nmap

sudo nmap -p- -sC -sV -v 10.10.10.161 -T5
Nmap scan report for 10.10.10.161
Host is up (0.049s latency).
Not shown: 65512 closed tcp ports (reset)
PORT      STATE SERVICE      VERSION
88/tcp    open  kerberos-sec Microsoft Windows Kerberos (server time: 2024-03-21 19:55:00Z)
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp   open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf       .NET Message Framing
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc        Microsoft Windows RPC
49665/tcp open  msrpc        Microsoft Windows RPC
49666/tcp open  msrpc        Microsoft Windows RPC
49667/tcp open  msrpc        Microsoft Windows RPC
49671/tcp open  msrpc        Microsoft Windows RPC
49676/tcp open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
49677/tcp open  msrpc        Microsoft Windows RPC
49682/tcp open  msrpc        Microsoft Windows RPC
49704/tcp open  msrpc        Microsoft Windows RPC
49958/tcp open  msrpc        Microsoft Windows RPC
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-security-mode: 
|   account_used: <blank>
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: required
| smb2-time: 
|   date: 2024-03-21T19:55:53
|_  start_date: 2024-03-21T19:16:54
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb-os-discovery: 
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
|   Computer name: FOREST
|   NetBIOS computer name: FOREST\x00
|   Domain name: htb.local
|   Forest name: htb.local
|   FQDN: FOREST.htb.local
|_  System time: 2024-03-21T12:55:51-07:00
|_clock-skew: mean: 2h26m49s, deviation: 4h02m30s, median: 6m48s

NSE: Script Post-scanning.
Initiating NSE at 14:49
Completed NSE at 14:49, 0.00s elapsed
Initiating NSE at 14:49
Completed NSE at 14:49, 0.00s elapsed
Initiating NSE at 14:49
Completed NSE at 14:49, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 147.80 seconds
           Raw packets sent: 67970 (2.991MB) | Rcvd: 67276 (2.691MB)

nmap -p47001- -A -T5 -v 10.10.10.161 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-21 14:35 CDT
NSE: Loaded 156 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 14:35
Completed NSE at 14:35, 0.00s elapsed
Initiating NSE at 14:35
Completed NSE at 14:35, 0.00s elapsed
Initiating NSE at 14:35
Completed NSE at 14:35, 0.00s elapsed
Initiating Ping Scan at 14:35
Scanning 10.10.10.161 [2 ports]
Completed Ping Scan at 14:35, 0.07s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 14:35
Completed Parallel DNS resolution of 1 host. at 14:35, 0.01s elapsed
Initiating Connect Scan at 14:35
Scanning 10.10.10.161 [18535 ports]
Discovered open port 49671/tcp on 10.10.10.161
Discovered open port 49665/tcp on 10.10.10.161
Warning: 10.10.10.161 giving up on port because retransmission cap hit (2).
Discovered open port 49666/tcp on 10.10.10.161
Discovered open port 49667/tcp on 10.10.10.161
Discovered open port 49682/tcp on 10.10.10.161
Discovered open port 49677/tcp on 10.10.10.161
Discovered open port 49676/tcp on 10.10.10.161
Discovered open port 47001/tcp on 10.10.10.161
Discovered open port 49704/tcp on 10.10.10.161
Discovered open port 49958/tcp on 10.10.10.161
Discovered open port 49664/tcp on 10.10.10.161
Completed Connect Scan at 14:36, 30.68s elapsed (18535 total ports)
Initiating Service scan at 14:36
Scanning 11 services on 10.10.10.161
Service scan Timing: About 27.27% done; ETC: 14:39 (0:02:24 remaining)
Completed Service scan at 14:37, 54.47s elapsed (11 services on 1 host)
NSE: Script scanning 10.10.10.161.
Initiating NSE at 14:37
Completed NSE at 14:37, 1.04s elapsed
Initiating NSE at 14:37
Completed NSE at 14:37, 0.20s elapsed
Initiating NSE at 14:37
Completed NSE at 14:37, 0.00s elapsed
Nmap scan report for 10.10.10.161
Host is up (0.049s latency).
Not shown: 18350 closed tcp ports (conn-refused), 174 filtered tcp ports (no-response)
PORT      STATE SERVICE    VERSION
47001/tcp open  http       Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc      Microsoft Windows RPC
49665/tcp open  msrpc      Microsoft Windows RPC
49666/tcp open  msrpc      Microsoft Windows RPC
49667/tcp open  msrpc      Microsoft Windows RPC
49671/tcp open  msrpc      Microsoft Windows RPC
49676/tcp open  ncacn_http Microsoft Windows RPC over HTTP 1.0
49677/tcp open  msrpc      Microsoft Windows RPC
49682/tcp open  msrpc      Microsoft Windows RPC
49704/tcp open  msrpc      Microsoft Windows RPC
49958/tcp open  msrpc      Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

NSE: Script Post-scanning.
Initiating NSE at 14:37
Completed NSE at 14:37, 0.00s elapsed
Initiating NSE at 14:37
Completed NSE at 14:37, 0.00s elapsed
Initiating NSE at 14:37
Completed NSE at 14:37, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 87.08 seconds