2026-06-05

CTF/VulNetInternal/business-req.txt

@@ -0,0 +1,2 @@
+We just wanted to remind you that we’re waiting for the DOCUMENT you agreed to send us so we can complete the TRANSACTION we discussed.
+If you have any questions, please text or phone us.

CTF/VulNetInternal/data.txt

@@ -0,0 +1 @@
+Purge regularly data that is not needed anymore

CTF/VulNetInternal/ip.txt

@@ -0,0 +1 @@
+10.81.148.220

CTF/VulNetInternal/nmap_scan_01.txt

@@ -0,0 +1,108 @@
+# Nmap 7.99 scan initiated Fri May  8 14:45:27 2026 as: /usr/lib/nmap/nmap --privileged -A -T4 -p- -oN nmap_scan_01.txt -vv 10.81.148.220
+Increasing send delay for 10.81.148.220 from 0 to 5 due to 4072 out of 10179 dropped probes since last increase.
+Increasing send delay for 10.81.148.220 from 5 to 10 due to 11 out of 15 dropped probes since last increase.
+Nmap scan report for 10.81.148.220
+Host is up, received echo-reply ttl 62 (0.14s latency).
+Scanned at 2026-05-08 14:45:28 CEST for 809s
+Not shown: 65523 closed tcp ports (reset)
+PORT      STATE    SERVICE     REASON         VERSION
+22/tcp    open     ssh         syn-ack ttl 62 OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
+| ssh-hostkey: 
+|   3072 98:e3:07:4c:6b:a4:76:d3:79:3b:a9:d1:99:b0:46:eb (RSA)
+| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCqmyZu4KaquMZ07hdtn2wyFLtqufrbvj6tu4yxV+V1lCBPLusk08xoEB/ZApuqEvXFiQM8jSDz8jVyZh+b2TE+AWCllzQ4tZnlcy0GuSvnrjZGJrSMESwuAlMTQuLXhoPeRnDHgPI6JWnRR6J0Gn6iHv3i1t5tEWploahO5YK5GBXBQHwljMNIaE0Mlopu3vfj6Y3S3BK/cvHyGYbhtSzQdFLYp+z/MkqPjqlQ45yEiLTk2U6IT42YrbJddT/wcnjnColbt0dD8UvcjEdeCg9SIZW9aZpmTns6jztPiQRGZonRckcRNvCko5vDJSXzBELoy6PQeDiZXYfCw3KlQDilmzXlcSvW4MhZ84tznqdzyGLHniLmm/DsXv+g91/gGNYh8PPqACtHXwTGz5Gm0CKI4F+z16x9tgGgvLw//QkAChlK3fmUWoyThL6ZW2X+MKKYpw2ymBHRdO7zGqAASSV4gml63NNt0jXWBjpd/w/77AJgJn0QpkBZ0Vb8Yyc5rdM=
+|   256 31:34:e6:37:c2:d5:09:63:3d:0a:1c:73:f9:1b:8d:49 (ECDSA)
+| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPa5KoSCT2U8tKjs86x8w4VME70mSnSK7ZhfaXE5mo4y8+ERNlcMAJG0nSlvwOYDWbII3sA76PsnUReCuyDj6Ho=
+|   256 ce:eb:45:8f:c8:cb:b8:c6:33:cf:8c:40:97:38:4d:6b (ED25519)
+|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAlHg69fqfg/GBqzjBKrRDT3PXbto4Qhvx7/PfsiflSB
+111/tcp   open     rpcbind     syn-ack ttl 62 2-4 (RPC #100000)
+| rpcinfo: 
+|   program version    port/proto  service
+|   100000  2,3,4        111/tcp   rpcbind
+|   100000  2,3,4        111/udp   rpcbind
+|   100000  3,4          111/tcp6  rpcbind
+|   100000  3,4          111/udp6  rpcbind
+|   100003  3           2049/udp   nfs
+|   100003  3           2049/udp6  nfs
+|   100003  3,4         2049/tcp   nfs
+|   100003  3,4         2049/tcp6  nfs
+|   100005  1,2,3      42205/udp   mountd
+|   100005  1,2,3      51151/tcp   mountd
+|   100005  1,2,3      59595/udp6  mountd
+|   100005  1,2,3      60983/tcp6  mountd
+|   100021  1,3,4      38519/tcp   nlockmgr
+|   100021  1,3,4      41999/tcp6  nlockmgr
+|   100021  1,3,4      46131/udp6  nlockmgr
+|   100021  1,3,4      46853/udp   nlockmgr
+|   100227  3           2049/tcp   nfs_acl
+|   100227  3           2049/tcp6  nfs_acl
+|   100227  3           2049/udp   nfs_acl
+|_  100227  3           2049/udp6  nfs_acl
+139/tcp   open     netbios-ssn syn-ack ttl 62 Samba smbd 4
