Easy Lab

May 17, 2024

# Nmap 7.94 scan initiated Sat May 18 00:14:25 2024 as: nmap -sS -sV -sC -oN nmap -vv 10.129.203.25
Increasing send delay for 10.129.203.25 from 0 to 5 due to 301 out of 1003 dropped probes since last increase.
Increasing send delay for 10.129.203.25 from 5 to 10 due to 11 out of 12 dropped probes since last increase.
Increasing send delay for 10.129.203.25 from 10 to 20 due to 11 out of 12 dropped probes since last increase.
Increasing send delay for 10.129.203.25 from 20 to 40 due to 11 out of 12 dropped probes since last increase.
Increasing send delay for 10.129.203.25 from 40 to 80 due to 11 out of 13 dropped probes since last increase.
Nmap scan report for 10.129.203.25
Host is up, received reset ttl 63 (0.31s latency).
Scanned at 2024-05-18 00:14:26 PST for 254s
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE      REASON         VERSION
21/tcp   open  ftp?         syn-ack ttl 63
| fingerprint-strings: 
|   GenericLines: 
|     220 ProFTPD Server (ftp.int.inlanefreight.htb) [10.129.203.25]
|     Invalid command: try being more creative
|_    Invalid command: try being more creative
22/tcp   open  ssh          syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 3f:4c:8f:10:f1:ae:be:cd:31:24:7c:a1:4e:ab:84:6d (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDa9RJRoAShv6FzLx23WYUh5z5vpaC1W0jTGGJuVfOVmOiwXu7d+eLRcf51dFwqe2J4OZ7z70w6Lrbm3RyKjNSZmY0ekPqbXyP0P6KqYn4eFdJkYp74zPUEvC/Y5U9gYmvCpoQ8gvqgAImYwhBXAlAmGDptcfRWRJ3KaRG/bbmfg0vsWqwYvDVfxEcCfbO1m7v6a9EiWELRTynHS26+oJbjY7tX5X05XMvj6L53JMWodHVsFf/vD4/qP2Ic0lafSBXuyKOcN5Tnx0DpExUwqj7GPLaM/ljG5LjF8y2yqZ85GeNQsgnsSxIL6dHiWkbUP4RXogUVI/prXLDU8307Wn/LWJQl3hxjJmunJfC5qw4a/JPLd9ydFSwadjYhztQoYIsSp41mr/wEVns8owxcKzBju74T9FptZ4I4UAzZLIWg1RJzpnJ7wpnFSUXFbvOa6V+nzeMesjYvKK1vx+UuNtrUuXPJm3BoYKjRJd2msog1KX4CguQNGZMS6LegiRIGde0=
|   256 7b:30:37:67:50:b9:ad:91:c0:8f:f7:02:78:3b:7c:02 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNAdY+PFLa0XBlXCp3lL+mrrQKkU6bxWjDVEsljltzBYtugbDuER3AyIq1igFdgQPn+uKh5RtNQvPvX1Al8pA0Y=
|   256 88:9e:0e:07:fe:ca:d0:5c:60:ab:cf:10:99:cd:6c:a7 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGKKM5saOYH/Fq3lWY1P4fchdWaH60Ib5/VQk6A00nAP
53/tcp   open  domain       syn-ack ttl 63 ISC BIND 9.16.1 (Ubuntu Linux)
| dns-nsid: 
|_  bind.version: 9.16.1-Ubuntu
2121/tcp open  ccproxy-ftp? syn-ack ttl 63
| fingerprint-strings: 
|   GenericLines: 
|     220 ProFTPD Server (Ceil's FTP) [10.129.203.25]
|     Invalid command: try being more creative
|_    Invalid command: try being more creative
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port21-TCP:V=7.94%I=7%D=5/18%Time=6647827D%P=x86_64-pc-linux-gnu%r(Gene
SF:ricLines,9C,"220\x20ProFTPD\x20Server\x20\(ftp\.int\.inlanefreight\.htb
SF:\)\x20\[10\.129\.203\.25\]\r\n500\x20Invalid\x20command:\x20try\x20bein
SF:g\x20more\x20creative\r\n500\x20Invalid\x20command:\x20try\x20being\x20
SF:more\x20creative\r\n");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port2121-TCP:V=7.94%I=7%D=5/18%Time=6647827D%P=x86_64-pc-linux-gnu%r(Ge
SF:nericLines,8D,"220\x20ProFTPD\x20Server\x20\(Ceil's\x20FTP\)\x20\[10\.1
SF:29\.203\.25\]\r\n500\x20Invalid\x20command:\x20try\x20being\x20more\x20
SF:creative\r\n500\x20Invalid\x20command:\x20try\x20being\x20more\x20creat
SF:ive\r\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat May 18 00:18:40 2024 -- 1 IP address (1 host up) scanned in 255.00 seconds

ftp 10.129.203.25 2121

Just getting the id_rsa

chmod 600 id_rsa
ssh -i id_rsa ceil@IP
find / -name flag.txt 2>/dev/null