HTB Academy - Service Enumeration
HTB Academy - Service Enumeration: Enumerate all ports/services on the host and extract the flag exposed by one of the services. • HTB Academy • htb-academy, module19
🎯 Objective
Enumerate all ports/services on the host and extract the flag exposed by one of the services.
Target: 10.129.204.110
🧭 Service Enumeration
1) Full version detection (initial pass)
nmap -vv -A 10.129.204.110Findings (key lines):
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
110/tcp open pop3 Dovecot pop3d
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp open imap Dovecot imapd
445/tcp open microsoft-ds Samba smbd 4.3.11-Ubuntu
31337/tcp open Elite?This matches a lean Ubuntu host with standard services plus an unusual high port 31337 labelled Elite? by Nmap.
2) Port sweep (confirming exposure)
sudo nmap 10.129.204.110 -sSResult (excerpt):
22/tcp open ssh
80/tcp open http
110/tcp open pop3
139/tcp open netbios-ssn
143/tcp open imap
445/tcp open microsoft-ds
31337/tcp open Elite🔎 Banner grab on the odd port (31337)
Given the ambiguous service label, I banner‑grabbed with netcat:
nc -nv 10.129.204.110 31337Server replied like an FTP‑style banner (code 220), revealing the flag:
220 HTB{pr0F7pDv3r510nb4nn3r}
500 CAT not understood
500 LS not understoodThe 500 responses indicate unknown commands—consistent with an FTP‑like protocol handler on a non‑standard port.
✅ Flag
HTB{pr0F7pDv3r510nb4nn3r}🧾 Commands Recap
# Aggressive service/version detection
nmap -vv -A 10.129.204.110
# SYN scan confirmation
sudo nmap 10.129.204.110 -sS
# Banner grab on the suspicious high port
nc -nv 10.129.204.110 31337Takeaway: after standard ports are mapped, always poke odd/high ports—banner strings frequently leak flags or sensitive info.