+445/tcp   open     netbios-ssn syn-ack ttl 62 Samba smbd 4
+873/tcp   open     rsync       syn-ack ttl 62 (protocol version 31)
+2049/tcp  open     nfs         syn-ack ttl 62 3-4 (RPC #100003)
+6379/tcp  open     redis       syn-ack ttl 62 Redis key-value store
+9090/tcp  filtered zeus-admin  no-response
+37291/tcp open     mountd      syn-ack ttl 62 1-3 (RPC #100005)
+38519/tcp open     nlockmgr    syn-ack ttl 62 1-4 (RPC #100021)
+40795/tcp open     mountd      syn-ack ttl 62 1-3 (RPC #100005)
+51151/tcp open     mountd      syn-ack ttl 62 1-3 (RPC #100005)
+No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
+TCP/IP fingerprint:
+OS:SCAN(V=7.99%E=4%D=5/8%OT=22%CT=1%CU=39961%PV=Y%DS=3%DC=T%G=Y%TM=69FDDE12
+OS:%P=aarch64-unknown-linux-gnu)SEQ(SP=102%GCD=1%ISR=104%TI=Z%CI=Z%II=I%TS=
+OS:A)SEQ(SP=103%GCD=1%ISR=10C%TI=Z%CI=Z%II=I%TS=A)SEQ(SP=104%GCD=1%ISR=10A%
+OS:TI=Z%CI=Z%II=I%TS=A)SEQ(SP=FB%GCD=1%ISR=109%TI=Z%CI=Z%II=I%TS=A)SEQ(SP=F
+OS:F%GCD=1%ISR=103%TI=Z%CI=Z%TS=A)OPS(O1=M4E8ST11NW7%O2=M4E8ST11NW7%O3=M4E8
+OS:NNT11NW7%O4=M4E8ST11NW7%O5=M4E8ST11NW7%O6=M4E8ST11)WIN(W1=F4B3%W2=F4B3%W
+OS:3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(R=Y%DF=Y%T=40%W=F507%O=M4E8NNSNW7%CC=
+OS:Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=
+OS:40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0
+OS:%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z
+OS:%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G
+OS:%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
+
+Uptime guess: 15.312 days (since Thu Apr 23 07:29:34 2026)
+Network Distance: 3 hops
+TCP Sequence Prediction: Difficulty=255 (Good luck!)
+IP ID Sequence Generation: All zeros
+Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
+
+Host script results:
+| smb2-time: 
+|   date: 2026-05-08T12:58:55
+|_  start_date: N/A
+| nbstat: NetBIOS name: , NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
+| Names:
+|   \x01\x02__MSBROWSE__\x02<01>  Flags: <group><active>
+|   <00>                 Flags: <unique><active>
+|   <03>                 Flags: <unique><active>
+|   <20>                 Flags: <unique><active>
+|   WORKGROUP<00>        Flags: <group><active>
+|   WORKGROUP<1d>        Flags: <unique><active>
+|   WORKGROUP<1e>        Flags: <group><active>
+| Statistics:
+|   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+|   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+|_  00 00 00 00 00 00 00 00 00 00 00 00 00 00
+|_clock-skew: -1s
+| p2p-conficker: 
+|   Checking for Conficker.C or higher...
+|   Check 1 (port 12380/tcp): CLEAN (Couldn't connect)
+|   Check 2 (port 35520/tcp): CLEAN (Couldn't connect)
+|   Check 3 (port 58973/udp): CLEAN (Failed to receive data)
+|   Check 4 (port 57845/udp): CLEAN (Failed to receive data)
+|_  0/4 checks are positive: Host is CLEAN or ports are blocked
+| smb2-security-mode: 
+|   3.1.1: 
+|_    Message signing enabled but not required
+
+TRACEROUTE (using port 1025/tcp)
+HOP RTT       ADDRESS
+1   218.41 ms 192.168.128.1
+2   ...
+3   218.76 ms 10.81.148.220
+
+Read data files from: /usr/share/nmap
+OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
+# Nmap done at Fri May  8 14:58:58 2026 -- 1 IP address (1 host up) scanned in 810.36 seconds

