┌──(operator@kali)-[~/writeup]
└─$ cat 01_session.log
session log (part 1)
┌──(operator@kali)-[~/writeup]
└─$ cat 02_port_scan.log
session log (part 2: 2500-4500 scan)
└─$ nmap -p2500-4500 -O 10.10.151.140
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-01 20:01 UTC
Stats: 0:00:38 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 11.07% done; ETC: 20:06 (0:04:41 remaining)
Nmap scan report for 10.10.151.140
Host is up (0.64s latency).
PORT STATE SERVICE
2500/tcp open rtsserv
2501/tcp open rtsclient
2502/tcp open kentrox-prot
2503/tcp open nms-dpnss
2504/tcp open wlbs
2505/tcp open ppcontrol
2506/tcp open jbroker
2507/tcp open spock
2508/tcp open jdatastore
2509/tcp open fjmpss
2510/tcp open fjappmgrbulk
2511/tcp open metastorm
2512/tcp open citrixima
2513/tcp open citrixadmin
2514/tcp open facsys-ntp
2515/tcp open facsys-router
2516/tcp open maincontrol
2517/tcp open call-sig-trans
2518/tcp open willy
2519/tcp open globmsgsvc
2520/tcp open pvsw
2521/tcp open adaptecmgr
2522/tcp open windb
2523/tcp open qke-llc-v3
2524/tcp open optiwave-lm
2525/tcp open ms-v-worlds
2526/tcp open ema-sent-lm
2527/tcp open iqserver
2528/tcp open ncr_ccl
2529/tcp open utsftp
2530/tcp open vrcommerce
2531/tcp open ito-e-gui
2532/tcp open ovtopmd
2533/tcp open snifferserver
2534/tcp open combox-web-acc
2535/tcp open madcap
2536/tcp open btpp2audctr1
2537/tcp open upgrade
2538/tcp open vnwk-prapi
2539/tcp open vsiadmin
2540/tcp open lonworks
2541/tcp open lonworks2
2542/tcp open udrawgraph
2543/tcp open reftek
2544/tcp open novell-zen
2545/tcp open sis-emt
2546/tcp open vytalvaultbrtp
2547/tcp open vytalvaultvsmp
2548/tcp open vytalvaultpipe
2549/tcp open ipass
2550/tcp open ads
2551/tcp open isg-uda-server
2552/tcp open call-logging
2553/tcp open efidiningport
2554/tcp open vcnet-link-v10
2555/tcp open compaq-wcp
2556/tcp open nicetec-nmsvc
2557/tcp open nicetec-mgmt
2558/tcp open pclemultimedia
2559/tcp open lstp
2560/tcp open labrat
2561/tcp open mosaixcc
2562/tcp open delibo
2563/tcp open cti-redwood
2564/tcp open hp-3000-telnet
2565/tcp open coord-svr
2566/tcp open pcs-pcw
2567/tcp open clp
2568/tcp open spamtrap
2569/tcp open sonuscallsig
2570/tcp open hs-port
2571/tcp open cecsvc
2572/tcp open ibp
2573/tcp open trustestablish
2574/tcp open blockade-bpsp
2575/tcp open hl7
2576/tcp open tclprodebugger
2577/tcp open scipticslsrvr
2578/tcp open rvs-isdn-dcp
2579/tcp open mpfoncl
2580/tcp open tributary
2581/tcp open argis-te
2582/tcp open argis-ds
2583/tcp open mon
2584/tcp open cyaserv
2585/tcp open netx-server
2586/tcp open netx-agent
2587/tcp open masc
2588/tcp open privilege
2589/tcp open quartus-tcl
2590/tcp open idotdist
2591/tcp open maytagshuffle
2592/tcp open netrek
2593/tcp open mns-mail
2594/tcp open dts
2595/tcp open worldfusion1
2596/tcp open worldfusion2
2597/tcp open homesteadglory
2598/tcp open citriximaclient
2599/tcp open snapd
2600/tcp open zebrasrv
2601/tcp open zebra
2602/tcp open ripd
2603/tcp open ripngd
2604/tcp open ospfd
2605/tcp open bgpd
2606/tcp open netmon
2607/tcp open connection
2608/tcp open wag-service
2609/tcp open system-monitor
2610/tcp open versa-tek
2611/tcp open lionhead
2612/tcp open qpasa-agent
2613/tcp open smntubootstrap
2614/tcp open neveroffline
2615/tcp open firepower
2616/tcp open appswitch-emp
2617/tcp open cmadmin
2618/tcp open priority-e-com
2619/tcp open bruce
2620/tcp open lpsrecommender
2621/tcp open miles-apart
2622/tcp open metricadbc
2623/tcp open lmdp
2624/tcp open aria
2625/tcp open blwnkl-port
2626/tcp open gbjd816
2627/tcp open webster
2628/tcp open dict
2629/tcp open sitaraserver
2630/tcp open sitaramgmt
2631/tcp open sitaradir
2632/tcp open irdg-post
2633/tcp open interintelli
2634/tcp open pk-electronics
2635/tcp open backburner
2636/tcp open solve
2637/tcp open imdocsvc
2638/tcp open sybase
2639/tcp open aminet
2640/tcp open sai_sentlm
2641/tcp open hdl-srv
2642/tcp open tragic
2643/tcp open gte-samp
2644/tcp open travsoft-ipx-t
2645/tcp open novell-ipx-cmd
2646/tcp open and-lm
2647/tcp open syncserver
2648/tcp open upsnotifyprot
2649/tcp open vpsipport
2650/tcp open eristwoguns
2651/tcp open ebinsite
2652/tcp open interpathpanel
2653/tcp open sonus
2654/tcp open corel_vncadmin
2655/tcp open unglue
2656/tcp open kana
2657/tcp open sns-dispatcher
2658/tcp open sns-admin
2659/tcp open sns-query
2660/tcp open gcmonitor
2661/tcp open olhost
2662/tcp open bintec-capi
2663/tcp open bintec-tapi
2664/tcp open patrol-mq-gm
2665/tcp open patrol-mq-nm
2666/tcp open extensis
2667/tcp open alarm-clock-s
2668/tcp open alarm-clock-c
2669/tcp open toad
2670/tcp open tve-announce
2671/tcp open newlixreg
2672/tcp open nhserver
2673/tcp open firstcall42
2674/tcp open ewnn
2675/tcp open ttc-etap
2676/tcp open simslink
2677/tcp open gadgetgate1way
2678/tcp open gadgetgate2way
2679/tcp open syncserverssl
2680/tcp open pxc-sapxom
2681/tcp open mpnjsomb
2682/tcp open unknown
2683/tcp open ncdloadbalance
2684/tcp open mpnjsosv
2685/tcp open mpnjsocl
2686/tcp open mpnjsomg
2687/tcp open pq-lic-mgmt
2688/tcp open md-cg-http
2689/tcp open fastlynx
2690/tcp open hp-nnm-data
2691/tcp open itinternet
2692/tcp open admins-lms
2693/tcp open unknown
2694/tcp open pwrsevent
2695/tcp open vspread
2696/tcp open unifyadmin
2697/tcp open oce-snmp-trap
2698/tcp open mck-ivpip
2699/tcp open csoft-plusclnt
2700/tcp open tqdata
2701/tcp open sms-rcinfo
2702/tcp open sms-xfer
2703/tcp open sms-chat
2704/tcp open sms-remctrl
2705/tcp open sds-admin
2706/tcp open ncdmirroring
2707/tcp open emcsymapiport
2708/tcp open banyan-net
2709/tcp open supermon
2710/tcp open sso-service
2711/tcp open sso-control
2712/tcp open aocp
2713/tcp open raventbs
2714/tcp open raventdm
2715/tcp open hpstgmgr2
2716/tcp open inova-ip-disco
2717/tcp open pn-requester
2718/tcp open pn-requester2
2719/tcp open scan-change
2720/tcp open wkars
2721/tcp open smart-diagnose
2722/tcp open proactivesrvr
2723/tcp open watchdog-nt
2724/tcp open qotps
2725/tcp open msolap-ptp2
2726/tcp open tams
2727/tcp open mgcp-callagent
2728/tcp open sqdr
2729/tcp open tcim-control
2730/tcp open nec-raidplus
2731/tcp open fyre-messanger
2732/tcp open g5m
2733/tcp open signet-ctf
2734/tcp open ccs-software
2735/tcp open netiq-mc
2736/tcp open radwiz-nms-srv
2737/tcp open srp-feedback
2738/tcp open ndl-tcp-ois-gw
2739/tcp open tn-timing
2740/tcp open alarm
2741/tcp open tsb
2742/tcp open tsb2
2743/tcp open murx
2744/tcp open honyaku
2745/tcp open urbisnet
2746/tcp open cpudpencap
2747/tcp open fjippol-swrly
2748/tcp open fjippol-polsvr
2749/tcp open fjippol-cnsl
2750/tcp open fjippol-port1
2751/tcp open fjippol-port2
2752/tcp open rsisysaccess
2753/tcp open de-spot
2754/tcp open apollo-cc
2755/tcp open expresspay
2756/tcp open simplement-tie
2757/tcp open cnrp
2758/tcp open apollo-status
2759/tcp open apollo-gms
2760/tcp open sabams
2761/tcp open dicom-iscl
2762/tcp open dicom-tls
2763/tcp open desktop-dna
2764/tcp open data-insurance
2765/tcp open qip-audup
2766/tcp open listen
2767/tcp open uadtc
2768/tcp open uacs
2769/tcp open exce
2770/tcp open veronica
2771/tcp open vergencecm
2772/tcp open auris
2773/tcp open rbakcup1
2774/tcp open rbakcup2
2775/tcp open smpp
2776/tcp open ridgeway1
2777/tcp open ridgeway2
2778/tcp open gwen-sonya
2779/tcp open lbc-sync
2780/tcp open lbc-control
2781/tcp open whosells
2782/tcp open everydayrc
2783/tcp open aises
2784/tcp open www-dev
2785/tcp open aic-np
2786/tcp open aic-oncrpc
2787/tcp open piccolo
2788/tcp open fryeserv
2789/tcp open media-agent
2790/tcp open plgproxy
2791/tcp open mtport-regist
2792/tcp open f5-globalsite
2793/tcp open initlsmsad
2794/tcp open unknown
2795/tcp open livestats
2796/tcp open ac-tech
2797/tcp open esp-encap
2798/tcp open tmesis-upshot
2799/tcp open icon-discover
2800/tcp open acc-raid
2801/tcp open igcp
2802/tcp open veritas-tcp1
2803/tcp open btprjctrl
2804/tcp open dvr-esm
2805/tcp open wta-wsp-s
2806/tcp open cspuni
2807/tcp open cspmulti
2808/tcp open j-lan-p
2809/tcp open corbaloc
2810/tcp open netsteward
2811/tcp open gsiftp
2812/tcp open atmtcp
2813/tcp open llm-pass
2814/tcp open llm-csv
2815/tcp open lbc-measure
2816/tcp open lbc-watchdog
2817/tcp open nmsigport
2818/tcp open rmlnk
2819/tcp open fc-faultnotify
2820/tcp open univision
2821/tcp open vrts-at-port
2822/tcp open ka0wuc
2823/tcp open cqg-netlan
