Exploit

Host:

192.168.155.97

Nmap

PORT      STATE SERVICE    REASON         VERSION
22/tcp    open  ssh        syn-ack ttl 61 OpenSSH 7.9p1 Debian 
23/tcp    open  telnet     syn-ack ttl 61 Linux telnetd
25/tcp    open  smtp       syn-ack ttl 61 Postfix smtpd
| ssl-cert: Subject: commonName=walla
| Subject Alternative Name: DNS:walla
| Issuer: commonName=walla
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2020-09-17T18:26:36
| Not valid after:  2030-09-15T18:26:36
| MD5:   097c:bda1:76ab:9b73:c8ef:68ab:84e9:a055
| SHA-1: 6c4b:fee3:0bd6:d910:2ef9:f81a:3a41:72d8:31bd:baa
|_ssl-date: TLS randomness does not represent time
|_smtp-commands: walla, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING
53/tcp    open  tcpwrapped syn-ack ttl 61
422/tcp   open  ssh        syn-ack ttl 61 OpenSSH 7.9p1 Debian 
8091/tcp  open  http       syn-ack ttl 61 lighttpd 1.4.53
|_http-server-header: lighttpd/1.4.53
|_http-favicon: Unknown favicon MD5: B5F9F8F2263315029AD7A81420E6CC2D
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  Basic realm=RaspAP
42042/tcp open  ssh        syn-ack ttl 61 OpenSSH 7.9p1 Debian 

UDP?