# ============================================================
# SIMULATED Nmap Scan Results — CTF Challenge Resource
# ============================================================
# This is a fictional scan output for educational / CTF use.
# All IPs, hostnames, and services are simulated.
# ============================================================

Starting Nmap 7.94 ( https://nmap.org ) at 2026-04-08 14:32 UTC
Nmap scan report for ctf-target.example.com (10.0.1.50)
Host is up (0.0023s latency).
Not shown: 65527 closed tcp ports (reset)

PORT      STATE SERVICE         VERSION
22/tcp    open  ssh             OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 41:2e:a4:b5:c7:d1:e3:f5:08:1a:2b:3c:4d:5e:6f:70 (RSA)
|   256  6a:7b:8c:9d:0e:1f:2a:3b:4c:5d:6e:7f:80:91:a2:b3 (ECDSA)
|_  256  c1:d2:e3:f4:05:16:27:38:49:5a:6b:7c:8d:9e:af:b0 (ED25519)
| ssh-auth-methods:
|   Supported authentication methods:
|     publickey
|_    password
| vulns:
|   CVE-2018-15473 - OpenSSH User Enumeration
|_    State: VULNERABLE (username enumeration via timing attack)

80/tcp    open  http            nginx/1.14.0 (Ubuntu)
| http-title: Welcome to ctf-target
|_Requested resource was http://ctf-target.example.com/
| http-server-header: nginx/1.14.0 (Ubuntu)
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
| http-headers:
|   Server: nginx/1.14.0 (Ubuntu)
|   X-Powered-By: Express
|_  (No security headers detected: missing X-Frame-Options, X-Content-Type-Options, CSP, HSTS)
| http-enum:
|   /admin/: Admin panel (HTTP 200 — no redirect to login!)
|   /status: Nginx stub_status page
|   /.env: Environment file (HTTP 200 — EXPOSED)
|   /server-info: Server information page
|   /phpinfo.php: PHP information page
|_  /backup/: Directory listing enabled — contains db_backup_2026-04-01.sql.gz

443/tcp   open  ssl/http        nginx/1.14.0 (Ubuntu)
| ssl-cert: Subject: CN=ctf-target.example.com
|   Issuer: CN=ctf-target.example.com (SELF-SIGNED)
|   Not valid before: 2025-01-01T00:00:00
|_  Not valid after:  2030-01-01T00:00:00
| ssl-enum-ciphers:
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - C
|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: client
|     warnings:
|       64-bit block cipher 3DES vulnerable to SWEET32 attack
|       Broken cipher RC4 is deprecated by RFC 7465
|   TLSv1.1:
|     ciphers:
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|     compressors:
|       NULL
|   TLSv1.2:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp384r1) - A
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: C
| vulns:
|   CVE-2014-3566 - SSLv3 POODLE (Padding Oracle On Downgraded Legacy Encryption)
|_    State: LIKELY VULNERABLE (TLS 1.0 enabled — downgrade possible)

3306/tcp  open  mysql           MySQL 5.7.42-0ubuntu0.18.04.1
| mysql-info:
|   Protocol: 10
|   Version: 5.7.42-0ubuntu0.18.04.1
|   Thread ID: 847
|   Capabilities flags: 65535
|   Some Coverage flags: 15
|   Status: Autocommit
|_  Salt: \x5a\x3b\x2c\x1d\x0e\xff\x4a\x6b
| mysql-brute:
|   Accounts:
|     root:root - Valid credentials
|     admin:SuperSecret123! - Valid credentials
|_  Statistics: Performed 150 guesses in 3 seconds, average tps: 50.0
| mysql-databases:
|   production
|   mysql
|   information_schema
|   performance_schema
|_  sys
| vulns:
|   CVE-2023-21980 - MySQL Server Optimizer Unspecified Vulnerability
|_    State: LIKELY VULNERABLE (version 5.7.42 is affected)

