HTB Academy - Firewall and IDS/IPS Evasion - Hard Lab

With our second test's help, our client was able to gain new insights and sent one of its administrators to a training course for IDS/IPS systems.

As our client told us, the training would last one week. Now the administrator has taken all the necessary precautions and wants us to test this again because specific services must be changed, and the communication for the provided software had to be modified.

Now our client wants to know if it is possible to find out the version of the running services. Submit the version of the service our client was talking about as the answer.

🎯 Objective

Re-run web enumeration to identify the exact version of the service your client cares about (DNS on port 53), after they updated protections post IDS/IPS training. Deliver the precise version string as the answer.

Targets seen in notes: 10.129.46.67, 10.129.148.17 (also mentioned port 50000).

🧭 What I tried first (context)

Initial attempts (various breadth scans / scripts):

nmap -sV 10.129.46.67
nmap 10.129.46.67 -A -p-
sudo nmap 10.129.46.67 -A -p-
sudo nmap -sSU -p 53 --script dns-nsid 10.129.46.67
nmap -v -sV -p- -Pn -n --disable-arp-ping --source-port 53 10.129.46.67
# earlier: sudo nmap -nv -p 53,50000 10.129.148.17

These confirmed DNS on 53/udp (and possibly 53/tcp). To pull the version string, I pivoted to CHAOS/TXT queries and focused service detection.

⚡ Quick win: CHAOS/TXT banner (UDP & TCP)

Ask the resolver for its own version via the legacy CHAOS class:

# UDP
dig @10.129.46.67 -p 53 CHAOS TXT version.bind +short
dig @10.129.46.67 -p 53 CHAOS TXT hostname.bind +short
dig @10.129.46.67 -p 53 CHAOS TXT id.server +short

# TCP (in case UDP is filtered/fragged or truncated)
dig +tcp @10.129.46.67 -p 53 CHAOS TXT version.bind +short

Examples of real outputs (submit exactly what you see):

• "BIND 9.16.48-1~deb12u1-Debian"
• "dnsmasq-2.86"
• "PowerDNS Authoritative Server 4.8.3"

If version.bind is disabled, sometimes hostname.bind/id.server still respond and hint at product/version.

🔍 Nmap service detection (UDP + TCP)

Use targeted detection and helpful DNS NSE scripts:

# UDP 53
sudo nmap -sU -sV -p53 --version-all   --script=dns-nsid,dns-recursion,dns-zone-transfer   10.129.46.67

# Also check TCP 53
sudo nmap -sT -sV -p53 --version-all 10.129.46.67

Look for lines like:

53/udp  open  domain   ISC BIND 9.11.3
53/udp  open  domain   dnsmasq 2.80
53/udp  open  domain   PowerDNS Authoritative Server 4.8.3

If dns-nsid prints an NSID or banner, include that, too.

🧗 If there’s also a high port (e.g., 50000)

If your earlier recon suggests 50000/tcp is up, scan and banner-grab it:

sudo nmap -sSV -p53,50000 --version-all 10.129.148.17
nc -v 10.129.148.17 50000
curl -I http://10.129.148.17:50000 || true

Sometimes management UIs expose additional version info.

🧾 One‑liners recap

# CHAOS class (UDP + TCP)
dig @10.129.46.67 -p 53 CHAOS TXT version.bind +short
dig +tcp @10.129.46.67 -p 53 CHAOS TXT version.bind +short

# Nmap with DNS scripts
sudo nmap -sU -sV -p53 --script=dns-nsid,dns-recursion,dns-zone-transfer 10.129.46.67
sudo nmap -sT -sV -p53 10.129.46.67

✅ What to submit

Paste the exact version string returned by CHAOS/TXT or Nmap service detection. For example:

BIND 9.16.48-1~deb12u1-Debian

If multiple targets respond, submit the one that matches the service your client referenced in their request (DNS on 53). If nothing returns for CHAOS, fall back to the Nmap -sU -sV output line.

Drop your command output here if you want me to extract and format the final answer verbatim.