# Service Exlpoitation

## Network Enumeration

### Enumeration

#### Host Discovery

*   **Command**:

    ```bash
    sudo nmap -O 10.129.228.63
    ```

    * **Result**: OS fingerprinting indicates the target operating system.

#### Port Scanning

*   **Command**:

    ```bash
    sudo nmap -p- 10.129.228.63
    ```

    * **Result**: Open ports include 22, 80, 110, 139, 143, 445, and 31337.

#### Service Enumeration

*   **Command**:

    ```bash
    sudo nmap -sV -p31337 10.129.228.63
    ```

    * **Result**: Banner reveals the flag.

#### NSE Scripts

*   **Command**:

    ```bash
    sudo nmap -p80 --script vuln 10.129.228.63
    ```

    * **Result**: `/robots.txt` detected with the flag.

#### Export Results to HTML

*   **Command**:

    ```bash
    xsltproc nmap.xml -o nmap.html
    ```

    * **Result**: Report generated as `nmap.html`.

### Privilege Update

#### Bypass IDS/IPS

*   **Command**:

    ```bash
    sudo nmap -sV -Pn -p80 10.129.22.245
    ```

    * **Result**: Detected Apache HTTPD version.
