_raw:
[20260109-09:48:55] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:55] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:55] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:55] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:55] [INFO ] Security protocol: configured [RDP], requested [SSL|HYBRID|HYBRID_EX|RDP], selected [RDP]
[20260109-09:48:55] [ERROR] libxrdp_force_read: header read error
[20260109-09:48:55] [ERROR] Processing [ITU-T T.125] Connect-Initial failed
[20260109-09:48:55] [ERROR] [MCS Connection Sequence] receive connection request failed
[20260109-09:48:55] [ERROR] xrdp_sec_incoming: xrdp_mcs_incoming failed
[20260109-09:48:55] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20260109-09:48:55] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20260109-09:48:55] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20260109-09:48:55] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed
[20260109-09:48:57] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.102 port 58227
[20260109-09:48:57] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:57] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:57] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:57] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:57] [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
[20260109-09:48:57] [INFO ] Connected client computer name: CPTC11-FINALS-T
[20260109-09:48:57] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
[20260109-09:48:57] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
[20260109-09:48:57] [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard_type:[0x04], keyboard_subtype:[0x00], keylayout:[0x00000409]
[20260109-09:48:57] [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [us] options []
[20260109-09:48:57] [INFO ] Non-TLS connection established from ::ffff:10.0.254.102 port 58227: with security level : high
[20260109-09:48:57] [INFO ] xrdp_caps_process_pointer: client supports new(color) cursor
[20260109-09:48:57] [INFO ] xrdp_process_offscreen_bmpcache: support level 1 cache size 10485760 MB cache entries 100
[20260109-09:48:57] [INFO ] xrdp_caps_process_codecs: nscodec, codec id 1, properties len 3
[20260109-09:48:57] [WARN ] xrdp_caps_process_codecs: unknown codec id 5
[20260109-09:48:57] [INFO ] xrdp_caps_process_codecs: RemoteFX, codec id 3, properties len 49
[20260109-09:48:57] [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
[20260109-09:48:57] [WARN ] local keymap file for 0x00000409 found and doesn't match built in keymap, using local keymap file


_raw: [20260109-09:48:55] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.102 port 58225


_raw:
[20260109-09:48:51] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:51] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:51] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:51] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:51] [INFO ] Security protocol: configured [RDP], requested [SSL|HYBRID|HYBRID_EX|RDP], selected [RDP]
[20260109-09:48:51] [ERROR] libxrdp_force_read: header read error
[20260109-09:48:51] [ERROR] Processing [ITU-T T.125] Connect-Initial failed
[20260109-09:48:51] [ERROR] [MCS Connection Sequence] receive connection request failed
[20260109-09:48:51] [ERROR] xrdp_sec_incoming: xrdp_mcs_incoming failed
[20260109-09:48:51] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20260109-09:48:51] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20260109-09:48:51] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20260109-09:48:51] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed
[20260109-09:48:53] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.103 port 57993
[20260109-09:48:53] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:53] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:53] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:53] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:53] [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
[20260109-09:48:53] [INFO ] Connected client computer name: CPTC11-FINALS-T
[20260109-09:48:53] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
[20260109-09:48:53] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
[20260109-09:48:53] [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard_type:[0x04], keyboard_subtype:[0x00], keylayout:[0x00000409]
[20260109-09:48:53] [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [us] options []
[20260109-09:48:53] [INFO ] Non-TLS connection established from ::ffff:10.0.254.103 port 57993: with security level : high
[20260109-09:48:54] [INFO ] xrdp_caps_process_pointer: client supports new(color) cursor
[20260109-09:48:54] [INFO ] xrdp_process_offscreen_bmpcache: support level 1 cache size 10485760 MB cache entries 100
[20260109-09:48:54] [INFO ] xrdp_caps_process_codecs: nscodec, codec id 1, properties len 3
[20260109-09:48:54] [WARN ] xrdp_caps_process_codecs: unknown codec id 5
[20260109-09:48:54] [INFO ] xrdp_caps_process_codecs: RemoteFX, codec id 3, properties len 49
[20260109-09:48:54] [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
[20260109-09:48:54] [WARN ] local keymap file for 0x00000409 found and doesn't match built in keymap, using local keymap file


_raw: [20260109-09:48:51] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.103 port 57991


_raw:
[20260109-09:48:51] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:51] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:51] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:51] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:51] [INFO ] Security protocol: configured [RDP], requested [SSL|HYBRID|HYBRID_EX|RDP], selected [RDP]
[20260109-09:48:51] [ERROR] libxrdp_force_read: header read error
[20260109-09:48:51] [ERROR] Processing [ITU-T T.125] Connect-Initial failed
[20260109-09:48:51] [ERROR] [MCS Connection Sequence] receive connection request failed
[20260109-09:48:51] [ERROR] xrdp_sec_incoming: xrdp_mcs_incoming failed
[20260109-09:48:51] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20260109-09:48:51] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20260109-09:48:51] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20260109-09:48:51] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed


_raw: [20260109-09:48:51] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.104 port 57963


_raw:
Processing triggers for kali-menu (2025.4.3) ...
Processing triggers for wordlists (2025.4.0) ...

_sourcetype: term

sourcetype: term


_raw: 2026-01-09 09:48:51 status installed wordlists:all 2025.4.0


_raw: 2026-01-09 09:48:51 status half-configured wordlists:all 2025.4.0


_raw: 2026-01-09 09:48:50 status half-configured kali-menu:all 2025.4.3


_raw: 2026-01-09 09:48:50 status installed seclists:all 2025.3-0kali1


_raw: 2026-01-09 09:48:50 status half-configured seclists:all 2025.3-0kali1


_raw: 2026-01-09 09:48:50 status unpacked seclists:all 2025.3-0kali1


_raw: 2026-01-09 09:48:50 startup packages configure


_raw: Setting up seclists (2025.3-0kali1) ...


_raw:
[20260109-09:48:43] [INFO ] Terminal Server Users group is disabled, allowing authentication
[20260109-09:48:43] [INFO ] ++ created session (access granted): username pentester, ip ::ffff:10.0.254.106:57997 - socket: 12
[20260109-09:48:43] [INFO ] starting Xorg session...
[20260109-09:48:43] [INFO ] Starting session: session_pid 228232, display :10.0, width 1920, height 1080, bpp 24, client ip ::ffff:10.0.254.106:57997 - socket: 12, user name pentester
[20260109-09:48:43] [INFO ] [session start] (display 10): calling auth_start_session from pid 228232
[20260109-09:48:43] [ERROR] sesman_data_in: scp_process_msg failed
[20260109-09:48:43] [ERROR] sesman_main_loop: trans_check_wait_objs failed, removing trans
[20260109-09:48:43] [INFO ] Starting X server on display 10: /usr/lib/xorg/Xorg :10 -auth .Xauthority -config xrdp/xorg.conf -noreset -nolisten tcp -logfile .xorgxrdp.%s.log
[20260109-09:48:43] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:48:43] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:48:43] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:48:43] [INFO ] Session started successfully for user pentester on display 10
[20260109-09:48:43] [INFO ] Session in progress on display 10, waiting until the window manager (pid 228259) exits to end the session
[20260109-09:48:43] [INFO ] Starting the xrdp channel server for display 10
[20260109-09:48:43] [INFO ] Starting the default window manager on display 10: /etc/xrdp/startwm.sh


_raw:
[20260109-09:48:43] [INFO ] xrdp_wm_log_msg: sesman connect ok
[20260109-09:48:43] [INFO ] sesman connect ok
[20260109-09:48:43] [INFO ] sending login info to session manager. Please wait...
[20260109-09:48:43] [INFO ] xrdp_wm_log_msg: login successful for user pentester on display 10
[20260109-09:48:43] [INFO ] login successful for user pentester on display 10
[20260109-09:48:43] [INFO ] loaded module 'libxup.so' ok, interface size 10296, version 4
[20260109-09:48:43] [INFO ] started connecting
[20260109-09:48:43] [INFO ] lib_mod_connect: connecting via UNIX socket
[20260109-09:48:43] [INFO ] lib_mod_log_peer: xrdp_pid=228168 connected to X11rdp_pid=228260 X11rdp_uid=1001 X11rdp_gid=1001 client_ip=::ffff:10.0.254.106 client_port=57997
[20260109-09:48:43] [INFO ] connected ok


_raw: [20260109-09:48:42] [INFO ] Socket 12: AF_INET6 connection received from ::1 port 52668


_raw: 2026-01-09 09:48:41 status triggers-pending wordlists:all 2025.4.0


_raw: 2026-01-09 09:48:41 status triggers-pending kali-menu:all 2025.4.3


_raw: 2026-01-09 09:48:41 status half-installed seclists:all 2025.3-0kali1


_raw:
Selecting previously unselected package seclists.
(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 451776 files and directories currently installed.)
Preparing to unpack .../seclists_2025.3-0kali1_all.deb ...
Unpacking seclists (2025.3-0kali1) ...