6379/tcp  open  redis           Redis key-value store 6.2.7
| redis-info:
|   Version: 6.2.7
|   Mode: standalone
|   OS: Linux 5.4.0-150-generic x86_64
|   Connected clients: 12
|   Used memory: 158.42M
|   Total keys: 23847
|_  Auth: NOT REQUIRED (no password set)
| redis-brute:
|_  No authentication required — server allows unauthenticated access
| vulns:
|   CVE-2022-0543 - Redis Lua Sandbox Escape (Debian/Ubuntu)
|_    State: LIKELY VULNERABLE (Redis 6.2.7 on Ubuntu)

8080/tcp  open  http-proxy      Node.js Express framework
| http-title: API Server — Debug Mode
| http-methods:
|_  Supported Methods: GET HEAD POST PUT DELETE OPTIONS
| http-headers:
|   X-Powered-By: Express
|   Access-Control-Allow-Origin: *
|_  (CORS wildcard — any origin can make requests)
| http-enum:
|   /api/debug: Debug endpoint (returns stack traces)
|   /api/health: Health check (returns environment variables!)
|   /api/users: User listing (no authentication required)
|   /api/admin: Admin API (HTTP 200 — no auth!)
|_  /swagger/: Swagger UI — full API documentation exposed

9200/tcp  open  http            Elasticsearch REST API 7.17.0
| http-title: Elasticsearch Cluster
| http-methods:
|_  Supported Methods: GET HEAD POST PUT DELETE OPTIONS
| http-elasticsearch-info:
|   Cluster name: ctf-target-cluster
|   Cluster UUID: xYz123AbC-DeFgHiJkLmN
|   Version: 7.17.0
|   Tagline: You Know, for Search
|_  Security: DISABLED (xpack.security.enabled=false)
| http-enum:
|   /_cat/indices: Index listing (15 indices, includes "users", "credentials", "logs")
|   /_cluster/health: Cluster health (status: yellow)
|   /_search: Global search endpoint (no authentication)
|_  /_cat/nodes: Node information exposed
| vulns:
|   CVE-2021-22145 - Elasticsearch Memory Disclosure
|_    State: LIKELY VULNERABLE (version 7.17.0)

27017/tcp open  mongodb         MongoDB 5.0.14
| mongodb-info:
|   Version: 5.0.14
|   Storage engine: wiredTiger
|   Server status: ok
|_  Authentication: DISABLED
| mongodb-databases:
|   admin (36.00 KiB)
|   config (108.00 KiB)
|   local (83.00 KiB)
|   production (2.14 GiB)
|_  user_data (512.00 MiB)
| vulns:
|   CVE-2021-32040 - MongoDB Denial of Service
|_    State: LIKELY VULNERABLE

OS fingerprinting:
  Running: Linux 5.4.X
  OS details: Linux 5.4.0-150-generic (Ubuntu 20.04 LTS)
  Network Distance: 1 hop

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel:5.4

Traceroute:
HOP RTT     ADDRESS
1   2.31 ms 10.0.1.50

NSE: Script Post-scanning.
Nmap done: 1 IP address (1 host up) scanned in 347.82 seconds

# ============================================================
# Summary of Critical Findings
# ============================================================
#
# [CRITICAL] Redis (6379) — No authentication; CVE-2022-0543 Lua sandbox escape
# [CRITICAL] MongoDB (27017) — No authentication; database "production" exposed
# [CRITICAL] Elasticsearch (9200) — Security disabled; sensitive indices exposed
# [CRITICAL] MySQL (3306) — Default root:root credentials; exposed to network
# [CRITICAL] HTTP (80) — .env file exposed; admin panel without auth; directory listing
# [HIGH]     SSH (22) — OpenSSH 7.6 vulnerable to user enumeration (CVE-2018-15473)
# [HIGH]     HTTPS (443) — TLS 1.0 enabled; weak ciphers (RC4, 3DES); self-signed cert
# [HIGH]     API (8080) — Debug mode enabled; CORS wildcard; no auth on admin endpoints
# [MEDIUM]   OS — Ubuntu 20.04 with kernel 5.4.0-150 (check for local privilege escalation)