Soulmate Writeup

Adding IP to /etc/hosts

Add your machine IP into your /etc/hosts:

10.10.11.86 soulmate.htb

Rustscan

Let’s use Rustscan/Nmap to check the ports on the SoulMate machine.

donutmaster@ubuntu:~/Desktop$ rustscan -a 10.10.11.86 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: Where scanning meets swagging. 😎

[~] The config file is expected to be at "/home/donutmaster/.rustscan.toml"
Open 10.10.11.86:22
Open 10.10.11.86:80
[~] Starting Script(s)
[>] Running script "nmap -vvv -p  -  -A" on ip 10.10.11.86
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-11-08 17:17 KST
NSE: Loaded 156 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 17:17
Completed NSE at 17:17, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 17:17
Completed NSE at 17:17, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 17:17
Completed NSE at 17:17, 0.00s elapsed
Initiating Ping Scan at 17:17
Scanning 10.10.11.86 [2 ports]
Completed Ping Scan at 17:17, 0.07s elapsed (1 total hosts)
Initiating Connect Scan at 17:17
Scanning soulmate.htb (10.10.11.86) [2 ports]
Discovered open port 22/tcp on 10.10.11.86
Discovered open port 80/tcp on 10.10.11.86
Completed Connect Scan at 17:17, 0.21s elapsed (2 total ports)
Initiating Service scan at 17:17
Scanning 2 services on soulmate.htb (10.10.11.86)
Completed Service scan at 17:17, 6.33s elapsed (2 services on 1 host)
NSE: Script scanning 10.10.11.86.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 17:17
Completed NSE at 17:17, 5.48s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 17:17
Completed NSE at 17:17, 0.66s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 17:17
Completed NSE at 17:17, 0.00s elapsed
Nmap scan report for soulmate.htb (10.10.11.86)
Host is up, received syn-ack (0.099s latency).
Scanned at 2025-11-08 17:17:04 KST for 13s

PORT   STATE SERVICE REASON  VERSION
22/tcp open  ssh     syn-ack OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ+m7rYl1vRtnm789pH3IRhxI4CNCANVj+N5kovboNzcw9vHsBwvPX3KYA3cxGbKiA0VqbKRpOHnpsMuHEXEVJc=
|   256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtuEdoYxTohG80Bo6YCqSzUY9+qbnAFnhsk4yAZNqhM
80/tcp open  http    syn-ack nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Soulmate - Find Your Perfect Match
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 17:17
Completed NSE at 17:17, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 17:17
Completed NSE at 17:17, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 17:17
Completed NSE at 17:17, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.27 seconds

🔒 Post is Locked 🔒

“Soulmate” is currently an active machine on HackTheBox. Once retired, this blog post will be published for public access, as per HackTheBox’s policy on publishing content from their platform.