> For the complete documentation index, see [llms.txt](https://bunring.gitbook.io/ctf-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://bunring.gitbook.io/ctf-writeups/hack-the-box/2024/headless.md). # Headless {% embed url="" %} ## Recon Let's start with a simple nmap scan. {% code overflow="wrap" %} ``` ┌──(kali㉿kali)-[~] └─$ nmap -p- -T4 headless.htb Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-08 06:22 BST Nmap scan report for headless.htb (10.10.11.8) Host is up (0.040s latency). Not shown: 65533 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 5000/tcp open upnp Nmap done: 1 IP address (1 host up) scanned in 21.58 seconds ┌──(kali㉿kali)-[~] └─$ nmap -sC -sV -p 22,5000 -T4 headless.htb Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-08 06:24 BST Stats: 0:00:32 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan Service scan Timing: About 50.00% done; ETC: 06:25 (0:00:32 remaining) Stats: 0:00:32 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan Service scan Timing: About 50.00% done; ETC: 06:25 (0:00:32 remaining) Nmap scan report for headless.htb (10.10.11.8) Host is up (0.040s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0) | ssh-hostkey: | 256 90:02:94:28:3d:ab:22:74:df:0e:a3:b2:0f:2b:c6:17 (ECDSA) |_ 256 2e:b9:08:24:02:1b:60:94:60:b3:84:a9:9e:1a:60:ca (ED25519) 5000/tcp open upnp? | fingerprint-strings: | GetRequest: | HTTP/1.1 200 OK | Server: Werkzeug/2.2.2 Python/3.11.2 | Date: Mon, 08 Apr 2024 05:21:06 GMT | Content-Type: text/html; charset=utf-8 | Content-Length: 2799 | Set-Cookie: is_admin=InVzZXIi.uAlmXlTvm8vyihjNaPDWnvB_Zfs; Path=/ | Connection: close | | | | | | Under Construction |