Hack The Box: Overwatch
Enum: mairon $ rustscan -a 10.129.232.128 --ulimit 5000 -- -Pn -n -v --open -A -sCV | tee rustscan.txt .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Port scanning: Making networking exciting since... whenever. [~] The config file is expected to be at "/home/mairon/.rustscan.toml" [~] Automatically increasing ulimit value to 5000. Open 10.129.232.128:53 Open 10.129.232.128:88 Open 10.129.232.128:139 Open 10.129.232.128:135 Open 10.129.232.128:389 Open 10.129.232.128:445 Open 10.129.232.128:464 Open 10.129.232.128:593 Open 10.129.232.128:636 Open 10.129.232.128:3269 Open 10.129.232.128:3268 Open 10.129.232.128:5985 Open 10.129.232.128:6520 Open 10.129.232.128:9389 Open 10.129.232.128:49270 Open 10.129.232.128:49269 Open 10.129.232.128:49664 Open 10.129.232.128:49669 Open 10.129.232.128:51185 Open 10.129.232.128:59555 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -Pn -n -v --open -A -sCV" on ip 10.129.232.128 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.98 ( https://nmap.org ) at 2026-01-30 14:09 +0100 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 14:09 Completed NSE at 14:09, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 14:09 Completed NSE at 14:09, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 14:09 Completed NSE at 14:09, 0.00s elapsed Initiating Connect Scan at 14:09 Scanning 10.129.232.128 [20 ports] Discovered open port 135/tcp on 10.129.232.128 Discovered open port 445/tcp on 10.129.232.128 Discovered open port 139/tcp on 10.129.232.128 Discovered open port 49269/tcp on 10.129.232.128 Discovered open port 53/tcp on 10.129.232.128 Discovered open port 593/tcp on 10.129.232.128 Discovered open port 88/tcp on 10.129.232.128 Discovered open port 49669/tcp on 10.129.232.128 Discovered open port 6520/tcp on 10.129.232.128 Discovered open port 59555/tcp on 10.129.232.128 Discovered open port 464/tcp on 10.129.232.128 Discovered open port 51185/tcp on 10.129.232.128 Discovered open port 3268/tcp on 10.129.232.128 Discovered open port 9389/tcp on 10.129.232.128 Discovered open port 636/tcp on 10.129.232.128 Discovered open port 49270/tcp on 10.129.232.128 Discovered open port 3269/tcp on 10.129.232.128 Discovered open port 49664/tcp on 10.129.232.128 Discovered open port 389/tcp on 10.129.232.128 Discovered open port 5985/tcp on 10.129.232.128 Completed Connect Scan at 14:09, 0.02s elapsed (20 total ports) Initiating Service scan at 14:09 Scanning 20 services on 10.129.232.128 Completed Service scan at 14:10, 53.79s elapsed (20 services on 1 host) NSE: Script scanning 10.129.232.128. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 14:10 NSE Timing: About 99.96% done; ETC: 14:10 (0:00:00 remaining) Completed NSE at 14:11, 40.11s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 14:11 Completed NSE at 14:11, 0.61s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 14:11 Completed NSE at 14:11, 0.00s elapsed Nmap scan report for 10.129.232.128 Host is up, received user-set (0.012s latency). Scanned at 2026-01-30 14:09:32 CET for 95s PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack Simple DNS Plus 88/tcp open kerberos-sec syn-ack Microsoft Windows Kerberos (server time: 2026-01-30 13:09:39Z) 135/tcp open msrpc syn-ack Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: overwatch.