HTB - ServMon Writeup - no Metasploit
Enumeration Let’s enumerate the open ports on the machine using nmap . I usually use nmap in 2 steps. First, I take a quick full-port sweep using following options. -sS for a stealthy SYN scan, which is fast because it doesn’t complete the full 3-way handshake -Pn to skip host discovery and assume the host is up, so that all ports actually get checked -p- to scan all 65535 TCP ports --open to…
Enumeration of open ports on the machine was conducted using nmap. A full-port sweep was initiated with -sS for a stealthy SYN scan, -Pn to skip host discovery, -p- to scan all 65535 TCP ports, --open to display only open ports, -n to avoid DNS resolution, and --min-rate 5000 to speed up the scan. The results indicated that ports 135 (RPC), 139 (NetBIOS/SMB), and 445 (SMB) were open, while ports 53 (DNS), 389 (LDAP), and 88 (Kerberos) were closed.
This pointed to a standalone Windows machine not part of an Active Directory domain. Additionally, ports 21 (FTP), 80 (HTTP), and some UDP ports were also open. Further investigation was planned to determine the application hosted on port 80.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
