search

Salem's Curse

Minimal writeup

hashtag
1. Footprinting:

┌──(kali㉿kali)-[~]
└─$ nmap -g53 -sS -T4 -p- -Pn -n --min-rate 4000 --disable-arp-ping salemmanor.hv
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-05 02:41 +07
Warning: 172.20.7.110 giving up on port because retransmission cap hit (6).
Nmap scan report for salemmanor.hv (172.20.7.110)
Host is up (0.16s latency).
Not shown: 65182 closed tcp ports (reset), 350 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
3000/tcp open  ppp

Nmap done: 1 IP address (1 host up) scanned in 36.93 seconds

┌──(kali㉿kali)-[~]
└─$ nmap -g53 -sCV -p22,80,3000 -Pn -n --disable-arp-ping salemmanor.hv
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-05 02:42 +07
Nmap scan report for salemmanor.hv (172.20.7.110)
Host is up (0.048s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
|   3072 95:30:f3:df:a0:a0:f5:2c:cb:3a:f7:4a:7d:c4:62:d5 (RSA)
|   256 21:d6:55:80:3b:05:0b:b6:f2:f3:0d:07:65:6a:87:41 (ECDSA)
|_  256 6b:5a:cd:21:7f:e0:a5:b2:96:02:18:13:56:db:8c:86 (ED25519)
80/tcp   open  http    Node.js (Express middleware)
|_http-title: Salem Manor Museum - Where History Haunts
3000/tcp open  ppp?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, GetRequest, HTTPOptions, Help, Kerberos, NCP, RPCCheck, RTSPRequest, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServerCookie: 
|     HTTP/1.0 400 Bad Request
|     Content-Type: text/html; charset=UTF-8
|_    WebSockets request was expected
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port3000-TCP:V=7.95%I=7%D=11/5%Time=690A5728%P=x86_64-pc-linux-gnu%r(Ge
SF:tRequest,65,"HTTP/1\.0\x20400\x20Bad\x20Request\r\nContent-Type:\x20tex
SF:t/html;\x20charset=UTF-8\r\n\r\nWebSockets\x20request\x20was\x20expecte
SF:d\r\n")%r(Help,65,"HTTP/1\.0\x20400\x20Bad\x20Request\r\nContent-Type:\
SF:x20text/html;\x20charset=UTF-8\r\n\r\nWebSockets\x20request\x20was\x20e
SF:xpected\r\n")%r(NCP,65,"HTTP/1\.0\x20400\x20Bad\x20Request\r\nContent-T
SF:ype:\x20text/html;\x20charset=UTF-8\r\n\r\nWebSockets\x20request\x20was
SF:\x20expected\r\n")%r(HTTPOptions,65,"HTTP/1\.0\x20400\x20Bad\x20Request
SF:\r\nContent-Type:\x20text/html;\x20charset=UTF-8\r\n\r\nWebSockets\x20r
SF:equest\x20was\x20expected\r\n")%r(RTSPRequest,65,"HTTP/1\.0\x20400\x20B
SF:ad\x20Request\r\nContent-Type:\x20text/html;\x20charset=UTF-8\r\n\r\nWe
SF:bSockets\x20request\x20was\x20expected\r\n")%r(RPCCheck,65,"HTTP/1\.0\x
SF:20400\x20Bad\x20Request\r\nContent-Type:\x20text/html;\x20charset=UTF-8
SF:\r\n\r\nWebSockets\x20request\x20was\x20expected\r\n")%r(DNSVersionBind
SF:ReqTCP,65,"HTTP/1\.0\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/
SF:html;\x20charset=UTF-8\r\n\r\nWebSockets\x20request\x20was\x20expected\
SF:r\n")%r(DNSStatusRequestTCP,65,"HTTP/1\.0\x20400\x20Bad\x20Request\r\nC
SF:ontent-Type:\x20text/html;\x20charset=UTF-8\r\n\r\nWebSockets\x20reques
SF:t\x20was\x20expected\r\n")%r(SSLSessionReq,65,"HTTP/1\.0\x20400\x20Bad\
SF:x20Request\r\nContent-Type:\x20text/html;\x20charset=UTF-8\r\n\r\nWebSo
SF:ckets\x20request\x20was\x20expected\r\n")%r(TerminalServerCookie,65,"HT
SF:TP/1\.0\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/html;\x20char
SF:set=UTF-8\r\n\r\nWebSockets\x20request\x20was\x20expected\r\n")%r(TLSSe
SF:ssionReq,65,"HTTP/1\.0\x20400\x20Bad\x20Request\r\nContent-Type:\x20tex
SF:t/html;\x20charset=UTF-8\r\n\r\nWebSockets\x20request\x20was\x20expecte
SF:d\r\n")%r(Kerberos,65,"HTTP/1\.0\x20400\x20Bad\x20Request\r\nContent-Ty
SF:pe:\x20text/html;\x20charset=UTF-8\r\n\r\nWebSockets\x20request\x20was\
SF:x20expected\r\n")%r(SMBProgNeg,65,"HTTP/1\.0\x20400\x20Bad\x20Request\r
SF:\nContent-Type:\x20text/html;\x20charset=UTF-8\r\n\r\nWebSockets\x20req
SF:uest\x20was\x20expected\r\n");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.05 seconds

hashtag
2. First Question: This question could be answered by add the host

hashtag
3. Second Question: This could be solved by connecting to the debugger on port 3000:

Setting up the penelope handler:

hashtag
Open the .db on your Kali to answer the question

hashtag
4. The 3rd question:

hashtag
5. The last question:

hashtag
Open the video on our machine to answer the final question.

PreviousTryhackme - Chillhack II - Second Wind

Last updated