Nmap scan report for 172.16.1.1 Host is up (0.00087s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http nginx |_http-title: Did not follow redirect to https://172.16.1.1/ 443/tcp open ssl/http nginx | tls-alpn: | h2 |_ http/1.1 | tls-nextprotoneg: | h2 |_ http/1.1 |_http-title: pfSense - Login |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=pfSense-5efcc658e3fe9/organizationName=pfSense webConfigurator Self-Signed Certificate | Subject Alternative Name: DNS:pfSense-5efcc658e3fe9 | Not valid before: 2020-07-01T17:22:33 |_Not valid after: 2025-12-22T17:22:33 MAC Address: A2:DE:AD:EC:8A:60 (Unknown) No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.95%E=4%D=8/15%OT=80%CT=1%CU=35746%PV=Y%DS=1%DC=D%G=Y%M=A2DEAD%T OS:M=6A80B973%P=x86_64-unknown-linux-gnu)SEQ(SP=103%GCD=1%ISR=108%TI=Z%CI=Z OS:%TS=20)SEQ(SP=105%GCD=1%ISR=106%TI=Z%CI=Z%TS=21)SEQ(SP=105%GCD=1%ISR=10C OS:%TI=Z%CI=Z%TS=20)SEQ(SP=106%GCD=1%ISR=10B%TI=Z%CI=Z%TS=22)SEQ(SP=FB%GCD= OS:1%ISR=106%TI=Z%CI=Z%TS=22)OPS(O1=M5B4NW7ST11%O2=M5B4NW7ST11%O3=M5B4NW7NN OS:T11%O4=M5B4NW7ST11%O5=M5B4NW7ST11%O6=M5B4ST11)WIN(W1=FECC%W2=FECC%W3=FEC OS:C%W4=FECC%W5=FECC%W6=FECC)ECN(R=Y%DF=Y%T=40%W=FECC%O=M5B4NW7SLL%CC=Y%Q=) OS:T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W= OS:0%S=A%A=S%F=AR%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=A%A=S+%F=AR%O=%RD=0%Q=) OS:T6(R=Y%DF=Y%T=40%W=0%S=A%A=S%F=AR%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=40%IPL OS:=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=N) Network Distance: 1 hop TRACEROUTE HOP RTT ADDRESS 1 0.87 ms 172.16.1.1 Nmap scan report for 172.16.1.5 Host is up (0.00073s latency). Not shown: 992 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp FileZilla ftpd | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_-r--r--r-- 1 ftp ftp 44 Jan 08 2021 flag.txt | ftp-syst: |_ SYST: UNIX emulated by FileZilla 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/tcp6 rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 2,3,4 111/udp6 rpcbind | 100003 2,3 2049/udp nfs | 100003 2,3 2049/udp6 nfs | 100003 2,3,4 2049/tcp nfs | 100003 2,3,4 2049/tcp6 nfs | 100005 1,2,3 2049/tcp mountd | 100005 1,2,3 2049/tcp6 mountd | 100005 1,2,3 2049/udp mountd | 100005 1,2,3 2049/udp6 mountd | 100021 1,2,3,4 2049/tcp nlockmgr | 100021 1,2,3,4 2049/tcp6 nlockmgr | 100021 1,2,3,4 2049/udp nlockmgr | 100021 1,2,3,4 2049/udp6 nlockmgr | 100024 1 2049/tcp status | 100024 1 2049/tcp6 status | 100024 1 2049/udp status |_ 100024 1 2049/udp6 status 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds 1433/tcp open ms-sql-s Microsoft SQL Server 2019 |_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug) | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2026-08-15T09:09:46 |_Not valid after: 2056-08-15T09:09:46 |_ssl-date: 2026-08-15T19:09:09+00:00; 0s from scanner time. |_ms-sql-info: ERROR: Script execution failed (use -d to debug) 2049/tcp open nlockmgr 1-4 (RPC #100021) 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 MAC Address: A2:DE:AD:89:C5:95 (Unknown) Device type: general purpose Running: Microsoft Windows 2016|2019 OS CPE: cpe:/o:microsoft:windows_server_2016 cpe:/o:microsoft:windows_server_2019 OS details: Microsoft Windows Server 2016 or Server 2019 Network Distance: 1 hop Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows Host script results: |_nbstat: NetBIOS name: DANTE-SQL01, NetBIOS user: , NetBIOS MAC: a2:de:ad:89:c5:95 (unknown) | smb2-time: | date: 2026-08-15T19:08:33 |_ start_date: 2026-08-15T09:09:37 | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) TRACEROUTE HOP RTT ADDRESS 1 0.73 ms 172.16.1.5 Nmap scan report for 172.16.1.10 Host is up (0.00052s latency). Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 5a:9c:1b:a5:c1:7f:2d:4f:4b:e8:cc:7b:e4:47:bc:a9 (RSA) | 256 fd:d6:3a:3f:a8:04:56:4c:e2:76:db:85:91:0c:5e:42 (ECDSA) |_ 256 e2:d5:17:7c:58:75:26:5b:e1:1b:98:39:3b:2c:6c:fc (ED25519) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Dante Hosting 139/tcp open netbios-ssn Samba smbd 4 445/tcp open netbios-ssn Samba smbd 4 MAC Address: A2:DE:AD:8F:23:D4 (Unknown) Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required |_nbstat: NetBIOS name: DANTE-NIX02, NetBIOS user: , NetBIOS MAC: (unknown) |_clock-skew: -21s | smb2-time: | date: 2026-08-15T19:08:08 |_ start_date: N/A TRACEROUTE HOP RTT ADDRESS 1 0.51 ms 172.16.1.10 Nmap scan report for 172.16.1.12 Host is up (0.00038s latency). Not shown: 995 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp | fingerprint-strings: | GenericLines: | 220 ProFTPD Server (ProFTPD) [::ffff:172.16.1.12] | Invalid command: try being more creative |_ Invalid command: try being more creative 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 22:cc:a3:e8:7d:d5:65:6d:9d:ea:17:d1:d9:1b:32:cb (RSA) | 256 04:fb:b6:1a:db:95:46:b7:22:13:61:24:76:80:1e:b8 (ECDSA) |_ 256 ae:c4:55:67:6e:be:ba:65:54:a3:c3:fc:08:29:24:0e (ED25519) 80/tcp open http Apache httpd 2.4.43 ((Unix) OpenSSL/1.1.1g PHP/7.4.7 mod_perl/2.0.11 Perl/v5.30.3) |_http-server-header: Apache/2.4.43 (Unix) OpenSSL/1.1.1g PHP/7.4.7 mod_perl/2.0.11 Perl/v5.30.3 | http-title: Welcome to XAMPP |_Requested resource was http://172.16.1.12/dashboard/ 443/tcp open ssl/http Apache httpd 2.4.43 ((Unix) OpenSSL/1.1.1g PHP/7.4.7 mod_perl/2.0.11 Perl/v5.30.3) | tls-alpn: |_ http/1.1 | ssl-cert: Subject: commonName=localhost/organizationName=Apache Friends/stateOrProvinceName=Berlin/countryName=DE | Not valid before: 2004-10-01T09:10:30 |_Not valid after: 2010-09-30T09:10:30 |_ssl-date: TLS randomness does not represent time |_http-server-header: Apache/2.4.43 (Unix) OpenSSL/1.1.1g PHP/7.4.7 mod_perl/2.0.11 Perl/v5.30.3 | http-title: Welcome to XAMPP |_Requested resource was https://172.16.1.12/dashboard/ 3306/tcp open mysql MariaDB 10.3.24 or later (unauthorized) 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port21-TCP:V=7.95%I=7%D=8/15%Time=6A80B8DE%P=x86_64-unknown-linux-gnu%r SF:(GenericLines,8F,"220\x20ProFTPD\x20Server\x20\(ProFTPD\)\x20\[::ffff:1 SF:72\.16\.1\.12\]\r\n500\x20Invalid\x20command:\x20try\x20being\x20more\x SF:20creative\r\n500\x20Invalid\x20command:\x20try\x20being\x20more\x20cre SF:ative\r\n"); MAC Address: A2:DE:AD:F2:18:5E (Unknown) Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.38 ms 172.16.1.12 Nmap scan report for 172.16.1.13 Host is up (0.00091s latency). Not shown: 997 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.7) | http-title: Welcome to XAMPP |_Requested resource was http://172.16.1.13/dashboard/ |_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.7 443/tcp open ssl/http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.7) |_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.7 |_ssl-date: TLS randomness does not represent time | http-title: Welcome to XAMPP |_Requested resource was https://172.16.1.13/dashboard/ | ssl-cert: Subject: commonName=localhost | Not valid before: 2009-11-10T23:48:47 |_Not valid after: 2019-11-08T23:48:47 | tls-alpn: |_ http/1.1 445/tcp open microsoft-ds? MAC Address: A2:DE:AD:F6:55:ED (Unknown) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 10|11|2019 (97%) OS CPE: cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_11 cpe:/o:microsoft:windows_server_2019 Aggressive OS guesses: Microsoft Windows 10 1803 (97%), Microsoft Windows 10 1903 - 21H1 (97%), Microsoft Windows 11 (92%), Microsoft Windows 10 1909 (91%), Microsoft Windows 10 1909 - 2004 (91%), Windows Server 2019 (91%), Microsoft Windows 10 1809 (91%), Microsoft Windows 10 20H2 (88%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required |_nbstat: NetBIOS name: DANTE-WS01, NetBIOS user: , NetBIOS MAC: a2:de:ad:f6:55:ed (unknown) | smb2-time: | date: 2026-08-15T19:08:30 |_ start_date: N/A TRACEROUTE HOP RTT ADDRESS 1 0.91 ms 172.16.1.13 Nmap scan report for 172.16.1.17 Host is up (0.00050s latency). Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.41 |_http-server-header: Apache/2.4.41 (Ubuntu) | http-ls: Volume / | SIZE TIME FILENAME | 376 2026-08-15 12:08 out.txt | 249K 2026-08-15 12:08 out2.txt | 249K 2026-08-15 12:08 r2.txt | 37M 2020-06-25 13:00 webmin-1.900.zip | - 2020-07-13 02:21 webmin/ |_ |_http-title: Index of / 139/tcp open netbios-ssn Samba smbd 4 445/tcp open netbios-ssn Samba smbd 4 10000/tcp open http MiniServ 1.900 (Webmin httpd) |_http-title: Login to Webmin | http-robots.txt: 1 disallowed entry |_/ MAC Address: A2:DE:AD:5B:DA:C9 (Unknown) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.19 Network Distance: 1 hop Service Info: Host: 127.0.0.1 Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb2-time: | date: 2026-08-15T19:08:33 |_ start_date: N/A |_nbstat: NetBIOS name: DANTE-NIX03, NetBIOS user: , NetBIOS MAC: (unknown) TRACEROUTE HOP RTT ADDRESS 1 0.50 ms 172.16.1.17 Nmap scan report for 172.16.1.19 Host is up (0.00055s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.41 |_http-title: Index of / |_http-server-header: Apache/2.4.41 (Ubuntu) 8080/tcp open http Jetty 9.4.27.v20200227 |_http-title: Site doesn't have a title (text/html;charset=utf-8). |_http-server-header: Jetty(9.4.27.v20200227) | http-robots.txt: 1 disallowed entry |_/ MAC Address: A2:DE:AD:5D:11:E1 (Unknown) Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) Network Distance: 1 hop Service Info: Host: 127.0.0.1 TRACEROUTE HOP RTT ADDRESS 1 0.55 ms 172.16.1.19 Nmap scan report for 172.16.1.20 Host is up (0.00042s latency). Not shown: 977 closed tcp ports (reset) Bug in http-title: no string output. Bug in http-title: no string output. PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH for_Windows_8.1 (protocol 2.0) | ssh-hostkey: | 3072 15:19:e6:66:c3:4f:f7:80:7e:48:f7:b9:9a:f9:ee:08 (RSA) | 256 f3:ea:12:b5:fa:b0:0c:14:fb:65:98:0f:09:92:5c:56 (ECDSA) |_ 256 42:ca:16:67:5a:e7:a2:01:b0:63:4b:f7:ed:55:db:90 (ED25519) 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 8.5 |_http-server-header: Microsoft-IIS/8.5 | http-methods: |_ Potentially risky methods: TRACE | http-robots.txt: 1 disallowed entry |_/ 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-08-15 