CTF/VulNetInternal/redis_pass.txt

@@ -0,0 +1 @@
+B65Hx562F@ggAZ@F

CTF/VulNetInternal/rsync/id_rsa

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBh5zieFCGh1stlOmiafc07xEtedT3qin/0/DpWKNJBtAAAAJgf0D9MH9A/
+TAAAAAtzc2gtZWQyNTUxOQAAACBh5zieFCGh1stlOmiafc07xEtedT3qin/0/DpWKNJBtA
+AAAEAOW/3nmJPXdajcfFshsCDy55x6hiYV8XEijSAUTcPaTmHnOJ4UIaHWy2U6aJp9zTvE
+S151PeqKf/T8OlYo0kG0AAAAEW5pa0BrYWxpLWxlYXJuaW5nAQIDBA==
+-----END OPENSSH PRIVATE KEY-----

CTF/VulNetInternal/rsync/id_rsa.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGHnOJ4UIaHWy2U6aJp9zTvES151PeqKf/T8OlYo0kG0 nik@kali-learning

CTF/VulNetInternal/rsync/user.txt

@@ -0,0 +1 @@
+THM{da7c20696831f253e0afaca8b83c07ab}

CTF/VulNetInternal/rsync_auth.txt

@@ -0,0 +1 @@
+Authorization for rsync://rsync-connect@127.0.0.1 with password Hcg3HP67@TW@Bc72v

