pit

Recon & Enum

port scan (tcp)

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
9090/tcp open  zeus-admin

nmap reveals the name :- dms.pit.htb

port scan (tcp)

PORT     STATE    SERVICE      VERSION
53/udp   filtered domain
67/udp   filtered dhcps
123/udp  filtered ntp
135/udp  filtered msrpc
137/udp  filtered netbios-ns
138/udp  filtered netbios-dgm
161/udp  open     snmp         SNMPv1 server; net-snmp SNMPv3 server (public)
445/udp  filtered microsoft-ds
631/udp  filtered ipp
1434/udp filtered ms-sql-m
Service Info: Host: pit.htb

directory scan - 10.10.10.241

[01:45:23] 200 -    4KB - /404.html                                         
[01:46:01] 200 -    4KB - /index.html   

directory scan - http://dms-pit.htb

website

http://10.10.10.241/

nothing interesting over here , just a ngnix page

http://10.10.10.241:9090

login page

http://dms-pit.htb

forbidden -403