_raw: 2026-01-09 09:48:41 startup archives unpack


_raw:
Start-Date: 2026-01-09  09:48:41
Commandline: apt install seclists
Requested-By: pentester (1001)
Install: seclists:amd64 (2025.3-0kali1)


_raw:
[20260109-09:48:38] [ERROR] pam_authenticate failed: Authentication failure
[20260109-09:48:38] [INFO ] AUTHFAIL: user=pentester ip=::ffff:10.0.254.105 time=1767970118
[20260109-09:48:38] [ERROR] sesman_data_in: scp_process_msg failed
[20260109-09:48:38] [ERROR] sesman_main_loop: trans_check_wait_objs failed, removing trans


_raw:
[20260109-09:48:37] [INFO ] xrdp_wm_log_msg: sesman connect ok
[20260109-09:48:37] [INFO ] sesman connect ok
[20260109-09:48:37] [INFO ] sending login info to session manager. Please wait...
[20260109-09:48:38] [INFO ] xrdp_wm_log_msg: login failed for user pentester
[20260109-09:48:38] [INFO ] login failed for user pentester


_raw: [20260109-09:48:37] [INFO ] Socket 12: AF_INET6 connection received from ::1 port 48226


_raw:
Processing triggers for kali-menu (2025.4.3) ...
Processing triggers for desktop-file-utils (0.28-1) ...
Processing triggers for hicolor-icon-theme (0.18-2) ...
Processing triggers for ca-certificates-java (20240118) ...
done.
Setting up openjdk-11-jre:amd64 (11.0.25~5ea-1) ...
Setting up neo4j (5.2.0+really4.4.26-0kali1) ...
Setting up bloodhound (8.3.1-0kali1) ...


_raw: 2026-01-09 09:48:37 status installed bloodhound:amd64 8.3.1-0kali1


_raw: 2026-01-09 09:48:37 status half-configured bloodhound:amd64 8.3.1-0kali1


_raw: 2026-01-09 09:48:37 status unpacked bloodhound:amd64 8.3.1-0kali1


_raw: 2026-01-09 09:48:37 status half-configured neo4j:all 5.2.0+really4.4.26-0kali1


_raw: 2026-01-09 09:48:37 status installed ca-certificates-java:all 20240118


_raw:
[20260109-09:48:37] [INFO ] Terminal Server Users group is disabled, allowing authentication
[20260109-09:48:37] [INFO ] ++ created session (access granted): username pentester, ip ::ffff:10.0.254.102:58421 - socket: 12
[20260109-09:48:37] [INFO ] starting Xorg session...
[20260109-09:48:37] [INFO ] Starting session: session_pid 229295, display :10.0, width 1920, height 1080, bpp 24, client ip ::ffff:10.0.254.102:58421 - socket: 12, user name pentester
[20260109-09:48:37] [INFO ] [session start] (display 10): calling auth_start_session from pid 229295
[20260109-09:48:37] [ERROR] sesman_data_in: scp_process_msg failed
[20260109-09:48:37] [ERROR] sesman_main_loop: trans_check_wait_objs failed, removing trans
[20260109-09:48:37] [INFO ] Starting X server on display 10: /usr/lib/xorg/Xorg :10 -auth .Xauthority -config xrdp/xorg.conf -noreset -nolisten tcp -logfile .xorgxrdp.%s.log
[20260109-09:48:37] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:48:37] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:48:37] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:48:37] [INFO ] Session started successfully for user pentester on display 10
[20260109-09:48:37] [INFO ] Starting the xrdp channel server for display 10
[20260109-09:48:37] [INFO ] Starting the default window manager on display 10: /etc/xrdp/startwm.sh
[20260109-09:48:37] [INFO ] Session in progress on display 10, waiting until the window manager (pid 229322) exits to end the session


_raw:
[20260109-09:48:37] [INFO ] xrdp_wm_log_msg: sesman connect ok
[20260109-09:48:37] [INFO ] sesman connect ok
[20260109-09:48:37] [INFO ] sending login info to session manager. Please wait...
[20260109-09:48:37] [INFO ] xrdp_wm_log_msg: login successful for user pentester on display 10
[20260109-09:48:37] [INFO ] login successful for user pentester on display 10
[20260109-09:48:37] [INFO ] loaded module 'libxup.so' ok, interface size 10296, version 4
[20260109-09:48:37] [INFO ] started connecting
[20260109-09:48:37] [INFO ] lib_mod_connect: connecting via UNIX socket
[20260109-09:48:37] [INFO ] lib_mod_log_peer: xrdp_pid=229215 connected to X11rdp_pid=229323 X11rdp_uid=1001 X11rdp_gid=1001 client_ip=::ffff:10.0.254.102 client_port=58421
[20260109-09:48:37] [INFO ] connected ok


_raw: [20260109-09:48:37] [INFO ] Socket 12: AF_INET6 connection received from ::1 port 50536


_raw: 2026-01-09 09:48:36 status installed openjdk-11-jre-headless:amd64 11.0.25~5ea-1


_raw: 2026-01-09 09:48:36 status half-configured ca-certificates-java:all 20240118


_raw: 2026-01-09 09:48:36 trigproc ca-certificates-java:all 20240118 <none>


_raw: 2026-01-09 09:48:36 status installed hicolor-icon-theme:all 0.18-2


_raw: 2026-01-09 09:48:36 status half-configured hicolor-icon-theme:all 0.18-2


_raw: 2026-01-09 09:48:36 trigproc hicolor-icon-theme:all 0.18-2 <none>


_raw: 2026-01-09 09:48:36 status installed desktop-file-utils:amd64 0.28-1


_raw: 2026-01-09 09:48:36 status half-configured desktop-file-utils:amd64 0.28-1


_raw: 2026-01-09 09:48:36 trigproc desktop-file-utils:amd64 0.28-1 <none>


_raw: 2026-01-09 09:48:36 status half-configured kali-menu:all 2025.4.3


_raw: 2026-01-09 09:48:35 status installed jarwrapper:all 0.81


_raw: 2026-01-09 09:48:35 status half-configured jarwrapper:all 0.81


_raw: 2026-01-09 09:48:35 status unpacked jarwrapper:all 0.81


_raw: 2026-01-09 09:48:35 configure jarwrapper:all 0.81 <none>


_raw: 2026-01-09 09:48:35 status installed azurehound:amd64 2.8.1-0kali1


_raw: 2026-01-09 09:48:35 status half-configured azurehound:amd64 2.8.1-0kali1


_raw: 2026-01-09 09:48:35 status unpacked azurehound:amd64 2.8.1-0kali1


_raw: 2026-01-09 09:48:35 status installed binfmt-support:amd64 2.2.2-7


_raw:
Selecting previously unselected package sharphound.
Preparing to unpack .../8-sharphound_2.8.0-0kali1_all.deb ...
Unpacking sharphound (2.8.0-0kali1) ...
Setting up fastjar (2:0.98-7) ...
Setting up openjdk-11-jre-headless:amd64 (11.0.25~5ea-1) ...
update-alternatives: using /usr/lib/jvm/java-11-openjdk-amd64/bin/jjs to provide /usr/bin/jjs (jjs) in auto mode
update-alternatives: using /usr/lib/jvm/java-11-openjdk-amd64/bin/rmid to provide /usr/bin/rmid (rmid) in auto mode
update-alternatives: using /usr/lib/jvm/java-11-openjdk-amd64/bin/pack200 to provide /usr/bin/pack200 (pack200) in auto mode
update-alternatives: using /usr/lib/jvm/java-11-openjdk-amd64/bin/unpack200 to provide /usr/bin/unpack200 (unpack200) in auto mode
Setting up sharphound (2.8.0-0kali1) ...
Setting up binfmt-support (2.2.2-7) ...
update-binfmts: warning: python3.13 already enabled in kernel.
update-binfmts: warning: llvm-19-runtime.binfmt already enabled in kernel.
update-binfmts: warning: llvm-18-runtime.binfmt already enabled in kernel.
Created symlink '/etc/systemd/system/multi-user.target.wants/binfmt-support.service' → '/usr/lib/systemd/system/binfmt-support.service'.
Setting up azurehound (2.8.1-0kali1) ...
Setting up jarwrapper (0.81) ...
Processing triggers for man-db (2.13.1-1) ...


_raw: 2026-01-09 09:48:34 status half-configured binfmt-support:amd64 2.2.2-7


_raw: 2026-01-09 09:48:34 status unpacked binfmt-support:amd64 2.2.2-7


_raw: 2026-01-09 09:48:34 status installed sharphound:all 2.8.0-0kali1


_raw: 2026-01-09 09:48:34 status half-configured sharphound:all 2.8.0-0kali1


_raw: 2026-01-09 09:48:34 status unpacked sharphound:all 2.8.0-0kali1


_raw: 2026-01-09 09:48:34 configure sharphound:all 2.8.0-0kali1 <none>


_raw: 2026-01-09 09:48:34 status triggers-awaited openjdk-11-jre-headless:amd64 11.0.25~5ea-1


_raw: 2026-01-09 09:48:34 status triggers-pending ca-certificates-java:all 20240118


_raw: 2026-01-09 09:48:34 status installed openjdk-11-jre-headless:amd64 11.0.25~5ea-1


_raw:
[20260109-09:48:33] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:33] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:33] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:33] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:33] [INFO ] Security protocol: configured [RDP], requested [SSL|HYBRID|HYBRID_EX|RDP], selected [RDP]
[20260109-09:48:33] [ERROR] libxrdp_force_read: header read error
[20260109-09:48:33] [ERROR] Processing [ITU-T T.125] Connect-Initial failed
[20260109-09:48:33] [ERROR] [MCS Connection Sequence] receive connection request failed
[20260109-09:48:33] [ERROR] xrdp_sec_incoming: xrdp_mcs_incoming failed
[20260109-09:48:33] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20260109-09:48:33] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20260109-09:48:33] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20260109-09:48:33] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed
[20260109-09:48:34] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.101 port 57966
[20260109-09:48:34] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:34] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:34] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:34] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:34] [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
[20260109-09:48:34] [INFO ] Connected client computer name: CPTC11-FINALS-T
[20260109-09:48:34] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
[20260109-09:48:34] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
[20260109-09:48:34] [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard_type:[0x04], keyboard_subtype:[0x00], keylayout:[0x00000409]
[20260109-09:48:34] [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [us] options []
[20260109-09:48:34] [INFO ] Non-TLS connection established from ::ffff:10.0.254.101 port 57966: with security level : high
[20260109-09:48:34] [INFO ] xrdp_caps_process_pointer: client supports new(color) cursor
[20260109-09:48:34] [INFO ] xrdp_process_offscreen_bmpcache: support level 1 cache size 10485760 MB cache entries 100
[20260109-09:48:34] [INFO ] xrdp_caps_process_codecs: nscodec, codec id 1, properties len 3
[20260109-09:48:34] [WARN ] xrdp_caps_process_codecs: unknown codec id 5
[20260109-09:48:34] [INFO ] xrdp_caps_process_codecs: RemoteFX, codec id 3, properties len 49
[20260109-09:48:34] [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
[20260109-09:48:34] [WARN ] local keymap file for 0x00000409 found and doesn't match built in keymap, using local keymap file


_raw: [20260109-09:48:33] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.101 port 57965


_raw: 2026-01-09 09:48:33 status half-configured openjdk-11-jre-headless:amd64 11.0.25~5ea-1


_raw: 2026-01-09 09:48:33 status unpacked openjdk-11-jre-headless:amd64 11.0.25~5ea-1


_raw: 2026-01-09 09:48:33 status half-configured fastjar:amd64 2:0.98-7


_raw: 2026-01-09 09:48:33 startup packages configure


_raw: update-alternatives 2026-01-09 09:48:33: run with --install /usr/bin/jexec jexec /usr/lib/jvm/java-11-openjdk-amd64/lib/jexec 1111 --slave /usr/share/binfmts/jar jexec-binfmt /usr/lib/jvm/java-11-openjdk-amd64/lib/jar.binfmt


_raw: update-alternatives 2026-01-09 09:48:33: link group unpack200 updated to point to /usr/lib/jvm/java-11-openjdk-amd64/bin/unpack200


_raw: update-alternatives 2026-01-09 09:48:33: run with --install /usr/bin/unpack200 unpack200 /usr/lib/jvm/java-11-openjdk-amd64/bin/unpack200 1111 --slave /usr/share/man/man1/unpack200.1.gz unpack200.1.gz /usr/lib/jvm/java-11-openjdk-amd64/man/man1/unpack200.1.gz


_raw: update-alternatives 2026-01-09 09:48:33: link group pack200 updated to point to /usr/lib/jvm/java-11-openjdk-amd64/bin/pack200


_raw: update-alternatives 2026-01-09 09:48:33: run with --install /usr/bin/pack200 pack200 /usr/lib/jvm/java-11-openjdk-amd64/bin/pack200 1111 --slave /usr/share/man/man1/pack200.1.gz pack200.1.gz /usr/lib/jvm/java-11-openjdk-amd64/man/man1/pack200.1.gz


_raw: update-alternatives 2026-01-09 09:48:33: run with --install /usr/bin/rmiregistry rmiregistry /usr/lib/jvm/java-11-openjdk-amd64/bin/rmiregistry 1111 --slave /usr/share/man/man1/rmiregistry.1.gz rmiregistry.1.gz /usr/lib/jvm/java-11-openjdk-amd64/man/man1/rmiregistry.1.gz


_raw: update-alternatives 2026-01-09 09:48:33: link group rmid updated to point to /usr/lib/jvm/java-11-openjdk-amd64/bin/rmid


_raw: update-alternatives 2026-01-09 09:48:33: run with --install /usr/bin/rmid rmid /usr/lib/jvm/java-11-openjdk-amd64/bin/rmid 1111 --slave /usr/share/man/man1/rmid.1.gz rmid.1.gz /usr/lib/jvm/java-11-openjdk-amd64/man/man1/rmid.1.gz


_raw: update-alternatives 2026-01-09 09:48:33: run with --install /usr/bin/keytool keytool /usr/lib/jvm/java-11-openjdk-amd64/bin/keytool 1111 --slave /usr/share/man/man1/keytool.1.gz keytool.1.gz /usr/lib/jvm/java-11-openjdk-amd64/man/man1/keytool.1.gz


_raw: update-alternatives 2026-01-09 09:48:33: link group jjs updated to point to /usr/lib/jvm/java-11-openjdk-amd64/bin/jjs


_raw: update-alternatives 2026-01-09 09:48:33: run with --install /usr/bin/jjs jjs /usr/lib/jvm/java-11-openjdk-amd64/bin/jjs 1111 --slave /usr/share/man/man1/jjs.1.gz jjs.1.gz /usr/lib/jvm/java-11-openjdk-amd64/man/man1/jjs.1.gz


_raw: update-alternatives 2026-01-09 09:48:33: run with --install /usr/bin/java java /usr/lib/jvm/java-11-openjdk-amd64/bin/java 1111 --slave /usr/share/man/man1/java.1.gz java.1.gz /usr/lib/jvm/java-11-openjdk-amd64/man/man1/java.1.gz


_raw: update-alternatives 2026-01-09 09:48:33: link group jar updated to point to /usr/bin/fastjar


_raw: update-alternatives 2026-01-09 09:48:33: run with --quiet --install /usr/bin/jar jar /usr/bin/fastjar 100 --slave /usr/share/man/man1/jar.1.gz jar.1.gz /usr/share/man/man1/fastjar.1.gz


_raw: 2026-01-09 09:48:33 status unpacked sharphound:all 2.8.0-0kali1


_raw: 2026-01-09 09:48:33 status half-installed sharphound:all 2.8.0-0kali1


_raw: 2026-01-09 09:48:33 status unpacked bloodhound:amd64 8.3.1-0kali1


_raw:
[20260109-09:48:32] [ERROR] pam_authenticate failed: Authentication failure
[20260109-09:48:32] [INFO ] AUTHFAIL: user=pentester ip=::ffff:10.0.254.105 time=1767970112
[20260109-09:48:32] [ERROR] sesman_data_in: scp_process_msg failed
[20260109-09:48:32] [ERROR] sesman_main_loop: trans_check_wait_objs failed, removing trans


_raw: 2026-01-09 09:48:31 status half-installed bloodhound:amd64 8.3.1-0kali1


_raw:
Selecting previously unselected package bloodhound.
Preparing to unpack .../7-bloodhound_8.3.1-0kali1_amd64.deb ...
Unpacking bloodhound (8.3.1-0kali1) ...


_raw:
[20260109-09:48:30] [INFO ] xrdp_wm_log_msg: sesman connect ok
[20260109-09:48:30] [INFO ] sesman connect ok
[20260109-09:48:30] [INFO ] sending login info to session manager. Please wait...
[20260109-09:48:32] [INFO ] xrdp_wm_log_msg: login failed for user pentester
[20260109-09:48:32] [INFO ] login failed for user pentester


_raw: [20260109-09:48:30] [INFO ] Socket 12: AF_INET6 connection received from ::1 port 33320


_raw: 2026-01-09 09:48:30 status half-installed neo4j:all 5.2.0+really4.4.26-0kali1


_raw: 2026-01-09 09:48:30 status triggers-pending hicolor-icon-theme:all 0.18-2


_raw: 2026-01-09 09:48:30 status triggers-pending desktop-file-utils:amd64 0.28-1


_raw:
Selecting previously unselected package binfmt-support.
(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 449895 files and directories currently installed.)
Preparing to unpack .../0-binfmt-support_2.2.2-7_amd64.deb ...
Unpacking binfmt-support (2.2.2-7) ...
Selecting previously unselected package azurehound.
Preparing to unpack .../1-azurehound_2.8.1-0kali1_amd64.deb ...
Unpacking azurehound (2.8.1-0kali1) ...
Selecting previously unselected package fastjar.
Preparing to unpack .../2-fastjar_2%3a0.98-7_amd64.deb ...
Unpacking fastjar (2:0.98-7) ...
Selecting previously unselected package jarwrapper.
Preparing to unpack .../3-jarwrapper_0.81_all.deb ...
Unpacking jarwrapper (0.81) ...
Selecting previously unselected package openjdk-11-jre-headless:amd64.
Preparing to unpack .../4-openjdk-11-jre-headless_11.0.25~5ea-1_amd64.deb ...
Unpacking openjdk-11-jre-headless:amd64 (11.0.25~5ea-1) ...
Selecting previously unselected package openjdk-11-jre:amd64.
Preparing to unpack .../5-openjdk-11-jre_11.0.25~5ea-1_amd64.deb ...
Unpacking openjdk-11-jre:amd64 (11.0.25~5ea-1) ...
Selecting previously unselected package neo4j.
Preparing to unpack .../6-neo4j_5.2.0+really4.4.26-0kali1_all.deb ...
Unpacking neo4j (5.2.0+really4.4.26-0kali1) ...


