1
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-17 00:34 EDT
2
Nmap scan report for 192.168.200.129
3
Host is up (0.00055s latency).
4
Not shown: 65507 filtered tcp ports (no-response), 19 filtered tcp ports (host-unreach)
5
PORT      STATE  SERVICE
6
22/tcp    open   ssh
7
80/tcp    open   http
8
137/tcp   closed netbios-ns
9
138/tcp   closed netbios-dgm
10
139/tcp   open   netbios-ssn
11
901/tcp   open   samba-swat
12
5900/tcp  closed vnc
13
8080/tcp  open   http-proxy
14
10000/tcp open   snet-sensor-mgmt
15
MAC Address: 00:0C:29:DF:B8:07 (VMware)
16

17
Nmap done: 1 IP address (1 host up) scanned in 13.43 seconds

1
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-17 00:37 EDT
2
Nmap scan report for 192.168.200.129
3
Host is up (0.00023s latency).
4

5
PORT      STATE SERVICE     VERSION
6
22/tcp    open  ssh         OpenSSH 5.3 (protocol 2.0)
7
| ssh-hostkey:
8
|   1024 41:8a:0d:5d:59:60:45:c4:c4:15:f3:8a:8d:c0:99:19 (DSA)
9
|_  2048 66:fb:a3:b4:74:72:66:f4:92:73:8f:bf:61:ec:8b:35 (RSA)
10
80/tcp    open  http        Apache httpd 2.2.15 ((CentOS))
11
|_http-server-header: Apache/2.2.15 (CentOS)
12
|_http-title: Mad Irish Hacking Academy
13
| http-cookie-flags:
14
|   /:
15
|     PHPSESSID:
16
|_      httponly flag not set
17
139/tcp   open  netbios-ssn Samba smbd 3.5.10-125.el6 (workgroup: MYGROUP)
18
901/tcp   open  http        Samba SWAT administration server
19
| http-auth:
20
| HTTP/1.0 401 Authorization Required\x0D
21
|_  Basic realm=SWAT
22
|_http-title: 401 Authorization Required
23
8080/tcp  open  http        Apache httpd 2.2.15 ((CentOS))
24
| http-cookie-flags:
25
|   /:
26
|     PHPSESSID:
27
|_      httponly flag not set
28
| http-title: Admin :: Mad Irish Hacking Academy
29
|_Requested resource was /login.php
30
|_http-open-proxy: Proxy might be redirecting requests
31
|_http-server-header: Apache/2.2.15 (CentOS)
32
10000/tcp open  http        MiniServ 1.610 (Webmin httpd)
33
| http-robots.txt: 1 disallowed entry
34
|_/
35
|_http-title: Login to Webmin
36
MAC Address: 00:0C:29:DF:B8:07 (VMware)
37
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
38
Device type: general purpose|router|storage-misc|media device|webcam
39
Running (JUST GUESSING): Linux 2.6.X|3.X|4.X|5.X (97%), MikroTik RouterOS 7.X (91%), Drobo embedded (89%), Synology DiskStation Manager 5.X (89%), LG embedded (88%), Tandberg embedded (88%)
40
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 cpe:/h:drobo:5n cpe:/a:synology:diskstation_manager:5.2
41
Aggressive OS guesses: Linux 2.6.32 - 3.13 (97%), Linux 2.6.32 - 3.10 (97%), Linux 2.6.32 - 2.6.39 (94%), Linux 2.6.32 - 3.5 (92%), Linux 3.2 (91%), Linux 3.2 - 3.16 (91%), Linux 3.2 - 3.8 (91%), Linux 2.6.32 (91%), Linux 3.10 - 4.11 (91%), Linux 3.2 - 4.14 (91%)
42
No exact OS matches for host (test conditions non-ideal).
43
Network Distance: 1 hop
44

