1
PORT     STATE SERVICE       REASON          VERSION
2
53/tcp   open  domain        syn-ack ttl 128 Simple DNS Plus
3
80/tcp   open  http          syn-ack ttl 128 Microsoft IIS httpd 10.0
4
| http-methods:
5
|   Supported Methods: OPTIONS TRACE GET HEAD POST
6
|_  Potentially risky methods: TRACE
7
|_http-favicon: Unknown favicon MD5: FED84E16B6CCFE88EE7FFAAE5DFEFD34
8
|_http-title: eBusiness Bootstrap Template
9
|_http-server-header: Microsoft-IIS/10.0
10
88/tcp   open  kerberos-sec  syn-ack ttl 128 Microsoft Windows Kerberos (server time: 2026-09-09 12:48:14Z)
11
135/tcp  open  msrpc         syn-ack ttl 128 Microsoft Windows RPC
12
139/tcp  open  netbios-ssn   syn-ack ttl 128 Microsoft Windows netbios-ssn
13
389/tcp  open  ldap          syn-ack ttl 128 Microsoft Windows Active Directory LDAP (Domain: fusion.corp0., Site: Default-First-Site-Name)
14
445/tcp  open  microsoft-ds? syn-ack ttl 128
15
464/tcp  open  kpasswd5?     syn-ack ttl 128
16
593/tcp  open  ncacn_http    syn-ack ttl 128 Microsoft Windows RPC over HTTP 1.0
17
636/tcp  open  tcpwrapped    syn-ack ttl 128
18
3268/tcp open  ldap          syn-ack ttl 128 Microsoft Windows Active Directory LDAP (Domain: fusion.corp0., Site: Default-First-Site-Name)
19
3269/tcp open  tcpwrapped    syn-ack ttl 128
20
3389/tcp open  ms-wbt-server syn-ack ttl 128 Microsoft Terminal Services
21
|_ssl-date: 2026-09-09T12:48:56+00:00; 0s from scanner time.
22
| ssl-cert: Subject: commonName=Fusion-DC.fusion.corp
23
| Issuer: commonName=Fusion-DC.fusion.corp
24
| Public Key type: rsa
25
| Public Key bits: 2048
26
| Signature Algorithm: sha256WithRSAEncryption
27
| Not valid before: 2026-09-08T12:44:36
28
| Not valid after:  2027-03-10T12:44:36
29
| MD5:   ac17:2de3:e42b:ac9a:2a98:7800:9b3b:60a8
30
| SHA-1: 9bf7:fd97:2be2:9a1b:4adc:e2e1:21af:023b:037e:2e59
31
| -----BEGIN CERTIFICATE-----
32
| MIIC7jCCAdagAwIBAgIQURQCtsQiX5dIRlFO2/uk5jANBgkqhkiG9w0BAQsFADAg
33
| MR4wHAYDVQQDExVGdXNpb24tREMuZnVzaW9uLmNvcnAwHhcNMjYwOTA4MTI0NDM2
34
| WhcNMjcwMzEwMTI0NDM2WjAgMR4wHAYDVQQDExVGdXNpb24tREMuZnVzaW9uLmNv
35
| cnAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCa1OgP4Hjbfk7vBwqi
36
| 5ZAy/ofrXjTYN3AFcZBkRI4Y69dXoVOrYGqs+nSk+0kbPm7hOPCcciOspd7oM5xS
37
| lJcNizVWaPgPg6jzhl03jlQmtujHHsz+xlyqDg/AVyfiy+A2nYEg3DNYJmuXRx30
38
| kjXWhnOK/1STq2dsb6vlsq72AR/gxbdx0i6fCj8uTNmt4LEUP95VSsAJfkkbkP/U
39
| R6vHkE238UcZgdcYV7egPBTjHh/alOw3evGuzApzmIiKqHUNyw9tQ3yx64uzOGDC
40
| NL/8gbcGVhkRojylfrrWk/5OE4nce4CDd3w/uTESAKItsM4Enu62WfuwqoPoLvGV
41
| h2eFAgMBAAGjJDAiMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIEMDAN
42
| BgkqhkiG9w0BAQsFAAOCAQEAUGsFertZvhZTUXF3z/QypEc7H6aY2ESyGmTg8f8E
43
| 1XU3vB32Y69ajI0fnrvIVhVIZcL52hc8bXj47mN2/TJmQ5fbYSSGXA2fEJ22R/t1
44
| 5d8Dq9+Zw5AY4Fe/B90xtjr6/dS1Cl5dmmeh0GOHsYaQSkl+nnDq8xfo7RAq7Xcm
45
| ELaGpaOObsI/LGqOj5UoVrpNyUziMKMtG+MUBmvAnhBH+ly2oTzelhEnijNeEgc4
46
| SaXrB5IfODLQSe/FAG2iSHGKExxhy3rgirJr0excphPVkxTBY+FeI2tgBkYJRCJv
47
| P5FOt1Mcn98ezT0+ZqxjTM7Pmq1khJO1uHsPGHa9fnVpkw==
48
|_-----END CERTIFICATE-----
49
| rdp-ntlm-info:
50
|   Target_Name: FUSION
51
|   NetBIOS_Domain_Name: FUSION
52
|   NetBIOS_Computer_Name: FUSION-DC
53
|   DNS_Domain_Name: fusion.corp
54
|   DNS_Computer_Name: Fusion-DC.fusion.corp
55
|   Product_Version: 10.0.17763
56
|_  System_Time: 2026-09-09T12:48:17+00:00
57
Service Info: Host: FUSION-DC; OS: Windows; CPE: cpe:/o:microsoft:windows

