2025年05月24日

# Nmap 7.95 scan initiated Sat May 24 06:50:55 2025 as: nmap -A -T5 -oN /home/chicken/puppy.nmap 10.10.11.70
Nmap scan report for PUPPY.HTB (10.10.11.70)
Host is up (0.12s latency).
Not shown: 985 filtered tcp ports (no-response)
Bug in iscsi-info: no string output.
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-05-24 13:30:13Z)
111/tcp  open  rpcbind       2-4 (RPC #100000)
| rpcinfo:
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/tcp6  rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  2,3,4        111/udp6  rpcbind
|   100003  2,3         2049/udp   nfs
|   100003  2,3         2049/udp6  nfs
|   100005  1,2,3       2049/udp   mountd
|   100005  1,2,3       2049/udp6  mountd
|   100021  1,2,3,4     2049/tcp   nlockmgr
|   100021  1,2,3,4     2049/tcp6  nlockmgr
|   100021  1,2,3,4     2049/udp   nlockmgr
|   100021  1,2,3,4     2049/udp6  nlockmgr
|   100024  1           2049/tcp   status
|   100024  1           2049/tcp6  status
|   100024  1           2049/udp   status
|_  100024  1           2049/udp6  status
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: PUPPY.HTB0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
2049/tcp open  nlockmgr      1-4 (RPC #100021)
3260/tcp open  iscsi?
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: PUPPY.HTB0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022|2012|2016 (89%)
OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016
Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 6h38m58s
| smb2-time:
|   date: 2025-05-24T13:32:14
|_  start_date: N/A
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

TRACEROUTE (using port 135/tcp)
HOP RTT       ADDRESS
1   128.93 ms 10.10.16.1 (10.10.16.1)
2   129.00 ms PUPPY.HTB (10.10.11.70)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat May 24 06:54:07 2025 -- 1 IP address (1 host up) scanned in 192.91 seconds

ss=user)" sAMAccountName userPrincipalName
# extended LDIF
#
# LDAPv3
# base <dc=puppy,dc=htb> with scope subtree
# filter: (objectClass=user)
# requesting: sAMAccountName userPrincipalName
#

# Administrator, Users, PUPPY.HTB
dn: CN=Administrator,CN=Users,DC=PUPPY,DC=HTB
sAMAccountName: Administrator

# Guest, Users, PUPPY.HTB
dn: CN=Guest,CN=Users,DC=PUPPY,DC=HTB
sAMAccountName: Guest

# DC, Domain Controllers, PUPPY.HTB
dn: CN=DC,OU=Domain Controllers,DC=PUPPY,DC=HTB
sAMAccountName: DC$

# krbtgt, Users, PUPPY.HTB
dn: CN=krbtgt,CN=Users,DC=PUPPY,DC=HTB
sAMAccountName: krbtgt

# Levi B. James, MANPOWER, PUPPY.HTB
dn: CN=Levi B. James,OU=MANPOWER,DC=PUPPY,DC=HTB
sAMAccountName: levi.james
userPrincipalName: levi.james@PUPPY.HTB

# Anthony J. Edwards, PUPPY.HTB
dn: CN=Anthony J. Edwards,DC=PUPPY,DC=HTB
sAMAccountName: ant.edwards
userPrincipalName: ant.edwards@PUPPY.HTB

# Adam D. Silver, Users, PUPPY.HTB
dn: CN=Adam D. Silver,CN=Users,DC=PUPPY,DC=HTB
sAMAccountName: adam.silver
userPrincipalName: adam.silver@PUPPY.HTB

# Jamie S. Williams, Users, PUPPY.HTB
dn: CN=Jamie S. Williams,CN=Users,DC=PUPPY,DC=HTB
sAMAccountName: jamie.williams
userPrincipalName: jamie.williams@PUPPY.HTB

# Stephen W. Cooper, PUPPY ADMINS, PUPPY.HTB
dn: CN=Stephen W. Cooper,OU=PUPPY ADMINS,DC=PUPPY,DC=HTB
sAMAccountName: steph.cooper
userPrincipalName: steph.cooper@PUPPY.HTB

# Stephen A. Cooper_adm, PUPPY ADMINS, PUPPY.HTB
dn: CN=Stephen A. Cooper_adm,OU=PUPPY ADMINS,DC=PUPPY,DC=HTB
sAMAccountName: steph.cooper_adm
userPrincipalName: steph.cooper_adm@PUPPY.HTB

# search reference
ref: ldap://ForestDnsZones.PUPPY.HTB/DC=ForestDnsZones,DC=PUPPY,DC=HTB

# search reference
ref: ldap://DomainDnsZones.PUPPY.HTB/DC=DomainDnsZones,DC=PUPPY,DC=HTB

# search reference
ref: ldap://PUPPY.HTB/CN=Configuration,DC=PUPPY,DC=HTB

# search result
search: 2
result: 0 Success

# numResponses: 14
# numEntries: 10
# numReferences: 3