NMAP1234567891011121314151617181920212223242526272829303132333435─$ sudo nmap -sU 10.10.11.187 --top-port=200 --min-rate=2000Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-07 00:41 ESTNmap scan report for 10.10.11.187Host is up (0.14s latency).Not shown: 197 open|filtered udp ports (no-response)PORT STATE SERVICE88/udp open kerberos-sec123/udp open ntp389/udp open ldap└─$ sudo nmap -sS 10.10.11.187 -p- --min-rate=2000Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-07 00:41...
Nmap12345678910111213141516171819202122232425262728293031323334353637└─$ sudo nmap -sS 10.10.10.248 -p- --min-rate=2000Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-02 23:57 ESTNmap scan report for 10.10.10.248Host is up (0.13s latency).Not shown: 65516 filtered tcp ports (no-response)PORT STATE SERVICE53/tcp open domain80/tcp open http88/tcp open kerberos-sec135/tcp open msrpc139/tcp open netbios-ssn389/tcp open ldap445/tcp open microsoft-ds464/tcp open...
解决了困扰了我很久的ldaps需要证书，和smb的krb认证连接问题
Nmap123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495010.10.11.168└─$ sudo nmap -sS 10.10.11.168 -p- --min-rate=2000Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-02 03:31 ESTStats: 0:00:36 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth ScanSYN Stealth Scan Timing: About 37.25% done; ETC: 03:33 (0:01:01 remaining)Stats: 0:01:38 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth ScanSYN ...
非常简单的一台适合纯新手阶段的ad机器
nmap123456789101112131415161718192021222324252627282930313233343536└─$ sudo nmap -sS 10.10.11.108 -p- --min-rate=3000 Nmap scan report for 10.10.11.108Host is up (7.9s latency).Not shown: 61510 filtered tcp ports (no-response), 4018 closed tcp ports (reset)PORT STATE SERVICE53/tcp open domain80/tcp open http135/tcp open msrpc139/tcp open netbios-ssn445/tcp open microsoft-ds49664/tcp open unknown49679/tcp open unknown└─$ sudo nmap -sU 10.10.11.108 ...
nmap123456789101112131415161718192021222324252627282930313233343536373839404110.10.11.158└─$ sudo nmap -sS 10.10.11.158 -p- --min-rate=2000[sudo] password for fonllge: Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-30 08:23 ESTNmap scan report for 10.10.11.158Host is up (0.11s latency).Not shown: 65516 filtered tcp ports (no-response)PORT STATE SERVICE53/tcp open domain80/tcp open http88/tcp open kerberos-sec135/tcp open msrpc139/tcp open netbios-ssn389/tcp ope...
nmap12345678910111213141516171819202122232425262728293031323334353637└─$ sudo nmap -sS 10.10.11.202 -p- --min-rate=2000[sudo] password for fonllge:Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-29 03:48 ESTNmap scan report for 10.10.11.202Host is up (0.18s latency).Not shown: 65516 filtered tcp ports (no-response)PORT STATE SERVICE53/tcp open domain88/tcp open kerberos-sec135/tcp open msrpc139/tcp open netbios-ssn389/tcp open ldap445/tcp open microsoft-ds464/tc...
nmap12345678910111213141516171819202122232425262728293031323334353637└─$ sudo nmap -sU 10.10.11.152 --top-ports=200 --min-rate=2000[sudo] password for fonllge:Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-28 01:35 ESTNmap scan report for 10.10.11.152Host is up (0.36s latency).Not shown: 196 open|filtered udp ports (no-response)PORT STATE SERVICE53/udp open domain88/udp open kerberos-sec123/udp open ntp389/udp open ldap└─$ sudo nmap -sS 10.10.11.152 -p- --min-rate=2000Starting...
Nmap1234567891011121314151617181920212223242526272829303132333435363738└─$ sudo nmap -sU 10.10.11.174 --top-ports=200 --min-rate=2000Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-24 01:46 ESTNmap scan report for 10.10.11.174Host is up (0.17s latency).Not shown: 196 open|filtered udp ports (no-response)PORT STATE SERVICE53/udp open domain88/udp open kerberos-sec123/udp open ntp389/udp open ldap└─$ sudo nmap -sS 10.10.11.174 -p- --min-rate=2000Starting Nmap 7.94SVN ( https://nm...
1这台机器因为流程不长，重点在后面部分，所以前面记录一下主要的转折点上的思路就跳过去了，后面的部分就稍微多写了写
nmap12345678910111213141516171819202122232425262728293031Not shown: 65330 closed tcp ports (reset), 176 filtered tcp ports (no-response)PORT STATE SERVICE53/tcp open domain80/tcp open http88/tcp open kerberos-sec135/tcp open msrpc139/tcp open netbios-ssn389/tcp open ldap445/tcp open microsoft-ds464/tcp open kpasswd5593/tcp open http-rpc-epmap636/tcp open ldapssl3268/tcp open globalcatLDAP3269/tc...