Welcome to the second challenge in our series.
I'm Josh Mason, your instructor again.
We have a console.
And we find our IP address is going to be 192.206.172.2.
And they tell us dot 3 is our target on this little network.
Dot 1 is our gateway.
It's pretty straightforward.
Let's make sure it's there.
It's responding.
Good.
Let's run our in-depth scans.
They tell us that the system administrator has
moved all of the services to ports 1 through 250,
but they're not in their standard location.
Their known location, their default location,
that's a better term for it.
So let's see if there's anything out there.
Oh, you can see 177.
Let's run an aggressive scan on 177.
And the aggressive scan is going to do the operating system
fingerprinting.
It's going to look for service information.
It's going to connect and try to grab a banner.
It's also going to run the default scripts.
And it's going to do a traceroute, which should just
be one hop at the gateway.
And we have our results back.
We see that port 177 has the the ISC BIND.
We're still looking for our TFTP and our SNMP.
And I see BIND is a DNS service, so I expect
there to be a UDP as well.
So we'll look for that.
So let's run our same scan again with the tag sU.
Because we know those three are going to be here.
And they didn't show up in TCP, so we'll check UDP.
And this scan can take a while.
So there's a good chance the video cuts and we end up
at the results.
All right, so we got our results back.
We've got three UDP ports, 134, 177, and 234.
So we will hone in on those three results
and do a service scan, only that U as well.
So it does the UDP ports, looking for that service.
Making sure I'm not missing anything
because we don't know which one's which.
I assume 177 is, again the BIND.
But we should test.
So we'll scan again.
Since we're only scanning those three ports,
it should go a little bit faster.
And we got our results back.
It looks like 134 is showing open and filtered.
We're not getting great info back from that.
We'll dive into that in a sec.
But 177 is showing that ISC BIND.
And 234 getting the SNMP.
So we could assume that that's the TFTP,
but I want to do one better.
Why is it having problems?
Let's dial in on that one.
And let's run some scripts.
It's like adding a tag SC--
in Rome, the discovery script or the discovery set of scripts.
See if there's something more that we're not getting.
OK, even with the discovery scan result coming back,
we still do you not have it showing us the service.
So let's try something.
We'll just do TFTP on port 134.
And it says we're connected.
OK.
Let's try that again.
Based off that usage right there, it didn't like my tag p.
It just wanted hostname and then port.
And so we did hostname and then port with that status.
And it says it's there.
With that, I will definitively say that port 134
is hosting the TFTP server.