Heist — Proving Grounds (heist.offsec DC)

PORT STATE SERVICE VERSION

#proving grounds#pg#walkthrough#boxes#os:windows#tech:active-directory

Heist — Proving Grounds (heist.offsec DC)

Port enumeration

🐺 howlsec@kaliphp

01PORT      STATE SERVICE       VERSION
0253/tcp    open  domain        Simple DNS Plus
0388/tcp    open  kerberos-sec  Microsoft Windows Kerberos
04135/139/445  msrpc / netbios / microsoft-ds
05389/3268  ldap  Microsoft Windows Active Directory LDAP (Domain: heist.offsec)
06464/tcp   open  kpasswd5
07593/tcp   open  ncacn_http
08636/3269  tcpwrapped (ldaps)
093389/tcp  open  ms-wbt-server  (DC01.heist.offsec, Windows Server 2019 Build 17763)
105985/tcp  open  http  Microsoft HTTPAPI 2.0 (WinRM)
118080/tcp  open  http  Werkzeug httpd 2.0.1 (Python 3.9.0) - "Super Secure Web Browser"
129389/tcp  open  mc-nmf  .NET Message Framing

Domain: heist.offsec (DC: DC01). The notable non-standard service is the Werkzeug/Flask "Super Secure Web Browser" app on port 8080.