1. Executive Summary
Two in-scope hosts were fully enumerated across all 65,535 TCP ports plus a UDP top-50 sweep, with service/version fingerprinting and anonymous (credential-free) protocol probing.
6 findings were recorded: 3 Low 3 Informational. No critical exposures were identified. The most useful intelligence gained is confirmation of the Active Directory environment (domain, hostname, OS build) leaked pre-authentication by the RDP handshake.
2. Methodology
- Full TCP SYN scan, all 65,535 ports on both hosts —
nmap -sS -p- --min-rate 5000 -Pn - Service/version detection + default NSE scripts on open ports —
nmap -sV -sC - Targeted RDP NSE scripts —
rdp-ntlm-info,rdp-enum-encryption,ssl-cert - UDP top-50 sweep on both hosts —
nmap -sU --top-ports 50 - Anonymous-only Windows probes (no credentials): SMB null session (
smbclient -L -N), SAMR/RPC (rpcclient -U '' -N), LDAP anonymous bind (ldapsearch -x) - Passive web fingerprint: HTTP response headers, page title, robots.txt
- Passive DNS resolution of
northgatefreight.ca
All scan XML/nmap/gnmap outputs retained under /tmp/pentestcode/recon_* as raw evidence.
3. Host Results — 77.91.123.159 (Web / Application Server)
3.1 Open ports — full TCP scan (65,535 ports)
| Port | State | Service | Version / detail |
|---|---|---|---|
22/tcp | open | SSH | OpenSSH 9.6p1 Ubuntu 3ubuntu13.18 (protocol 2.0). Host keys: ECDSA P-256 77:e5:76:…:18:17, ED25519 97:dc:f9:…:69:c0 |
80/tcp | open | HTTP | Apache httpd 2.4.58 (Ubuntu). Title: Northgate Freight Lines — Track & Trace. No robots.txt (404) |
25/tcp | filtered | SMTP | Filtered at perimeter (no response) |
465/tcp | filtered | SMTPS | Filtered at perimeter |
587/tcp | filtered | Submission | Filtered at perimeter |
Remaining 65,530 TCP ports closed (RST). UDP top-50: all closed.
3.2 HTTP posture
HTTP/1.1 200 OK
Server: Apache/2.4.58 (Ubuntu)
Content-Type: text/html; charset=UTF-8
<title>Northgate Freight Lines — Track & Trace</title>
[No X-Frame-Options / Content-Security-Policy / X-Content-Type-Options / Referrer-Policy]
3.3 Shares & AD enumeration
Not applicable — no SMB, RPC, or LDAP services exposed on this host.
3.4 Security products
None directly observable. Perimeter filtering of the three mail ports indicates an edge firewall/security gateway. No AV/EDR agent ports exposed (not externally enumerable without authenticated access).
3.5 Findings
| Severity | Finding |
|---|---|
| Low | Missing HTTP security headers on the Track & Trace portal (X-Frame-Options, CSP, X-Content-Type-Options, Referrer-Policy) → clickjacking and MIME-sniffing exposure. |
| Info | Verbose version disclosure — Apache/2.4.58 (Ubuntu) and OpenSSH 9.6p1 banners reveal exact OS patch level, aiding targeted exploit selection. |
| Info | Perimeter filtering present — mail ports filtered rather than closed; SMTP infrastructure likely exists internally. |
4. Host Results — 45.92.170.247 (Windows Server 2022, Domain Member)
Product_Version 10.0.20348, via unauthenticated RDP NTLM handshake)SRV-NG-01 (FQDN SRV-NG-01.northgatefreight.ca)4.1 Open ports — full TCP scan (65,535 ports)
| Port | State | Service | Version / detail |
|---|---|---|---|
3389/tcp | open | RDP (ms-wbt-server) | Microsoft Terminal Services. CredSSP (NLA): SUCCESS; CredSSP Early User Auth: SUCCESS; RDSTLS: SUCCESS |
Remaining 65,534 TCP ports filtered (no-response) — a host firewall drops everything except RDP. Specifically unreachable: SMB 445/139, LDAP 389/636/3268/3269, Kerberos 88, DNS 53, WinRM 5985/5986, RPC 135. UDP top-50: all open|filtered (no response) — inconclusive.
