS

|_ RDP Protocol Version: RDP 5.x, 6.x, 7.x, or 8.x server

Nmap done: 1 IP address (1 host up) scanned in 30.47 seconds Service detection performed. Please report any incorrect results at https://nmap.org/submit/ Nmap done: 1 IP address (1 host up) scanned in 30.47 seconds

Anyhow, that’s all for todays task. As always, best of luck. If you enjoy my content, feel free to add me on LinkedIn and let me know you saw the blog.

Until next time,

-3lduderino