2824/tcp open cqg-netlan-1
2825/tcp open unknown
2826/tcp open slc-systemlog
2827/tcp open slc-ctrlrloops
2828/tcp open itm-lm
2829/tcp open silkp1
2830/tcp open silkp2
2831/tcp open silkp3
2832/tcp open silkp4
2833/tcp open glishd
2834/tcp open evtp
2835/tcp open evtp-data
2836/tcp open catalyst
2837/tcp open repliweb
2838/tcp open starbot
2839/tcp open nmsigport
2840/tcp open l3-exprt
2841/tcp open l3-ranger
2842/tcp open l3-hawk
2843/tcp open pdnet
2844/tcp open bpcp-poll
2845/tcp open bpcp-trap
2846/tcp open aimpp-hello
2847/tcp open aimpp-port-req
2848/tcp open amt-blc-port
2849/tcp open fxp
2850/tcp open metaconsole
2851/tcp open webemshttp
2852/tcp open bears-01
2853/tcp open ispipes
2854/tcp open infomover
2855/tcp open msrp
2856/tcp open cesdinv
2857/tcp open simctlp
2858/tcp open ecnp
2859/tcp open activememory
2860/tcp open dialpad-voice1
2861/tcp open dialpad-voice2
2862/tcp open ttg-protocol
2863/tcp open sonardata
2864/tcp open astromed-main
2865/tcp open pit-vpn
2866/tcp open iwlistener
2867/tcp open esps-portal
2868/tcp open npep-messaging
2869/tcp open icslap
2870/tcp open daishi
2871/tcp open msi-selectplay
2872/tcp open radix
2873/tcp open psrt
2874/tcp open dxmessagebase1
2875/tcp open dxmessagebase2
2876/tcp open sps-tunnel
2877/tcp open bluelance
2878/tcp open aap
2879/tcp open ucentric-ds
2880/tcp open synapse
2881/tcp open ndsp
2882/tcp open ndtp
2883/tcp open ndnp
2884/tcp open flashmsg
2885/tcp open topflow
2886/tcp open responselogic
2887/tcp open aironetddp
2888/tcp open spcsdlobby
2889/tcp open rsom
2890/tcp open cspclmulti
2891/tcp open cinegrfx-elmd
2892/tcp open snifferdata
2893/tcp open vseconnector
2894/tcp open abacus-remote
2895/tcp open natuslink
2896/tcp open ecovisiong6-1
2897/tcp open citrix-rtmp
2898/tcp open appliance-cfg
2899/tcp open powergemplus
2900/tcp open quicksuite
2901/tcp open allstorcns
2902/tcp open netaspi
2903/tcp open extensisportfolio
2904/tcp open m2ua
2905/tcp open m3ua
2906/tcp open caller9
2907/tcp open webmethods-b2b
2908/tcp open mao
2909/tcp open funk-dialout
2910/tcp open tdaccess
2911/tcp open blockade
2912/tcp open epicon
2913/tcp open boosterware
2914/tcp open gamelobby
2915/tcp open tksocket
2916/tcp open elvin_server
2917/tcp open elvin_client
2918/tcp open kastenchasepad
2919/tcp open roboer
2920/tcp open roboeda
2921/tcp open cesdcdman
2922/tcp open cesdcdtrn
2923/tcp open wta-wsp-wtp-s
2924/tcp open precise-vip
2925/tcp open unknown
2926/tcp open mobile-file-dl
2927/tcp open unimobilectrl
2928/tcp open redstone-cpss
2929/tcp open amx-webadmin
2930/tcp open amx-weblinx
2931/tcp open circle-x
2932/tcp open incp
2933/tcp open 4-tieropmgw
2934/tcp open 4-tieropmcli
2935/tcp open qtp
2936/tcp open otpatch
2937/tcp open pnaconsult-lm
2938/tcp open sm-pas-1
2939/tcp open sm-pas-2
2940/tcp open sm-pas-3
2941/tcp open sm-pas-4
2942/tcp open sm-pas-5
2943/tcp open ttnrepository
2944/tcp open megaco-h248
2945/tcp open h248-binary
2946/tcp open fjsvmpor
2947/tcp open gpsd
2948/tcp open wap-push
2949/tcp open wap-pushsecure
2950/tcp open esip
2951/tcp open ottp
2952/tcp open mpfwsas
2953/tcp open ovalarmsrv
2954/tcp open ovalarmsrv-cmd
2955/tcp open csnotify
2956/tcp open ovrimosdbman
2957/tcp open jmact5
2958/tcp open jmact6
2959/tcp open rmopagt
2960/tcp open dfoxserver
2961/tcp open boldsoft-lm
2962/tcp open iph-policy-cli
2963/tcp open iph-policy-adm
2964/tcp open bullant-srap
2965/tcp open bullant-rap
2966/tcp open idp-infotrieve
2967/tcp open symantec-av
2968/tcp open enpp
2969/tcp open essp
2970/tcp open index-net
2971/tcp open netclip
2972/tcp open pmsm-webrctl
2973/tcp open svnetworks
2974/tcp open signal
2975/tcp open fjmpcm
2976/tcp open cns-srv-port
2977/tcp open ttc-etap-ns
2978/tcp open ttc-etap-ds
2979/tcp open h263-video
2980/tcp open wimd
2981/tcp open mylxamport
2982/tcp open iwb-whiteboard
2983/tcp open netplan
2984/tcp open hpidsadmin
2985/tcp open hpidsagent
2986/tcp open stonefalls
2987/tcp open identify
2988/tcp open hippad
2989/tcp open zarkov
2990/tcp open boscap
2991/tcp open wkstn-mon
2992/tcp open avenyo
2993/tcp open veritas-vis1
2994/tcp open veritas-vis2
2995/tcp open idrs
2996/tcp open vsixml
2997/tcp open rebol
2998/tcp open iss-realsec
2999/tcp open remoteware-un
3000/tcp open ppp
3001/tcp open nessus
3002/tcp open exlm-agent
3003/tcp open cgms
3004/tcp open csoftragent
3005/tcp open deslogin
3006/tcp open deslogind
3007/tcp open lotusmtap
3008/tcp open midnight-tech
3009/tcp open pxc-ntfy
3010/tcp open gw
3011/tcp open trusted-web
3012/tcp open twsdss
3013/tcp open gilatskysurfer
3014/tcp open broker_service
3015/tcp open nati-dstp
3016/tcp open notify_srvr
3017/tcp open event_listener
3018/tcp open srvc_registry
3019/tcp open resource_mgr
3020/tcp open cifs
3021/tcp open agriserver
3022/tcp open csregagent
3023/tcp open magicnotes
3024/tcp open nds_sso
3025/tcp open slnp
3026/tcp open agri-gateway
3027/tcp open LiebDevMgmt_C
3028/tcp open LiebDevMgmt_DM
3029/tcp open LiebDevMgmt_A
3030/tcp open arepa-cas
3031/tcp open eppc
3032/tcp open redwood-chat
3033/tcp open pdb
3034/tcp open osmosis-aeea
3035/tcp open fjsv-gssagt
3036/tcp open hagel-dump
3037/tcp open hp-san-mgmt
3038/tcp open santak-ups
3039/tcp open cogitate
3040/tcp open tomato-springs
3041/tcp open di-traceware
3042/tcp open journee
3043/tcp open brp
3044/tcp open epp
3045/tcp open slnp
3046/tcp open di-ase
3047/tcp open hlserver
3048/tcp open pctrader
3049/tcp open cfs
3050/tcp open gds_db
3051/tcp open galaxy-server
3052/tcp open powerchute
3053/tcp open dsom-server
3054/tcp open amt-cnf-prot
3055/tcp open policyserver
3056/tcp open cdl-server
3057/tcp open goahead-fldup
3058/tcp open videobeans
3059/tcp open qsoft
3060/tcp open interserver
3061/tcp open cautcpd
3062/tcp open ncacn-ip-tcp
3063/tcp open ncadg-ip-udp
3064/tcp open dnet-tstproxy
3065/tcp open slinterbase
3066/tcp open netattachsdmp
3067/tcp open fjhpjp
3068/tcp open ls3bcast
3069/tcp open ls3
3070/tcp open mgxswitch
3071/tcp open csd-mgmt-port
3072/tcp open csd-monitor
3073/tcp open vcrp
3074/tcp open xbox
3075/tcp open orbix-locator
3076/tcp open orbix-config
3077/tcp open orbix-loc-ssl
3078/tcp open orbix-cfg-ssl
3079/tcp open lv-frontpanel
3080/tcp open stm_pproc
3081/tcp open tl1-lv
3082/tcp open tl1-raw
3083/tcp open tl1-telnet
3084/tcp open itm-mccs
3085/tcp open pcihreq
3086/tcp open sj3
3087/tcp open asoki-sma
3088/tcp open xdtp
3089/tcp open ptk-alink
3090/tcp open stss
3091/tcp open 1ci-smcs
3092/tcp open unknown
3093/tcp open rapidmq-center
3094/tcp open rapidmq-reg
3095/tcp open panasas
3096/tcp open ndl-aps
3097/tcp open unknown
3098/tcp open umm-port
3099/tcp open chmd
3100/tcp open opcon-xps
3101/tcp open hp-pxpib
3102/tcp open sl-mon
3103/tcp open autocuesmi
3104/tcp open autocuelog
3105/tcp open cardbox
3106/tcp open cardbox-http
3107/tcp open business
3108/tcp open geolocate
3109/tcp open personnel
3110/tcp open sim-control
3111/tcp open wsynch
3112/tcp open ksysguard
3113/tcp open cs-auth-svr
3114/tcp open ccmad
3115/tcp open mctet-master
3116/tcp open mctet-gateway
3117/tcp open mctet-jserv
3118/tcp open pkagent
3119/tcp open d2000kernel
3120/tcp open d2000webserver
3121/tcp open pcmk-remote
3122/tcp open vtr-emulator
3123/tcp open edix
3124/tcp open beacon-port
3125/tcp open a13-an
3126/tcp open unknown
3127/tcp open ctx-bridge
3128/tcp open squid-http
3129/tcp open netport-id
3130/tcp open icpv2
3131/tcp open netbookmark
3132/tcp open ms-rule-engine
3133/tcp open prism-deploy
3134/tcp open ecp
3135/tcp open peerbook-port
3136/tcp open grubd
3137/tcp open rtnt-1
3138/tcp open rtnt-2
3139/tcp open incognitorv
3140/tcp open ariliamulti
3141/tcp open vmodem
3142/tcp open apt-cacher
3143/tcp open seaview
3144/tcp open tarantella
3145/tcp open csi-lfap
3146/tcp open bears-02
3147/tcp open rfio
3148/tcp open nm-game-admin
3149/tcp open nm-game-server
3150/tcp open nm-asses-admin
3151/tcp open nm-assessor
3152/tcp open feitianrockey
3153/tcp open s8-client-port
3154/tcp open ccmrmi
3155/tcp open jpegmpeg
3156/tcp open indura
3157/tcp open e3consultants
3158/tcp open stvp
3159/tcp open navegaweb-port
3160/tcp open tip-app-server
3161/tcp open doc1lm
3162/tcp open sflm
3163/tcp open res-sap
3164/tcp open imprs
3165/tcp open newgenpay
3166/tcp open sossecollector
3167/tcp open nowcontact