1
PS C:\Users\Administrator\Desktop> whoami /all
2

3
USER INFORMATION
4
----------------
5

6
User Name            SID
7
==================== ============================================
8
fusion\administrator S-1-5-21-1898838421-3672757654-990739655-500
9

10

11
GROUP INFORMATION
12
-----------------
13

14
Group Name                                    Type             SID                                          Attributes
15
============================================= ================ ============================================ ===============================================================
16
Everyone                                      Well-known group S-1-1-0                                      Mandatory group, Enabled by default, Enabled group
17
BUILTIN\Administrators                        Alias            S-1-5-32-544                                 Mandatory group, Enabled by default, Enabled group, Group owner
18
BUILTIN\Users                                 Alias            S-1-5-32-545                                 Mandatory group, Enabled by default, Enabled group
19
BUILTIN\Pre-Windows 2000 Compatible Access    Alias            S-1-5-32-554                                 Mandatory group, Enabled by default, Enabled group
20
NT AUTHORITY\NETWORK                          Well-known group S-1-5-2                                      Mandatory group, Enabled by default, Enabled group
21
NT AUTHORITY\Authenticated Users              Well-known group S-1-5-11                                     Mandatory group, Enabled by default, Enabled group
22
NT AUTHORITY\This Organization                Well-known group S-1-5-15                                     Mandatory group, Enabled by default, Enabled group
23
FUSION\Domain Admins                          Group            S-1-5-21-1898838421-3672757654-990739655-512 Mandatory group, Enabled by default, Enabled group
24
FUSION\Group Policy Creator Owners            Group            S-1-5-21-1898838421-3672757654-990739655-520 Mandatory group, Enabled by default, Enabled group
25
FUSION\Schema Admins                          Group            S-1-5-21-1898838421-3672757654-990739655-518 Mandatory group, Enabled by default, Enabled group
26
FUSION\Enterprise Admins                      Group            S-1-5-21-1898838421-3672757654-990739655-519 Mandatory group, Enabled by default, Enabled group
27
FUSION\Denied RODC Password Replication Group Alias            S-1-5-21-1898838421-3672757654-990739655-572 Mandatory group, Enabled by default, Enabled group, Local Group
28
NT AUTHORITY\NTLM Authentication              Well-known group S-1-5-64-10                                  Mandatory group, Enabled by default, Enabled group
29
Mandatory Label\High Mandatory Level          Label            S-1-16-12288
30

31

32
PRIVILEGES INFORMATION
33
----------------------
34

35
Privilege Name                            Description                                                        State
36
========================================= ================================================================== =======
37
SeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 Enabled
38
SeMachineAccountPrivilege                 Add workstations to domain                                         Enabled
39
SeSecurityPrivilege                       Manage auditing and security log                                   Enabled
40
SeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Enabled
41
SeLoadDriverPrivilege                     Load and unload device drivers                                     Enabled
42
SeSystemProfilePrivilege                  Profile system performance                                         Enabled
43
SeSystemtimePrivilege                     Change the system time                                             Enabled
44
SeProfileSingleProcessPrivilege           Profile single process                                             Enabled
45
SeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       Enabled
46
SeCreatePagefilePrivilege                 Create a pagefile                                                  Enabled
47
SeBackupPrivilege                         Back up files and directories                                      Enabled
48
SeRestorePrivilege                        Restore files and directories                                      Enabled
49
SeShutdownPrivilege                       Shut down the system                                               Enabled
50
SeDebugPrivilege                          Debug programs                                                     Enabled
51
SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Enabled
52
SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled
53
SeRemoteShutdownPrivilege                 Force shutdown from a remote system                                Enabled
54
SeUndockPrivilege                         Remove computer from docking station                               Enabled
55
SeEnableDelegationPrivilege               Enable computer and user accounts to be trusted for delegation     Enabled
56
SeManageVolumePrivilege                   Perform volume maintenance tasks                                   Enabled
57
SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled
58
SeCreateGlobalPrivilege                   Create global objects                                              Enabled
59
SeIncreaseWorkingSetPrivilege             Increase a process working set                                     Enabled
60
SeTimeZonePrivilege                       Change the time zone                                               Enabled
61
SeCreateSymbolicLinkPrivilege             Create symbolic links                                              Enabled
62
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled
63

64

65
PS C:\Users\Administrator\Desktop> ipconfig
66

67
Windows IP Configuration
68

69
Ethernet adapter Ethernet:
70

71
   Connection-specific DNS Suffix  . : ec2.internal
72
   Link-local IPv6 Address . . . . . : fe80::985e:63d:c0fa:2957%4
73
   IPv4 Address. . . . . . . . . . . : 10.67.153.186
74
   Subnet Mask . . . . . . . . . . . : 255.255.192.0
75
   Default Gateway . . . . . . . . . : 10.67.128.1