> For the complete documentation index, see [llms.txt](https://eth3real.gitbook.io/eth3real/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eth3real.gitbook.io/eth3real/documentation/platforms/hackthebox/labs/medium/devarea.md). # DevArea ``` rustscan -a 10.129.18.190 -b 1000 -t 5000 -- -A -sCV .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Scanning ports like it's my full-time job. Wait, it is. [~] The config file is expected to be at "/home/rustscan/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 2147483484'. Open 10.129.18.190:21 Open 10.129.18.190:22 Open 10.129.18.190:80 Open 10.129.18.190:8080 Open 10.129.18.190:8500 Open 10.129.18.190:8888 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} {{ip}} -A -sCV" on ip 10.129.18.190 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-29 04:46 UTC NSE: Loaded 157 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 04:46 Completed NSE at 04:46, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 04:46 Completed NSE at 04:46, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 04:46 Completed NSE at 04:46, 0.00s elapsed Initiating Ping Scan at 04:46 Scanning 10.129.18.190 [2 ports] Completed Ping Scan at 04:46, 0.15s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 04:46 Completed Parallel DNS resolution of 1 host. at 04:46, 0.00s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating Connect Scan at 04:46 Scanning 10.129.18.190 [6 ports] Discovered open port 22/tcp on 10.129.18.190 Discovered open port 8888/tcp on 10.129.18.190 Discovered open port 21/tcp on 10.129.18.190 Discovered open port 80/tcp on 10.129.18.190 Discovered open port 8080/tcp on 10.129.18.190 Discovered open port 8500/tcp on 10.129.18.190 Completed Connect Scan at 04:46, 0.14s elapsed (6 total ports) Initiating Service scan at 04:46 Scanning 6 services on 10.129.18.190 Completed Service scan at 04:47, 30.25s elapsed (6 services on 1 host) NSE: Script scanning 10.129.18.190. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 04:47 NSE: [ftp-bounce 10.129.18.190:21] PORT response: 500 Illegal PORT command. Completed NSE at 04:47, 5.95s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 04:47 Completed NSE at 04:47, 1.05s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 04:47 Completed NSE at 04:47, 0.01s elapsed Nmap scan report for 10.129.18.190 Host is up, received syn-ack (0.15s latency). Scanned at 2026-03-29 04:46:31 UTC for 38s PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack vsftpd 3.0.5 | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_drwxr-xr-x 2 ftp ftp 4096 Sep 22 2025 pub | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:10.10.15.149 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 1 | vsFTPd 3.0.5 - secure, fast, stable |_End of status 22/tcp open ssh syn-ack OpenSSH 9.6p1 Ubuntu 3ubuntu13.15 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 83:13:6b:a1:9b:28:fd:bd:5d:2b:ee:03:be:9c:8d:82 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBD5s4VbmJmJE5NzFN8hY3uJZo3GHyZbsZy5xQiGBTnfjhK1Ya4cJAcX8R+ZR01Q7zQN+S3HD/2cY8VXIwPDl1Yk= | 256 0a:86:fa:65:d1:20:b4:3a:57:13:d1:1a:c2:de:52:78 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJBNRMFlkdjnZ3/y18k16stZAv/NHxEz5Ut68zr4/KQt 80/tcp open http syn-ack Apache httpd 2.4.58 |_http-title: Did not follow redirect to http://devarea.htb/ |_http-server-header: Apache/2.4.58 (Ubuntu) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS 8080/tcp open http syn-ack Jetty 9.4.27.v20200227 |_http-title: Error 404 Not Found |_http-server-header: Jetty(9.4.27.v20200227) 8500/tcp open http syn-ack Golang net/http server | fingerprint-strings: | FourOhFourRequest: | HTTP/1.0 500 Internal Server Error | Content-Type: text/plain; charset=utf-8 | X-Content-Type-Options: nosniff | Date: Sun, 29 Mar 2026 04:46:59 GMT | Content-Length: 64 | This is a proxy server. Does not respond to non-proxy requests. | GenericLines, Help, LPDString, RTSPRequest, SIPOptions, SSLSessionReq, Socks5: | HTTP/1.1 400 Bad Request | Content-Type: text/plain; charset=utf-8 | Connection: close | Request | GetRequest: | HTTP/1.0 500 Internal Server Error | Content-Type: text/plain; charset=utf-8 | X-Content-Type-Options: nosniff | Date: Sun, 29 Mar 2026 04:46:42 GMT | Content-Length: 64 | This is a proxy server. Does not respond to non-proxy requests. | HTTPOptions: | HTTP/1.0 500 Internal Server Error | Content-Type: text/plain; charset=utf-8 | X-Content-Type-Options: nosniff | Date: Sun, 29 Mar 2026 04:46:43 GMT | Content-Length: 64 |_ This is a proxy server. Does not respond to non-proxy requests. |_http-title: Site doesn't have a title (text/plain; charset=utf-8). 8888/tcp open http syn-ack Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-favicon: Unknown favicon MD5: BAA090FBC1418C8C4971002CC5459574 |_http-title: Hoverfly Dashboard 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port8500-TCP:V=7.95%I=7%D=3/29%Time=69C8AEAE%P=x86_64-alpine-linux-musl SF:%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type: SF:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20 SF:Bad\x20Request")%r(GetRequest,E9,"HTTP/1\.0\x20500\x20Internal\x20Serve SF:r\x20Error\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nX-Conten SF:t-Type-Options:\x20nosniff\r\nDate:\x20Sun,\x2029\x20Mar\x202026\x2004: SF:46:42\x20GMT\r\nContent-Length:\x2064\r\n\r\nThis\x20is\x20a\x20proxy\x SF:20server\.\x20Does\x20not\x20respond\x20to\x20non-proxy\x20requests\.\n SF:")%r(HTTPOptions,E9,"HTTP/1\.0\x20500\x20Internal\x20Server\x20Error\r\ SF:nContent-Type:\x20text/plain;\x20charset=utf-8\r\nX-Content-Type-Option SF:s:\x20nosniff\r\nDate:\x20Sun,\x2029\x20Mar\x202026\x2004:46:43\x20GMT\ SF:r\nContent-Length:\x2064\r\n\r\nThis\x20is\x20a\x20proxy\x20server\.\x2 SF:0Does\x20not\x20respond\x20to\x20non-proxy\x20requests\.\n")%r(RTSPRequ SF:est,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/pla SF:in;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Reque SF:st")%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20 SF:text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\ SF:x20Request")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\n SF:Content-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r SF:\n\r\n400\x20Bad\x20Request")%r(FourOhFourRequest,E9,"HTTP/1\.0\x20500\ SF:x20Internal\x20Server\x20Error\r\nContent-Type:\x20text/plain;\x20chars SF:et=utf-8\r\nX-Content-Type-Options:\x20nosniff\r\nDate:\x20Sun,\x2029\x SF:20Mar\x202026\x2004:46:59\x20GMT\r\nContent-Length:\x2064\r\n\r\nThis\x SF:20is\x20a\x20proxy\x20server\.\x20Does\x20not\x20respond\x20to\x20non-p SF:roxy\x20requests\.\n")%r(LPDString,67,"HTTP/1\.1\x20400\x20Bad\x20Reque SF:st\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20c SF:lose\r\n\r\n400\x20Bad\x20Request")%r(SIPOptions,67,"HTTP/1\.1\x20400\x SF:20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nCo SF:nnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Socks5,67,"HTTP/1\. SF:1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=u SF:tf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request"); Service Info: Host: _; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 04:47 Completed NSE at 04:47, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 04:47 Completed NSE at 04:47, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 04:47 Completed NSE at 04:47, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 38.57 seconds ```