LeakIX - Host 5.255.102.145

Host 5.255.102.145

The Netherlands

The Infrastructure Group B.V.

Open SMB file sharing detected

Malicious users exploiting this vulnerability may be able to read and/or write information to shared directories.

This may also include IPC services and lead to remote code execution.

IP: 5.255.102.145
Port: 445

First seen 2024-09-11 21:05
Last seen 2024-12-22 01:00
Open for 101 days
- Severity: high
  Fingerprint: 22420ce026fa767de22ea8c3df372350d40013922645c7572645c7572645c757
```
Found open SMB shares with NT AUTHORITY/ANONYMOUS LOGON
print$
IPC$
nobody
```
  Found on 2024-12-22 01:00
Create report
SSH is potenitally vulnerable

WARNING: This plugin will generate false positive and is purely informative:

regreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems (CVE-2024-6387)

IP: 5.255.102.145
Port: 2222

First seen 2024-09-11 13:09
Last seen 2024-12-19 22:00
Open for 99 days
- Severity: info
  Fingerprint: 3f43e0ebb5dce37ab8b59eb5a7d696c8bb8c345dbb8c345dbb8c345dbb8c345d
```
Found potentially vulnerable SSH version:
SSH-2.0-OpenSSH_9.2p1 Debian-2
WARNING, RISK IS ESTIMATED FALSE POSITIVE ARE LIKELY
```
  Found on 2024-12-19 22:00
Create report

Leak detected by ApacheStatusHttpPlugin

No description available

IP: 5.255.102.145
Port: 443
URL: https://5.255.102.145/server-status

First seen 2022-03-11 16:46

Severity: medium
Fingerprint: c72c1c3018e67f2f18e67f2f9d6971f19d6971f16143e9336143e933050d517a

Apache Status

Apache Server Status for 5.255.102.145 (via 127.0.0.1)

Server Version: Apache/2.4.25 (Debian)
Server MPM: prefork
Server Built: 2022-02-01T18:18:01

Current Time: Friday, 11-Mar-2022 11:46:46 EST
Restart Time: Wednesday, 23-Feb-2022 07:45:00 EST
Parent Server Config. Generation: 16
Parent Server MPM Generation: 15
Server uptime:  16 days 4 hours 1 minute 45 seconds
Server load: 0.00 0.00 0.00
Total accesses: 5779 - Total Traffic: 43.6 MB
CPU Usage: u.14 s.04 cu0 cs0 - 1.29e-5% CPU load
.00414 requests/sec - 32 B/second - 7.7 kB/request
1 requests currently being processed, 5 idle workers
__W_..__........................................................
................................................................
......................
Scoreboard Key:
"_" Waiting for Connection, 
"S" Starting up, 
"R" Reading Request,
"W" Sending Reply, 
"K" Keepalive (read), 
"D" DNS Lookup,
"C" Closing connection, 
"L" Logging, 
"G" Gracefully finishing, 
"I" Idle cleanup of worker, 
"." Open slot with no current process



SrvPIDAccMCPU
SSReqConnChildSlotClientProtocolVHostRequest

0-15236220/12/984_
0.01000.00.077.41
127.0.0.1http/1.1grandsf.com:19080GET /telescope/requests HTTP/1.0

1-15236240/12/981_
0.02000.00.107.53
127.0.0.1http/1.1grandsf.com:19080GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.expor

2-15242950/2/784W
0.00000.00.015.76
127.0.0.1http/1.1grandsf.com:19080GET /server-status HTTP/1.0

3-15236250/12/978_
0.01000.00.077.63
127.0.0.1http/1.1grandsf.com:19080GET /login.action HTTP/1.0

4-7-0/0/369.
0.0563461600.00.002.66
::1http/1.1grandsf.com:19080OPTIONS * HTTP/1.0

5-7-0/0/219.
0.0263460400.00.001.46
::1http/1.1grandsf.com:19080OPTIONS * HTTP/1.0

6-15236260/12/672_
0.01010.00.075.09
127.0.0.1http/1.1grandsf.com:19080GET / HTTP/1.0

7-15236270/11/668_
0.01000.00.095.25
127.0.0.1http/1.1grandsf.com:19080GET /.env HTTP/1.0

8-7-0/0/68.
0.0363457300.00.000.50
::1http/1.1grandsf.com:19080OPTIONS * HTTP/1.0

