host discovery
$ nmap -sn 192.168.140.0/24
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-09-22 13:00 IST
Nmap scan report for 192.168.140.1
Host is up (0.00060s latency).
MAC Address: 00:50:56:C0:00:01 (VMware)
Nmap scan report for 192.168.140.128
Host is up (0.00016s latency).
MAC Address: 00:0C:29:04:D6:55 (VMware)
Nmap scan report for 192.168.140.129
Host is up (0.00030s latency).
MAC Address: 00:0C:29:04:D6:55 (VMware)
Nmap scan report for 192.168.140.254
Host is up (0.00015s latency).
MAC Address: 00:50:56:ED:EF:74 (VMware)
Nmap scan report for 192.168.140.130
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 14.99 seconds
of these ports the ctf box is assigned the ip 192.168.140.128 . which was set up on the vmware workstation during box setup with a host only network adapter.
the available open ports were these:
nmap -p- 192.168.140.128
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-09-22 13:01 IST
Nmap scan report for 192.168.140.128
Host is up (0.0021s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
5000/tcp open upnp
5355/tcp open llmnr
MAC Address: 00:0C:29:04:D6:55 (VMware)
─$ sudo nmap -p22,5000,5355 192.168.140.128 -sCV -A
Starting Nmap 7.95 ( <https://nmap.org> ) at 2025-09-22 13:06 IST
Nmap scan report for 192.168.140.128
Host is up (0.00089s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey:
| 256 e1:c6:00:a6:16:5b:78:82:cd:50:ae:35:57:03:84:41 (ECDSA)
|_ 256 42:97:49:52:c9:da:ad:5a:e7:eb:f3:7b:e8:87:06:7f (ED25519)
5000/tcp open http Werkzeug httpd 3.1.3 (Python 3.11.2)
|_http-server-header: Werkzeug/3.1.3 Python/3.11.2
|_http-title: R&D Portal
5355/tcp open llmnr?
MAC Address: 00:0C:29:04:D6:55 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 0.89 ms 192.168.140.128
OS and Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 164.87 seconds
a simple webpage is there with no links seem to be working and a dummy search bar . It seems like this page is a dead end.
using gobuster to find hidden directories:
gobuster dir -u <http://192.168.140.128:5000> -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: <http://192.168.140.128:5000>
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/page (Status: 200) [Size: 425]