❯ rustscan -a 172.17.0.2 .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Port scanning: Making networking exciting since... whenever. [~] The config file is expected to be at "/home/ctf/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 172.17.0.2:22 Open 172.17.0.2:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-09 21:46 CST Initiating ARP Ping Scan at 21:46 Scanning 172.17.0.2 [1 port] Completed ARP Ping Scan at 21:46, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 21:46 Completed Parallel DNS resolution of 1 host. at 21:46, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 21:46 Scanning 172.17.0.2 [2 ports] Discovered open port 22/tcp on 172.17.0.2 Discovered open port 80/tcp on 172.17.0.2 Completed SYN Stealth Scan at 21:46, 0.03s elapsed (2 total ports) Nmap scan report for 172.17.0.2 Host is up, received arp-response (0.000029s latency). Scanned at 2024-12-09 21:46:45 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 02:42:AC:11:00:02 (Unknown)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.29 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
❯ ssh [email protected] The authenticity of host '172.17.0.2 (172.17.0.2)' can't be established. ED25519 key fingerprint is SHA256:EZNhR2ojYOvInwAg+dpLntRab/b7eRvr60vq3sn7hH8. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '172.17.0.2' (ED25519) to the list of known hosts. [email protected]'s password: Linux 5ed94ec8c875 5.15.167.4-microsoft-standard-WSL2 #1 SMP Tue Nov 5 00:21:55 UTC 2024 x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Tue May 14 17:41:58 2024 from 172.17.0.1 agua@5ed94ec8c875:~$
agua@5ed94ec8c875:~$ id uid=1000(agua) gid=1000(agua) groups=1000(agua),104(lxd) agua@5ed94ec8c875:~$ sudo -l Matching Defaults entries for agua on 5ed94ec8c875: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User agua may run the following commands on 5ed94ec8c875: (root) NOPASSWD: /usr/bin/bettercap agua@5ed94ec8c875:~$ sudo /usr/bin/bettercap bettercap v2.32.0 (built for linux amd64 with go1.19.8) [type'help'for a list of commands]
172.17.0.0/16 > 172.17.0.2 » [14:03:50] [sys.log] [war] exec: "ip": executable file not found in$PATH 172.17.0.0/16 > 172.17.0.2 » help
help MODULE : List available commands or show module specific helpif no module name is provided. active : Show information about active modules. quit : Close the session and exit. sleep SECONDS : Sleep for the given amount of seconds. get NAME : Get the value of variable NAME, use * alone for all, or NAME* as a wildcard. set NAME VALUE : Set the VALUE of variable NAME. read VARIABLE PROMPT : Show a PROMPT to ask the user for input that will be saved inside VARIABLE. clear : Clear the screen. include CAPLET : Load and run this caplet in the current session. ! COMMAND : Execute a shell command and print its output. alias MAC NAME : Assign an alias to a given endpoint given its MAC address.