3168/tcp open poweronnud
3169/tcp open serverview-as
3170/tcp open serverview-asn
3171/tcp open serverview-gf
3172/tcp open serverview-rm
3173/tcp open serverview-icc
3174/tcp open armi-server
3175/tcp open t1-e1-over-ip
3176/tcp open ars-master
3177/tcp open phonex-port
3178/tcp open radclientport
3179/tcp open h2gf-w-2m
3180/tcp open mc-brk-srv
3181/tcp open bmcpatrolagent
3182/tcp open bmcpatrolrnvu
3183/tcp open cops-tls
3184/tcp open apogeex-port
3185/tcp open smpppd
3186/tcp open iiw-port
3187/tcp open odi-port
3188/tcp open brcm-comm-port
3189/tcp open pcle-infex
3190/tcp open csvr-proxy
3191/tcp open csvr-sslproxy
3192/tcp open firemonrcc
3193/tcp open spandataport
3194/tcp open magbind
3195/tcp open ncu-1
3196/tcp open ncu-2
3197/tcp open embrace-dp-s
3198/tcp open embrace-dp-c
3199/tcp open dmod-workspace
3200/tcp open tick-port
3201/tcp open cpq-tasksmart
3202/tcp open intraintra
3203/tcp open netwatcher-mon
3204/tcp open netwatcher-db
3205/tcp open isns
3206/tcp open ironmail
3207/tcp open vx-auth-port
3208/tcp open pfu-prcallback
3209/tcp open netwkpathengine
3210/tcp open flamenco-proxy
3211/tcp open avsecuremgmt
3212/tcp open surveyinst
3213/tcp open neon24x7
3214/tcp open jmq-daemon-1
3215/tcp open jmq-daemon-2
3216/tcp open ferrari-foam
3217/tcp open unite
3218/tcp open smartpackets
3219/tcp open wms-messenger
3220/tcp open xnm-ssl
3221/tcp open xnm-clear-text
3222/tcp open glbp
3223/tcp open digivote
3224/tcp open aes-discovery
3225/tcp open fcip-port
3226/tcp open isi-irp
3227/tcp open dwnmshttp
3228/tcp open dwmsgserver
3229/tcp open global-cd-port
3230/tcp open sftdst-port
3231/tcp open vidigo
3232/tcp open mdtp
3233/tcp open whisker
3234/tcp open alchemy
3235/tcp open mdap-port
3236/tcp open apparenet-ts
3237/tcp open apparenet-tps
3238/tcp open apparenet-as
3239/tcp open apparenet-ui
3240/tcp open triomotion
3241/tcp open sysorb
3242/tcp open sdp-id-port
3243/tcp open timelot
3244/tcp open onesaf
3245/tcp open vieo-fe
3246/tcp open dvt-system
3247/tcp open dvt-data
3248/tcp open procos-lm
3249/tcp open ssp
3250/tcp open hicp
3251/tcp open sysscanner
3252/tcp open dhe
3253/tcp open pda-data
3254/tcp open pda-sys
3255/tcp open semaphore
3256/tcp open cpqrpm-agent
3257/tcp open cpqrpm-server
3258/tcp open ivecon-port
3259/tcp open epncdp2
3260/tcp open iscsi
3261/tcp open winshadow
3262/tcp open necp
3263/tcp open ecolor-imager
3264/tcp open ccmail
3265/tcp open altav-tunnel
3266/tcp open ns-cfg-server
3267/tcp open ibm-dial-out
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
3270/tcp open verismart
3271/tcp open csoft-prev
3272/tcp open user-manager
3273/tcp open sxmp
3274/tcp open ordinox-server
3275/tcp open samd
3276/tcp open maxim-asics
3277/tcp open awg-proxy
3278/tcp open lkcmserver
3279/tcp open admind
3280/tcp open vs-server
3281/tcp open sysopt
3282/tcp open datusorb
3283/tcp open netassistant
3284/tcp open 4talk
3285/tcp open plato
3286/tcp open e-net
3287/tcp open directvdata
3288/tcp open cops
3289/tcp open enpc
3290/tcp open caps-lm
3291/tcp open sah-lm
3292/tcp open meetingmaker
3293/tcp open fg-fps
3294/tcp open fg-gip
3295/tcp open dyniplookup
3296/tcp open rib-slm
3297/tcp open cytel-lm
3298/tcp open deskview
3299/tcp open saprouter
3300/tcp open ceph
3301/tcp open tarantool
3302/tcp open mcs-fastmail
3303/tcp open opsession-clnt
3304/tcp open opsession-srvr
3305/tcp open odette-ftp
3306/tcp open mysql
3307/tcp open opsession-prxy
3308/tcp open tns-server
3309/tcp open tns-adv
3310/tcp open dyna-access
3311/tcp open mcns-tel-ret
3312/tcp open appman-server
3313/tcp open uorb
3314/tcp open uohost
3315/tcp open cdid
3316/tcp open aicc-cmi
3317/tcp open vsaiport
3318/tcp open ssrip
3319/tcp open sdt-lmd
3320/tcp open officelink2000
3321/tcp open vnsstr
3322/tcp open active-net
3323/tcp open active-net
3324/tcp open active-net
3325/tcp open active-net
3326/tcp open sftu
3327/tcp open bbars
3328/tcp open egptlm
3329/tcp open hp-device-disc
3330/tcp open mcs-calypsoicf
3331/tcp open mcs-messaging
3332/tcp open mcs-mailsvr
3333/tcp open dec-notes
3334/tcp open directv-web
3335/tcp open directv-soft
3336/tcp open directv-tick
3337/tcp open directv-catlg
3338/tcp open anet-b
3339/tcp open anet-l
3340/tcp open anet-m
3341/tcp open anet-h
3342/tcp open webtie
3343/tcp open ms-cluster-net
3344/tcp open bnt-manager
3345/tcp open influence
3346/tcp open trnsprntproxy
3347/tcp open phoenix-rpc
3348/tcp open pangolin-laser
3349/tcp open chevinservices
3350/tcp open findviatv
3351/tcp open btrieve
3352/tcp open ssql
3353/tcp open fatpipe
3354/tcp open suitjd
3355/tcp open ordinox-dbase
3356/tcp open upnotifyps
3357/tcp open adtech-test
3358/tcp open mpsysrmsvr
3359/tcp open wg-netforce
3360/tcp open kv-server
3361/tcp open kv-agent
3362/tcp open dj-ilm
3363/tcp open nati-vi-server
3364/tcp open creativeserver
3365/tcp open contentserver
3366/tcp open creativepartnr
3367/tcp open satvid-datalnk
3368/tcp open satvid-datalnk
3369/tcp open satvid-datalnk
3370/tcp open satvid-datalnk
3371/tcp open satvid-datalnk
3372/tcp open msdtc
3373/tcp open lavenir-lm
3374/tcp open cluster-disc
3375/tcp open vsnm-agent
3376/tcp open cdbroker
3377/tcp open cogsys-lm
3378/tcp open wsicopy
3379/tcp open socorfs
3380/tcp open sns-channels
3381/tcp open geneous
3382/tcp open fujitsu-neat
3383/tcp open esp-lm
3384/tcp open hp-clic
3385/tcp open qnxnetman
3386/tcp open gprs-data
3387/tcp open backroomnet
3388/tcp open cbserver
3389/tcp open ms-wbt-server
3390/tcp open dsc
3391/tcp open savant
3392/tcp open efi-lm
3393/tcp open d2k-tapestry1
3394/tcp open d2k-tapestry2
3395/tcp open dyna-lm
3396/tcp open printer_agent
3397/tcp open saposs
3398/tcp open sapcomm
3399/tcp open sapeps
3400/tcp open csms2
3401/tcp open filecast
3402/tcp open fxaengine-net
3403/tcp open unknown
3404/tcp open unknown
3405/tcp open nokia-ann-ch1
3406/tcp open nokia-ann-ch2
3407/tcp open ldap-admin
3408/tcp open BESApi
3409/tcp open networklens
3410/tcp open networklenss
3411/tcp open biolink-auth
3412/tcp open xmlblaster
3413/tcp open svnet
3414/tcp open wip-port
3415/tcp open bcinameservice
3416/tcp open commandport
3417/tcp open csvr
3418/tcp open rnmap
3419/tcp open softaudit
3420/tcp open ifcp-port
3421/tcp open bmap
3422/tcp open rusb-sys-port
3423/tcp open xtrm
3424/tcp open xtrms
3425/tcp open agps-port
3426/tcp open arkivio
3427/tcp open websphere-snmp
3428/tcp open twcss
3429/tcp open gcsp
3430/tcp open ssdispatch
3431/tcp open ndl-als
3432/tcp open osdcp
3433/tcp open alta-smp
3434/tcp open opencm
3435/tcp open pacom
3436/tcp open gc-config
3437/tcp open autocueds
3438/tcp open spiral-admin
3439/tcp open hri-port
3440/tcp open ans-console
3441/tcp open connect-client
3442/tcp open connect-server
3443/tcp open ov-nnm-websrv
3444/tcp open denali-server
3445/tcp open monp
3446/tcp open 3comfaxrpc
3447/tcp open directnet
3448/tcp open dnc-port
3449/tcp open hotu-chat
3450/tcp open castorproxy
3451/tcp open asam
3452/tcp open sabp-signal
3453/tcp open pscupd
3454/tcp open mira
3455/tcp open prsvp
3456/tcp open vat
3457/tcp open vat-control
3458/tcp open d3winosfi
3459/tcp open integral
3460/tcp open edm-manager
3461/tcp open edm-stager
3462/tcp open track
3463/tcp open edm-adm-notify
3464/tcp open edm-mgr-sync
3465/tcp open edm-mgr-cntrl
3466/tcp open workflow
3467/tcp open rcst
3468/tcp open ttcmremotectrl
3469/tcp open pluribus
3470/tcp open jt400
3471/tcp open jt400-ssl
3472/tcp open jaugsremotec-1
3473/tcp open jaugsremotec-2
3474/tcp open ttntspauto
3475/tcp open genisar-port
3476/tcp open nppmp
3477/tcp open ecomm
3478/tcp open stun
3479/tcp open twrpc
3480/tcp open plethora
3481/tcp open cleanerliverc
3482/tcp open vulture
3483/tcp open slim-devices
3484/tcp open gbs-stp
3485/tcp open celatalk
3486/tcp open ifsf-hb-port
3487/tcp open ltctcp
3488/tcp open fs-rh-srv
3489/tcp open dtp-dia
3490/tcp open colubris
3491/tcp open swr-port
3492/tcp open tvdumtray-port
3493/tcp open nut
3494/tcp open ibm3494
3495/tcp open seclayer-tcp
3496/tcp open seclayer-tls
3497/tcp open ipether232port
3498/tcp open dashpas-port
3499/tcp open sccip-media
3500/tcp open rtmp-port
3501/tcp open isoft-p2p
3502/tcp open avinstalldisc
3503/tcp open lsp-ping
3504/tcp open ironstorm
3505/tcp open ccmcomm
3506/tcp open apc-3506
3507/tcp open nesh-broker
3508/tcp open interactionweb
