┌──(root㉿Eecho)-[~] └─# rustscan -a 192.168.43.120 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Port scanning: Because every port has a story to tell.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.43.120:22 Open 192.168.43.120:80 Open 192.168.43.120:3006 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.120 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-14 16:26 +0800 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 16:26 Completed NSE at 16:26, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 16:26 Completed NSE at 16:26, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 16:26 Completed NSE at 16:26, 0.00s elapsed Initiating ARP Ping Scan at 16:26 Scanning 192.168.43.120 [1 port] Completed ARP Ping Scan at 16:26, 0.05s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 16:26 Completed Parallel DNS resolution of 1 host. at 16:26, 0.50s elapsed DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 16:26 Scanning 192.168.43.120 [3 ports] Discovered open port 22/tcp on 192.168.43.120 Discovered open port 80/tcp on 192.168.43.120 Discovered open port 3006/tcp on 192.168.43.120 Completed SYN Stealth Scan at 16:26, 0.02s elapsed (3 total ports) Initiating Service scan at 16:26 Scanning 3 services on 192.168.43.120 Completed Service scan at 16:26, 11.05s elapsed (3 services on 1 host) Initiating OS detection (try #1) against 192.168.43.120 NSE: Script scanning 192.168.43.120. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 16:26 Completed NSE at 16:26, 0.22s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 16:26 Completed NSE at 16:26, 0.01s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 16:26 Completed NSE at 16:26, 0.00s elapsed Nmap scan report for 192.168.43.120 Host is up, received arp-response (0.00066s latency). Scanned at 2026-05-14 16:26:06 CST for 13s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 10.0 (protocol 2.0) 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.66 ((Unix)) |_http-title: It works! Apache httpd | http-methods: | Supported Methods: POST OPTIONS HEAD GET TRACE |_ Potentially risky methods: TRACE |_http-server-header: Apache/2.4.66 (Unix) 3006/tcp open http syn-ack ttl 64 Node.js (Express middleware) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Site doesn't have a title (text/html; charset=utf-8). MAC Address: 08:00:27:7C:08:CD (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4) TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=5/14%OT=22%CT=%CU=36670%PV=Y%DS=1%DC=D%G=N%M=080027%TM OS:=6A05872B%P=x86_64-pc-linux-gnu)SEQ(SP=FB%GCD=1%ISR=10D%TI=Z%CI=Z%II=I%T OS:S=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5= OS:M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=F OS:E88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0% OS:Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S= OS:A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R= OS:Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N% OS:T=40%CD=S)
Uptime guess: 1.740 days (since Tue May 12 22:40:31 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=251 (Good luck!) IP ID Sequence Generation: All zeros
TRACEROUTE HOP RTT ADDRESS 1 0.66 ms 192.168.43.120
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 16:26 Completed NSE at 16:26, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 16:26 Completed NSE at 16:26, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 16:26 Completed NSE at 16:26, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 13.44 seconds Raw packets sent: 26 (1.938KB) | Rcvd: 18 (1.410KB)
wiktor@Local:~$ ssh citrus@localhost -i ~/.ssh/id_rsa The authenticity of host 'localhost (::1)' can't be established. ED25519 key fingerprint is SHA256:xJ90oWmr5sPR2afHz9etzSdtxINmLI+JvbwgV/iCsWY. This host key is known by the following other names/addresses: ~/.ssh/known_hosts:1: 127.0.0.1 Are you sure you want to continue connecting (yes/no/[fingerprint])? YES Warning: Permanently added 'localhost' (ED25519) to the list of known hosts. _ __ _____| | ___ ___ _ __ ___ ___ \ \ /\ / / _ \ |/ __/ _ \| '_ ` _ \ / _ \ \ V V / __/ | (_| (_) | | | | | | __/ \_/\_/ \___|_|\___\___/|_| |_| |_|\___|
citrus@Local:~$ ID -bash: ID: command not found citrus@Local:~$ id uid=1001(citrus) gid=1001(citrus) groups=1001(citrus) citrus@Local:~$
citrus -> root
1 2 3 4 5 6 7 8 9 10 11 12 13
citrus@Local:~$ sudo -l Matching Defaults entries for citrus on Local: secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
Runas and Command-specific defaults for citrus: Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"
User citrus may run the following commands on Local: (ALL : ALL) NOPASSWD: /usr/local/bin/pm2 citrus@Local:~$ cat /usr/local/bin/pm2 #!/usr/bin/env node
