HTB Write-Up: Haze
🧠 HTB Write-Up: Haze Difficulty: Hard OS: Linux Points: 30 Date: 2025-04-07 🔍 Reconnaissance 🔎 Nmap Scan Results Command Used: nmap -sV -sC 10.xx.xx.xx -v Target Host: 10.xx.xx.
🧠 HTB Write-Up: Haze Difficulty: Hard OS: Linux Points: 30 Date: 2025-04-07 🔍 Reconnaissance 🔎 Nmap Scan Results Command Used: nmap -sV -sC 10.xx.xx.xx -v Target Host: 10.xx.xx.
Nmap /usr/lib/nmap/nmap --privileged -sC -sV -Pn -oN ./nmap.txt 10.xx.xx.xx Nmap scan report for 10.xx.xx.xx Host is up (0.43s latency)
Recon #nmap nmap --top-ports 1000 -T4 [LAB_IP] --open -Pn -vvv PORT STATE SERVICE REASON 22/tcp open ssh syn-ack 80/tcp open http syn-ack 139/tcp open netbios-ssn syn-ack
Target is [LAB_IP] connecting via openvpn openvpn oscp.vpn [ ](https://www.prestonzen.com/publications/cybersecurity/oscp/linux/sunset-noontide#h.9ds2jjg2j16) Recon nmap -sC -sV -p- -vv [LAB_IP] PORT
Enumerate Looking for targets on subnet. Found [LAB_IP] ##Nmap Adding -O for OS detection in the field sudo nmap -sT -sV -sC -O --open -p- [LAB_IP] -oN sumo.
Enumeration Target IP given is: [LAB_IP] Got OpenVAS working just for fun via docker. Only able to check the services and their versions for CVE's. No deep
Potato company At the moment, there is nothing. This site is under construction. To make you wait, here is a photo of a potato: Login User: Password: Go to the
Prep set up nc -nlvp 4444 Enumeration Assume netdiscover + subnet ping scan Target: [LAB_IP] ##Nmap → nmap -p- -sV -sC --open -T4 [LAB_IP] -oN InfoSecPrep_nmap.txt 15:19:
Target is: [LAB_IP] nmap --top-ports 100 -sV [LAB_IP] -sC Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-13 04:19 EDT Nmap scan report for [LAB_IP] Host
OG Vulnhub box: https://www.vulnhub.com/entry/cybersploit-1,506/ Since target was given I don't have to run netdiscover to find target: Target is: [LAB_IP] $ nmap
\n\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x20\x20\x20\x20\x20 Er