3509/tcp open vt-ssl
3510/tcp open xss-port
3511/tcp open webmail-2
3512/tcp open aztec
3513/tcp open arcpd
3514/tcp open must-p2p
3515/tcp open must-backplane
3516/tcp open smartcard-port
3517/tcp open 802-11-iapp
3518/tcp open artifact-msg
3519/tcp open nvmsgd
3520/tcp open galileolog
3521/tcp open mc3ss
3522/tcp open nssocketport
3523/tcp open odeumservlink
3524/tcp open ecmport
3525/tcp open eisport
3526/tcp open starquiz-port
3527/tcp open beserver-msg-q
3528/tcp open jboss-iiop
3529/tcp open jboss-iiop-ssl
3530/tcp open gf
3531/tcp open peerenabler
3532/tcp open raven-rmp
3533/tcp open raven-rdp
3534/tcp open urld-port
3535/tcp open ms-la
3536/tcp open snac
3537/tcp open ni-visa-remote
3538/tcp open ibm-diradm
3539/tcp open ibm-diradm-ssl
3540/tcp open pnrp-port
3541/tcp open voispeed-port
3542/tcp open hacl-monitor
3543/tcp open qftest-lookup
3544/tcp open teredo
3545/tcp open camac
3546/tcp open unknown
3547/tcp open symantec-sim
3548/tcp open interworld
3549/tcp open tellumat-nms
3550/tcp open ssmpp
3551/tcp open apcupsd
3552/tcp open taserver
3553/tcp open rbr-discovery
3554/tcp open questnotify
3555/tcp open razor
3556/tcp open sky-transport
3557/tcp open personalos-001
3558/tcp open mcp-port
3559/tcp open cctv-port
3560/tcp open iniserve-port
3561/tcp open bmc-onekey
3562/tcp open sdbproxy
3563/tcp open watcomdebug
3564/tcp open esimport
3565/tcp open m2pa
3566/tcp open quest-data-hub
3567/tcp open oap
3568/tcp open oap-s
3569/tcp open mbg-ctrl
3570/tcp open mccwebsvr-port
3571/tcp open megardsvr-port
3572/tcp open megaregsvrport
3573/tcp open tag-ups-1
3574/tcp open dmaf-server
3575/tcp open ccm-port
3576/tcp open cmc-port
3577/tcp open config-port
3578/tcp open data-port
3579/tcp open ttat3lb
3580/tcp open nati-svrloc
3581/tcp open kfxaclicensing
3582/tcp open press
3583/tcp open canex-watch
3584/tcp open u-dbap
3585/tcp open emprise-lls
3586/tcp open emprise-lsc
3587/tcp open p2pgroup
3588/tcp open sentinel
3589/tcp open isomair
3590/tcp open wv-csp-sms
3591/tcp open gtrack-server
3592/tcp open gtrack-ne
3593/tcp open bpmd
3594/tcp open mediaspace
3595/tcp open shareapp
3596/tcp open iw-mmogame
3597/tcp open a14
3598/tcp open a15
3599/tcp open quasar-server
3600/tcp open trap-daemon
3601/tcp open visinet-gui
3602/tcp open infiniswitchcl
3603/tcp open int-rcv-cntrl
3604/tcp open bmc-jmx-port
3605/tcp open comcam-io
3606/tcp open splitlock
3607/tcp open precise-i3
3608/tcp open trendchip-dcp
3609/tcp open cpdi-pidas-cm
3610/tcp open echonet
3611/tcp open six-degrees
3612/tcp open hp-dataprotect
3613/tcp open alaris-disc
3614/tcp open sigma-port
3615/tcp open start-network
3616/tcp open cd3o-protocol
3617/tcp open sharp-server
3618/tcp open aairnet-1
3619/tcp open aairnet-2
3620/tcp open ep-pcp
3621/tcp open ep-nsp
3622/tcp open ff-lr-port
3623/tcp open haipe-discover
3624/tcp open dist-upgrade
3625/tcp open volley
3626/tcp open bvcdaemon-port
3627/tcp open jamserverport
3628/tcp open ept-machine
3629/tcp open escvpnet
3630/tcp open cs-remote-db
3631/tcp open cs-services
3632/tcp open distccd
3633/tcp open wacp
3634/tcp open hlibmgr
3635/tcp open sdo
3636/tcp open servistaitsm
3637/tcp open scservp
3638/tcp open ehp-backup
3639/tcp open xap-ha
3640/tcp open netplay-port1
3641/tcp open netplay-port2
3642/tcp open juxml-port
3643/tcp open audiojuggler
3644/tcp open ssowatch
3645/tcp open cyc
3646/tcp open xss-srv-port
3647/tcp open splitlock-gw
3648/tcp open fjcp
3649/tcp open nmmp
3650/tcp open prismiq-plugin
3651/tcp open xrpc-registry
3652/tcp open vxcrnbuport
3653/tcp open tsp
3654/tcp open vaprtm
3655/tcp open abatemgr
3656/tcp open abatjss
3657/tcp open immedianet-bcn
3658/tcp open ps-ams
3659/tcp open apple-sasl
3660/tcp open can-nds-ssl
3661/tcp open can-ferret-ssl
3662/tcp open pserver
3663/tcp open dtp
3664/tcp open ups-engine
3665/tcp open ent-engine
3666/tcp open eserver-pap
3667/tcp open infoexch
3668/tcp open dell-rm-port
3669/tcp open casanswmgmt
3670/tcp open smile
3671/tcp open efcp
3672/tcp open lispworks-orb
3673/tcp open mediavault-gui
3674/tcp open wininstall-ipc
3675/tcp open calltrax
3676/tcp open va-pacbase
3677/tcp open roverlog
3678/tcp open ipr-dglt
3679/tcp open newton-dock
3680/tcp open npds-tracker
3681/tcp open bts-x73
3682/tcp open cas-mapi
3683/tcp open bmc-ea
3684/tcp open faxstfx-port
3685/tcp open dsx-agent
3686/tcp open tnmpv2
3687/tcp open simple-push
3688/tcp open simple-push-s
3689/tcp open rendezvous
3690/tcp open svn
3691/tcp open magaya-network
3692/tcp open intelsync
3693/tcp open easl
3694/tcp open unknown
3695/tcp open bmc-data-coll
3696/tcp open telnetcpcd
3697/tcp open nw-license
3698/tcp open sagectlpanel
3699/tcp open kpn-icw
3700/tcp open lrs-paging
3701/tcp open netcelera
3702/tcp open ws-discovery
3703/tcp open adobeserver-3
3704/tcp open adobeserver-4
3705/tcp open adobeserver-5
3706/tcp open rt-event
3707/tcp open rt-event-s
3708/tcp open sun-as-iiops
3709/tcp open ca-idms
3710/tcp open portgate-auth
3711/tcp open edb-server2
3712/tcp open sentinel-ent
3713/tcp open tftps
3714/tcp open delos-dms
3715/tcp open anoto-rendezv
3716/tcp open wv-csp-sms-cir
3717/tcp open wv-csp-udp-cir
3718/tcp open opus-services
3719/tcp open itelserverport
3720/tcp open ufastro-instr
3721/tcp open xsync
3722/tcp open xserveraid
3723/tcp open sychrond
3724/tcp open blizwow
3725/tcp open na-er-tip
3726/tcp open array-manager
3727/tcp open e-mdu
3728/tcp open e-woa
3729/tcp open fksp-audit
3730/tcp open client-ctrl
3731/tcp open smap
3732/tcp open m-wnn
3733/tcp open multip-msg
3734/tcp open synel-data
3735/tcp open pwdis
3736/tcp open rs-rmi
3737/tcp open xpanel
3738/tcp open versatalk
3739/tcp open launchbird-lm
3740/tcp open heartbeat
3741/tcp open wysdma
3742/tcp open cst-port
3743/tcp open ipcs-command
3744/tcp open sasg
3745/tcp open gw-call-port
3746/tcp open linktest
3747/tcp open linktest-s
3748/tcp open webdata
3749/tcp open cimtrak
3750/tcp open cbos-ip-port
3751/tcp open gprs-cube
3752/tcp open vipremoteagent
3753/tcp open nattyserver
3754/tcp open timestenbroker
3755/tcp open sas-remote-hlp
3756/tcp open canon-capt
3757/tcp open grf-port
3758/tcp open apw-registry
3759/tcp open exapt-lmgr
3760/tcp open adtempusclient
3761/tcp open gsakmp
3762/tcp open gbs-smp
3763/tcp open xo-wave
3764/tcp open mni-prot-rout
3765/tcp open rtraceroute
3766/tcp open sitewatch-s
3767/tcp open listmgr-port
3768/tcp open rblcheckd
3769/tcp open haipe-otnk
3770/tcp open cindycollab
3771/tcp open paging-port
3772/tcp open ctp
3773/tcp open ctdhercules
3774/tcp open zicom
3775/tcp open ispmmgr
3776/tcp open dvcprov-port
3777/tcp open jibe-eb
3778/tcp open c-h-it-port
3779/tcp open cognima
3780/tcp open nnp
3781/tcp open abcvoice-port
3782/tcp open iso-tp0s
3783/tcp open bim-pem
3784/tcp open bfd-control
3785/tcp open bfd-echo
3786/tcp open upstriggervsw
3787/tcp open fintrx
3788/tcp open isrp-port
3789/tcp open remotedeploy
3790/tcp open quickbooksrds
3791/tcp open tvnetworkvideo
3792/tcp open sitewatch
3793/tcp open dcsoftware
3794/tcp open jaus
3795/tcp open myblast
3796/tcp open spw-dialer
3797/tcp open idps
3798/tcp open minilock
3799/tcp open radius-dynauth
3800/tcp open pwgpsi
3801/tcp open ibm-mgr
3802/tcp open vhd
3803/tcp open soniqsync
3804/tcp open iqnet-port
3805/tcp open tcpdataserver
3806/tcp open wsmlb
3807/tcp open spugna
3808/tcp open sun-as-iiops-ca
3809/tcp open apocd
3810/tcp open wlanauth
3811/tcp open amp
3812/tcp open neto-wol-server
3813/tcp open rap-ip
3814/tcp open neto-dcs
3815/tcp open lansurveyorxml
3816/tcp open sunlps-http
3817/tcp open tapeware
3818/tcp open crinis-hb
3819/tcp open epl-slp
3820/tcp open scp
3821/tcp open pmcp
3822/tcp open acp-discovery
3823/tcp open acp-conduit
3824/tcp open acp-policy
3825/tcp open ffserver
3826/tcp open wormux
3827/tcp open netmpi
3828/tcp open neteh
3829/tcp open neteh-ext
3830/tcp open cernsysmgmtagt
3831/tcp open dvapps
3832/tcp open xxnetserver
3833/tcp open aipn-auth
3834/tcp open spectardata
3835/tcp open spectardb
3836/tcp open markem-dcp
3837/tcp open mkm-discovery
3838/tcp open sos
3839/tcp open amx-rms
3840/tcp open flirtmitmir
3841/tcp open zfirm-shiprush3
3842/tcp open nhci
3843/tcp open quest-agent
3844/tcp open rnm
3845/tcp open v-one-spp
3846/tcp open an-pcp
3847/tcp open msfw-control
3848/tcp open item
3849/tcp open spw-dnspreload