CTF/VulNetInternal/services.txt

@@ -0,0 +1 @@
+THM{0a09d51e488f5fa105d8d866a497440a}

CTF/VulNetInternal/smb_enumeration.txt

@@ -0,0 +1,193 @@
+Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Fri May  8 16:33:16 2026
+
+ =========================================( Target Information )=========================================
+
+Target ........... 10.81.148.220
+RID Range ........ 500-550,1000-1050
+Username ......... ''
+Password ......... ''
+Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
+
+
+ ===========================( Enumerating Workgroup/Domain on 10.81.148.220 )===========================
+
+
+[+] Got domain/workgroup name: WORKGROUP
+
+
+ ===============================( Nbtstat Information for 10.81.148.220 )===============================
+
+Looking up status of 10.81.148.220
+	..__MSBROWSE__. <01> - <GROUP> B <ACTIVE>  Master Browser
+	                <00> -         B <ACTIVE> 
+	                <03> -         B <ACTIVE> 
+	                <20> -         B <ACTIVE> 
+	WORKGROUP       <00> - <GROUP> B <ACTIVE>  Domain/Workgroup Name
+	WORKGROUP       <1d> -         B <ACTIVE>  Master Browser
+	WORKGROUP       <1e> - <GROUP> B <ACTIVE>  Browser Service Elections
+
+	MAC Address = 00-00-00-00-00-00
+
+ ===================================( Session Check on 10.81.148.220 )===================================
+
+
+[+] Server 10.81.148.220 allows sessions using username '', password ''
+
+
+ ================================( Getting domain SID for 10.81.148.220 )================================
+
+Domain Name: WORKGROUP
+Domain Sid: (NULL SID)
+
+[+] Can't determine if host is part of domain or part of a workgroup
+
+
+ ==================================( OS information on 10.81.148.220 )==================================
+
+
+[E] Can't get OS info with smbclient
+
+
+[+] Got OS info for 10.81.148.220 from srvinfo: 
+	IP-10-81-148-22Wk Sv PrQ Unx NT SNT ip-10-81-148-220 server (Samba, Ubuntu)
+	platform_id     :	500
+	os version      :	6.1
+	server type     :	0x809a03
+
+
+ =======================================( Users on 10.81.148.220 )=======================================
+
+
+
+ =================================( Share Enumeration on 10.81.148.220 )=================================
+
+smbXcli_negprot_smb1_done: No compatible protocol selected by server.
+
+	Sharename       Type      Comment
+	---------       ----      -------
+	print$          Disk      Printer Drivers
+	shares          Disk      VulnNet Business Shares
+	IPC$            IPC       IPC Service (ip-10-81-148-220 server (Samba, Ubuntu))
+Reconnecting with SMB1 for workgroup listing.
+Protocol negotiation to server 10.81.148.220 (for a protocol between LANMAN1 and NT1) failed: NT_STATUS_INVALID_NETWORK_RESPONSE
+Unable to connect with SMB1 -- no workgroup available
+
+[+] Attempting to map shares on 10.81.148.220
+
+//10.81.148.220/print$	Mapping: DENIED Listing: N/A Writing: N/A
+//10.81.148.220/shares	Mapping: OK Listing: OK Writing: N/A
+
+[E] Can't understand response:
+
+NT_STATUS_OBJECT_NAME_NOT_FOUND listing \*
+//10.81.148.220/IPC$	Mapping: N/A Listing: N/A Writing: N/A
+
+ ===========================( Password Policy Information for 10.81.148.220 )===========================
+
+
+
+[+] Attaching to 10.81.148.220 using a NULL share
+
+[+] Trying protocol 139/SMB...
+
+[+] Found domain(s):
+
+	[+] IP-10-81-148-220
+	[+] Builtin
+
+[+] Password Info for Domain: IP-10-81-148-220
+
+	[+] Minimum password length: 5
+	[+] Password history length: None
+	[+] Maximum password age: 136 years 37 days 6 hours 21 minutes 
+	[+] Password Complexity Flags: 000000
+
+		[+] Domain Refuse Password Change: 0
+		[+] Domain Password Store Cleartext: 0
+		[+] Domain Password Lockout Admins: 0
+		[+] Domain Password No Clear Change: 0
+		[+] Domain Password No Anon Change: 0
+		[+] Domain Password Complex: 0
+
+	[+] Minimum password age: None
+	[+] Reset Account Lockout Counter: 30 minutes 
+	[+] Locked Account Duration: 30 minutes 
+	[+] Account Lockout Threshold: None
+	[+] Forced Log off Time: 136 years 37 days 6 hours 21 minutes 
+
+
+
+[+] Retieved partial password policy with rpcclient:
+
+
+Password Complexity: Disabled
+Minimum Password Length: 5
+
+
+ ======================================( Groups on 10.81.148.220 )======================================
+
+
+[+] Getting builtin groups:
+
+
+[+]  Getting builtin group memberships:
+
+
+[+]  Getting local groups:
+
+
+[+]  Getting local group memberships:
+
+
+[+]  Getting domain groups:
+
+
+[+]  Getting domain group memberships:
+
+
+ ==================( Users on 10.81.148.220 via RID cycling (RIDS: 500-550,1000-1050) )==================
+
+
+[I] Found new SID: 
+S-1-22-1
+
+[I] Found new SID: 
+S-1-5-32
+
+[I] Found new SID: 
+S-1-5-32
+
+[I] Found new SID: 
+S-1-5-32
+
+[I] Found new SID: 
+S-1-5-32
+
+[+] Enumerating users using SID S-1-5-32 and logon username '', password ''
+
+S-1-5-32-544 BUILTIN\Administrators (Local Group)
+S-1-5-32-545 BUILTIN\Users (Local Group)
+S-1-5-32-546 BUILTIN\Guests (Local Group)
+S-1-5-32-547 BUILTIN\Power Users (Local Group)
+S-1-5-32-548 BUILTIN\Account Operators (Local Group)
+S-1-5-32-549 BUILTIN\Server Operators (Local Group)
+S-1-5-32-550 BUILTIN\Print Operators (Local Group)
+
+[+] Enumerating users using SID S-1-5-21-4177045482-676087334-2392555964 and logon username '', password ''
+
+S-1-5-21-4177045482-676087334-2392555964-501 IP-10-81-148-220\nobody (Local User)
+S-1-5-21-4177045482-676087334-2392555964-513 IP-10-81-148-220\None (Domain Group)
+
+[+] Enumerating users using SID S-1-22-1 and logon username '', password ''
+
+S-1-22-1-1000 Unix User\sys-internal (Local User)
+S-1-22-1-1001 Unix User\ssm-user (Local User)
+S-1-22-1-1002 Unix User\ubuntu (Local User)
+
+ ===============================( Getting printer info for 10.81.148.220 )===============================
+
+No printers returned.
+
+
+enum4linux complete on Fri May  8 16:37:34 2026
+