Exploit

Host:

192.168.56.100

Nmap

PORT      STATE SERVICE  REASON         VERSION
22/tcp    open  ssh      syn-ack ttl 61 OpenSSH 7.9p1 Debian 10+deb10u2 
80/tcp    open  http     syn-ack ttl 61 nginx
| http-methods: 
|_  Supported Methods: GET HEAD
|_http-title: Site doesn't have a title (text/html).
111/tcp   open  rpcbind  syn-ack ttl 61 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100003  3           2049/udp   nfs
|   100003  3,4         2049/tcp   nfs
|   100005  1,2,3      38921/tcp   mountd
|   100005  1,2,3      53150/udp   mountd
|   100021  1,3,4      37464/udp   nlockmgr
|   100021  1,3,4      40685/tcp   nlockmgr
|   100227  3           2049/tcp   nfs_acl
|_  100227  3           2049/udp   nfs_acl
2049/tcp  open  nfs      syn-ack ttl 61 3-4 (RPC #100003)
7742/tcp  open  http     syn-ack ttl 61 nginx
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: SORCERER
8080/tcp  open  http     syn-ack ttl 61 Apache Tomcat 7.0.4
|_http-title: Apache Tomcat/7.0.4
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Apache Tomcat
|_http-open-proxy: Proxy might be redirecting requests
38921/tcp open  mountd   syn-ack ttl 61 1-3 (RPC #100005)
39103/tcp open  mountd   syn-ack ttl 61 1-3 (RPC #100005)
40685/tcp open  nlockmgr syn-ack ttl 61 1-4 (RPC #100021)
54405/tcp open  mountd   syn-ack ttl 61 1-3 (RPC #100005)

UDP?

• Could potentially use scp_wrapper.sh