_raw:
[20260109-09:48:29] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:29] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:29] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:29] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:29] [INFO ] Security protocol: configured [RDP], requested [SSL|HYBRID|HYBRID_EX|RDP], selected [RDP]
[20260109-09:48:29] [ERROR] libxrdp_force_read: header read error
[20260109-09:48:29] [ERROR] Processing [ITU-T T.125] Connect-Initial failed
[20260109-09:48:29] [ERROR] [MCS Connection Sequence] receive connection request failed
[20260109-09:48:29] [ERROR] xrdp_sec_incoming: xrdp_mcs_incoming failed
[20260109-09:48:29] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20260109-09:48:29] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20260109-09:48:29] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20260109-09:48:29] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed
[20260109-09:48:31] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.101 port 58399
[20260109-09:48:31] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:31] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:31] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:31] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:31] [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
[20260109-09:48:31] [INFO ] Connected client computer name: CPTC11-FINALS-T
[20260109-09:48:31] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
[20260109-09:48:31] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
[20260109-09:48:31] [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard_type:[0x04], keyboard_subtype:[0x00], keylayout:[0x00000409]
[20260109-09:48:31] [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [us] options []
[20260109-09:48:31] [INFO ] Non-TLS connection established from ::ffff:10.0.254.101 port 58399: with security level : high
[20260109-09:48:31] [INFO ] xrdp_caps_process_pointer: client supports new(color) cursor
[20260109-09:48:31] [INFO ] xrdp_process_offscreen_bmpcache: support level 1 cache size 10485760 MB cache entries 100
[20260109-09:48:31] [INFO ] xrdp_caps_process_codecs: nscodec, codec id 1, properties len 3
[20260109-09:48:31] [WARN ] xrdp_caps_process_codecs: unknown codec id 5
[20260109-09:48:31] [INFO ] xrdp_caps_process_codecs: RemoteFX, codec id 3, properties len 49
[20260109-09:48:31] [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
[20260109-09:48:31] [WARN ] local keymap file for 0x00000409 found and doesn't match built in keymap, using local keymap file


_raw: [20260109-09:48:29] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.101 port 58398


_raw:
[20260109-09:48:29] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:29] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:29] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:29] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:29] [INFO ] Security protocol: configured [RDP], requested [SSL|HYBRID|HYBRID_EX|RDP], selected [RDP]
[20260109-09:48:29] [ERROR] libxrdp_force_read: header read error
[20260109-09:48:29] [ERROR] Processing [ITU-T T.125] Connect-Initial failed
[20260109-09:48:29] [ERROR] [MCS Connection Sequence] receive connection request failed
[20260109-09:48:29] [ERROR] xrdp_sec_incoming: xrdp_mcs_incoming failed
[20260109-09:48:29] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20260109-09:48:29] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20260109-09:48:29] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20260109-09:48:29] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed
[20260109-09:48:30] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.106 port 58024
[20260109-09:48:30] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:30] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:30] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:30] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:30] [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
[20260109-09:48:30] [INFO ] Connected client computer name: CPTC11-FINALS-T
[20260109-09:48:30] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
[20260109-09:48:30] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
[20260109-09:48:30] [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard_type:[0x04], keyboard_subtype:[0x00], keylayout:[0x00000409]
[20260109-09:48:30] [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [us] options []
[20260109-09:48:30] [INFO ] Non-TLS connection established from ::ffff:10.0.254.106 port 58024: with security level : high
[20260109-09:48:30] [INFO ] xrdp_caps_process_pointer: client supports new(color) cursor
[20260109-09:48:30] [INFO ] xrdp_process_offscreen_bmpcache: support level 1 cache size 10485760 MB cache entries 100
[20260109-09:48:30] [INFO ] xrdp_caps_process_codecs: nscodec, codec id 1, properties len 3
[20260109-09:48:30] [WARN ] xrdp_caps_process_codecs: unknown codec id 5
[20260109-09:48:30] [INFO ] xrdp_caps_process_codecs: RemoteFX, codec id 3, properties len 49
[20260109-09:48:30] [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
[20260109-09:48:30] [WARN ] local keymap file for 0x00000409 found and doesn't match built in keymap, using local keymap file


_raw: [20260109-09:48:29] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.106 port 58023


_raw: 2026-01-09 09:48:29 status unpacked openjdk-11-jre-headless:amd64 11.0.25~5ea-1


_raw:
[20260109-09:48:29] [INFO ] Terminal Server Users group is disabled, allowing authentication
[20260109-09:48:29] [INFO ] ++ created session (access granted): username pentester, ip ::ffff:10.0.254.101:58191 - socket: 12
[20260109-09:48:29] [INFO ] starting Xorg session...
[20260109-09:48:29] [INFO ] Starting session: session_pid 229218, display :10.0, width 1920, height 1080, bpp 24, client ip ::ffff:10.0.254.101:58191 - socket: 12, user name pentester
[20260109-09:48:29] [INFO ] [session start] (display 10): calling auth_start_session from pid 229218
[20260109-09:48:29] [ERROR] sesman_data_in: scp_process_msg failed
[20260109-09:48:29] [ERROR] sesman_main_loop: trans_check_wait_objs failed, removing trans
[20260109-09:48:29] [INFO ] Starting X server on display 10: /usr/lib/xorg/Xorg :10 -auth .Xauthority -config xrdp/xorg.conf -noreset -nolisten tcp -logfile .xorgxrdp.%s.log
[20260109-09:48:29] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:48:29] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:48:29] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:48:29] [INFO ] Session started successfully for user pentester on display 10
[20260109-09:48:29] [INFO ] Starting the xrdp channel server for display 10
[20260109-09:48:29] [INFO ] Starting the default window manager on display 10: /etc/xrdp/startwm.sh
[20260109-09:48:29] [INFO ] Session in progress on display 10, waiting until the window manager (pid 229245) exits to end the session


_raw:
[20260109-09:48:29] [INFO ] xrdp_wm_log_msg: sesman connect ok
[20260109-09:48:29] [INFO ] sesman connect ok
[20260109-09:48:29] [INFO ] sending login info to session manager. Please wait...
[20260109-09:48:29] [INFO ] xrdp_wm_log_msg: login successful for user pentester on display 10
[20260109-09:48:29] [INFO ] login successful for user pentester on display 10
[20260109-09:48:29] [INFO ] loaded module 'libxup.so' ok, interface size 10296, version 4
[20260109-09:48:29] [INFO ] started connecting
[20260109-09:48:29] [INFO ] lib_mod_connect: connecting via UNIX socket
[20260109-09:48:29] [INFO ] lib_mod_log_peer: xrdp_pid=229137 connected to X11rdp_pid=229246 X11rdp_uid=1001 X11rdp_gid=1001 client_ip=::ffff:10.0.254.101 client_port=58191
[20260109-09:48:29] [INFO ] connected ok


_raw: [20260109-09:48:29] [INFO ] Socket 12: AF_INET6 connection received from ::1 port 56224


_raw: 2026-01-09 09:48:28 status half-installed openjdk-11-jre-headless:amd64 11.0.25~5ea-1


_raw: 2026-01-09 09:48:28 status unpacked jarwrapper:all 0.81


_raw: 2026-01-09 09:48:28 status half-installed jarwrapper:all 0.81


_raw: 2026-01-09 09:48:28 status unpacked azurehound:amd64 2.8.1-0kali1


_raw: 2026-01-09 09:48:27 startup archives unpack


_raw:
Start-Date: 2026-01-09  09:48:27
Commandline: apt install -y bloodhound neo4j
Requested-By: pentester (1001)
Install: openjdk-11-jre:amd64 (11.0.25~5ea-1, automatic), openjdk-11-jre-headless:amd64 (11.0.25~5ea-1, automatic), binfmt-support:amd64 (2.2.2-7, automatic), jarwrapper:amd64 (0.81, automatic), sharphound:amd64 (2.8.0-0kali1, automatic), azurehound:amd64 (2.8.1-0kali1, automatic), bloodhound:amd64 (8.3.1-0kali1), fastjar:amd64 (2:0.98-7, automatic), neo4j:amd64 (5.2.0+really4.4.26-0kali1)


_raw: 2026-01-09 09:48:27 status half-installed azurehound:amd64 2.8.1-0kali1


_raw: 2026-01-09 09:48:27 status unpacked binfmt-support:amd64 2.2.2-7


_raw: 2026-01-09 09:48:27 status triggers-pending kali-menu:all 2025.4.3


_raw: 2026-01-09 09:48:27 status half-installed binfmt-support:amd64 2.2.2-7


_raw:
[20260109-09:48:15] [ERROR] pam_authenticate failed: Authentication failure
[20260109-09:48:15] [INFO ] AUTHFAIL: user=pentester ip=::ffff:10.0.254.105 time=1767970095
[20260109-09:48:15] [ERROR] sesman_data_in: scp_process_msg failed
[20260109-09:48:15] [ERROR] sesman_main_loop: trans_check_wait_objs failed, removing trans


_raw:
[20260109-09:48:14] [INFO ] xrdp_caps_process_codecs: nscodec, codec id 1, properties len 3
[20260109-09:48:14] [WARN ] xrdp_caps_process_codecs: unknown codec id 5
[20260109-09:48:14] [INFO ] xrdp_caps_process_codecs: RemoteFX, codec id 3, properties len 49
[20260109-09:48:14] [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
[20260109-09:48:14] [WARN ] local keymap file for 0x00000409 found and doesn't match built in keymap, using local keymap file


_raw:
[20260109-09:48:13] [INFO ] xrdp_wm_log_msg: sesman connect ok
[20260109-09:48:13] [INFO ] sesman connect ok
[20260109-09:48:13] [INFO ] sending login info to session manager. Please wait...
[20260109-09:48:15] [INFO ] xrdp_wm_log_msg: login failed for user pentester
[20260109-09:48:15] [INFO ] login failed for user pentester


_raw: [20260109-09:48:13] [INFO ] Socket 12: AF_INET6 connection received from ::1 port 57574


_raw:
[20260109-09:48:11] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:11] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:11] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:11] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:11] [INFO ] Security protocol: configured [RDP], requested [SSL|HYBRID|HYBRID_EX|RDP], selected [RDP]
[20260109-09:48:11] [ERROR] libxrdp_force_read: header read error
[20260109-09:48:11] [ERROR] Processing [ITU-T T.125] Connect-Initial failed
[20260109-09:48:11] [ERROR] [MCS Connection Sequence] receive connection request failed
[20260109-09:48:11] [ERROR] xrdp_sec_incoming: xrdp_mcs_incoming failed
[20260109-09:48:11] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20260109-09:48:11] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20260109-09:48:11] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20260109-09:48:11] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed
[20260109-09:48:14] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.101 port 58115
[20260109-09:48:14] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:14] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:14] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:14] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:14] [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
[20260109-09:48:14] [INFO ] Connected client computer name: CPTC11-FINALS-T
[20260109-09:48:14] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
[20260109-09:48:14] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
[20260109-09:48:14] [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard_type:[0x04], keyboard_subtype:[0x00], keylayout:[0x00000409]
[20260109-09:48:14] [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [us] options []
[20260109-09:48:14] [INFO ] Non-TLS connection established from ::ffff:10.0.254.101 port 58115: with security level : high
[20260109-09:48:14] [INFO ] xrdp_caps_process_pointer: client supports new(color) cursor
[20260109-09:48:14] [INFO ] xrdp_process_offscreen_bmpcache: support level 1 cache size 10485760 MB cache entries 100


