Platform: TryHackMe Difficulty: Medium Reconnaissance Nmap nmap -sC -sV -A MACHINE-IP -oA nmap Enter fullscreen mode Exit fullscreen mode Starting Nmap 7.98 at 2026-06-12 06:47 -0400 Nmap scan report for 10.49.133.153 Host is up (0.075s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0 ) | ssh-hostkey: | 2048 ea:c9:e8:67:76:0a:3f:97:09:a7:d7:a6:63:ad:c1:2c (RSA) | 256 0f:c8:f6:d3:8e:4c:ea:67:47:68:84:dc:1c:2b:2e:34 (ECDSA) |_ 256 05:53:99:fc:98:10:b5:c3:68:00:6c:29:41:da:a5:c9 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-title: "VulnNet" |_http-server-header: Apache/2.4.29 (Ubuntu) Enter fullscreen mode Exit fullscreen mode The attack surface here is intentionally minimal - only two ports are open. Port Service 22 OpenSSH 7.6p1 (Ubuntu) 80 Apache httpd 2.4.29 No SMB, no AD, no WinRM. Everything is going to happen through the web.…