Skip to main content
XsiSec.com
HomeReposBlogProjectsPortfolio
© 2026 XsiSec.com
Security rules |security.txt
Updated 2026-08-15 · v1.0.0+2026-08-14.82f92cb · 82f92cb
← Back to overview
Security article

HTB Academy - Service Enumeration

HTB Academy - Service Enumeration: Enumerate all ports/services on the host and extract the flag exposed by one of the services. • HTB Academy • htb-academy, module19

2022-10-243 tags
Tags

🎯 Objective

Enumerate all ports/services on the host and extract the flag exposed by one of the services.

Target: 10.129.204.110


🧭 Service Enumeration

1) Full version detection (initial pass)

bash
nmap -vv -A 10.129.204.110

Findings (key lines):

text
22/tcp   open  ssh       OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux)
80/tcp   open  http      Apache httpd 2.4.18 ((Ubuntu))
110/tcp  open  pop3      Dovecot pop3d
139/tcp  open  netbios-ssn  Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp  open  imap      Dovecot imapd
445/tcp  open  microsoft-ds  Samba smbd 4.3.11-Ubuntu
31337/tcp open  Elite?

This matches a lean Ubuntu host with standard services plus an unusual high port 31337 labelled Elite? by Nmap.

2) Port sweep (confirming exposure)

bash
sudo nmap 10.129.204.110 -sS

Result (excerpt):

text
22/tcp open ssh
80/tcp open http
110/tcp open pop3
139/tcp open netbios-ssn
143/tcp open imap
445/tcp open microsoft-ds
31337/tcp open Elite

🔎 Banner grab on the odd port (31337)

Given the ambiguous service label, I banner‑grabbed with netcat:

bash
nc -nv 10.129.204.110 31337

Server replied like an FTP‑style banner (code 220), revealing the flag:

text
220 HTB{pr0F7pDv3r510nb4nn3r}
500 CAT not understood
500 LS not understood

The 500 responses indicate unknown commands—consistent with an FTP‑like protocol handler on a non‑standard port.


✅ Flag

text
HTB{pr0F7pDv3r510nb4nn3r}

🧾 Commands Recap

bash
# Aggressive service/version detection
nmap -vv -A 10.129.204.110

# SYN scan confirmation
sudo nmap 10.129.204.110 -sS

# Banner grab on the suspicious high port
nc -nv 10.129.204.110 31337

Takeaway: after standard ports are mapped, always poke odd/high ports—banner strings frequently leak flags or sensitive info.

Navigate

In this post

  1. 01🎯 Objective
  2. 02🧭 Service Enumeration
  3. 031) Full version detection (initial pass)
  4. 042) Port sweep (confirming exposure)
  5. 05🔎 Banner grab on the odd port (31337)
  6. 06✅ Flag
  7. 07🧾 Commands Recap
Search
Explore

Popular tags

Browse all 30 tags

Comments

0 comments

No comments yet — be the first to comment.