_raw: [20260109-09:48:11] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.101 port 58114


_raw:
[20260109-09:48:07] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:07] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:07] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:07] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:07] [INFO ] Security protocol: configured [RDP], requested [SSL|HYBRID|HYBRID_EX|RDP], selected [RDP]
[20260109-09:48:07] [ERROR] libxrdp_force_read: header read error
[20260109-09:48:07] [ERROR] Processing [ITU-T T.125] Connect-Initial failed
[20260109-09:48:07] [ERROR] [MCS Connection Sequence] receive connection request failed
[20260109-09:48:07] [ERROR] xrdp_sec_incoming: xrdp_mcs_incoming failed
[20260109-09:48:07] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20260109-09:48:07] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20260109-09:48:07] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20260109-09:48:07] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed
[20260109-09:48:08] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.106 port 57979
[20260109-09:48:08] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:08] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:08] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:08] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:08] [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
[20260109-09:48:08] [INFO ] Connected client computer name: CPTC11-FINALS-T
[20260109-09:48:08] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
[20260109-09:48:08] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
[20260109-09:48:08] [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard_type:[0x04], keyboard_subtype:[0x00], keylayout:[0x00000409]
[20260109-09:48:08] [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [us] options []
[20260109-09:48:08] [INFO ] Non-TLS connection established from ::ffff:10.0.254.106 port 57979: with security level : high
[20260109-09:48:08] [INFO ] xrdp_caps_process_pointer: client supports new(color) cursor
[20260109-09:48:08] [INFO ] xrdp_process_offscreen_bmpcache: support level 1 cache size 10485760 MB cache entries 100
[20260109-09:48:08] [INFO ] xrdp_caps_process_codecs: nscodec, codec id 1, properties len 3
[20260109-09:48:08] [WARN ] xrdp_caps_process_codecs: unknown codec id 5
[20260109-09:48:08] [INFO ] xrdp_caps_process_codecs: RemoteFX, codec id 3, properties len 49
[20260109-09:48:08] [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
[20260109-09:48:08] [WARN ] local keymap file for 0x00000409 found and doesn't match built in keymap, using local keymap file


_raw: [20260109-09:48:07] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.106 port 57978


_raw:
[20260109-09:48:02] [ERROR] pam_authenticate failed: Authentication failure
[20260109-09:48:02] [INFO ] AUTHFAIL: user=pentester ip=::ffff:10.0.254.105 time=1767970082
[20260109-09:48:02] [ERROR] sesman_data_in: scp_process_msg failed
[20260109-09:48:02] [ERROR] sesman_main_loop: trans_check_wait_objs failed, removing trans


_raw:
[20260109-09:48:02] [INFO ] xrdp_wm_log_msg: login failed for user pentester
[20260109-09:48:02] [INFO ] login failed for user pentester


_raw: 2026-01-09 09:48:01 status half-configured kali-menu:all 2025.4.3


_raw: 2026-01-09 09:48:01 status installed docker-compose:amd64 2.32.4-3


_raw: 2026-01-09 09:48:01 status half-configured docker-compose:amd64 2.32.4-3


_raw: 2026-01-09 09:48:01 status unpacked docker-compose:amd64 2.32.4-3


_raw: 2026-01-09 09:48:01 startup packages configure


_raw: (lightdm-gtk-greeter:938): Gtk-WARNING **: 09:48:00.962: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:934): Gtk-WARNING **: 09:48:00.944: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:934): Gtk-WARNING **: 09:48:00.915: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:935): Gtk-WARNING **: 09:48:00.905: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:968): Gtk-WARNING **: 09:48:00.900: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:945): Gtk-WARNING **: 09:48:00.889: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:959): Gtk-WARNING **: 09:48:00.857: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:1158): Gtk-WARNING **: 09:48:00.853: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:942): Gtk-WARNING **: 09:48:00.836: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:1153): Gtk-WARNING **: 09:48:00.825: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:1149): Gtk-WARNING **: 09:48:00.822: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:946): Gtk-WARNING **: 09:48:00.821: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:936): Gtk-WARNING **: 09:48:00.804: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:942): Gtk-WARNING **: 09:48:00.801: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:943): Gtk-WARNING **: 09:48:00.789: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:935): Gtk-WARNING **: 09:48:00.723: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:937): Gtk-WARNING **: 09:48:00.707: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:940): Gtk-WARNING **: 09:48:00.702: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:937): Gtk-WARNING **: 09:48:00.691: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:940): Gtk-WARNING **: 09:48:00.671: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:934): Gtk-WARNING **: 09:48:00.655: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:937): Gtk-WARNING **: 09:48:00.646: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:939): Gtk-WARNING **: 09:48:00.634: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:940): Gtk-WARNING **: 09:48:00.604: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:1319): Gtk-WARNING **: 09:48:00.591: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:938): Gtk-WARNING **: 09:48:00.589: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:940): Gtk-WARNING **: 09:48:00.559: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:944): Gtk-WARNING **: 09:48:00.558: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:943): Gtk-WARNING **: 09:48:00.550: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:932): Gtk-WARNING **: 09:48:00.541: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:941): Gtk-WARNING **: 09:48:00.469: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:961): Gtk-WARNING **: 09:48:00.427: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:936): Gtk-WARNING **: 09:48:00.418: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:944): Gtk-WARNING **: 09:48:00.415: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:961): Gtk-WARNING **: 09:48:00.401: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:969): Gtk-WARNING **: 09:48:00.397: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:940): Gtk-WARNING **: 09:48:00.376: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:935): Gtk-WARNING **: 09:48:00.371: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:939): Gtk-WARNING **: 09:48:00.361: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:938): Gtk-WARNING **: 09:48:00.360: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:937): Gtk-WARNING **: 09:48:00.338: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:948): Gtk-WARNING **: 09:48:00.325: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:1165): Gtk-WARNING **: 09:48:00.315: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:933): Gtk-WARNING **: 09:48:00.302: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:944): Gtk-WARNING **: 09:48:00.301: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:939): Gtk-WARNING **: 09:48:00.301: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:939): Gtk-WARNING **: 09:48:00.299: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:938): Gtk-WARNING **: 09:48:00.291: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:937): Gtk-WARNING **: 09:48:00.274: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:942): Gtk-WARNING **: 09:48:00.255: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:949): Gtk-WARNING **: 09:48:00.248: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:939): Gtk-WARNING **: 09:48:00.248: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:935): Gtk-WARNING **: 09:48:00.247: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:943): Gtk-WARNING **: 09:48:00.230: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:946): Gtk-WARNING **: 09:48:00.223: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:939): Gtk-WARNING **: 09:48:00.220: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:944): Gtk-WARNING **: 09:48:00.206: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:946): Gtk-WARNING **: 09:48:00.204: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:937): Gtk-WARNING **: 09:48:00.204: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:935): Gtk-WARNING **: 09:48:00.201: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:948): Gtk-WARNING **: 09:48:00.164: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:936): Gtk-WARNING **: 09:48:00.159: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:940): Gtk-WARNING **: 09:48:00.149: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:940): Gtk-WARNING **: 09:48:00.140: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:946): Gtk-WARNING **: 09:48:00.121: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:939): Gtk-WARNING **: 09:48:00.113: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:932): Gtk-WARNING **: 09:48:00.111: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:943): Gtk-WARNING **: 09:48:00.102: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:942): Gtk-WARNING **: 09:48:00.101: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:935): Gtk-WARNING **: 09:48:00.092: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:941): Gtk-WARNING **: 09:48:00.088: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:939): Gtk-WARNING **: 09:48:00.076: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:952): Gtk-WARNING **: 09:48:00.073: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:936): Gtk-WARNING **: 09:48:00.068: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:928): Gtk-WARNING **: 09:48:00.047: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:1044): Gtk-WARNING **: 09:48:00.030: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:940): Gtk-WARNING **: 09:48:00.019: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw: (lightdm-gtk-greeter:1151): Gtk-WARNING **: 09:48:00.015: Drawing a gadget with negative dimensions. Did you forget to allocate a size? (node menubar owner GreeterMenuBar)


_raw:
Start-Date: 2026-01-09  09:48:00
Commandline: apt install docker-compose -y
Install: docker-compose:amd64 (2.32.4-3)


_raw:
Log started: 2026-01-09  09:48:00
Selecting previously unselected package docker-compose.
(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 456764 files and directories currently installed.)
Preparing to unpack .../docker-compose_2.32.4-3_amd64.deb ...
Unpacking docker-compose (2.32.4-3) ...
Setting up docker-compose (2.32.4-3) ...
Processing triggers for kali-menu (2025.4.3) ...
Processing triggers for man-db (2.13.1-1) ...


_raw: 2026-01-09 09:48:00 status triggers-pending kali-menu:all 2025.4.3


_raw: 2026-01-09 09:48:00 status half-installed docker-compose:amd64 2.32.4-3


_raw: 2026-01-09 09:48:00 startup archives unpack


_raw: Processing triggers for kali-menu (2025.4.3) ...


