❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.187 08:00:27:1d:c6:76 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:fd:65:82 VMware, Inc. 4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.032 seconds (125.98 hosts/sec). 4 responded ❯ export ip=192.168.60.187 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- I don't always scan ports, but when I do, I prefer RustScan.
[~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.187:22 Open 192.168.60.187:80 Open 192.168.60.187:873 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-16 15:48 CST Initiating ARP Ping Scan at 15:48 Scanning 192.168.60.187 [1 port] Completed ARP Ping Scan at 15:48, 0.08s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 15:48 Completed Parallel DNS resolution of 1 host. at 15:48, 0.00s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 15:48 Scanning 192.168.60.187 [3 ports] Discovered open port 22/tcp on 192.168.60.187 Discovered open port 873/tcp on 192.168.60.187 Discovered open port 80/tcp on 192.168.60.187 Completed SYN Stealth Scan at 15:48, 0.04s elapsed (3 total ports) Nmap scan report for 192.168.60.187 Host is up, received arp-response (0.00086s latency). Scanned at 2025-02-16 15:48:05 CST for 0s PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 873/tcp open rsync syn-ack ttl 64 MAC Address: 08:00:27:1D:C6:76 (Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.29 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
❯ rsync -av rsync://$ip:873/extensions ./rsyn_shared receiving incremental file list created directory ./rsyn_shared ./ Password_manager_FirefoxExtension-VulNyx.pdf password_manager.zip
sent 65 bytes received 124,610 bytes 249,350.00 bytes/sec total size is 124,364 speedup is 1.00 ❯ cd rsyn_shared ❯ x password_manager.zip extract: extracting to password_manager Archive: /home/Pepster/vulnyx/rsyn_shared/password_manager.zip inflating: background.js inflating: icon.png inflating: manifest.json inflating: popup.html inflating: popup.js inflating: styles.css
❯ ssh d4t4s3c@$ip The authenticity of host '192.168.60.187 (192.168.60.187)' can't be established. ED25519 key fingerprint is SHA256:q2oJVk8pvyNE1iEAucoSG9iwm1MeIlnMRT7L9fXkqzI. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.187' (ED25519) to the list of known hosts. [email protected]'s password: Linux bola 6.1.0-30-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.124-1 (2025-01-12) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Feb 6 09:33:51 2025 from 192.168.1.50 d4t4s3c@bola:~$ cat user.txt 4e62a268197ebd869b7bafe859e35d00
