# DX2: Hell's Kitchen {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0

](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** ## Recon We start with a Nmap scan and find only two open ports, `80` and `4346`. A subsequent service and default script scan tells us that both are web servers. ```bash ┌──(0xb0b㉿kali)-[~/Documents/tryhackme/dx2] └─$ nmap -p- dx2.thm -T4 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-19 14:02 EDT Nmap scan report for dx2.thm (10.10.80.2) Host is up (0.038s latency). Not shown: 65533 filtered tcp ports (no-response) PORT STATE SERVICE 80/tcp open http 4346/tcp open elanlm Nmap done: 1 IP address (1 host up) scanned in 123.28 seconds ┌──(0xb0b㉿kali)-[~/Documents/tryhackme/dx2] └─$ nmap -sV -sC -p 80,4346 dx2.thm -T4 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-19 14:06 EDT Nmap scan report for dx2.thm (10.10.80.2) Host is up (0.065s latency). PORT STATE SERVICE VERSION 80/tcp open http |_http-title: Welcome to the 'Ton! | fingerprint-strings: | GetRequest: | HTTP/1.0 200 OK | content-length: 859 | date: Fri, 19 Jul 2024 18:06:46 GMT | | ... |