Howlsec
HOWLSEC
offensive security
// notes/ Practice Boxes
🟦

AuthBy — Proving Grounds (192.168.103.46)

sudo rustscan -a $target -- -A -sC

#proving grounds#pg#walkthrough#boxes#os:windows#os:linux

AuthBy — Proving Grounds (192.168.103.46)

Port Enumeration

🐺 howlsec@kali
$sudo rustscan -a $target -- -A -sC
$ 
$PORT     STATE SERVICE       VERSION
$21/tcp   open  ftp           zFTPServer 6.0 build 2011-10-17 (Anonymous FTP login allowed)
$|  Contents include zFTPServer.exe, Settings.ini, accounts/, extensions/, certificates/, log/
$242/tcp  open  http          Apache httpd 2.2.21 (Win32) PHP/5.3.8
$|  HTTP 401 - Basic realm "Qui e nuce nuculeum esse volt, frangit nucem!"
$3145/tcp open  zftp-admin    zFTPServer admin
$3389/tcp open  ms-wbt-server Microsoft Terminal Service (Host: LIVDA, Windows 6.0.6001)

Anonymous FTP (zFTPServer 6.0) is allowed and exposes the server's own installation directory (including the accounts/ and Settings.ini files). Port 242 hosts an Apache/PHP site behind HTTP Basic auth, and 3145 is the zFTPServer admin interface — the zFTPServer install being writable/readable over anonymous FTP is the key foothold surface (LIVDA host, Windows Server 2008).