_raw: 2026-01-09 09:47:59 status half-configured kali-menu:all 2025.4.3


_raw:
[20260109-09:47:58] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:47:58] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:47:58] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:47:58] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:47:58] [INFO ] Security protocol: configured [RDP], requested [SSL|HYBRID|HYBRID_EX|RDP], selected [RDP]
[20260109-09:47:58] [ERROR] libxrdp_force_read: header read error
[20260109-09:47:58] [ERROR] Processing [ITU-T T.125] Connect-Initial failed
[20260109-09:47:58] [ERROR] [MCS Connection Sequence] receive connection request failed
[20260109-09:47:58] [ERROR] xrdp_sec_incoming: xrdp_mcs_incoming failed
[20260109-09:47:58] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20260109-09:47:58] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20260109-09:47:58] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20260109-09:47:58] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed
[20260109-09:48:01] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.106 port 57997
[20260109-09:48:01] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:48:01] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:48:01] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:48:01] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:48:01] [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
[20260109-09:48:01] [INFO ] Connected client computer name: CPTC11-FINALS-T
[20260109-09:48:01] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
[20260109-09:48:01] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
[20260109-09:48:01] [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard_type:[0x04], keyboard_subtype:[0x00], keylayout:[0x00000409]
[20260109-09:48:01] [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [us] options []
[20260109-09:48:01] [INFO ] Non-TLS connection established from ::ffff:10.0.254.106 port 57997: with security level : high
[20260109-09:48:01] [INFO ] xrdp_caps_process_pointer: client supports new(color) cursor
[20260109-09:48:01] [INFO ] xrdp_process_offscreen_bmpcache: support level 1 cache size 10485760 MB cache entries 100
[20260109-09:48:01] [INFO ] xrdp_caps_process_codecs: nscodec, codec id 1, properties len 3
[20260109-09:48:01] [WARN ] xrdp_caps_process_codecs: unknown codec id 5
[20260109-09:48:01] [INFO ] xrdp_caps_process_codecs: RemoteFX, codec id 3, properties len 49
[20260109-09:48:01] [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
[20260109-09:48:01] [WARN ] local keymap file for 0x00000409 found and doesn't match built in keymap, using local keymap file


_raw:
[20260109-09:47:58] [INFO ] Terminal Server Users group is disabled, allowing authentication
[20260109-09:47:58] [INFO ] ++ created session (access granted): username pentester, ip ::ffff:10.0.254.104:58392 - socket: 12
[20260109-09:47:58] [INFO ] starting Xorg session...
[20260109-09:47:58] [INFO ] Starting session: session_pid 229172, display :10.0, width 1920, height 1080, bpp 24, client ip ::ffff:10.0.254.104:58392 - socket: 12, user name pentester
[20260109-09:47:58] [INFO ] [session start] (display 10): calling auth_start_session from pid 229172
[20260109-09:47:58] [ERROR] sesman_data_in: scp_process_msg failed
[20260109-09:47:58] [ERROR] sesman_main_loop: trans_check_wait_objs failed, removing trans
[20260109-09:47:58] [INFO ] Starting X server on display 10: /usr/lib/xorg/Xorg :10 -auth .Xauthority -config xrdp/xorg.conf -noreset -nolisten tcp -logfile .xorgxrdp.%s.log
[20260109-09:47:58] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:47:58] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:47:58] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:47:58] [INFO ] Session started successfully for user pentester on display 10
[20260109-09:47:58] [INFO ] Starting the xrdp channel server for display 10
[20260109-09:47:58] [INFO ] Starting the default window manager on display 10: /etc/xrdp/startwm.sh
[20260109-09:47:58] [INFO ] Session in progress on display 10, waiting until the window manager (pid 229199) exits to end the session
[20260109-09:47:59] [INFO ] Socket 12: AF_INET6 connection received from ::1 port 33254


_raw:
[20260109-09:47:58] [INFO ] xrdp_wm_log_msg: sesman connect ok
[20260109-09:47:58] [INFO ] sesman connect ok
[20260109-09:47:58] [INFO ] sending login info to session manager. Please wait...
[20260109-09:47:58] [INFO ] xrdp_wm_log_msg: login successful for user pentester on display 10
[20260109-09:47:58] [INFO ] login successful for user pentester on display 10
[20260109-09:47:58] [INFO ] loaded module 'libxup.so' ok, interface size 10296, version 4
[20260109-09:47:58] [INFO ] started connecting
[20260109-09:47:58] [INFO ] lib_mod_connect: connecting via UNIX socket
[20260109-09:47:58] [INFO ] lib_mod_log_peer: xrdp_pid=229053 connected to X11rdp_pid=229200 X11rdp_uid=1001 X11rdp_gid=1001 client_ip=::ffff:10.0.254.104 client_port=58392
[20260109-09:47:58] [INFO ] connected ok
[20260109-09:47:59] [INFO ] connecting to sesman on 127.0.0.1:3350
[20260109-09:47:59] [INFO ] xrdp_wm_log_msg: sesman connect ok
[20260109-09:47:59] [INFO ] sesman connect ok
[20260109-09:47:59] [INFO ] sending login info to session manager. Please wait...


_raw: [20260109-09:47:58] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.106 port 57995


_raw: [20260109-09:47:58] [INFO ] Socket 12: AF_INET6 connection received from ::1 port 33244


_raw: 2026-01-09 09:47:56 status half-configured libc-bin:amd64 2.41-12


_raw: 2026-01-09 09:47:56 status installed libintl-xs-perl:amd64 1.35-1


_raw: 2026-01-09 09:47:56 status half-configured libintl-xs-perl:amd64 1.35-1


_raw: 2026-01-09 09:47:56 status unpacked libintl-xs-perl:amd64 1.35-1


_raw:
Setting up python3-pycriu (4.2-1) ...
Setting up docker.io (27.5.1+dfsg4-1) ...
update-rc.d: We have no instructions for the docker init script.
update-rc.d: It looks like a non-network service, we enable it.
Created symlink '/etc/systemd/system/multi-user.target.wants/docker.service' → '/usr/lib/systemd/system/docker.service'.
Created symlink '/etc/systemd/system/sockets.target.wants/docker.socket' → '/usr/lib/systemd/system/docker.socket'.
Setting up libintl-xs-perl (1.35-1) ...
Processing triggers for libc-bin (2.41-12) ...
Processing triggers for man-db (2.13.1-1) ...


_raw: 2026-01-09 09:47:54 status half-configured docker.io:amd64 27.5.1+dfsg4-1


_raw: 2026-01-09 09:47:54 status installed python3-pycriu:all 4.2-1


_raw: 2026-01-09 09:47:54 status half-configured python3-pycriu:all 4.2-1


_raw: 2026-01-09 09:47:54 status unpacked python3-pycriu:all 4.2-1


_raw: 2026-01-09 09:47:54 configure python3-pycriu:all 4.2-1 <none>


_raw: 2026-01-09 09:47:54 status installed needrestart:all 3.11-1


_raw: 2026-01-09 09:47:54 status half-configured needrestart:all 3.11-1


_raw: 2026-01-09 09:47:54 status unpacked needrestart:all 3.11-1


_raw: 2026-01-09 09:47:54 configure needrestart:all 3.11-1 <none>


_raw: 2026-01-09 09:47:54 status installed libsort-naturally-perl:all 1.03-4


_raw: 2026-01-09 09:47:54 status half-configured libsort-naturally-perl:all 1.03-4


_raw: 2026-01-09 09:47:54 status unpacked libsort-naturally-perl:all 1.03-4


_raw: 2026-01-09 09:47:54 configure libsort-naturally-perl:all 1.03-4 <none>


_raw: 2026-01-09 09:47:54 status installed docker-buildx:amd64 0.19.3+ds1-4


_raw: 2026-01-09 09:47:54 status half-configured docker-buildx:amd64 0.19.3+ds1-4


_raw:
Selecting previously unselected package docker-cli.
Preparing to unpack .../07-docker-cli_27.5.1+dfsg4-1_amd64.deb ...
Unpacking docker-cli (27.5.1+dfsg4-1) ...
Selecting previously unselected package libintl-perl.
Preparing to unpack .../08-libintl-perl_1.35-1_all.deb ...
Unpacking libintl-perl (1.35-1) ...
Selecting previously unselected package libintl-xs-perl.
Preparing to unpack .../09-libintl-xs-perl_1.35-1_amd64.deb ...
Unpacking libintl-xs-perl (1.35-1) ...
Selecting previously unselected package libmodule-find-perl.
Preparing to unpack .../10-libmodule-find-perl_0.17-1_all.deb ...
Unpacking libmodule-find-perl (0.17-1) ...
Selecting previously unselected package libproc-processtable-perl:amd64.
Preparing to unpack .../11-libproc-processtable-perl_0.637-1_amd64.deb ...
Unpacking libproc-processtable-perl:amd64 (0.637-1) ...
Selecting previously unselected package libsort-naturally-perl.
Preparing to unpack .../12-libsort-naturally-perl_1.03-4_all.deb ...
Unpacking libsort-naturally-perl (1.03-4) ...
Selecting previously unselected package needrestart.
Preparing to unpack .../13-needrestart_3.11-1_all.deb ...
Unpacking needrestart (3.11-1) ...
Selecting previously unselected package python3-protobuf.
Preparing to unpack .../14-python3-protobuf_3.21.12-14_amd64.deb ...
Unpacking python3-protobuf (3.21.12-14) ...
Selecting previously unselected package python3-pycriu.
Preparing to unpack .../15-python3-pycriu_4.2-1_all.deb ...
Unpacking python3-pycriu (4.2-1) ...
Setting up docker-cli (27.5.1+dfsg4-1) ...
Setting up tini-static (0.19.0-6) ...
Setting up runc (1.3.3+ds1-2) ...
Setting up libcompel1:amd64 (4.2-1) ...
Setting up libmodule-find-perl (0.17-1) ...
Setting up libproc-processtable-perl:amd64 (0.637-1) ...
Setting up criu (4.2-1) ...
Setting up libintl-perl (1.35-1) ...
Setting up python3-protobuf (3.21.12-14) ...
Setting up containerd (1.7.24~ds1-10) ...
containerd.service is a disabled or a static unit, not starting it.
Setting up docker-buildx (0.19.3+ds1-4) ...
Setting up libsort-naturally-perl (1.03-4) ...
Setting up needrestart (3.11-1) ...


