Nmap

Starting Nmap 7.93 (https://nmap.org) at 2024-03-19 09:24 EDT

Nmap scan report for 192.168.233.8

Host is up (0.0014s latency).

Not shown: 977 closed tcp ports (conn-refused)

PORT     STATE SERVICE

21/tcp   open  ftp

| ftp-syst: 

|   STAT: 

| FTP server status:

|      Connected to 192.168.233.130

|      Logged in as ftp

|      TYPE: ASCII

|      No session bandwidth limit

|      Session timeout in seconds is 300

|      Control connection is plain text

|      Data connections will be plain text

|      vsFTPd 2.3.4 - secure, fast, stable

|_End of status

|_ftp-anon: Anonymous FTP login allowed (FTP code 230)

22/tcp   open  ssh

| ssh-hostkey: 

|   1024 600fcfe1c05f6a74d69024fac4d56ccd (DSA)

|_  2048 5656240f211ddea72bae61b1243de8f3 (RSA)

23/tcp   open  telnet

25/tcp   open  smtp

| sslv2: 

|   SSLv2 supported

|   ciphers: 

|     SSL2_RC2_128_CBC_WITH_MD5

|     SSL2_RC4_128_EXPORT40_WITH_MD5

|     SSL2_RC4_128_WITH_MD5

|     SSL2_DES_64_CBC_WITH_MD5

|     SSL2_DES_192_EDE3_CBC_WITH_MD5

|_    SSL2_RC2_128_CBC_EXPORT40_WITH_MD5

|_ssl-date: 2024-03-19T13:24:59+00:00; +8s from scanner time.

|_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN,
 STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN

| ssl-cert: Subject: commonName=ubuntu804-base.localdomain/
organizationName=
OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX

| Not valid before: 2010-03-17T14:07:45

|_Not valid after:  2010-04-16T14:07:45

53/tcp   open  domain

| dns-nsid: 

|_  bind.version: 9.4.2

80/tcp   open  http

|_http-title: Metasploitable2 - Linux

111/tcp  open  rpcbind

| rpcinfo: 

|   program version    port/proto  service

|   100000  2            111/tcp   rpcbind

|   100000  2            111/udp   rpcbind

|   100003  2,3,4       2049/tcp   nfs

|   100003  2,3,4       2049/udp   nfs

|   100005  1,2,3      46745/udp   mountd

|   100005  1,2,3      49939/tcp   mountd

|   100021  1,3,4      56476/udp   nlockmgr

|   100021  1,3,4      58927/tcp   nlockmgr

|   100024  1          34528/tcp   status

|_  100024  1          51500/udp   status

139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds

512/tcp  open  exec

513/tcp  open  login

514/tcp  open  shell

1099/tcp open  rmiregistry

1524/tcp open  ingreslock

2049/tcp open  nfs

2121/tcp open  ccproxy-ftp

3306/tcp open  mysql

| mysql-info:

|   Protocol: 10

|   Version: 5.0.51a-3ubuntu5

|   Thread ID: 8

|   Capabilities flags: 43564

|   Some Capabilities: SwitchToSSLAfterHandshake, Support41Auth,
 SupportsTransactions, Speaks41ProtocolNew, SupportsCompression, 
 LongColumnFlag, ConnectWithDatabase

|   Status: Autocommit

|_  Salt: j5e"r;o@/g=7?rD=CyW*

5432/tcp open  postgresql

| ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=
sOCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX

| Not valid before: 2010-03-17T14:07:45

|_Not valid after:  2010-04-16T14:07:45

|_ssl-date: 2024-03-19T13:25:27+00:00; +8s from scanner time.

5900/tcp open  vnc

| vnc-info:

|   Protocol version: 3.3

|   Security types:

|_    VNC Authentication (2)

6000/tcp open  X11

6667/tcp open  irc

| irc-info:

|   users: 1

|   servers: 1

|   lusers: 1

|   lservers: 0

|   server: irc.Metasploitable.LAN

|   version: Unreal3.2.8.1. irc.Metasploitable.LAN

|   uptime: 0 days, 3:30:10

|   source ident: nmap

|   source host: DA54AD4C.F2A81775.FFFA6D49.IP

|_  error: Closing Link: nlrkzzzsy[192.168.233.130] (Quit: nlrkzzzsy)