19:06:51Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: DANTE.local, Site: Default-First-Site-Name) 443/tcp open ssl/http Microsoft IIS httpd 8.5 | ssl-cert: Subject: commonName=DANTE-DC01 | Subject Alternative Name: othername: | Not valid before: 2020-08-07T09:32:48 |_Not valid after: 2025-08-06T09:32:48 |_ssl-date: 2026-08-15T19:08:47+00:00; -21s from scanner time. |_http-server-header: Microsoft-IIS/8.5 | http-methods: |_ Potentially risky methods: TRACE | http-robots.txt: 1 disallowed entry |_/ 445/tcp open microsoft-ds Windows Server 2012 R2 Standard 9600 microsoft-ds (workgroup: DANTE) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ldapssl? 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: DANTE.local, Site: Default-First-Site-Name) 3269/tcp open globalcatLDAPssl? 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2026-08-15T19:08:48+00:00; -21s from scanner time. | ssl-cert: Subject: commonName=DANTE-DC01.DANTE.local | Not valid before: 2026-08-14T09:06:47 |_Not valid after: 2027-02-13T09:06:47 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49155/tcp open msrpc Microsoft Windows RPC 49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49158/tcp open msrpc Microsoft Windows RPC 49159/tcp open msrpc Microsoft Windows RPC MAC Address: A2:DE:AD:74:7B:1E (Unknown) Device type: general purpose Running: Microsoft Windows 2012|7|8.1 OS CPE: cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_7:::ultimate cpe:/o:microsoft:windows_8.1 OS details: Microsoft Windows Server 2012 or 2012 R2, Microsoft Windows Server 2012 R2 Update 1, Microsoft Windows 7, Windows Server 2012, or Windows 8.1 Update 1 Network Distance: 1 hop Service Info: Host: DANTE-DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb-os-discovery: | OS: Windows Server 2012 R2 Standard 9600 (Windows Server 2012 R2 Standard 6.3) | OS CPE: cpe:/o:microsoft:windows_server_2012::- | Computer name: DANTE-DC01 | NetBIOS computer name: DANTE-DC01\x00 | Domain name: DANTE.local | Forest name: DANTE.local | FQDN: DANTE-DC01.DANTE.local |_ System time: 2026-08-15T20:08:11+01:00 |_clock-skew: mean: -12m19s, deviation: 26m45s, median: -21s | smb2-time: | date: 2026-08-15T19:08:12 |_ start_date: 2026-08-15T09:09:07 |_nbstat: NetBIOS name: DANTE-DC01, NetBIOS user: , NetBIOS MAC: a2:de:ad:74:7b:1e (unknown) | smb-security-mode: | account_used: | authentication_level: user | challenge_response: supported |_ message_signing: required | smb2-security-mode: | 3:0:2: |_ Message signing enabled and required TRACEROUTE HOP RTT ADDRESS 1 0.42 ms 172.16.1.20 Nmap scan report for 172.16.1.101 Host is up (0.00060s latency). Not shown: 995 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp FileZilla ftpd 0.9.60 beta | ftp-syst: |_ SYST: UNIX emulated by FileZilla 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found MAC Address: A2:DE:AD:47:5A:A0 (Unknown) Device type: general purpose Running: Microsoft Windows 10 OS CPE: cpe:/o:microsoft:windows_10 OS details: Microsoft Windows 10 1709 - 21H2 Network Distance: 1 hop Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2026-08-15T19:08:34 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required |_nbstat: NetBIOS name: DANTE-WS02, NetBIOS user: , NetBIOS MAC: a2:de:ad:47:5a:a0 (unknown) TRACEROUTE HOP RTT ADDRESS 1 0.60 ms 