4.2 Pre-authentication intelligence (rdp-ntlm-info)
Target_Name: NORTHGATE
NetBIOS_Domain_Name: NORTHGATE
NetBIOS_Computer_Name: SRV-NG-01
DNS_Domain_Name: northgatefreight.ca
DNS_Computer_Name: SRV-NG-01.northgatefreight.ca
DNS_Tree_Name: northgatefreight.ca
Product_Version: 10.0.20348 (Windows Server 2022)
System_Time: 2026-08-03T13:59:34+00:00
TLS certificate on 3389 is self-signed: CN=SRV-NG-01.northgatefreight.ca, RSA-2048,
sha256WithRSAEncryption, valid 2026-07-27 → 2027-01-26, SHA-1 a2a1:7a26:6ca8:a83e:aaa7:6415:c109:5362:e73c:8bfc.
4.3 Shares & AD enumeration (anonymous — no credentials used)
| Probe | Result |
|---|---|
smbclient -L -N (SMB null session share list) | NT_STATUS_IO_TIMEOUT — port 445 filtered |
rpcclient -U '' -N (SAMR user/group enum) | NT_STATUS_IO_TIMEOUT — ports 445/135 filtered |
ldapsearch -x :389 (anonymous bind / rootDSE) | No response — port 389 filtered |
Positive finding: zero SMB shares, AD users, or AD groups are enumerable anonymously from an
external vantage. The firewall blocks every Active Directory service port — strong hardening.
4.4 Security products observed
- Windows host firewall (WFP): drop (
no-response) behavior across 65,534 ports; only RDP permitted. - NLA / CredSSP + RDSTLS enforced on RDP — mitigates pre-auth RCE classes and network credential capture.
- Antivirus/EDR presence and real-time-protection state are not externally observable without authenticated access (stated as a limitation, not assumed absent).
4.5 Findings
| Severity | Finding |
|---|---|
| Low | RDP (3389) exposed to the network — reachable for password spraying and future RDP-class vulnerabilities. NLA is a strong mitigating control. |
| Low | Pre-auth information disclosure via RDP NTLM handshake — leaks domain (NORTHGATE), hostname (SRV-NG-01), DNS domain (northgatefreight.ca) and exact OS build (10.0.20348); aids targeted phishing and user enumeration. |
| Info | Self-signed RDP TLS certificate — not trust-anchored; clients ignoring warnings are exposed to MitM. |
| Info | Strict host firewall — only RDP exposed; exemplary attack-surface reduction. |
| Info | Active Directory confirmed — a domain environment (NORTHGATE / northgatefreight.ca) exists; its domain controllers are not reachable from this vantage. |
5. Consolidated Findings & Recommendations
| # | Severity | Host | Finding | Recommendation |
|---|---|---|---|---|
| 1 | Low | 45.92.170.247 | RDP exposed to network (NLA enforced) | Restrict 3389 to VPN/jump-host source ranges; enforce MFA via RD Gateway; monitor logon failures. |
| 2 | Low | 45.92.170.247 | Pre-auth RDP NTLM info disclosure (domain/host/OS build) | Restrict RDP to trusted sources where possible; treat disclosed naming data as public in threat modeling. |
| 3 | Low | 77.91.123.159 | Missing HTTP security headers | Add X-Frame-Options/frame-ancestors, CSP, X-Content-Type-Options, Referrer-Policy; plan TLS migration for the portal. |
| 4 | Info | 45.92.170.247 | Self-signed RDP certificate | Deploy a PKI-issued RDP certificate (internal CA) to enable client-side validation. |
| 5 | Info | 77.91.123.159 | Verbose service version disclosure (Apache/OpenSSH banners) | Set ServerTokens Prod / suppress SSH comment where policy allows; keep versions current. |
| 6 | Info | 45.92.170.247 | Strict host firewall; AD ports unreachable (positive) | Maintain posture; validate rule set periodically. |
6. Caveats & Limitations
- External unauthenticated vantage only. Filtered ports may expose services to internal or allow-listed networks that are invisible here.
- AV / EDR / real-time protection state and scheduled tasks cannot be determined without authenticated access. Per the recon-only rules of engagement, no credentials were used; these items are therefore out of assessment reach, not verified absent.
- UDP results on 45.92.170.247 are inconclusive (all top-50 ports open|filtered).
- DNS anomaly: public resolution of
northgatefreight.ca(andsrv-ng-01.northgatefreight.ca) returns127.0.0.1(sinkholed/lab-zone artifact). Domain identity was confirmed via the RDP NTLM handshake instead. - Domain-controller role of 45.92.170.247 is undetermined: naming (SRV-NG-01) suggests a member server, but with AD ports filtered this cannot be verified externally.
- No exploitation, brute force, credential use, or system modification was performed. Results are a point-in-time snapshot (2026-08-03, ~16:00 CEST).