8009/tcp open  ajp13

|_ajp-methods: Failed to get a valid response for the OPTION request

8180/tcp open  unknown

|_http-favicon: Apache Tomcat

|_http-title: Apache Tomcat/5.5

Host script results:

|_nbstat: NetBIOS name: METASPLOITABLE, NetBIOS user:
 <unknown>, NetBIOS MAC: 00:00:00:00:00:00 (Xerox)

| smb-os-discovery: 

|   OS: Unix (Samba 3.0.20-Debian)

|   Computer name: metasploitable

|   NetBIOS computer name: 

|   Domain name: localdomain

|   FQDN: metasploitable.localdomain

|_  System time: 2024-03-19T09:24:43-04:00

|_clock-skew: mean: 1h00m07s, deviation: 2h00m00s, median: 7s

| smb-security-mode: 

|   account_used: guest

|   authentication_level: user

|   challenge_response: supported

|_  message_signing: disabled (dangerous, but default)

|_smb2-time: Protocol negotiation failed (SMB2)

Nmap done: 1 IP address (1 host up) scanned in 73.66 seconds

Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-19 13:15 EDT

Nmap scan report for 192.168.233.8

Host is up (0.00020s latency).

PORT     STATE SERVICE    REASON

21/tcp   open  ftp        syn-ack

|_ftp-anon: Anonymous FTP login allowed

22/tcp   open  ssh        syn-ack

| ssh-hostkey: 

|   2048 4a:5b:13:2b:7f:98:56:ad:ad:e8:2a:5e:33:a1:90:c7 (RSA)

|_  256 a7:4c:30:04:86:d4:ec:4a:2a:54:49:45:e8:d5:95:7f (ECDSA)

80/tcp   open  http       syn-ack

|_http-title: Test Page for Apache Installation

| http-methods: 

|   Supported Methods: GET HEAD POST OPTIONS

|_  Potentially risky methods: TRACE

139/tcp  closed netbios-ssn reset

445/tcp  closed microsoft-ds reset

3306/tcp open  mysql       syn-ack

| mysql-info: 

|   MySQL Version: 5.5.62-0ubuntu0.14.04.1

|   Protocol Version: 10

|   Status: Autocommit

|   Thread ID: 35

|   Capabilities flags: 63487

|   Some Capabilities: Speaks41ProtocolNew, SupportsCompression, 
LongPassword, SupportsTransactions

|   Server charset: latin1 COLLATE latin1_swedish_ci (compiled)

|_  Server: Ubuntu

Host script results:

|_clock-skew: mean: 1m24s, deviation: 0s, median: 1m24s

| smb-security-mode: 

|   account_used: guest

|   authentication_level: user

|   challenge_response: supported

|_  message_signing: disabled (dangerous, but default)

Nmap done: 1 IP address (1 host up) scanned in 10.76 seconds

Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-19 14:39 EDT

Nmap scan report for 192.168.233.8

Host is up (0.00072s latency).

Not shown: 977 closed tcp ports (conn-refused)

PORT     STATE SERVICE

21/tcp   open  ftp 

|_ftp-anon: Anonymous FTP login allowed (FTP code 230)

22/tcp   open  ssh

| ssh-auth-methods: 

|   Supported authentication methods: 

|     publickey

|_    password

| ssh-publickey-acceptance: 

|_  Accepted Public Keys: No public keys accepted

23/tcp   open  telnet 

25/tcp   open  smtp 

| smtp-enum-users: 

|_  Method RCPT returned a unhandled status code.

53/tcp   open  domain 

80/tcp   open  http 

|_http-config-backup: ERROR: Script execution failed (use -d to debug)

111/tcp  open  rpcbind 

139/tcp  open  netbios-ssn 

445/tcp  open  microsoft-ds 

512/tcp  open  exec 

513/tcp  open  login 

514/tcp  open  shell

1099/tcp open  rmiregistry 

1524/tcp open  ingreslock 

2049/tcp open  nfs 

2121/tcp open  ccproxy-ftp 

3306/tcp open  mysql 

| mysql-users: 

|   debian-sys-maint

|   guest

|_  root

| mysql-empty-password: 

|_  root account has empty password

5432/tcp open  postgresql 

5900/tcp open  vnc 

6000/tcp open  X11 

6667/tcp open  irc 

8009/tcp open  ajp13 

8180/tcp open  unknown 

| http-default-accounts: 

|   [Apache Tomcat] at /manager/html/

|     tomcat:tomcat

|   [Apache Tomcat Host Manager] at /host-manager/html/

|_    tomcat:tomcat

|_http-config-backup: ERROR: Script execution failed (use -d to debug)

Host script results:

| smb-enum-users: 

|_  Domain: METASPLOITABLE; Users: backup, bin, bind, daemon, dhcp, distccd,
 ftp, games, gnats, irc, klog, libuuid, list, lp, mail,
 man, msfadmin, mysql, news, nobody, postfix
, postgres, proftpd, proxy, root,
 service, sshd, sync, sys, syslog, 
telnetd, tomcat55, user, uucp, www-data

Post-scan script results:

| creds-summary: 

|   192.168.233.8: 

|     8180/unknown: 

|       tomcat:tomcat - Valid credentials

|_      tomcat:tomcat - Valid credentials

Nmap done: 1 IP address (1 host up) scanned in 30.52 seconds

Starting Nmap 7.93 (https://nmap.org) at 2024-03-19 16:00 EDT

Nmap scan report for 192.168.233.8

Host is up (0.00020s latency).

