Reconnaissance

Using nmap for scanning ports

nmap -v 10.10.8.20

Untitled

nmap -sV -v -p 8983 10.10.8.20


root@ip-10-10-195-37:~# nmap -v  -sV -p 8983 10.10.8.20

Starting Nmap 7.60 ( <https://nmap.org> ) at 2021-12-14 11:56 GMT
NSE: Loaded 42 scripts for scanning.
Initiating ARP Ping Scan at 11:56
Scanning 10.10.29.198 [1 port]
Completed ARP Ping Scan at 11:56, 0.23s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 11:56
Completed Parallel DNS resolution of 1 host. at 11:56, 0.00s elapsed
Initiating SYN Stealth Scan at 11:56
Scanning ip-10-10-29-198.eu-west-1.compute.internal (10.10.29.198) [1 port]
Discovered open port 8983/tcp on 10.10.29.198
Completed SYN Stealth Scan at 11:56, 0.22s elapsed (1 total ports)
Initiating Service scan at 11:56
Scanning 1 service on ip-10-10-29-198.eu-west-1.compute.internal (10.10.29.198)
Completed Service scan at 11:56, 11.29s elapsed (1 service on 1 host)
NSE: Script scanning 10.10.29.198.
Initiating NSE at 11:56
Completed NSE at 11:56, 0.78s elapsed
Initiating NSE at 11:56
Completed NSE at 11:56, 0.00s elapsed
Nmap scan report for ip-10-10-29-198.eu-west-1.compute.internal (10.10.29.198)
Host is up (0.00033s latency).

PORT     STATE SERVICE VERSION
8983/tcp open  http    Apache Solr
MAC Address: 02:A0:39:01:E1:F1 (Unknown)

Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .
Nmap done: 1 IP address (1 host up) scanned in 12.99 seconds
           Raw packets sent: 3 (116B) | Rcvd: 3 (116B)

Found service Apache Solr running vulnerable to log4j.