php://filter/ tricknmap 10.10.198.245-246 -sC -sV -o nmap/Trusted
Output:
Starting Nmap 7.94 ( <https://nmap.org> ) at 2023-08-19 02:07 EDT
Nmap scan report for **10.10.198.245**
Host is up (0.17s latency).
Not shown: 988 closed tcp ports (reset)
PORT STATE SERVICE VERSION
**53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-08-19 06:08:13Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: trusted.vl0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: trusted.vl0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services**
| ssl-cert: Subject: commonName=trusteddc.trusted.vl
| Not valid before: 2023-04-21T14:47:57
|_Not valid after: 2023-10-21T14:47:57
|_ssl-date: 2023-08-19T06:08:40+00:00; 0s from scanner time.
| rdp-ntlm-info:
| Target_Name: TRUSTED
| NetBIOS_Domain_Name: TRUSTED
| NetBIOS_Computer_Name: TRUSTEDDC
| DNS_Domain_Name: trusted.vl
| DNS_Computer_Name: trusteddc.trusted.vl
| Product_Version: 10.0.20348
|_ System_Time: 2023-08-19T06:08:24+00:00
Service Info: Host: TRUSTEDDC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2023-08-19T06:08:25
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
Nmap scan report for **10.10.198.246**
Host is up (0.17s latency).
Not shown: 985 closed tcp ports (reset)
PORT STATE SERVICE VERSION
**53/tcp open domain Simple DNS Plus
80/tcp open http Apache httpd 2.4.53 ((Win64) OpenSSL/1.1.1n PHP/8.1.6)
| http-title: Welcome to XAMPP
|_Requested resource was <http://10.10.198.246/dashboard/>
|_http-server-header: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/8.1.6
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-08-19 06:08:13Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: trusted.vl0., Site: Default-First-Site-Name)
443/tcp open ssl/http Apache httpd 2.4.53 ((Win64) OpenSSL/1.1.1n PHP/8.1.6)**
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after: 2019-11-08T23:48:47
| http-title: Welcome to XAMPP
|_Requested resource was <https://10.10.198.246/dashboard/>
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/8.1.6
| tls-alpn:
|_ http/1.1
**445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: trusted.vl0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3306/tcp open mysql MySQL 5.5.5-10.4.24-MariaDB**
| mysql-info:
| Protocol: 10
| Version: 5.5.5-10.4.24-MariaDB
| Thread ID: 10
| Capabilities flags: 63486
| Some Capabilities: IgnoreSigpipes, Support41Auth, Speaks41ProtocolNew, SupportsTransactions, ConnectWithDatabase, LongColumnFlag, Speaks41ProtocolOld, InteractiveClient, FoundRows, SupportsLoadDataLocal, IgnoreSpaceBeforeParenthesis, DontAllowDatabaseTableColumn, ODBCClient, SupportsCompression, SupportsMultipleStatments, SupportsMultipleResults, SupportsAuthPlugins
| Status: Autocommit
| Salt: k?5-!]4)px-qv}3!I.Jj
|_ Auth Plugin Name: mysql_native_password
**3389/tcp open ms-wbt-server Microsoft Terminal Services**
|_ssl-date: 2023-08-19T06:08:41+00:00; 0s from scanner time.
| rdp-ntlm-info:
| Target_Name: LAB
| NetBIOS_Domain_Name: LAB
| NetBIOS_Computer_Name: LABDC
| DNS_Domain_Name: lab.trusted.vl
| DNS_Computer_Name: labdc.lab.trusted.vl
| DNS_Tree_Name: trusted.vl
| Product_Version: 10.0.20348
|_ System_Time: 2023-08-19T06:08:25+00:00
| ssl-cert: Subject: commonName=labdc.lab.trusted.vl
| Not valid before: 2023-04-21T14:48:14
|_Not valid after: 2023-10-21T14:48:14
Service Info: Host: LABDC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2023-08-19T06:08:31
|_ start_date: N/A
Post-scan script results:
| clock-skew:
| 0s:
| 10.10.198.245
|_ 10.10.198.246
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 2 IP addresses (2 hosts up) scanned in 65.94 seconds
Visit http://10.10.198.246:
Fuzz directory with gobuster:
gobuster dir -u <http://10.10.198.246/> -w /usr/share/seclists/Discovery/Web-Content/common.txt
Output:
===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: <http://10.10.198.246/>
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/seclists/Discovery/Web-Content/common.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.5
[+] Timeout: 10s
===============================================================
2023/08/19 02:16:45 Starting gobuster in directory enumeration mode
===============================================================
/.htaccess (Status: 403) [Size: 302]
/.hta (Status: 403) [Size: 302]
/.htpasswd (Status: 403) [Size: 302]
/aux (Status: 403) [Size: 302]
/cgi-bin/ (Status: 403) [Size: 302]
/com3 (Status: 403) [Size: 302]
/com4 (Status: 403) [Size: 302]
/com2 (Status: 403) [Size: 302]
/com1 (Status: 403) [Size: 302]
/con (Status: 403) [Size: 302]
/dashboard (Status: 301) [Size: 342] [--> <http://10.10.198.246/dashboard/>]
**/dev** (Status: 301) [Size: 336] [--> <http://10.10.198.246/dev/>]
/favicon.ico (Status: 200) [Size: 30894]
/examples (Status: 503) [Size: 402]
/img (Status: 301) [Size: 336] [--> <http://10.10.198.246/img/>]
/index.php (Status: 302) [Size: 0] [--> <http://10.10.198.246/dashboard/>]
/licenses (Status: 403) [Size: 421]
/lpt1 (Status: 403) [Size: 302]
/lpt2 (Status: 403) [Size: 302]
/nul (Status: 403) [Size: 302]
/phpmyadmin (Status: 403) [Size: 302]
/prn (Status: 403) [Size: 302]
/server-info (Status: 403) [Size: 421]
/server-status (Status: 403) [Size: 421]
/webalizer (Status: 403) [Size: 302]
Progress: 4715 / 4716 (99.98%)
===============================================================
2023/08/19 02:18:06 Finished
===============================================================
Visit /dev: