> For the complete documentation index, see [llms.txt](https://eth3real.gitbook.io/eth3real/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eth3real.gitbook.io/eth3real/documentation/platforms/hackthebox/labs/easy/facts.md).
# Facts
Facts is a Easy Linux HackTheBox Machine
```
┌──(Eth3real㉿DΣDSEC)-[~/htb/labs/facts]
└─$ rustscan -a 10.129.10.72 -b 10 -t 5000 -- -A -sC -sV
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog :
: https://github.com/RustScan/RustScan :
--------------------------------------
You miss 100% of the ports you don't scan. - RustScan
[~] The config file is expected to be at "/home/rustscan/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 2147483484'.
Open 10.129.10.72:22
Open 10.129.10.72:80
Open 10.129.10.72:54321
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} {{ip}} -A -sC -sV" on ip 10.129.10.72
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-02-05 14:58 UTC
NSE: Loaded 157 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 14:58
Completed NSE at 14:58, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 14:58
Completed NSE at 14:58, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 14:58
Completed NSE at 14:58, 0.00s elapsed
Initiating Ping Scan at 14:58
Scanning 10.129.10.72 [2 ports]
Completed Ping Scan at 14:58, 0.08s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 14:58
Completed Parallel DNS resolution of 1 host. at 14:58, 0.00s elapsed
DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating Connect Scan at 14:58
Scanning 10.129.10.72 [3 ports]
Discovered open port 22/tcp on 10.129.10.72
Discovered open port 80/tcp on 10.129.10.72
Discovered open port 54321/tcp on 10.129.10.72
Completed Connect Scan at 14:58, 0.08s elapsed (3 total ports)
Initiating Service scan at 14:58
Scanning 3 services on 10.129.10.72
Completed Service scan at 14:58, 28.41s elapsed (3 services on 1 host)
NSE: Script scanning 10.129.10.72.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 14:58
Completed NSE at 14:58, 3.11s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 14:58
Completed NSE at 14:58, 0.38s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 14:58
Completed NSE at 14:58, 0.00s elapsed
Nmap scan report for 10.129.10.72
Host is up, received syn-ack (0.084s latency).
Scanned at 2026-02-05 14:58:21 UTC for 32s
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 9.9p1 Ubuntu 3ubuntu3.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 4d:d7:b2:8c:d4:df:57:9c:a4:2f:df:c6:e3:01:29:89 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNYjzL0v+zbXt5Zvuhd63ZMVGK/8TRBsYpIitcmtFPexgvOxbFiv6VCm9ZzRBGKf0uoNaj69WYzveCNEWxdQUww=
| 256 a3:ad:6b:2f:4a:bf:6f:48:ac:81:b9:45:3f:de:fb:87 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPCNb2NXAGnDBofpLTCGLMyF/N6Xe5LIri/onyTBifIK
80/tcp open http syn-ack nginx 1.26.3 (Ubuntu)
|_http-server-header: nginx/1.26.3 (Ubuntu)
|_http-title: Did not follow redirect to http://facts.htb/
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
54321/tcp open http syn-ack Golang net/http server
|_http-server-header: MinIO
|_http-title: Did not follow redirect to http://10.129.10.72:9001
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.0 400 Bad Request
| Accept-Ranges: bytes
| Content-Length: 303
| Content-Type: application/xml
| Server: MinIO
| Strict-Transport-Security: max-age=31536000; includeSubDomains
| Vary: Origin
| X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
| X-Amz-Request-Id: 189161ACBAA7B867
| X-Content-Type-Options: nosniff
| X-Xss-Protection: 1; mode=block
| Date: Thu, 05 Feb 2026 14:58:43 GMT
|
| InvalidRequestInvalid Request (invalid argument)/nice ports,/Trinity.txt.bak189161ACBAA7B867dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
| GenericLines, Help, RTSPRequest, SSLSessionReq:
| HTTP/1.1 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| Connection: close
| Request
| GetRequest:
| HTTP/1.0 400 Bad Request
| Accept-Ranges: bytes
| Content-Length: 276
| Content-Type: application/xml
| Server: MinIO
| Strict-Transport-Security: max-age=31536000; includeSubDomains
| Vary: Origin
| X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
| X-Amz-Request-Id: 189161A8F60C79AC
| X-Content-Type-Options: nosniff
