---
# System prepended metadata

title: NCSF

---

# NCSF

verona.net 166.48.22.5

Discovered open port 80/tcp on 166.48.22.17                                    
Discovered open port 80/tcp on 166.48.22.11                                    
Discovered open port 80/tcp on 166.48.22.12                                    
Discovered open port 80/tcp on 166.48.22.6                                     
Discovered open port 80/tcp on 166.48.22.16                                    
Discovered open port 80/tcp on 166.48.22.13                                    
Discovered open port 80/tcp on 166.48.22.7                                     
Discovered open port 80/tcp on 166.48.22.10                                    
Discovered open port 80/tcp on 166.48.22.14 

----
166.48.22.1
PORT    STATE SERVICE
22/tcp  open  ssh
179/tcp open  bgp

----
166.48.22.6 (OpenKm - exploits available)
PORT   STATE SERVICE
80/tcp open  http

----
166.48.22.7
PORT   STATE SERVICE
80/tcp open  http

----
166.48.22.10
PORT   STATE SERVICE
80/tcp open  http
Investigating this one -Nate

----
166.48.22.11
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
80/tcp   open  http
443/tcp  open  https
3306/tcp open  mysql

----
166.48.22.12
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Note:
Allows TRACE HTTP method
Using TRACE gives a 200 response with the following message (decoded from B64):

"TRACE / HTTP/1.1
Host: 166.48.22.12
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,**application/xml**;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
If-Modified-Since: Mon, 11 Jun 2007 18:53:14 GMT
If-None-Match: "2d-432a5e4a73a80"
Cache-Control: max-age=0, no-cache
Origin: http://166.48.22.12
Pragma: no-cache"
Appears to be reflectintg the request headers?

----
166.48.22.14
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
443/tcp  open  https
445/tcp  open  microsoft-ds
3306/tcp open  mysql

----
166.48.22.15
PORT    STATE SERVICE
22/tcp  open  ssh
135/tcp open  msrpc
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

nmblookup -A 166.48.22.15
Looking up status of 166.48.22.15
	VERONA-SRV04    <20> -         B <ACTIVE> 
	VERONA-SRV04    <00> -         B <ACTIVE> 
	WORKGROUP       <00> - <GROUP> B <ACTIVE> 
	WORKGROUP       <1e> - <GROUP> B <ACTIVE> 
	WORKGROUP       <1d> -         B <ACTIVE> 
	..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> 

	MAC Address = 00-02-B3-00-33-00
 
The install_notes file on the SMB shares contained a txt with the following contents:
"Hi Patrick

I installed RemoteMouse 3.008 like you asked. I can't remember what port it is running on, but it should be there. This way, IT support can connect and assist me with transferring those files you told me about. 

Thank you!

- Gus
BPR Telecom Maintenance Team 
353-1243"
    
Found that RemoteMouse is running on port 1978, and does not require any authentication. It is exploitable with this script: https://www.exploit-db.com/exploits/46697
    
Still unable to get the exploit to work correctly


----
166.48.22.16
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
443/tcp  open  https
445/tcp  open  microsoft-ds
3306/tcp open  mysql

----
166.48.22.17
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
443/tcp  open  https
445/tcp  open  microsoft-ds
3306/tcp open  mysql
    
    +----+--------------+------------+----------------------------------+
| id | legal_name   | logon_name | logon_password                   |
+----+--------------+------------+----------------------------------+
| 0  | <blank>      | <blank>    | <blank>                          |
| 1  | Jacob Peters | jacob      | 5f4dcc3b5aa765d61d8327deb882cf99 |
| 2  | Joanna Smith | joanna     | ae2b1fca515949e5d54fb22b8ed95575 |
| 3  | BUS_DRIVER   | driver     | 95c065fb9c29e1799b96e054bcf80ee8 |
| 4  | Dylan Branch | dylan      | 827ccb0eea8a706c4c34a16891f84e7b |
+----+--------------+------------+----------------------------------+