172.16.1.101 Nmap scan report for 172.16.1.102 Host is up (0.00068s latency). Not shown: 992 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.54 ((Win64) OpenSSL/1.1.1p PHP/7.4.0) |_http-server-header: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.0 |_http-title: Dante Marriage Registration System :: Home Page 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 443/tcp open ssl/http Apache httpd 2.4.54 ((Win64) OpenSSL/1.1.1p PHP/7.4.0) | ssl-cert: Subject: commonName=localhost/organizationName=TESTING CERTIFICATE | Subject Alternative Name: DNS:localhost | Not valid before: 2022-06-24T01:07:25 |_Not valid after: 2022-12-24T01:07:25 |_ssl-date: TLS randomness does not represent time |_http-title: Dante Marriage Registration System :: Home Page |_http-server-header: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.0 | tls-alpn: | h2 |_ http/1.1 445/tcp open microsoft-ds? 3306/tcp open mysql MySQL (unauthorized) 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2026-08-15T19:09:09+00:00; +1s from scanner time. | ssl-cert: Subject: commonName=DANTE-WS03 | Not valid before: 2026-08-14T09:06:19 |_Not valid after: 2027-02-13T09:06:19 | rdp-ntlm-info: | Target_Name: DANTE-WS03 | NetBIOS_Domain_Name: DANTE-WS03 | NetBIOS_Computer_Name: DANTE-WS03 | DNS_Domain_Name: DANTE-WS03 | DNS_Computer_Name: DANTE-WS03 | Product_Version: 10.0.19041 |_ System_Time: 2026-08-15T19:08:26+00:00 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found MAC Address: A2:DE:AD:30:8A:D0 (Unknown) Device type: general purpose Running: Microsoft Windows 10 OS CPE: cpe:/o:microsoft:windows_10 OS details: Microsoft Windows 10 1709 - 21H2 Network Distance: 1 hop Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required |_nbstat: NetBIOS name: DANTE-WS03, NetBIOS user: , NetBIOS MAC: a2:de:ad:30:8a:d0 (unknown) | smb2-time: | date: 2026-08-15T19:08:35 |_ start_date: N/A TRACEROUTE HOP RTT ADDRESS 1 0.68 ms 172.16.1.102 Nmap scan report for 172.16.1.100 Host is up (0.000094s latency). Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:172.16.1.100 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 1 | vsFTPd 3.0.3 - secure, fast, stable |_End of status | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_drwxr-xr-x 4 0 0 4096 Apr 14 2021 Transfer 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 8f:a2:ff:cf:4e:3e:aa:2b:c2:6f:f4:5a:2a:d9:e9:da (RSA) | 256 07:83:8e:b6:f7:e6:72:e9:65:db:42:fd:ed:d6:93:ee (ECDSA) |_ 256 13:45:c5:ca:db:a6:b4:ae:9c:09:7d:21:cd:9d:74:f4 (ED25519) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works | http-robots.txt: 2 disallowed entries |_/wordpress DANTE{Y0u_Cant_G3t_at_m3_br0!} 65000/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works | http-robots.txt: 2 disallowed entries |_/wordpress DANTE{Y0u_Cant_G3t_at_m3_br0!} Device type: general purpose Running: Linux 2.6.X|5.X OS CPE: cpe:/o:linux:linux_kernel:2.6.32 cpe:/o:linux:linux_kernel:5 cpe:/o:linux:linux_kernel:6 OS details: Linux 2.6.32, Linux 5.0 - 6.2 Network Distance: 0 hops Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel Post-scan script results: | clock-skew: | -12m19s: | 172.16.1.20 | 172.16.1.10 | 0s: | 172.16.1.17 | 172.16.1.102 | 172.16.1.101 | 172.16.1.13 |_ 172.16.1.5 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 256 IP addresses (11 hosts up) scanned in 531.09 seconds