_raw: 2026-01-09 09:47:53 status half-configured containerd:amd64 1.7.24~ds1-10


_raw: 2026-01-09 09:47:53 status half-configured python3-protobuf:amd64 3.21.12-14


_raw: 2026-01-09 09:47:53 status unpacked python3-pycriu:all 4.2-1


_raw: 2026-01-09 09:47:53 status half-installed python3-pycriu:all 4.2-1


_raw: 2026-01-09 09:47:53 status installed libintl-perl:all 1.35-1


_raw: 2026-01-09 09:47:53 status half-configured libintl-perl:all 1.35-1


_raw: 2026-01-09 09:47:53 status unpacked libintl-perl:all 1.35-1


_raw: 2026-01-09 09:47:53 status half-installed python3-protobuf:amd64 3.21.12-14


_raw: 2026-01-09 09:47:53 status unpacked needrestart:all 3.11-1


_raw: 2026-01-09 09:47:53 status half-configured criu:amd64 4.2-1


_raw: 2026-01-09 09:47:53 status installed libproc-processtable-perl:amd64 0.637-1


_raw: 2026-01-09 09:47:53 status half-configured libproc-processtable-perl:amd64 0.637-1


_raw: 2026-01-09 09:47:53 status unpacked libproc-processtable-perl:amd64 0.637-1


_raw: 2026-01-09 09:47:53 configure libproc-processtable-perl:amd64 0.637-1 <none>


_raw: 2026-01-09 09:47:53 status installed libmodule-find-perl:all 0.17-1


_raw: 2026-01-09 09:47:53 status half-configured libmodule-find-perl:all 0.17-1


_raw: 2026-01-09 09:47:53 status unpacked libmodule-find-perl:all 0.17-1


_raw: 2026-01-09 09:47:53 configure libmodule-find-perl:all 0.17-1 <none>


_raw: 2026-01-09 09:47:53 status installed libcompel1:amd64 4.2-1


_raw: 2026-01-09 09:47:53 status half-configured libcompel1:amd64 4.2-1


_raw: 2026-01-09 09:47:53 status half-configured tini-static:amd64 0.19.0-6


_raw: 2026-01-09 09:47:53 status half-configured docker-cli:amd64 27.5.1+dfsg4-1


_raw: 2026-01-09 09:47:53 startup packages configure


_raw:
[20260109-09:47:53] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:47:53] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:47:53] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:47:53] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:47:53] [INFO ] Security protocol: configured [RDP], requested [SSL|HYBRID|HYBRID_EX|RDP], selected [RDP]
[20260109-09:47:53] [ERROR] libxrdp_force_read: header read error
[20260109-09:47:53] [ERROR] Processing [ITU-T T.125] Connect-Initial failed
[20260109-09:47:53] [ERROR] [MCS Connection Sequence] receive connection request failed
[20260109-09:47:53] [ERROR] xrdp_sec_incoming: xrdp_mcs_incoming failed
[20260109-09:47:53] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20260109-09:47:53] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20260109-09:47:53] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20260109-09:47:53] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed
[20260109-09:47:54] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.102 port 58421
[20260109-09:47:54] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:47:54] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:47:54] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:47:54] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:47:54] [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
[20260109-09:47:54] [INFO ] Connected client computer name: CPTC11-FINALS-T
[20260109-09:47:54] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
[20260109-09:47:54] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
[20260109-09:47:54] [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard_type:[0x04], keyboard_subtype:[0x00], keylayout:[0x00000409]
[20260109-09:47:54] [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [us] options []
[20260109-09:47:54] [INFO ] Non-TLS connection established from ::ffff:10.0.254.102 port 58421: with security level : high
[20260109-09:47:54] [INFO ] xrdp_caps_process_pointer: client supports new(color) cursor
[20260109-09:47:54] [INFO ] xrdp_process_offscreen_bmpcache: support level 1 cache size 10485760 MB cache entries 100
[20260109-09:47:54] [INFO ] xrdp_caps_process_codecs: nscodec, codec id 1, properties len 3
[20260109-09:47:54] [WARN ] xrdp_caps_process_codecs: unknown codec id 5
[20260109-09:47:54] [INFO ] xrdp_caps_process_codecs: RemoteFX, codec id 3, properties len 49
[20260109-09:47:54] [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
[20260109-09:47:54] [WARN ] local keymap file for 0x00000409 found and doesn't match built in keymap, using local keymap file


_raw: [20260109-09:47:53] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.102 port 58420


_raw: 2026-01-09 09:47:52 status half-installed needrestart:all 3.11-1


_raw: 2026-01-09 09:47:52 status unpacked libsort-naturally-perl:all 1.03-4


_raw: 2026-01-09 09:47:52 status half-installed libsort-naturally-perl:all 1.03-4


_raw: 2026-01-09 09:47:52 install libsort-naturally-perl:all <none> 1.03-4


_raw: 2026-01-09 09:47:52 status unpacked libproc-processtable-perl:amd64 0.637-1


_raw: 2026-01-09 09:47:52 status half-installed libproc-processtable-perl:amd64 0.637-1


_raw: 2026-01-09 09:47:52 install libproc-processtable-perl:amd64 <none> 0.637-1


_raw: 2026-01-09 09:47:52 status unpacked libmodule-find-perl:all 0.17-1


_raw: 2026-01-09 09:47:52 status half-installed libmodule-find-perl:all 0.17-1


_raw: 2026-01-09 09:47:52 install libmodule-find-perl:all <none> 0.17-1


_raw: 2026-01-09 09:47:52 status unpacked libintl-xs-perl:amd64 1.35-1


_raw: 2026-01-09 09:47:52 status half-installed libintl-xs-perl:amd64 1.35-1


_raw: 2026-01-09 09:47:52 status unpacked libintl-perl:all 1.35-1


_raw: 2026-01-09 09:47:52 status half-installed libintl-perl:all 1.35-1


_raw: 2026-01-09 09:47:51 status half-installed docker-cli:amd64 27.5.1+dfsg4-1


_raw: 2026-01-09 09:47:51 status half-installed docker-buildx:amd64 0.19.3+ds1-4


_raw:
Selecting previously unselected package runc.
(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 455751 files and directories currently installed.)
Preparing to unpack .../00-runc_1.3.3+ds1-2_amd64.deb ...
Unpacking runc (1.3.3+ds1-2) ...
Selecting previously unselected package containerd.
Preparing to unpack .../01-containerd_1.7.24~ds1-10_amd64.deb ...
Unpacking containerd (1.7.24~ds1-10) ...
Selecting previously unselected package tini-static.
Preparing to unpack .../02-tini-static_0.19.0-6_amd64.deb ...
Unpacking tini-static (0.19.0-6) ...
Selecting previously unselected package docker.io.
Preparing to unpack .../03-docker.io_27.5.1+dfsg4-1_amd64.deb ...
Unpacking docker.io (27.5.1+dfsg4-1) ...
Selecting previously unselected package libcompel1:amd64.
Preparing to unpack .../04-libcompel1_4.2-1_amd64.deb ...
Unpacking libcompel1:amd64 (4.2-1) ...
Selecting previously unselected package criu.
Preparing to unpack .../05-criu_4.2-1_amd64.deb ...
Unpacking criu (4.2-1) ...
Selecting previously unselected package docker-buildx.
Preparing to unpack .../06-docker-buildx_0.19.3+ds1-4_amd64.deb ...
Unpacking docker-buildx (0.19.3+ds1-4) ...


_raw:
[20260109-09:47:51] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.105 port 57946
[20260109-09:47:51] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:47:51] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:47:51] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:47:51] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:47:51] [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
[20260109-09:47:51] [INFO ] Connected client computer name: CPTC11-FINALS-T
[20260109-09:47:51] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
[20260109-09:47:51] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
[20260109-09:47:51] [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard_type:[0x04], keyboard_subtype:[0x00], keylayout:[0x00000409]
[20260109-09:47:51] [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [us] options []
[20260109-09:47:51] [INFO ] Non-TLS connection established from ::ffff:10.0.254.105 port 57946: with security level : high
[20260109-09:47:51] [INFO ] xrdp_caps_process_pointer: client supports new(color) cursor
[20260109-09:47:51] [INFO ] xrdp_process_offscreen_bmpcache: support level 1 cache size 10485760 MB cache entries 100
[20260109-09:47:51] [INFO ] xrdp_caps_process_codecs: nscodec, codec id 1, properties len 3
[20260109-09:47:51] [WARN ] xrdp_caps_process_codecs: unknown codec id 5
[20260109-09:47:51] [INFO ] xrdp_caps_process_codecs: RemoteFX, codec id 3, properties len 49
[20260109-09:47:51] [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
[20260109-09:47:51] [WARN ] local keymap file for 0x00000409 found and doesn't match built in keymap, using local keymap file


_raw: 2026-01-09 09:47:50 status half-installed libcompel1:amd64 4.2-1


_raw: 2026-01-09 09:47:50 status triggers-pending libc-bin:amd64 2.41-12


_raw: 2026-01-09 09:47:50 status half-installed docker.io:amd64 27.5.1+dfsg4-1


_raw: Processing triggers for kali-menu (2025.4.3) ...


