I am working on an assignment where we are supposed to attack a private network simulated by a virtual machine provided to us using Kali. My Kali VM and the target network are on a 'host-only' private network in virtual box.
I scan the network using nmap and there is only a single other IP active so this leads me to the conclusion that the private netwwork is behind a router using NAT. Our task is:
"Using network scanners, extract the topology information of the company's private network. Identify available hosts, and for each host, find the IP address, Operating System, running services and open ports. Ensure that you specify the exact versions."
From what I can guess I am required to scan through the NAT to find details on the internal network but I can't seem to grasp how to do that.
To elaborate.The VM is supposed to emulate a companies private network. Its up and running and I can see the above services using nmap. I do know that I can use the browser to go to the IP of it (192.168.56.2) which displays a website (I'm guessing via one of the available apache services). I can browse around the website and gain information on employees and their positions in the company so I have been running brute force attacks on the SSH and FTP service based off of usernames I have guessed and put into a list. I have run Ncrack and hydra on both my generated username list and generic ones for days with no results on SSH and FTP. The website gave me some email accounts as well but running Hydra on SMTP gives my a 'Auth not activated' so I'm guessing that's not possible. I'm still running more permutations of usernames via NCrack and hydra to gain access but I'm not having any luck.
Edit 2 For additional info I did a nessus scan. Here is the link to the report.