hackthebox-conceal（考点：161/ike/IIS/win10/juicy-potato）

namp

C:\root\Desktop> nmap -A 10.10.10.116
Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-18 04:34 EDT
Nmap scan report for 10.10.10.116
Host is up (0.26s latency).
All 1000 scanned ports on 10.10.10.116 are filtered
Too many fingerprints match this host to give specific OS details
Network Distance: 2 hops

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   266.33 ms 10.10.14.1
2   251.39 ms 10.10.10.116

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 280.15 seconds

没结果，开全局扫，太慢了。。。。

nmap -p 1-65535 -T4 -A -v 10.10.10.116

换个方式，加速扫。。。

C:\root\Desktop> masscan -p1-65535,U:1-65535 10.10.10.116 --rate=1000 -e tun0

Starting masscan 1.0.5 (http://bit.ly/14GZzcT) at 2020-04-18 08:54:26 GMT
 -- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 1 hosts [131070 ports/host]
Discovered open port 161/udp on 10.10.10.116        

就一个161，再拿nmap看看，果然运行着snmp

C:\root\Desktop> nmap -sV -sU -p161 10.10.10.116
Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-18 05:09 EDT
Nmap scan report for 10.10.10.116
Host is up (0.25s latency).

PORT    STATE SERVICE VERSION
161/udp open  snmp    SNMPv1 server (public)
Service Info: Host: Conceal

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.03 seconds

用专门的工具扫它。第一个工具提示超时，扫不出来？？

C:\root\Desktop> snmp-check 10.10.10.116
snmp-check v1.9 - SNMP enumerator
Copyright (c) 2005-2015 by Matteo Cantoni (www.nothink