3850/tcp open qtms-bootstrap
3851/tcp open spectraport
3852/tcp open sse-app-config
3853/tcp open sscan
3854/tcp open stryker-com
3855/tcp open opentrac
3856/tcp open informer
3857/tcp open trap-port
3858/tcp open trap-port-mom
3859/tcp open nav-port
3860/tcp open sasp
3861/tcp open winshadow-hd
3862/tcp open giga-pocket
3863/tcp open asap-tcp
3864/tcp open asap-tcp-tls
3865/tcp open xpl
3866/tcp open dzdaemon
3867/tcp open dzoglserver
3868/tcp open diameter
3869/tcp open ovsam-mgmt
3870/tcp open ovsam-d-agent
3871/tcp open avocent-adsap
3872/tcp open oem-agent
3873/tcp open fagordnc
3874/tcp open sixxsconfig
3875/tcp open pnbscada
3876/tcp open dl_agent
3877/tcp open xmpcr-interface
3878/tcp open fotogcad
3879/tcp open appss-lm
3880/tcp open igrs
3881/tcp open idac
3882/tcp open msdts1
3883/tcp open vrpn
3884/tcp open softrack-meter
3885/tcp open topflow-ssl
3886/tcp open nei-management
3887/tcp open ciphire-data
3888/tcp open ciphire-serv
3889/tcp open dandv-tester
3890/tcp open ndsconnect
3891/tcp open rtc-pm-port
3892/tcp open pcc-image-port
3893/tcp open cgi-starapi
3894/tcp open syam-agent
3895/tcp open syam-smc
3896/tcp open sdo-tls
3897/tcp open sdo-ssh
3898/tcp open senip
3899/tcp open itv-control
3900/tcp open udt_os
3901/tcp open nimsh
3902/tcp open nimaux
3903/tcp open charsetmgr
3904/tcp open omnilink-port
3905/tcp open mupdate
3906/tcp open topovista-data
3907/tcp open imoguia-port
3908/tcp open hppronetman
3909/tcp open surfcontrolcpa
3910/tcp open prnrequest
3911/tcp open prnstatus
3912/tcp open gbmt-stars
3913/tcp open listcrt-port
3914/tcp open listcrt-port-2
3915/tcp open agcat
3916/tcp open wysdmc
3917/tcp open aftmux
3918/tcp open pktcablemmcops
3919/tcp open hyperip
3920/tcp open exasoftport1
3921/tcp open herodotus-net
3922/tcp open sor-update
3923/tcp open symb-sb-port
3924/tcp open mpl-gprs-port
3925/tcp open zmp
3926/tcp open winport
3927/tcp open natdataservice
3928/tcp open netboot-pxe
3929/tcp open smauth-port
3930/tcp open syam-webserver
3931/tcp open msr-plugin-port
3932/tcp open dyn-site
3933/tcp open plbserve-port
3934/tcp open sunfm-port
3935/tcp open sdp-portmapper
3936/tcp open mailprox
3937/tcp open dvbservdsc
3938/tcp open dbcontrol_agent
3939/tcp open aamp
3940/tcp open xecp-node
3941/tcp open homeportal-web
3942/tcp open srdp
3943/tcp open tig
3944/tcp open sops
3945/tcp open emcads
3946/tcp open backupedge
3947/tcp open ccp
3948/tcp open apdap
3949/tcp open drip
3950/tcp open namemunge
3951/tcp open pwgippfax
3952/tcp open i3-sessionmgr
3953/tcp open xmlink-connect
3954/tcp open adrep
3955/tcp open p2pcommunity
3956/tcp open gvcp
3957/tcp open mqe-broker
3958/tcp open mqe-agent
3959/tcp open treehopper
3960/tcp open bess
3961/tcp open proaxess
3962/tcp open sbi-agent
3963/tcp open thrp
3964/tcp open sasggprs
3965/tcp open ati-ip-to-ncpe
3966/tcp open bflckmgr
3967/tcp open ppsms
3968/tcp open ianywhere-dbns
3969/tcp open landmarks
3970/tcp open lanrevagent
3971/tcp open lanrevserver
3972/tcp open iconp
3973/tcp open progistics
3974/tcp open citysearch
3975/tcp open airshot
3976/tcp open opswagent
3977/tcp open opswmanager
3978/tcp open secure-cfg-svr
3979/tcp open smwan
3980/tcp open acms
3981/tcp open starfish
3982/tcp open eis
3983/tcp open eisp
3984/tcp open mapper-nodemgr
3985/tcp open mapper-mapethd
3986/tcp open mapper-ws_ethd
3987/tcp open centerline
3988/tcp open dcs-config
3989/tcp open bv-queryengine
3990/tcp open bv-is
3991/tcp open bv-smcsrv
3992/tcp open bv-ds
3993/tcp open bv-agent
3994/tcp open unknown
3995/tcp open iss-mgmt-ssl
3996/tcp open abcsoftware
3997/tcp open agentsease-db
3998/tcp open dnx
3999/tcp open remoteanything
4000/tcp open remoteanything
4001/tcp open newoak
4002/tcp open mlchat-proxy
4003/tcp open pxc-splr-ft
4004/tcp open pxc-roid
4005/tcp open pxc-pin
4006/tcp open pxc-spvr
4007/tcp open pxc-splr
4008/tcp open netcheque
4009/tcp open chimera-hwm
4010/tcp open samsung-unidex
4011/tcp open altserviceboot
4012/tcp open pda-gate
4013/tcp open acl-manager
4014/tcp open taiclock
4015/tcp open talarian-mcast1
4016/tcp open talarian-mcast2
4017/tcp open talarian-mcast3
4018/tcp open talarian-mcast4
4019/tcp open talarian-mcast5
4020/tcp open trap
4021/tcp open nexus-portal
4022/tcp open dnox
4023/tcp open esnm-zoning
4024/tcp open tnp1-port
4025/tcp open partimage
4026/tcp open as-debug
4027/tcp open bxp
4028/tcp open dtserver-port
4029/tcp open ip-qsig
4030/tcp open jdmn-port
4031/tcp open suucp
4032/tcp open vrts-auth-port
4033/tcp open sanavigator
4034/tcp open ubxd
4035/tcp open wap-push-http
4036/tcp open wap-push-https
4037/tcp open ravehd
4038/tcp open fazzt-ptp
4039/tcp open fazzt-admin
4040/tcp open yo-main
4041/tcp open houston
4042/tcp open ldxp
4043/tcp open nirp
4044/tcp open ltp
4045/tcp open lockd
4046/tcp open acp-proto
4047/tcp open ctp-state
4048/tcp open unknown
4049/tcp open wafs
4050/tcp open cisco-wafs
4051/tcp open cppdp
4052/tcp open interact
4053/tcp open ccu-comm-1
4054/tcp open ccu-comm-2
4055/tcp open ccu-comm-3
4056/tcp open lms
4057/tcp open wfm
4058/tcp open kingfisher
4059/tcp open dlms-cosem
4060/tcp open dsmeter_iatc
4061/tcp open ice-location
4062/tcp open ice-slocation
4063/tcp open ice-router
4064/tcp open ice-srouter
4065/tcp open avanti_cdp
4066/tcp open pmas
4067/tcp open idp
4068/tcp open ipfltbcst
4069/tcp open minger
4070/tcp open tripe
4071/tcp open aibkup
4072/tcp open zieto-sock
4073/tcp open iRAPP
4074/tcp open cequint-cityid
4075/tcp open perimlan
4076/tcp open seraph
4077/tcp open ascomalarm
4078/tcp open cssp
4079/tcp open santools
4080/tcp open lorica-in
4081/tcp open lorica-in-sec
4082/tcp open lorica-out
4083/tcp open lorica-out-sec
4084/tcp open fortisphere-vm
4085/tcp open ezmessagesrv
4086/tcp open ftsync
4087/tcp open applusservice
4088/tcp open npsp
4089/tcp open opencore
4090/tcp open omasgport
4091/tcp open ewinstaller
4092/tcp open ewdgs
4093/tcp open pvxpluscs
4094/tcp open sysrqd
4095/tcp open xtgui
4096/tcp open bre
4097/tcp open patrolview
4098/tcp open drmsfsd
4099/tcp open dpcp
4100/tcp open igo-incognito
4101/tcp open brlp-0
4102/tcp open brlp-1
4103/tcp open brlp-2
4104/tcp open brlp-3
4105/tcp open shofarplayer
4106/tcp open synchronite
4107/tcp open j-ac
4108/tcp open accel
4109/tcp open izm
4110/tcp open g2tag
4111/tcp open xgrid
4112/tcp open apple-vpns-rp
4113/tcp open aipn-reg
4114/tcp open jomamqmonitor
4115/tcp open cds
4116/tcp open smartcard-tls
4117/tcp open hillrserv
4118/tcp open netscript
4119/tcp open assuria-slm
4120/tcp open minirem
4121/tcp open e-builder
4122/tcp open fprams
4123/tcp open z-wave
4124/tcp open tigv2
4125/tcp open rww
4126/tcp open ddrepl
4127/tcp open unikeypro
4128/tcp open nufw
4129/tcp open nuauth
4130/tcp open fronet
4131/tcp open stars
4132/tcp open nuts_dem
4133/tcp open nuts_bootp
4134/tcp open nifty-hmi
4135/tcp open cl-db-attach
4136/tcp open cl-db-request
4137/tcp open cl-db-remote
4138/tcp open nettest
4139/tcp open thrtx
4140/tcp open cedros_fds
4141/tcp open oirtgsvc
4142/tcp open oidocsvc
4143/tcp open oidsr
4144/tcp open wincim
4145/tcp open vvr-control
4146/tcp open tgcconnect
4147/tcp open vrxpservman
4148/tcp open hhb-handheld
4149/tcp open agslb
4150/tcp open PowerAlert-nsa
4151/tcp open menandmice_noh
4152/tcp open idig_mux
4153/tcp open mbl-battd
4154/tcp open atlinks
4155/tcp open bzr
4156/tcp open stat-results
4157/tcp open stat-scanner
4158/tcp open stat-cc
4159/tcp open nss
4160/tcp open jini-discovery
4161/tcp open omscontact
4162/tcp open omstopology
4163/tcp open silverpeakpeer
4164/tcp open silverpeakcomm
4165/tcp open altcp
4166/tcp open joost
4167/tcp open ddgn
4168/tcp open pslicser
4169/tcp open iadt
4170/tcp open d-cinema-csp
4171/tcp open ml-svnet
4172/tcp open pcoip
4173/tcp open mma-discovery
4174/tcp open smcluster
4175/tcp open bccp
4176/tcp open tl-ipcproxy
4177/tcp open wello
4178/tcp open storman
4179/tcp open MaxumSP
4180/tcp open httpx
4181/tcp open macbak
4182/tcp open pcptcpservice
4183/tcp open gmmp
4184/tcp open universe_suite
4185/tcp open wcpp
4186/tcp open boxbackupstore
4187/tcp open csc_proxy
4188/tcp open vatata
4189/tcp open pcep
4190/tcp open sieve
4191/tcp open dsmipv6
4192/tcp open azeti
4193/tcp open pvxplusio
4194/tcp open spdm
4195/tcp open aws-wsp
4196/tcp open unknown
4197/tcp open hctl
4198/tcp open unknown
4199/tcp open eims-admin
4200/tcp open vrml-multi-use
4201/tcp open vrml-multi-use
4202/tcp open vrml-multi-use
4203/tcp open vrml-multi-use
4204/tcp open vrml-multi-use
4205/tcp open vrml-multi-use
4206/tcp open vrml-multi-use
4207/tcp open vrml-multi-use
4208/tcp open vrml-multi-use
4209/tcp open vrml-multi-use
4210/tcp open vrml-multi-use
4211/tcp open vrml-multi-use
4212/tcp open vrml-multi-use
4213/tcp open vrml-multi-use
4214/tcp open vrml-multi-use
4215/tcp open vrml-multi-use
4216/tcp open vrml-multi-use
4217/tcp open vrml-multi-use
4218/tcp open vrml-multi-use
4219/tcp open vrml-multi-use
4220/tcp open vrml-multi-use
4221/tcp open vrml-multi-use
4222/tcp open vrml-multi-use
4223/tcp open vrml-multi-use
4224/tcp open xtell
4225/tcp open vrml-multi-use
4226/tcp open vrml-multi-use
4227/tcp open vrml-multi-use
4228/tcp open vrml-multi-use
4229/tcp open vrml-multi-use
4230/tcp open vrml-multi-use
4231/tcp open vrml-multi-use
4232/tcp open vrml-multi-use
4233/tcp open vrml-multi-use
4234/tcp open vrml-multi-use
4235/tcp open vrml-multi-use
4236/tcp open vrml-multi-use
4237/tcp open vrml-multi-use
4238/tcp open vrml-multi-use
4239/tcp open vrml-multi-use
4240/tcp open vrml-multi-use
4241/tcp open vrml-multi-use
4242/tcp open vrml-multi-use
4243/tcp open vrml-multi-use
4244/tcp open vrml-multi-use
4245/tcp open vrml-multi-use
4246/tcp open vrml-multi-use
4247/tcp open vrml-multi-use
4248/tcp open vrml-multi-use
4249/tcp open vrml-multi-use
4250/tcp open vrml-multi-use
4251/tcp open vrml-multi-use
4252/tcp open vrml-multi-use
4253/tcp open vrml-multi-use
4254/tcp open vrml-multi-use
4255/tcp open vrml-multi-use
4256/tcp open vrml-multi-use
4257/tcp open vrml-multi-use
4258/tcp open vrml-multi-use
4259/tcp open vrml-multi-use
4260/tcp open vrml-multi-use
4261/tcp open vrml-multi-use
4262/tcp open vrml-multi-use
4263/tcp open vrml-multi-use
4264/tcp open vrml-multi-use
4265/tcp open vrml-multi-use
4266/tcp open vrml-multi-use
4267/tcp open vrml-multi-use
4268/tcp open vrml-multi-use
4269/tcp open vrml-multi-use
4270/tcp open vrml-multi-use
4271/tcp open vrml-multi-use
4272/tcp open vrml-multi-use
4273/tcp open vrml-multi-use
4274/tcp open vrml-multi-use
4275/tcp open vrml-multi-use
4276/tcp open vrml-multi-use
4277/tcp open vrml-multi-use
4278/tcp open vrml-multi-use
4279/tcp open vrml-multi-use
4280/tcp open vrml-multi-use
4281/tcp open vrml-multi-use
4282/tcp open vrml-multi-use
4283/tcp open vrml-multi-use
4284/tcp open vrml-multi-use
4285/tcp open vrml-multi-use
4286/tcp open vrml-multi-use
4287/tcp open vrml-multi-use
4288/tcp open vrml-multi-use
4289/tcp open vrml-multi-use
4290/tcp open vrml-multi-use
4291/tcp open vrml-multi-use
4292/tcp open vrml-multi-use
4293/tcp open vrml-multi-use
4294/tcp open vrml-multi-use
4295/tcp open vrml-multi-use
4296/tcp open vrml-multi-use
4297/tcp open vrml-multi-use
4298/tcp open vrml-multi-use
4299/tcp open vrml-multi-use
4300/tcp open corelccam
4301/tcp open d-data
4302/tcp open d-data-control
4303/tcp open srcp
4304/tcp open owserver
4305/tcp open batman
4306/tcp open pinghgl
4307/tcp open visicron-vs
4308/tcp open compx-lockview
4309/tcp open dserver
4310/tcp open mirrtex
4311/tcp open p6ssmc
4312/tcp open pscl-mgt
4313/tcp open perrla
4314/tcp open choiceview-agt
4315/tcp open unknown
4316/tcp open choiceview-clt
4317/tcp open opentelemetry
4318/tcp open unknown
4319/tcp open fox-skytale
4320/tcp open fdt-rcatp
4321/tcp open rwhois
4322/tcp open trim-event
4323/tcp open trim-ice
4324/tcp open balour
4325/tcp open geognosisman
4326/tcp open geognosis
4327/tcp open jaxer-web
4328/tcp open jaxer-manager
4329/tcp open publiqare-sync
4330/tcp open dey-sapi
4331/tcp open ktickets-rest
4332/tcp open getty-focus
4333/tcp open msql
4334/tcp open netconf-ch-ssh
4335/tcp open netconf-ch-tls
4336/tcp open restconf-ch-tls
4337/tcp open unknown
4338/tcp open unknown
4339/tcp open unknown
4340/tcp open gaia
4341/tcp open lisp-data
4342/tcp open lisp-cons
4343/tcp open unicall
4344/tcp open vinainstall
4345/tcp open m4-network-as
4346/tcp open elanlm
4347/tcp open lansurveyor
4348/tcp open itose
4349/tcp open fsportmap
4350/tcp open net-device
4351/tcp open plcy-net-svcs
4352/tcp open pjlink
4353/tcp open f5-iquery
4354/tcp open qsnet-trans
4355/tcp open qsnet-workst
4356/tcp open qsnet-assist
4357/tcp open qsnet-cond
4358/tcp open qsnet-nucl
4359/tcp open omabcastltkm
4360/tcp open matrix_vnet
4361/tcp open nacnl
4362/tcp open afore-vdp-disc
4363/tcp open unknown
4364/tcp open unknown
4365/tcp open unknown
4366/tcp open shadowstream
4367/tcp open unknown
4368/tcp open wxbrief
4369/tcp open epmd
4370/tcp open elpro_tunnel
4371/tcp open l2c-control
4372/tcp open l2c-data
4373/tcp open remctl
4374/tcp open psi-ptt
4375/tcp open tolteces
4376/tcp open bip
4377/tcp open cp-spxsvr
4378/tcp open cp-spxdpy
4379/tcp open ctdb
4380/tcp open unknown
4381/tcp open unknown
4382/tcp open unknown
4383/tcp open unknown
4384/tcp open unknown
4385/tcp open unknown
4386/tcp open unknown
4387/tcp open unknown
4388/tcp open unknown
4389/tcp open xandros-cms
4390/tcp open wiegand
4391/tcp open apwi-imserver
4392/tcp open apwi-rxserver
4393/tcp open apwi-rxspooler
4394/tcp open apwi-disc
4395/tcp open omnivisionesx
4396/tcp open fly
4397/tcp open unknown
4398/tcp open unknown
4399/tcp open unknown
4400/tcp open ds-srv
4401/tcp open ds-srvr
4402/tcp open ds-clnt
4403/tcp open ds-user
4404/tcp open ds-admin
4405/tcp open ds-mail
4406/tcp open ds-slp
4407/tcp open nacagent
4408/tcp open slscc
4409/tcp open netcabinet-com
4410/tcp open itwo-server
4411/tcp open found
4412/tcp open smallchat
4413/tcp open avi-nms
4414/tcp open updog
4415/tcp open brcd-vr-req
4416/tcp open pjj-player
4417/tcp open workflowdir
4418/tcp open axysbridge
4419/tcp open cbp
4420/tcp open nvm-express
4421/tcp open scaleft
4422/tcp open tsepisp
4423/tcp open thingkit
4424/tcp open unknown
4425/tcp open netrockey6
4426/tcp open beacon-port-2
4427/tcp open drizzle
4428/tcp open omviserver
4429/tcp open omviagent
4430/tcp open rsqlserver
4431/tcp open wspipe
4432/tcp open l-acoustics
4433/tcp open vop
4434/tcp open unknown
4435/tcp open unknown
4436/tcp open unknown
4437/tcp open unknown
4438/tcp open unknown
4439/tcp open unknown
4440/tcp open unknown
4441/tcp open netblox
4442/tcp open saris
4443/tcp open pharos
4444/tcp open krb524
4445/tcp open upnotifyp
4446/tcp open n1-fwp
4447/tcp open n1-rmgmt
4448/tcp open asc-slmd
4449/tcp open privatewire
4450/tcp open camp
4451/tcp open ctisystemmsg
4452/tcp open ctiprogramload
4453/tcp open nssalertmgr
4454/tcp open nssagentmgr
4455/tcp open prchat-user
4456/tcp open prchat-server
4457/tcp open prRegister
4458/tcp open mcp
4459/tcp open unknown
4460/tcp open ntske
4461/tcp open unknown
4462/tcp open unknown
4463/tcp open unknown
4464/tcp open unknown
4465/tcp open unknown
4466/tcp open unknown
4467/tcp open unknown
4468/tcp open unknown
4469/tcp open unknown
4470/tcp open unknown
4471/tcp open unknown
4472/tcp open unknown
4473/tcp open unknown
4474/tcp open unknown
4475/tcp open unknown
4476/tcp open unknown
4477/tcp open unknown
4478/tcp open unknown
4479/tcp open unknown
4480/tcp open proxy-plus
4481/tcp open unknown
4482/tcp open unknown
4483/tcp open unknown
4484/tcp open hpssmgmt
4485/tcp open assyst-dr
4486/tcp open icms
4487/tcp open prex-tcp
4488/tcp open awacs-ice
4489/tcp open unknown
4490/tcp open unknown
4491/tcp open unknown
4492/tcp open unknown
4493/tcp open unknown
4494/tcp open unknown
4495/tcp open unknown
4496/tcp open unknown
4497/tcp open unknown
4498/tcp open unknown
4499/tcp open unknown
4500/tcp open sae-urn
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 (95%), Linux 5.10 - 5.15 (94%), Linux 5.4 (94%), Linux 5.15 (93%), MikroTik RouterOS 7.2 (Linux 5.6.3) (93%), Android 4.4.0 (92%), Android 9 - 10 (Linux 4.9 - 4.14) (92%), Linux 3.2 - 4.14 (91%), Linux 4.15 - 5.19 (91%), Linux 2.6.32 - 3.10 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 4 hops
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 237.04 seconds
┌──(operator@kali)-[~/writeup]
└─$ cat 03_nmap_scan.txt
raw nmap scan
┌──(alvan㉿vbox)-[~/THM/ctf]
└─$ nmap -sC -sV -Pn 10.10.151.140 -p1337
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-01 19:06 UTC
Nmap scan report for 10.10.151.140
Host is up (0.78s latency).