45
Host script results:
46
| smb-os-discovery:
47
|   OS: Unix (Samba 3.5.10-125.el6)
48
|   Computer name: localhost
49
|   NetBIOS computer name:
50
|   Domain name:
51
|   FQDN: localhost
52
|_  System time: 2026-08-02T07:18:52-04:00
53
|_clock-skew: mean: -14d15h18m55s, deviation: 2h49m46s, median: -14d17h18m58s
54
|_smb2-time: Protocol negotiation failed (SMB2)
55
| smb-security-mode:
56
|   account_used: guest
57
|   authentication_level: user
58
|   challenge_response: supported
59
|_  message_signing: disabled (dangerous, but default)
60

61
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
62
Nmap done: 1 IP address (1 host up) scanned in 89.33 seconds

1
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-17 00:38 EDT
2
Nmap scan report for 192.168.200.129
3
Host is up (0.00022s latency).
4

5
PORT      STATE SERVICE
6
22/tcp    open  ssh
7
80/tcp    open  http
8
|_http-dombased-xss: Couldn't find any DOM based XSS.
9
| http-cookie-flags:
10
|   /:
11
|     PHPSESSID:
12
|_      httponly flag not set
13
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
14
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
15
| http-csrf:
16
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.200.129
17
|   Found the following possible CSRF vulnerabilities:
18
|
19
|     Path: http://192.168.200.129:80/signup
20
|     Form id: email
21
|_    Form action: /signup_scr
22
| http-fileupload-exploiter:
23
|
24
|     Couldn't find a file-type field.
25
|
26
|     Couldn't find a file-type field.
27
|
28
|     Couldn't find a file-type field.
29
|
30
|     Couldn't find a file-type field.
31
|
32
|_    Couldn't find a file-type field.
33
| http-slowloris-check:
34
|   VULNERABLE:
35
|   Slowloris DOS attack
36
|     State: LIKELY VULNERABLE
37
|     IDs:  CVE:CVE-2007-6750
38
|       Slowloris tries to keep many connections to the target web server open and hold
39
|       them open as long as possible.  It accomplishes this by opening connections to
40
|       the target web server and sending a partial request. By doing so, it starves
41
|       the http server's resources causing Denial Of Service.
42
|
43
|     Disclosure date: 2009-09-17
44
|     References:
45
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
46
|_      http://ha.ckers.org/slowloris/
47
|_http-trace: TRACE is enabled
48
| http-enum:
49
|   /webmail/: Mail folder
50
|   /css/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
51
|   /icons/: Potentially interesting folder w/ directory listing
52
|   /img/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
53
|   /inc/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
54
|   /js/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
55
|_  /webalizer/: Potentially interesting folder
56
139/tcp   open  netbios-ssn
57
901/tcp   open  samba-swat
58
8080/tcp  open  http-proxy
59
| http-cookie-flags:
60
|   /:
61
|     PHPSESSID:
62
|       httponly flag not set
63
|   /login.php:
64
|     PHPSESSID:
65
|_      httponly flag not set
66
|_http-trace: TRACE is enabled
67
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
68
| http-enum:
69
|   /login.php: Possible admin folder
70
|   /phpmyadmin/: phpMyAdmin
71
|   /docs/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
72
|   /icons/: Potentially interesting folder w/ directory listing
73
|_  /inc/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
74
10000/tcp open  snet-sensor-mgmt
75
MAC Address: 00:0C:29:DF:B8:07 (VMware)
76

77
Host script results:
78
| smb-vuln-regsvc-dos:
79
|   VULNERABLE:
80
|   Service regsvc in Microsoft Windows systems vulnerable to denial of service
81
|     State: VULNERABLE
82
|       The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference
83
|       pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes
84
|       while working on smb-enum-sessions.
85
|_
86
|_smb-vuln-ms10-061: false
87
| smb-vuln-cve2009-3103:
88
|   VULNERABLE:
89
|   SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
90
|     State: VULNERABLE
91
|     IDs:  CVE:CVE-2009-3103
92
|           Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2,
93
|           Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a
94
|           denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE
95
|           PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location,
96
|           aka "SMBv2 Negotiation Vulnerability."
97
|
98
|     Disclosure date: 2009-09-08
99
|     References:
100
|       http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
101
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
102
|_smb-vuln-ms10-054: false
103

104
Nmap done: 1 IP address (1 host up) scanned in 91.35 seconds