Last updated June 28, 2026 • 4 min read

Would you like to solve this machine together? Join our discord and/or our open HTB team!

Join the HackIndex community

Share writeups, ask questions, and stay current with techniques. Over 150 members.

Join Discord (opens in new tab)

Discovery

TCP scan across all ports:

kali㉿kali: ~

┌──(kali㉿kali)-[~]

└─$ nmap -p- --min-rate 5000 -T4 $TARGET_IP -oA nmap-allports

┌──(kali㉿kali)-[~]

└─$ nmap -sCV -p 22,80,110,143,993,995,2049 $TARGET_IP -oA nmap-services

22/tcp  open  ssh      OpenSSH 9.6p1 Ubuntu
80/tcp  open  http     nginx 1.24.0
110/tcp open  pop3     Dovecot pop3d
143/tcp open  imap     Dovecot imapd
993/tcp open  ssl/imap
995/tcp open  ssl/pop3
2049/tcp open  nfs_acl

SSH only accepts public key authentication. NFS on 2049 is worth checking before anything else.

kali㉿kali: ~

┌──(kali㉿kali)-[~]

└─$ showmount -e $TARGET_IP

Export list for $TARGET_IP:
/srv/nfs/onboarding *