> For the complete documentation index, see [llms.txt](https://eth3real.gitbook.io/eth3real/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eth3real.gitbook.io/eth3real/documentation/platforms/hackthebox/labs/medium/smarthire.md). # SmartHire ``` # Nmap 7.99 scan initiated Mon May 18 09:19:56 2026 as: /usr/lib/nmap/nmap --privileged -A -sC -sV -vv -oN nop.txt 10.129.41.83 Nmap scan report for 10.129.41.83 Host is up, received echo-reply ttl 63 (0.14s latency). Scanned at 2026-05-18 09:19:58 EDT for 15s Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.15 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 41:3c:e3:bb:88:70:99:7f:b8:96:59:48:9b:85:98:69 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLg1Y2xxe0euIHDjjKTIrxL+XZXgsBabs0FMAMKBL8arUuELui3vhlkgcDVGcZ4vFWnsiu4osw5INjfcQGkp2BY= | 256 d5:9d:fd:6b:be:d8:39:6f:3f:43:ab:0e:f6:3e:22:db (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPc/kqsR+WxwGPMNTukcYPjzZRGjQL6N+0HsGIS1NV4U 80/tcp open http syn-ack ttl 63 nginx 1.18.0 (Ubuntu) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: nginx/1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://smarthire.htb/ Device type: general purpose|router Running: Linux 5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 5.0 - 5.14, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=5/18%OT=22%CT=1%CU=32028%PV=Y%DS=2%DC=T%G=Y%TM=6A0B120 OS:D%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%TS=A)OPS OS:(O1=M552ST11NW7%O2=M552ST11NW7%O3=M552NNT11NW7%O4=M552ST11NW7%O5=M552ST1 OS:1NW7%O6=M552ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN OS:(R=Y%DF=Y%T=40%W=FAF0%O=M552NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=A OS:S%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F OS:=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G% OS:RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S) Uptime guess: 27.419 days (since Mon Apr 20 23:17:06 2026) Network Distance: 2 hops TCP Sequence Prediction: Difficulty=260 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE (using port 5900/tcp) HOP RTT ADDRESS 1 143.64 ms 10.10.14.1 2 143.83 ms 10.129.41.83 Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Mon May 18 09:20:13 2026 -- 1 IP address (1 host up) scanned in 16.91 seconds ``` ``` ffuf -u http://smarthire.htb/ -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H 'Host: FUZZ.smarthire.htb' -fs 178 /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v2.1.0-dev ________________________________________________ :: Method : GET :: URL : http://smarthire.htb/ :: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt :: Header : Host: FUZZ.smarthire.htb :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 :: Filter : Response size: 178 ________________________________________________ models [Status: 401, Size: 137, Words: 11, Lines: 1, Duration: 154ms] :: Progress: [114442/114442] :: Job [1/1] :: 316 req/sec :: Duration: [0:06:49] :: Errors: 0 :: ``` ``` nikto -h models.smarthire.htb - Nikto v2.6.0 --------------------------------------------------------------------------- + Target IP: 10.129.41.83 + Target Hostname: models.smarthire.htb + Target Port: 80 + Platform: Unknown + Start Time: 2026-05-18 09:32:49 (GMT-4) --------------------------------------------------------------------------- + Server: nginx/1.18.0 (Ubuntu) + ERROR: Failed to check for updates: 403 + / - Requires Authentication for realm 'mlflow' + [700044] /: Default account found for 'mlflow' at (ID 'admin', PW 'password'). Generic account discovered. See: CWE-16 + [999984] /: Server may leak inodes via ETags, header found with file /, inode: 1758116347.0, size: 645, mtime: 3612482313. See: https://cve.mitre.org/cgi-bin/cvename.cgi?na me=CVE-2003-1418 + [999100] /: Uncommon header(s) 'content-disposition' found, with contents: inline; filename=index.html. + No CGI Directories found (use '-C all' to force check all possible dirs). CGI tests skipped. + [600575] nginx/1.18.0 appears to be outdated (current is at least 1.24.0). ```