PORT STATE SERVICE VERSION
1337/tcp open waste?
| fingerprint-strings:
| NULL:
| Welcome traveller, to the beginning of your journey
| begin, find the trollface
| Legend says he's hiding in the first 100 ports
|_ printing the banners from the ports
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port1337-TCP:V=7.95%I=7%D=9/1%Time=68B5EEAB%P=x86_64-pc-linux-gnu%r(NUL
SF:L,A7,"Welcome\x20traveller,\x20to\x20the\x20beginning\x20of\x20your\x20
SF:journey\nTo\x20begin,\x20find\x20the\x20trollface\nLegend\x20says\x20he
SF:'s\x20hiding\x20in\x20the\x20first\x20100\x20ports\nTry\x20printing\x20
SF:the\x20banners\x20from\x20the\x20ports");
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 72.98 seconds
┌──(alvan㉿vbox)-[~/THM/ctf]
└─$ nmap -sC -sV -Pn 10.10.151.140 -p1-100
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-01 19:08 UTC
Nmap scan report for 10.10.151.140
Host is up (0.74s latency).
PORT STATE SERVICE VERSION
1/tcp open tcpmux?
| fingerprint-strings:
| NULL:
|_ 550 12345 0000000000000000000000000000000000000000000000000000000
2/tcp open compressnet?
| fingerprint-strings:
| NULL:
|_ 550 12345 0000000000000000000000000000000000000000000000000000000
3/tcp open compressnet?
| fingerprint-strings:
| NULL:
|_ 550 12345 0000000000000000000000000000000000000000000000000000000
4/tcp open unknown
| fingerprint-strings:
| NULL:
|_ 550 12345 0000000000000000000000000000000000000000000000000000000
5/tcp open rje?
| fingerprint-strings:
| NULL:
|_ 550 12345 0000000000000000000000000000000000000000000000000000000
6/tcp open unknown
| fingerprint-strings:
| NULL:
|_ 550 12345 0ffffffffffffffffffffffffffffffffffffffffffffffffffff00
7/tcp open echo?
| fingerprint-strings:
| NULL:
|_ 550 12345 0fffffffffffff777778887777777777cffffffffffffffffffff00
8/tcp open unknown
| fingerprint-strings:
| NULL:
|_ 550 12345 0fffffffffff8000000000000000008888887cfcfffffffffffff00
9/tcp open discard?
| fingerprint-strings:
| NULL:
|_ 550 12345 0ffffffffff80000088808000000888800000008887ffffffffff00
10/tcp open unknown
| fingerprint-strings:
| JavaRMI, NULL:
|_ 550 12345 0fffffffff70000088800888800088888800008800007ffffffff00
11/tcp open systat?
| fingerprint-strings:
| NULL:
|_ 550 12345 0fffffffff000088808880000000000000088800000008fffffff00
12/tcp open unknown
| fingerprint-strings:
| NULL:
|_ 550 12345 0ffffffff80008808880000000880000008880088800008ffffff00
13/tcp open daytime?
| fingerprint-strings:
| NULL:
|_ 550 12345 0ffffffff000000888000000000800000080000008800007fffff00
14/tcp open unknown
| fingerprint-strings:
| NULL:
|_ 550 12345 0fffffff8000000000008888000000000080000000000007fffff00
15/tcp open netstat?
| fingerprint-strings:
| NULL:
|_ 550 12345 0ffffff70000000008cffffffc0000000080000000000008fffff00
16/tcp open unknown
| fingerprint-strings:
| NULL:
|_ 550 12345 0ffffff8000000008ffffff007f8000000007cf7c80000007ffff00
17/tcp open qotd?
| fingerprint-strings:
| JavaRMI, NULL:
|_ 550 12345 0fffff7880000780f7cffff7800f8000008fffffff80808807fff00
18/tcp open msp?
| fingerprint-strings:
| NULL:
|_ 550 12345 0fff78000878000077800887fc8f80007fffc7778800000880cff00
19/tcp open chargen?
| fingerprint-strings:
| NULL:
|_ 550 12345 0ff70008fc77f7000000f80008f8000007f0000000000000888ff00
20/tcp open ftp-data?
| fingerprint-strings:
| NULL:
|_ 550 12345 0ff0008f00008ffc787f70000000000008f000000087fff8088cf00
21/tcp open ftp?
|_ftp-syst: ERROR: Script execution failed (use -d to debug)
|_ssl-date: ERROR: Script execution failed (use -d to debug)
|_tls-alpn: ERROR: Script execution failed (use -d to debug)
|_ftp-anon: ERROR: Script execution failed (use -d to debug)
| fingerprint-strings:
| LDAPSearchReq, NULL:
|_ 550 12345 0f7000f800770008777 go to port 12345 80008f7f700880cf00
|_sslv2: ERROR: Script execution failed (use -d to debug)
|_ssl-cert: ERROR: Script execution failed (use -d to debug)
|_ftp-bounce: ERROR: Script execution failed (use -d to debug)
|_tls-nextprotoneg: ERROR: Script execution failed (use -d to debug)
22/tcp open ssh?
| fingerprint-strings:
| NULL:
|_ 550 12345 0f8008c008fff8000000000000780000007f800087708000800ff00
23/tcp open telnet?
| fingerprint-strings:
| NULL, SMBProgNeg:
|_ 550 12345 0f8008707ff07ff8000008088ff800000000f7000000f800808ff00
24/tcp open priv-mail?
| fingerprint-strings:
| NULL, X11Probe:
|_ 550 12345 0f7000f888f8007ff7800000770877800000cf780000ff00807ff00
25/tcp open smtp?
| fingerprint-strings:
| FourOhFourRequest, NULL:
|_ 550 12345 0ff0808800cf0000ffff70000f877f70000c70008008ff8088fff00
|_smtp-commands: SMTP EHLO nmap.scanme.org: failed to receive data: connection closed
26/tcp open rsftp?
| fingerprint-strings:
| FourOhFourRequest, NULL:
|_ 550 12345 0ff70800008ff800f007fff70880000087f70000007fcf7007fff00
27/tcp open nsw-fe?
| fingerprint-strings:
| NULL, SMBProgNeg:
|_ 550 12345 0fff70000007fffcf700008ffc778000078000087ff87f700ffff00
28/tcp open unknown
| fingerprint-strings:
| NULL:
|_ 550 12345 0ffffc000000f80fff700007787cfffc7787fffff0788f708ffff00
29/tcp open msg-icp?
| fingerprint-strings:
| NULL:
|_ 550 12345 0fffff7000008f00fffff78f800008f887ff880770778f708ffff00
30/tcp open unknown
| fingerprint-strings:
| LPDString, NULL:
|_ 550 12345 0ffffff8000007f0780cffff700000c000870008f07fff707ffff00
31/tcp open msg-auth?
| fingerprint-strings:
| FourOhFourRequest, NULL:
|_ 550 12345 0ffffcf7000000cfc00008fffff777f7777f777fffffff707ffff00
32/tcp open unknown
| fingerprint-strings:
| NULL, X11Probe:
|_ 550 12345 0cccccff0000000ff000008c8cffffffffffffffffffff807ffff00
33/tcp open dsp?
| fingerprint-strings:
| NULL, SMBProgNeg:
|_ 550 12345 0fffffff70000000ff8000c700087fffffffffffffffcf808ffff00
34/tcp open unknown
| fingerprint-strings:
| Kerberos, NULL:
|_ 550 12345 0ffffffff800000007f708f000000c0888ff78f78f777c008ffff00
35/tcp open priv-print?
| fingerprint-strings:
| FourOhFourRequest, NULL:
|_ 550 12345 0fffffffff800000008fff7000008f0000f808f0870cf7008ffff00
36/tcp open unknown
| fingerprint-strings:
| NULL:
|_ 550 12345 0ffffffffff7088808008fff80008f0008c00770f78ff0008ffff00
37/tcp open time?
| fingerprint-strings:
| Kerberos, NULL:
|_ 550 12345 0fffffffffffc8088888008cffffff7887f87ffffff800000ffff00
38/tcp open rap?
| fingerprint-strings:
| NULL, X11Probe:
|_ 550 12345 0fffffffffffff7088888800008777ccf77fc777800000000ffff00
39/tcp open rlp?
| fingerprint-strings:
| NULL, SSLSessionReq:
|_ 550 12345 0fffffffffffffff800888880000000000000000000800800cfff00
40/tcp open unknown
| fingerprint-strings:
| Help, NULL:
|_ 550 12345 0fffffffffffffffff70008878800000000000008878008007fff00
41/tcp open graphics?
| fingerprint-strings:
| NULL:
|_ 550 12345 0fffffffffffffffffff700008888800000000088000080007fff00
42/tcp open nameserver?
| fingerprint-strings:
| NULL:
|_ 550 12345 0fffffffffffffffffffffc800000000000000000088800007fff00
43/tcp open whois?
| fingerprint-strings:
| NULL:
|_ 550 12345 0fffffffffffffffffffffff7800000000000008888000008ffff00
44/tcp open mpm-flags?
| fingerprint-strings:
| NULL:
|_ 550 12345 0fffffffffffffffffffffffff7878000000000000000000cffff00
45/tcp open mpm?
| fingerprint-strings:
| NULL:
|_ 550 12345 0ffffffffffffffffffffffffffffffc880000000000008ffffff00
46/tcp open mpm-snd?
| fingerprint-strings:
| NULL:
|_ 550 12345 0ffffffffffffffffffffffffffffffffff7788888887ffffffff00
47/tcp open ni-ftp?
| fingerprint-strings:
| NULL, oracle-tns:
|_ 550 12345 0ffffffffffffffffffffffffffffffffffffffffffffffffffff00
48/tcp open auditd?