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? syn-ack 464/tcp open kpasswd5? syn-ack 593/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped syn-ack 3268/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: overwatch.htb, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped syn-ack 5985/tcp open http syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 6520/tcp open ms-sql-s syn-ack Microsoft SQL Server 2022 16.00.1000.00; RTM | ms-sql-ntlm-info: | 10.129.232.128:6520: | Target_Name: OVERWATCH | NetBIOS_Domain_Name: OVERWATCH | NetBIOS_Computer_Name: S200401 | DNS_Domain_Name: overwatch.htb | DNS_Computer_Name: S200401.overwatch.htb | DNS_Tree_Name: overwatch.htb |_ Product_Version: 10.0.20348 | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Issuer: commonName=SSL_Self_Signed_Fallback | Public Key type: rsa | Public Key bits: 3072 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-01-30T13:07:29 | Not valid after: 2056-01-30T13:07:29 | MD5: 9826 167f cbfe db36 5da5 fd8e 9f1a c1f2 | SHA-1: 4872 b58e 57de 7612 b68f 6b1d 4115 5f8c 34b1 1ffb | SHA-256: 0e6b 5f94 f6fe 4eb1 1941 b8ae 695e 0236 36d1 14f6 606f fff2 9feb dbe6 bda1 5793 | -----BEGIN CERTIFICATE----- | MIIEADCCAmigAwIBAgIQYbYvmsvdZbhAzduf6y+mJjANBgkqhkiG9w0BAQsFADA7 | MTkwNwYDVQQDHjAAUwBTAEwAXwBTAGUAbABmAF8AUwBpAGcAbgBlAGQAXwBGAGEA | bABsAGIAYQBjAGswIBcNMjYwMTMwMTMwNzI5WhgPMjA1NjAxMzAxMzA3MjlaMDsx | OTA3BgNVBAMeMABTAFMATABfAFMAZQBsAGYAXwBTAGkAZwBuAGUAZABfAEYAYQBs | AGwAYgBhAGMAazCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKeGw0S2 | vd0ffVmPJqilh3YzYf7jsZ3gSzaE2V3X3+UL57L4oqHmU1Kc2J4zl5iroS0bufuu | pSf49BUJw4ih8rlVyjQpUh16kPDlVMekf+p32e1BdkjhkmvkHBWbfGna7qcLKg/p | qQjQw5se6rm64v0g/HdD5keTtXsn87W5y0jmHg8IuEncgR4WVKfpEX9gg5//zohx | Io4xE9d3O0X0zSGDkkWQq/BsBsrPfHy4x85k7hKPKyyvd56fQEGkGz9ogZgyMgqP | hqbxZ6uXHeViyKhlq8XbrITYmveUTijFi8ub8tockNkf9hHib3PbtjGhN97990XH | hUuO8+DyOCqQvvmPkFVvVaOFpMVh8jOpfLUzCxbXmHNYzYvroPlRyU2SG5XPwZMC | EcISGbZDtdQk5DFxPOeBHLh2K8DfXCjUtAvQFkh3mqGUQr0ZwYVdhzY7FB3Cr0d9 | +kkub0VMpAi+01//BYSqsfwQRsdg90Gq+XKiNt1BV5oh/NdSGTcNMtl4gQIDAQAB | MA0GCSqGSIb3DQEBCwUAA4IBgQCTJ6CQJUurIPrP3eOl96L7DgI/kkI23sZDCAim | f5JWuQWcR3uncpDA+97Z+yaQ4FYkb2lyFsUM8Jhh78eijUsh1UJhs9uuCpQr3fQm | ucbSkepGBuOJGtkrZlRO/ar6Pc2hUsJ0N+MJK79noMKxVzHm+x+0J+k5spq6SJW/ | QqT/uzHsSduOSt2m9s6DYlU3vaNXchLbIZVCqzaTdl7f/sbsjJLeTpkxml4n8Ct7 | vQjGCrPOV3JIkhv22zyfXN+5dAlDc/eYKpIyxnKpdBNGZI3GTroWxWt72u61fgcw | kRUiPmzZjzmZXMw1c1h3njtU1fp/iq1+otPIYB0wrEsOhNJ3qU4JuYQ2mzmqq5Vi | loLWBsNkb/PlFQvJWCrGNUI37sdtZGIk5aAAyiEikM7Ey/igMQYEKCQxNKAZwsnZ | TjWoR+NeJqCN1AzaVYGRLA+Xs+8/D2vowFwDqQ0/tty7fRs+aEWjuCaYY83niitV | y3Y8KkkewAL4hKc4HgAEV9K5EX8= |_-----END CERTIFICATE----- | ms-sql-info: | 10.129.232.128:6520: | Version: | name: Microsoft SQL Server 2022 RTM | number: 16.00.1000.00 | Product: Microsoft SQL Server 2022 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 6520 |_ssl-date: 2026-01-30T13:11:07+00:00; 0s from scanner time. 9389/tcp open mc-nmf syn-ack .NET Message Framing 49269/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0 49270/tcp open msrpc syn-ack Microsoft Windows RPC 49664/tcp open msrpc syn-ack Microsoft Windows RPC 49669/tcp open msrpc syn-ack Microsoft Windows RPC 51185/tcp open tcpwrapped syn-ack 59555/tcp open msrpc syn-ack Microsoft Windows RPC Service Info: Host: S200401; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2026-01-30T13:10:31 |_ start_date: N/A |_clock-skew: mean: 0s, deviation: 0s, median: 0s | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 55945/tcp): CLEAN (Timeout) | Check 2 (port 57027/tcp): CLEAN (Timeout) | Check 3 (port 30386/udp): CLEAN (Timeout) | Check 4 (port 44208/udp): CLEAN (Timeout) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 14:11 Completed NSE at 14:11, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 14:11 Completed NSE at 14:11, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 14:11 Completed NSE at 14:11, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 94.68 seconds ...