# Hack Smarter Security {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** ## Recon We start with a Nmap scan and find six open ports. An FTP service is running on 21, SSH is available on 22, we have a web server on port 80 and RDP is available on port 3389. What exactly is running on port 1311 and 7680 cannot yet be determined, but we start a version and default script scan in the second run.
The service and script scan tell us a lot more. An IIS is running behind port 80. Furthermore, we can see the hostname of the targets via 3389: `HACKSMARTERSEC`. We also see that an HTTP server is probably running on port 1311. We are dealing with a Windows host. ``` ┌──(0xb0b㉿kali)-[~/Documents/tryhackme/hacksmartersecurity] └─$ sudo nmap -sC -sV -p 21,22,80,1311,3389,7680 hacksmarter.thm Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-15 20:19 EDT Nmap scan report for hacksmarter.thm (10.10.201.35) Host is up (0.12s latency). PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-anon: Anonymous FTP login allowed (FTP code 230) | 06-28-23 02:58PM 3722 Credit-Cards-We-Pwned.txt |_06-28-23 03:00PM 1022126 stolen-passport.png | ftp-syst: |_ SYST: Windows_NT 22/tcp open ssh OpenSSH for_Windows_7.7 (protocol 2.0) | ssh-hostkey: | 2048 0d:fa:da:de:c9:dd:99:8d:2e:8e:eb:3b:93:ff:e2:6c (RSA) | 256 5d:0c:df:32:26:d3:71:a2:8e:6e:9a:1c:43:fc:1a:03 (ECDSA) |_ 256 c4:25:e7:09:d6:c9:d9:86:5f:6e:8a:8b:ec:13:4a:8b (ED25519) 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: HackSmarterSec | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 1311/tcp open ssl/rxmon? | ssl-cert: Subject: commonName=hacksmartersec/organizationName=Dell Inc/stateOrProvinceName=TX/countryName=US | Not valid before: 2023-06-30T19:03:17 |_Not valid after: 2025-06-29T19:03:17 | fingerprint-strings: | GetRequest: | HTTP/1.1 200 | Strict-Transport-Security: max-age=0 | X-Frame-Options: SAMEORIGIN | X-Content-Type-Options: nosniff | X-XSS-Protection: 1; mode=block | vary: accept-encoding | Content-Type: text/html;charset=UTF-8 | Date: Sat, 16 Mar 2024 00:20:07 GMT | Connection: close | | | | | OpenManage™ | | |