9-7-0/0/4.
0.0063461500.00.000.02
::1http/1.1grandsf.com:19080OPTIONS * HTTP/1.0

10-7-0/0/18.
0.0263461700.00.000.08
::1http/1.1grandsf.com:19080OPTIONS * HTTP/1.0

11-7-0/0/5.
0.0063461100.00.000.02
::1http/1.1grandsf.com:19080OPTIONS * HTTP/1.0

12-7-0/0/11.
0.0062410420.00.000.09
127.0.0.1http/1.1grandsf.com:19080GET / HTTP/1.0

13-7-0/0/8.
0.0063459600.00.000.06
::1http/1.1grandsf.com:19080OPTIONS * HTTP/1.0

14-7-0/0/3.
0.0062410410.00.000.02
127.0.0.1http/1.1grandsf.com:19080GET / HTTP/1.0

15-7-0/0/1.
0.0063461900.00.000.00
::1http/1.1grandsf.com:19080OPTIONS * HTTP/1.0

16-7-0/0/2.
0.0062410420.00.000.01
127.0.0.1http/1.1grandsf.pro:19080GET / HTTP/1.0

17-7-0/0/2.
0.0062410420.00.000.01
127.0.0.1http/1.1grandsf.net:19080GET /login HTTP/1.0

18-7-0/0/2.
0.0062410400.00.000.01
127.0.0.1http/1.1grandsf.pro:19080HEAD / HTTP/1.0


  
 SrvChild Server number - generation
 PIDOS process ID
 AccNumber of accesses this connection / this child / this slot
 MMode of operation
CPUCPU usage, number of seconds
SSSeconds since beginning of most recent request
 ReqMilliseconds required to process most recent request
 ConnKilobytes transferred this connection
 ChildMegabytes transferred this child
 SlotTotal megabytes transferred this slot
 

Apache/2.4.25 (Debian) Server at 5.255.102.145 Port 80

Found on 2022-03-11 16:46

Create report

Open service 5.255.102.145:445

2024-12-22 01:00
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 10 hours ago by SmbPlugin
Create report
Open service 5.255.102.145:445

2024-12-20 00:36
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2 days ago by SmbPlugin
Create report
Open service 5.255.102.145:2222

2024-12-19 22:00
Found 3 days ago by SSHOpenPlugin
Create report
Open service 5.255.102.145:445

2024-12-18 01:49
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-12-18 by SmbPlugin
Create report
Open service 5.255.102.145:2222

2024-12-17 21:58
Found 2024-12-17 by SSHOpenPlugin
Create report
Open service 5.255.102.145:445

2024-12-17 20:19
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-12-17 by SmbPlugin
Create report
Open service 5.255.102.145:445

2024-12-15 21:56
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-12-15 by SmbPlugin
Create report
Open service 5.255.102.145:2222

2024-12-15 21:50
Found 2024-12-15 by SSHOpenPlugin
Create report
Open service 5.255.102.145:2222

2024-12-13 21:53
Found 2024-12-13 by SSHOpenPlugin
Create report
Open service 5.255.102.145:445

2024-12-13 21:45
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-12-13 by SmbPlugin
Create report
Open service 5.255.102.145:445

2024-12-11 23:57
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-12-11 by SmbPlugin
Create report
Open service 5.255.102.145:2222

2024-12-11 23:47
Found 2024-12-11 by SSHOpenPlugin
Create report
Open service 5.255.102.145:445

2024-12-02 01:29
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-12-02 by SmbPlugin
Create report
Open service 5.255.102.145:2222

2024-12-02 01:13
Found 2024-12-02 by SSHOpenPlugin
Create report
Open service 5.255.102.145:2222

2024-11-30 00:43
Found 2024-11-30 by SSHOpenPlugin
Create report
Open service 5.255.102.145:445

2024-11-30 00:35
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-11-30 by SmbPlugin
Create report
Open service 5.255.102.145:2222

2024-11-28 00:57
Found 2024-11-28 by SSHOpenPlugin
Create report
Open service 5.255.102.145:445

2024-11-28 00:24
```
SMB NTLMSSP handshake results:
Found non-Windows 6.1 build 0
```
Found 2024-11-28 by SmbPlugin
Create report

Domain summary

No record

Host 5.255.102.145

The Netherlands

Open SMB file sharing detected

SSH is potenitally vulnerable

Leak detected by ApacheStatusHttpPlugin

Domain summary