| fingerprint-strings:
| NULL:
|_ 550 12345 0000000000000000000000000000000000000000000000000000000
49/tcp open tacacs?
| fingerprint-strings:
| NULL:
|_ 550 12345 0000000000000000000000000000000000000000000000000000000
50/tcp open re-mail-ck?
| fingerprint-strings:
| NULL:
|_ 550 12345 0000000000000000000000000000000000000000000000000000000
51/tcp open ftp Novell NetWare ftpd v2728
52/tcp open xns-time?
| fingerprint-strings:
| NULL:
| HTTP/1.1 302 Found
| hServer: Vernier/133921414
|_ oLocation: https://0887:447/
53/tcp open http Panasonic sPodQqMML webcam http config
|_dns-nsid: ERROR: Script execution failed (use -d to debug)
54/tcp open smtp qpsmtpd
|_smtp-commands: SMTP EHLO nmap.scanme.org: failed to receive data: connection closed
55/tcp open imap Mirapoint imapd icEbp
|_imap-capabilities: CAPABILITY
56/tcp open xns-auth?
| fingerprint-strings:
| NULL, oracle-tns:
| HTTP/1.1 200 OK
| pServer: KM_HTTP-Server/3078325
|_ g<title>Kyocera Command Center</title>
57/tcp open priv-term?
| fingerprint-strings:
| NULL:
| HTTP/1.0 200 OK
| Pragma:no-cache
| Content-Length: 1r
| Content-Type: text/html
| <html>
| <head>
|_ <title>AXIS 676215432; IP address: 16826</title>
58/tcp open xns-mail?
| fingerprint-strings:
| NULL:
| 0000000000000000000
| |0000
|_ 0000000000000000000
59/tcp open http Linksys WAP11 http config
|_http-title: Site doesn't have a title (text/html).
60/tcp open unknown
| fingerprint-strings:
| NULL:
|_ 220 [?wZmqZoXD]? Microsoft ESMTP MAIL Service, Version: IPbdwdmrx ready
61/tcp open http Google Mini search appliance httpd
|_http-title: Site doesn't have a title (text/html).
62/tcp open smtp-proxy EdgeWave MAG3000 Email Filtering appliance smtp proxy
63/tcp open http Hay Systems HSL 2.75G Femtocell http config
|_http-title: Welcome to INTEGRITY
|_http-server-header: Integrity
64/tcp open ident FreeBSD identd
65/tcp open tacacs-ds?
| fingerprint-strings:
| NULL:
| HTTP/1.1 832 a
| Content-Length: 6r
| Pragma: no-cache
| Expires: 0
| Connection: close
| Content-Type: text/html
| <HTML>
| <HEAD><TITLE>
| SMART - SMART Bridgit - Download Conferencing Software
|_ </TITLE>
66/tcp open pop3 Classic Hamster pop3d (Permission denied)
67/tcp open dhcps?
| fingerprint-strings:
| Help, NULL:
| match http m%^HTTP/1.0 200 OK
| b<title>?:Livebox|HNM</title>
| <meta http-equiv="content-type" content="text/html; charset=UTF-8">
| <meta http-equiv="Content-language" content="fr">
| <meta name="author" content="Nicolas VIVIEN">
|_ <meta name="Copyright" content="SAGEM COMMUNICATIONS">%s p/Sagem Livebox WAP http config/ d/WAP/
68/tcp open dhcpc?
| fingerprint-strings:
| NULL:
| HTTP/1.1 -1 Bad Request
| Date: c 3w2049 911PST
| Server: TargetWeb/RzJqSnL_ (TargetOS)
|_ Connection: close
69/tcp open http SAP Internet DB httpd 3
|_http-title: Site doesn't have a title.
|_http-server-header: SAP-Internet-SapDb-Server/3
70/tcp open gopher?
|_gopher-ls:
| fingerprint-strings:
| NULL:
|_ obby_welcome:4nnet6_encryption:3n
71/tcp open telnet CyberSwitching Dualcom power device rabbit 2000 embedded telnetd
72/tcp open netrjs-2?
| fingerprint-strings:
| NULL:
|_ 0000000000000
73/tcp open http Everfocus webcam http config
|_http-server-header: http server/everfocus
74/tcp open http Dune httpd 636724
|_http-title: Site doesn't have a title.
|_http-server-header: Dune/636724
75/tcp open smtp
| fingerprint-strings:
| NULL:
|_ 220 SMTP-Server Classic Hamster ?:Vr.|Version 48398507 (Build 318132282)
|_smtp-commands: SMTP EHLO nmap.scanme.org: failed to receive data: connection closed
76/tcp open telnet
| fingerprint-strings:
| NULL:
| 0QEMU ehFbQ monitor - type 'help' for more information
|_ (qemu)
77/tcp open priv-rje?
| fingerprint-strings:
| JavaRMI, NULL, afp:
| HTTP/1.1 401 Unauthorized
| WWW-Authenticate: Basic realm="View Home & Status Web Pages"
|_ mServer: Allegro-Software-RomPager/wwG
78/tcp open http Konica Minolta PageScope Web Connection httpd
|_http-title: Site doesn't have a title (text/html).
79/tcp open ftp OpenVMS Secure/IP ftpd rCwPUDNz
80/tcp open http?
81/tcp open textui TeamSpeak 3 ServerQuery
82/tcp open xfer?
| fingerprint-strings:
| JavaRMI, NULL:
| 000@TransBase Multiplexer error report:
|_ Illegal request
83/tcp open mit-ml-dev?
| fingerprint-strings:
| NULL:
| [1;1fATOS Telnet Server
| CTRL+d to exit
| Init Command Line Interface..
| Boot Version: 4
| Boot Date: /34 46/1
| ATOS Version: 9906 (
| ATOS Date: 7:449 5/
| Hardware: jr
| Product Code : 8r
| Serial Number : 3r
| LAN0 MAC Address : D:CDD99
| ADSL Modem SW version: YJTZ *
| ADSL Modem API version: 3r
| ADSL Driver version: G
| release: Mlx_xhDsl+
| encryption not supported
| Vinetic fw version : mG_VCD
|_ User name :
84/tcp open imap Binc imapd
|_imap-capabilities: CAPABILITY
85/tcp open telnet Apache Felix remote console
86/tcp open ftp OpenFTPD
87/tcp open donkey MLDonkey multi-network P2P GUI port
88/tcp open http Octoshape P2P streaming web service
|_http-title: Site doesn't have a title.
89/tcp open su-mit-tg?
| fingerprint-strings:
| LANDesk-RC, NCP, NULL:
| HTTP/1.0 551 n
| Content-Type: text/html
|_ q<TITLE>Lexmark Optra SC g/TITLE>
90/tcp open http Panasonic ZMrh webcam http config
91/tcp open mit-dov?
92/tcp open http Openwbem CIMOM httpd ZBEZoOx
|_http-server-header: openwbem/ZBEZoOx (CIMOM)
|_http-title: Site doesn't have a title.
93/tcp open http-proxy Astaro Security http proxy
|_http-title: Site doesn't have a title.
94/tcp open nagios-nsca Nagios NSCA
95/tcp open http QNAP TS-219, TS-239, or TS-509 NAS http config VhYt
|_http-server-header: http server VhYt
96/tcp open dixie?
| fingerprint-strings:
| NULL, NotesRPC:
| +Network Services Processor *
| Version ZvDFtn *
|_ (Estech Systems, Inc.)
97/tcp open http Cherokee httpd e
|_http-server-header: Cherokee/e
|_http-title: Site doesn't have a title.
98/tcp open linuxconf?
| fingerprint-strings:
| NULL, WMSRequest:
| HTTP/1.1 404 Not Found
| rExpires: Thu, 01-Jan-1970 00:00:00 GMT
|_ l<title>VMware vCloud Director</title>
99/tcp open metagram?
| fingerprint-strings:
| NULL:
|_ You are not welcome to use pfrom sONkgfF.
100/tcp open newacct?
| fingerprint-strings:
| LANDesk-RC, NULL:
| HTTP/1.1 200 OK
| CACHE-CONTROL: no-cache
| j<META name="author" content="J.Huber, R.Kunz">
|_ <TITLE>Speedport W tKonfigurationsprogramm</TITLE>
9 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at https://nmap.org/cgi-bin/submit.cgi?new-service :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port1-TCP:V=7.95%I=7%D=9/1%Time=68B5EF47%P=x86_64-pc-linux-gnu%r(NULL,4
SF:1,"550\x2012345\x200000000000000000000000000000000000000000000000000000
SF:000");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port2-TCP:V=7.95%I=7%D=9/1%Time=68B5EF47%P=x86_64-pc-linux-gnu%r(NULL,4
SF:1,"550\x2012345\x200000000000000000000000000000000000000000000000000000
SF:000");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port3-TCP:V=7.95%I=7%D=9/1%Time=68B5EF47%P=x86_64-pc-linux-gnu%r(NULL,4
SF:1,"550\x2012345\x200000000000000000000000000000000000000000000000000000
SF:000");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port4-TCP:V=7.95%I=7%D=9/1%Time=68B5EF46%P=x86_64-pc-linux-gnu%r(NULL,4
SF:1,"550\x2012345\x200000000000000000000000000000000000000000000000000000
SF:000");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port5-TCP:V=7.95%I=7%D=9/1%Time=68B5EF46%P=x86_64-pc-linux-gnu%r(NULL,4
SF:1,"550\x2012345\x200000000000000000000000000000000000000000000000000000
SF:000");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port6-TCP:V=7.95%I=7%D=9/1%Time=68B5EF46%P=x86_64-pc-linux-gnu%r(NULL,4
SF:1,"550\x2012345\x200fffffffffffffffffffffffffffffffffffffffffffffffffff
SF:f00");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port7-TCP:V=7.95%I=7%D=9/1%Time=68B5EF47%P=x86_64-pc-linux-gnu%r(NULL,4
SF:1,"550\x2012345\x200fffffffffffff777778887777777777cfffffffffffffffffff
SF:f00");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port8-TCP:V=7.95%I=7%D=9/1%Time=68B5EF46%P=x86_64-pc-linux-gnu%r(NULL,4
SF:1,"550\x2012345\x200fffffffffff8000000000000000008888887cfcffffffffffff
SF:f00");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port9-TCP:V=7.95%I=7%D=9/1%Time=68B5EF47%P=x86_64-pc-linux-gnu%r(NULL,4
SF:1,"550\x2012345\x200ffffffffff80000088808000000888800000008887fffffffff
SF:f00");
Service Info: Hosts: l-B, LJjVIuSA, _A; OSs: NetWare, FreeBSD, Windows, OpenVMS; Devices: webcam, router, proxy server, WAP, power-device; CPE: cpe:/o:novell:netware, cpe:/h:panasonic:spodqqmml, cpe:/h:linksys:wap11, cpe:/o:hay_systems:hsl_2.75g_femtocell, cpe:/o:freebsd:freebsd
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 600.21 seconds