nmap

❯ 8map 10.10.11.90
  ___
 ( _ ) _ __ ___   __ _ _ __
 / _ \| '_ ` _ \ / _` | '_ \
| (_) | | | | | | (_| | |_) |
 \___/|_| |_| |_|\__,_| .__/
                      |_|
          adot8 <3

[+] Scanning 10.10.11.90 [65535 TCP ports]


[+] Enumerating 10.10.11.90 [1433]

Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-17 10:34 CDT
Nmap scan report for 10.10.11.90
Host is up (0.046s latency).

PORT     STATE SERVICE  VERSION
1433/tcp open  ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RTM
| ms-sql-ntlm-info:
|   10.10.11.90:1433:
|     Target_Name: SIGNED
|     NetBIOS_Domain_Name: SIGNED
|     NetBIOS_Computer_Name: DC01
|     DNS_Domain_Name: SIGNED.HTB
|     DNS_Computer_Name: DC01.SIGNED.HTB
|     DNS_Tree_Name: SIGNED.HTB
|_    Product_Version: 10.0.17763
|_ssl-date: 2025-10-17T15:34:51+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2025-10-16T21:40:10
|_Not valid after:  2055-10-16T21:40:10
| ms-sql-info:
|   10.10.11.90:1433:
|     Version:
|       name: Microsoft SQL Server 2022 RTM
|       number: 16.00.1000.00
|       Product: Microsoft SQL Server 2022
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.29 seconds

[+] Scanning 10.10.11.90 [1000 UDP ports]
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-17 10:34 CDT
Initiating Ping Scan at 10:34
Scanning 10.10.11.90 [4 ports]
Completed Ping Scan at 10:34, 0.09s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 10:34
Completed Parallel DNS resolution of 1 host. at 10:34, 0.07s elapsed
Initiating UDP Scan at 10:34
Scanning 10.10.11.90 [100 ports]
Discovered open port 53/udp on 10.10.11.90
Completed UDP Scan at 10:34, 3.00s elapsed (100 total ports)
Nmap scan report for 10.10.11.90
Host is up (0.051s latency).
Not shown: 99 open|filtered udp ports (no-response)
PORT   STATE SERVICE
53/udp open  domain

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 3.30 seconds
           Raw packets sent: 259 (15.852KB) | Rcvd: 3 (160B)

[+] Completed!

❯ echo 10.10.11.90 DC01 SIGNED.HTB DC01.SIGNED.HTB | sudo tee -a /etc/hosts
[sudo] password for adot:
10.10.11.90 DC01 SIGNED.HTB DC01.SIGNED.HTB