PORT    STATE SERVICE

21/tcp  open  ftp

| ftp-proftpd-backdoor:

|   VULNERABLE:

|   ProFTPD 1.3.3c Backdoor Command Execution

22/tcp  open  ssh

| sshv1:

|   VULNERABLE:

|   Use of SSH protocol version 1

80/tcp  open  http

|_http-webdav-scan:

|   WebDAV enabled and accessible

445/tcp open  microsoft-ds

|_smb-vuln-ms08-067:

|   VULNERABLE:

|   Windows Server Service Crafted RPC Request Handling Remote Code Execution

3306/tcp open  mysql

| mysql-vuln-cve2012-2122:

|   VULNERABLE:

|   MySQL Authentication Bypass Vulnerability (CVE-2012-2122)

Host script results:

|_clock-skew: mean: 1m24s, deviation: 0s, median: 1m24s

Nmap done: 1 IP address (1 host up) scanned in 28.76 seconds

Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-23 05:29 EDT

Nmap scan report for 192.168.233.8

Host is up (0.00044s latency).

Not shown: 977 closed tcp ports (reset)

PORT     STATE SERVICE

21/tcp   open  ftp

| ftp-vsftpd-backdoor:

|   VULNERABLE:

|   vsFTPd version 2.3.4 backdoor

|     State: VULNERABLE (Exploitable)

|     IDs:  CVE:CVE-2011-2523  BID:48539

|       vsFTPd version 2.3.4 backdoor, this was reported on 2011-07-04.

|     Disclosure date: 2011-07-03

|     Exploit results:

|       Shell command: id

|       Results: uid=0(root) gid=0(root)

|     References:

|       https://www.securityfocus.com/bid/48539

|       http://scarybeastsecurity.blogspot.com/2011/07/
alert-vsftpd-download-backdoored.html

|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2523

|_      https://github.com/rapid7/metasploit-framework/blob/master/modules
/exploits/unix/ftp/vsftpd_234_backdoor.rb

22/tcp   open  ssh

23/tcp   open  telnet

25/tcp   open  smtp

53/tcp   open  domain

80/tcp   open  http

111/tcp  open  rpcbind

139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds

512/tcp  open  exec

513/tcp  open  login

514/tcp  open  shell

1099/tcp open  rmiregistry

1524/tcp open  ingreslock

2049/tcp open  nfs

2121/tcp open  ccproxy-ftp

3306/tcp open  mysql

5432/tcp open  postgresql

5900/tcp open  vnc

6000/tcp open  X11

6667/tcp open  irc

|_irc-unrealircd-backdoor: Looks like trojaned version of unrealircd. 
See http://seclists.org/fulldisclosure/2010/Jun/277

8009/tcp open  ajp13

8180/tcp open  unknown

MAC Address: 54:ac:71:fa:ca:9f (VMware)

Nmap done: 1 IP address (1 host up) scanned in 9.83 seconds

Starting Nmap 7.93 (https://nmap.org) at 2024-03-18 03:24 EDT

Nmap scan report for 192.168.233.8
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
  --traceroute: Trace hop path to each host
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sU: UDP Scan
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idle scan
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b <FTP relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
  --exclude-ports <port ranges>: Exclude the specified ports from scanning
  -F: Fast mode - Scan fewer ports than the default scan
  -r: Scan ports sequentially - don't randomize
  --top-ports <number>: Scan <number> most common ports
  --port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity <level>: Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
  -sC: equivalent to --script=default
  --script=<Lua scripts>: <Lua scripts> is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=<Lua scripts>: Show help about scripts.
           <Lua scripts> is a comma-separated list of script-files or
           script-categories.
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take <time> are in seconds, or append 'ms' (milliseconds),
  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T<0-5>: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <numprobes>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second
FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
  --data <hex string>: Append a custom payload to sent packets
  --data-string <string>: Append a custom ASCII string to sent packets
  --data-length <num>: Append random data to sent packets
  --ip-options <options>: Send packets with specified ip options
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP/SCTP checksum
OUTPUT:
  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s| kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --reason: Display the reason a port is in a particular state
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --noninteractive: Disable runtime interactions via keyboard
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Nmap.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  -6: Enable IPv6 scanning
  -A: Enable OS detection, version detection, script scanning, and traceroute
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  --unprivileged: Assume the user lacks raw socket privileges
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  nmap -v -A scanme.nmap.org
  nmap -v -sn 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -Pn -p 80
SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES
Scantype Q not supported