Mist writeup
- ping to make sure box is alive
-
bash b7h30@kali:~/Documents/obsidian/docs/CTF/HTB/mist$ ping $IP PING 10.129.231.20 (10.129.231.20) 56(84) bytes of data. 64 bytes from 10.129.231.20: icmp_seq=1 ttl=127 time=32.6 ms 64 bytes from 10.129.231.20: icmp_seq=2 ttl=127 time=32.6 ms ^C --- 10.129.231.20 ping statistics --- 3 packets transmitted, 2 received, 33.3333% packet loss, time 2005ms rtt min/avg/max/mdev = 32.562/32.597/32.632/0.035 ms- ttl of 127 indicates a windows machine
-
nmap for open ports
- ```bash
b7h30@kali:~/Documents/obsidian/docs/CTF/HTB/mist$ nmap -p- --min-rate 3000 -Pn -oA nmap/mistNmapOpenPorts $IP
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-16 11:18 -0400 Nmap scan report for 10.129.231.20 Host is up (0.031s latency). Not shown: 65534 filtered tcp ports (no-response) PORT STATE SERVICE 80/tcp open http
``` - only 80 is open
- ```bash
b7h30@kali:~/Documents/obsidian/docs/CTF/HTB/mist$ nmap -p- --min-rate 3000 -Pn -oA nmap/mistNmapOpenPorts $IP
-
pulling out open ports
ports=$(awk '/^[0-9]+\/tcp/ {print $1}' nmap/mistNmapOpenPorts.nmap | cut -d/ -f1 | paste -sd,)
-
nmap for services and versions on those ports
- ```bashnmap -p$ports -sSCV --min-rate=2000 -Pn -oN nmap/mistNmapServicesVersions.txt $IP Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-16 11:21 -0400 Nmap scan report for 10.129.231.20 Host is up (0.030s latency).
PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1) | http-cookie-flags: | /: | PHPSESSID: | httponly flag not set | http-title: Mist - Mist |_Requested resource was http://10.129.231.20/?file=mist | http-robots.txt: 2 disallowed entries |/data/ /docs/ |_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1 |_http-generator: pluck 4.7.18
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.88 seconds
``
- 80 / http running Apache httpd2.4.52
- robots disallowing/data/ /docs/`
- pluck 4.7.18