| X-Xss-Protection: 1; mode=block
| Date: Thu, 05 Feb 2026 14:58:26 GMT
|
| InvalidRequestInvalid Request (invalid argument)/189161A8F60C79ACdd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
| HTTPOptions:
| HTTP/1.0 200 OK
| Vary: Origin
| Date: Thu, 05 Feb 2026 14:58:27 GMT
|_ Content-Length: 0
| http-methods:
|_ Supported Methods: GET OPTIONS
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port54321-TCP:V=7.95%I=7%D=2/5%Time=6984B013%P=x86_64-alpine-linux-musl
SF:%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:
SF:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20
SF:Bad\x20Request")%r(GetRequest,2B0,"HTTP/1\.0\x20400\x20Bad\x20Request\r
SF:\nAccept-Ranges:\x20bytes\r\nContent-Length:\x20276\r\nContent-Type:\x2
SF:0application/xml\r\nServer:\x20MinIO\r\nStrict-Transport-Security:\x20m
SF:ax-age=31536000;\x20includeSubDomains\r\nVary:\x20Origin\r\nX-Amz-Id-2:
SF:\x20dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\
SF:nX-Amz-Request-Id:\x20189161A8F60C79AC\r\nX-Content-Type-Options:\x20no
SF:sniff\r\nX-Xss-Protection:\x201;\x20mode=block\r\nDate:\x20Thu,\x2005\x
SF:20Feb\x202026\x2014:58:26\x20GMT\r\n\r\n<\?xml\x20version=\"1\.0\"\x20e
SF:ncoding=\"UTF-8\"\?>\nInvalidRequestInvali
SF:d\x20Request\x20\(invalid\x20argument\)/
SF:189161A8F60C79ACdd9025bab4ad464b049177c9
SF:5eb6ebf374d3b3fd1af9251148b658df7ac2e3e8")%r(HTTPOptio
SF:ns,59,"HTTP/1\.0\x20200\x20OK\r\nVary:\x20Origin\r\nDate:\x20Thu,\x2005
SF:\x20Feb\x202026\x2014:58:27\x20GMT\r\nContent-Length:\x200\r\n\r\n")%r(
SF:RTSPRequest,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20
SF:text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\
SF:x20Request")%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-T
SF:ype:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400
SF:\x20Bad\x20Request")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Req
SF:uest\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x2
SF:0close\r\n\r\n400\x20Bad\x20Request")%r(FourOhFourRequest,2CB,"HTTP/1\.
SF:0\x20400\x20Bad\x20Request\r\nAccept-Ranges:\x20bytes\r\nContent-Length
SF::\x20303\r\nContent-Type:\x20application/xml\r\nServer:\x20MinIO\r\nStr
SF:ict-Transport-Security:\x20max-age=31536000;\x20includeSubDomains\r\nVa
SF:ry:\x20Origin\r\nX-Amz-Id-2:\x20dd9025bab4ad464b049177c95eb6ebf374d3b3f
SF:d1af9251148b658df7ac2e3e8\r\nX-Amz-Request-Id:\x20189161ACBAA7B867\r\nX
SF:-Content-Type-Options:\x20nosniff\r\nX-Xss-Protection:\x201;\x20mode=bl
SF:ock\r\nDate:\x20Thu,\x2005\x20Feb\x202026\x2014:58:43\x20GMT\r\n\r\n<\?
SF:xml\x20version=\"1\.0\"\x20encoding=\"UTF-8\"\?>\nInvalidR
SF:equestInvalid\x20Request\x20\(invalid\x20argument\)/nice\x20ports,/Trinity\.txt\.bak
SF:189161ACBAA7B867dd9025bab4ad464b049177c95eb6ebf374d
SF:3b3fd1af9251148b658df7ac2e3e8");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 14:58
Completed NSE at 14:58, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 14:58
Completed NSE at 14:58, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 14:58
Completed NSE at 14:58, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.67 seconds
```
```
┌──(Eth3real㉿DΣDSEC)-[~/htb/labs/facts]
└─$ nikto -h http://facts.htb
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP: 10.129.10.72
+ Target Hostname: facts.htb
+ Target Port: 80
+ Start Time: 2026-02-05 20:24:51 (GMT5.5)
---------------------------------------------------------------------------
+ Server: nginx/1.26.3 (Ubuntu)
+ /: Uncommon header 'x-request-id' found, with contents: 7f27ad4e-04c9-455f-8855-5825dfa47f87.
+ /: Uncommon header 'x-runtime' found, with contents: 0.003747.
+ /FHqzB2mo.bas: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ /: Uncommon header 'plugin_front_cache' found, with contents: TRUE.
+ /admin.cgi: Cookie return_to created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
+ /cgi_wrapper: Drupal Link header found with value: ; rel=preload; as=style; nopush,; rel=preload; as=script; nopush. See: https://www.drupal.org/
^[[D+ 7962 requests: 0 error(s) and 6 item(s) reported on remote host
+ End Time: 2026-02-05 20:38:50 (GMT5.5) (839 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
```
"/admin/login" creating a account reveals version number