Machine beep - Easy - Linux - abandoned
Host is up, received user-set (0.043s latency).
Scanned at 2021-10-20 22:21:44 CEST for 12s
Not shown: 65519 closed tcp ports (reset)
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
25/tcp open smtp syn-ack ttl 63
80/tcp open http syn-ack ttl 63
110/tcp open pop3 syn-ack ttl 63
111/tcp open rpcbind syn-ack ttl 63
143/tcp open imap syn-ack ttl 63
443/tcp open https syn-ack ttl 63
878/tcp open unknown syn-ack ttl 63
993/tcp open imaps syn-ack ttl 63
995/tcp open pop3s syn-ack ttl 63
3306/tcp open mysql syn-ack ttl 63
4190/tcp open sieve syn-ack ttl 63
4445/tcp open upnotifyp syn-ack ttl 63
4559/tcp open hylafax syn-ack ttl 63
5038/tcp open unknown syn-ack ttl 63
10000/tcp open snet-sensor-mgmt syn-ack ttl 63
Starting Nmap 7.92 ( https://nmap.org ) at 2021-10-20 21:51 CEST
Nmap scan report for 10.10.10.7
Host is up (0.044s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 4.3 (protocol 2.0)
| ssh-hostkey:
| 1024 ad:ee:5a:bb:69:37:fb:27:af:b8:30:72:a0:f9:6f:53 (DSA)
|_ 2048 bc:c6:73:59:13:a1:8a:4b:55:07:50:f6:65:1d:6d:0d (RSA)
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100024 1 875/udp status
|_ 100024 1 878/tcp status
3306/tcp open mysql MySQL (unauthorized)
|_tls-nextprotoneg: ERROR: Script execution failed (use -d to debug)
|_ssl-cert: ERROR: Script execution failed (use -d to debug)
|_ssl-date: ERROR: Script execution failed (use -d to debug)
|_tls-alpn: ERROR: Script execution failed (use -d to debug)
|_sslv2: ERROR: Script execution failed (use -d to debug)
4445/tcp open upnotifyp?
-
port 111 (trying to see which rpc endoint)
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 4.3 (protocol 2.0) | ssh-hostkey: | 1024 ad:ee:5a:bb:69:37:fb:27:af:b8:30:72:a0:f9:6f:53 (DSA) |_ 2048 bc:c6:73:59:13:a1:8a:4b:55:07:50:f6:65:1d:6d:0d (RSA) 25/tcp open smtp Postfix smtpd |_smtp-commands: beep.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, ENHANCEDSTATUSCODES, 8BITMIME, DSN 80/tcp open http Apache httpd 2.2.3 |_http-server-header: Apache/2.2.3 (CentOS) |_http-title: Did not follow redirect to https://10.10.10.7/ 110/tcp open pop3 Cyrus pop3d 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4 |_sslv2: ERROR: Script execution failed (use -d to debug) |_ssl-date: ERROR: Script execution failed (use -d to debug) |_pop3-capabilities: PIPELINING IMPLEMENTATION(Cyrus POP3 server v2) AUTH-RESP-CODE TOP RESP-CODES UIDL APOP USER STLS LOGIN-DELAY(0) EXPIRE(NEVER) |_ssl-cert: ERROR: Script execution failed (use -d to debug) |_tls-alpn: ERROR: Script execution failed (use -d to debug) |_tls-nextprotoneg: ERROR: Script execution failed (use -d to debug) 111/tcp open rpcbind 2 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2 111/tcp rpcbind | 100000 2 111/udp rpcbind | 100024 1 875/udp status |_ 100024 1 878/tcp status 143/tcp open imap Cyrus imapd 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4 |_tls-alpn: ERROR: Script execution failed (use -d to debug) |_tls-nextprotoneg: ERROR: Script execution failed (use -d to debug) |_ssl-cert: ERROR: Script execution failed (use -d to debug) |_imap-capabilities: ANNOTATEMORE IMAP4rev1 URLAUTHA0001 OK X-NETSCAPE Completed BINARY UIDPLUS IMAP4 NAMESPACE IDLE LIST-SUBSCRIBED MAILBOX-REFERRALS UNSELECT LISTEXT ID SORT=MODSEQ CATENATE RENAME THREAD=REFERENCES QUOTA NO THREAD=ORDEREDSUBJECT ACL CONDSTORE SORT ATOMIC MULTIAPPEND CHILDREN STARTTLS RIGHTS=kxte LITERAL+ |_imap-ntlm-info: ERROR: Script execution failed (use -d to debug) |_ssl-date: ERROR: Script execution failed (use -d to debug) |_sslv2: ERROR: Script execution failed (use -d to debug) 443/tcp open ssl/http Apache httpd 2.2.3 ((CentOS)) | ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=-- | Not valid before: 2017-04-07T08:22:08 |_Not valid after: 2018-04-07T08:22:08 |_ssl-date: 2021-10-20T20:32:50+00:00; +15s from scanner time. |_http-server-header: Apache/2.2.3 (CentOS) | http-robots.txt: 1 disallowed entry |_/ |_http-title: Elastix - Login page 878/tcp open status 1 (RPC #100024) 993/tcp open ssl/imap Cyrus imapd |_imap-capabilities: CAPABILITY 995/tcp open pop3 Cyrus pop3d |_tls-nextprotoneg: ERROR: Script execution failed (use -d to debug) |_ssl-known-key: ERROR: Script execution failed (use -d to debug) |_tls-alpn: ERROR: Script execution failed (use -d to debug) |_ssl-date: ERROR: Script execution failed (use -d to debug) |_ssl-cert: ERROR: Script execution failed (use -d to debug) |_sslv2: ERROR: Script execution failed (use -d to debug) 4190/tcp open sieve Cyrus timsieved 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4 (included w/cyrus imap) 4445/tcp open upnotifyp? 4559/tcp open hylafax HylaFAX 4.3.10 5038/tcp open asterisk Asterisk Call Manager 1.1 10000/tcp open http MiniServ 1.570 (Webmin httpd) |_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1). Service Info: Hosts: beep.localdomain, 127.0.0.1, example.com, localhost; OS: Unix -
port 3306
- if I connect via nc, it says
jHost '10.10.14.6' is not allowed to connect to this MySQL serverTotal received bytes: 71
- if I connect via nc, it says
-
110
- lets see if we can see mails
Cyrus POP3 v2.3.7-Invoca-RPM-2.3.7-7.el5_6.4 server
- lets see if we can see mails
-
port 10000
- another admin page
-
5038
- maybe it’s exploitable ?
https://github.com/EnableSecurity/sipvicious
$ svmap 10.10.10.7 +-----------------+---------------------+ | SIP Device | User Agent | +=================+=====================+ | 10.10.10.7:5060 | FPBX-2.8.1(1.8.7.0) | +-----------------+---------------------+svwar 10.10.10.7-p