Academy Network Enumeration with NMAP hard lab

HTB Content Academy
48

■■■, been stuck on this for the last 3 days, how frustrating. Yep, was all the way on the right track. Using openvpn from my local parrot running under kvm/libvirt (current version) vm, identical command for nc given in the thread gives:
retrying local 0.0.0.0:53 : Address already in use
Can’t grab 0.0.0.0:53 with bind

Using the pwnbox and sudo nc…, it just worked. Onward!

49

and here is the difference: (as shown by netstat -tunlp|grep LISTEN|grep 53)
nothing listening on 53 on pwnbox, while on parrot, dnsmasq is listening on 53.
#systemctl stop dnsmasq
then nc will bind properly and you get the expected result.