_raw: 2026-01-09 09:47:49 status half-configured kali-menu:all 2025.4.3


_raw: 2026-01-09 09:47:49 status half-installed tini-static:amd64 0.19.0-6


_raw: 2026-01-09 09:47:49 status half-installed containerd:amd64 1.7.24~ds1-10


_raw: 2026-01-09 09:47:48 status triggers-pending kali-menu:all 2025.4.3


_raw: 2026-01-09 09:47:48 startup archives unpack


_raw:
Start-Date: 2026-01-09  09:47:48
Commandline: apt install docker.io -y
Install: libintl-perl:amd64 (1.35-1, automatic), containerd:amd64 (1.7.24~ds1-10, automatic), libcompel1:amd64 (4.2-1, automatic), docker-cli:amd64 (27.5.1+dfsg4-1, automatic), python3-pycriu:amd64 (4.2-1, automatic), docker.io:amd64 (27.5.1+dfsg4-1), libsort-naturally-perl:amd64 (1.03-4, automatic), docker-buildx:amd64 (0.19.3+ds1-4, automatic), libmodule-find-perl:amd64 (0.17-1, automatic), runc:amd64 (1.3.3+ds1-2, automatic), python3-protobuf:amd64 (3.21.12-14, automatic), criu:amd64 (4.2-1, automatic), needrestart:amd64 (3.11-1, automatic), tini-static:amd64 (0.19.0-6, automatic), libintl-xs-perl:amd64 (1.35-1, automatic), libproc-processtable-perl:amd64 (0.637-1, automatic)


_raw: 2026-01-09 09:47:47 status half-configured libc-bin:amd64 2.41-12


_raw: 2026-01-09 09:47:47 status half-configured pkgconf:amd64 1.8.1-4


_raw:
[20260109-09:47:47] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:47:47] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:47:47] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:47:47] [INFO ] Security protocol: configured [RDP], requested [SSL|HYBRID|HYBRID_EX|RDP], selected [RDP]
[20260109-09:47:47] [ERROR] libxrdp_force_read: header read error
[20260109-09:47:47] [ERROR] Processing [ITU-T T.125] Connect-Initial failed
[20260109-09:47:47] [ERROR] [MCS Connection Sequence] receive connection request failed
[20260109-09:47:47] [ERROR] xrdp_sec_incoming: xrdp_mcs_incoming failed
[20260109-09:47:47] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20260109-09:47:47] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20260109-09:47:47] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20260109-09:47:47] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed


_raw: 2026-01-09 09:47:47 status half-configured golang-go:amd64 2:1.24~2


_raw:
[20260109-09:47:47] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.105 port 57945
[20260109-09:47:47] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem


_raw: 2026-01-09 09:47:47 status half-configured golang-src:all 2:1.24~2


_raw: 2026-01-09 09:47:47 status half-configured pkgconf-bin:amd64 1.8.1-4


_raw: 2026-01-09 09:47:47 status half-configured libpkgconf3:amd64 1.8.1-4


_raw: 2026-01-09 09:47:47 startup packages configure


_raw:
Preparing to unpack .../3-golang-go_2%3a1.24~2_amd64.deb ...
Unpacking golang-go:amd64 (2:1.24~2) ...
Selecting previously unselected package libpkgconf3:amd64.
Preparing to unpack .../4-libpkgconf3_1.8.1-4_amd64.deb ...
Unpacking libpkgconf3:amd64 (1.8.1-4) ...
Selecting previously unselected package pkgconf-bin.
Preparing to unpack .../5-pkgconf-bin_1.8.1-4_amd64.deb ...
Unpacking pkgconf-bin (1.8.1-4) ...
Selecting previously unselected package pkgconf:amd64.
Preparing to unpack .../6-pkgconf_1.8.1-4_amd64.deb ...
Unpacking pkgconf:amd64 (1.8.1-4) ...
Setting up golang-1.24-src (1.24.9-1) ...
Setting up libpkgconf3:amd64 (1.8.1-4) ...
Setting up golang-1.24-go (1.24.9-1) ...
Setting up pkgconf-bin (1.8.1-4) ...
Setting up golang-src (2:1.24~2) ...
Setting up golang-go:amd64 (2:1.24~2) ...
Setting up pkgconf:amd64 (1.8.1-4) ...
Processing triggers for libc-bin (2.41-12) ...
Processing triggers for man-db (2.13.1-1) ...


_raw: 2026-01-09 09:47:47 status half-installed pkgconf:amd64 1.8.1-4


_raw: 2026-01-09 09:47:47 status half-installed pkgconf-bin:amd64 1.8.1-4


_raw: 2026-01-09 09:47:46 status half-installed libpkgconf3:amd64 1.8.1-4


_raw: 2026-01-09 09:47:46 status triggers-pending libc-bin:amd64 2.41-12


_raw: 2026-01-09 09:47:46 status triggers-pending kali-menu:all 2025.4.3


_raw: 2026-01-09 09:47:46 status half-installed golang-src:all 2:1.24~2


_raw:
Selecting previously unselected package golang-1.24-go.
Preparing to unpack .../1-golang-1.24-go_1.24.9-1_amd64.deb ...
Unpacking golang-1.24-go (1.24.9-1) ...
Selecting previously unselected package golang-src.
Preparing to unpack .../2-golang-src_2%3a1.24~2_all.deb ...
Unpacking golang-src (2:1.24~2) ...
Selecting previously unselected package golang-go:amd64.


_raw:
[20260109-09:47:43] [INFO ] Terminal Server Users group is disabled, allowing authentication
[20260109-09:47:43] [INFO ] ++ created session (access granted): username pentester, ip ::ffff:10.0.254.104:58058 - socket: 12
[20260109-09:47:43] [INFO ] starting Xorg session...
[20260109-09:47:43] [INFO ] Starting session: session_pid 228434, display :10.0, width 1920, height 1080, bpp 24, client ip ::ffff:10.0.254.104:58058 - socket: 12, user name pentester
[20260109-09:47:43] [INFO ] [session start] (display 10): calling auth_start_session from pid 228434
[20260109-09:47:43] [ERROR] sesman_data_in: scp_process_msg failed
[20260109-09:47:43] [ERROR] sesman_main_loop: trans_check_wait_objs failed, removing trans
[20260109-09:47:44] [INFO ] Starting X server on display 10: /usr/lib/xorg/Xorg :10 -auth .Xauthority -config xrdp/xorg.conf -noreset -nolisten tcp -logfile .xorgxrdp.%s.log
[20260109-09:47:44] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:47:44] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:47:44] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:47:44] [INFO ] Session started successfully for user pentester on display 10
[20260109-09:47:44] [INFO ] Starting the xrdp channel server for display 10
[20260109-09:47:44] [INFO ] Starting the default window manager on display 10: /etc/xrdp/startwm.sh
[20260109-09:47:44] [INFO ] Session in progress on display 10, waiting until the window manager (pid 228461) exits to end the session


_raw:
[20260109-09:47:43] [INFO ] xrdp_wm_log_msg: sesman connect ok
[20260109-09:47:43] [INFO ] sesman connect ok
[20260109-09:47:43] [INFO ] sending login info to session manager. Please wait...
[20260109-09:47:43] [INFO ] xrdp_wm_log_msg: login successful for user pentester on display 10
[20260109-09:47:43] [INFO ] login successful for user pentester on display 10
[20260109-09:47:43] [INFO ] loaded module 'libxup.so' ok, interface size 10296, version 4
[20260109-09:47:43] [INFO ] started connecting
[20260109-09:47:43] [INFO ] lib_mod_connect: connecting via UNIX socket
[20260109-09:47:44] [INFO ] lib_mod_log_peer: xrdp_pid=228415 connected to X11rdp_pid=228462 X11rdp_uid=1001 X11rdp_gid=1001 client_ip=::ffff:10.0.254.104 client_port=58058
[20260109-09:47:44] [INFO ] connected ok


_raw:
[20260109-09:47:43] [INFO ] Terminal Server Users group is disabled, allowing authentication
[20260109-09:47:43] [INFO ] ++ created session (access granted): username pentester, ip ::ffff:10.0.254.105:58050 - socket: 12
[20260109-09:47:43] [INFO ] starting Xorg session...
[20260109-09:47:43] [INFO ] Starting session: session_pid 228423, display :10.0, width 1920, height 1080, bpp 24, client ip ::ffff:10.0.254.105:58050 - socket: 12, user name pentester
[20260109-09:47:43] [INFO ] [session start] (display 10): calling auth_start_session from pid 228423
[20260109-09:47:43] [ERROR] sesman_data_in: scp_process_msg failed
[20260109-09:47:43] [ERROR] sesman_main_loop: trans_check_wait_objs failed, removing trans
[20260109-09:47:43] [INFO ] Starting X server on display 10: /usr/lib/xorg/Xorg :10 -auth .Xauthority -config xrdp/xorg.conf -noreset -nolisten tcp -logfile .xorgxrdp.%s.log
[20260109-09:47:44] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:47:44] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:47:44] [INFO ] Found X server running at /tmp/.X11-unix/X10
[20260109-09:47:44] [INFO ] Session started successfully for user pentester on display 10
[20260109-09:47:44] [INFO ] Session in progress on display 10, waiting until the window manager (pid 228450) exits to end the session
[20260109-09:47:44] [INFO ] Starting the xrdp channel server for display 10
[20260109-09:47:44] [INFO ] Starting the default window manager on display 10: /etc/xrdp/startwm.sh


_raw:
[20260109-09:47:43] [INFO ] xrdp_wm_log_msg: sesman connect ok
[20260109-09:47:43] [INFO ] sesman connect ok
[20260109-09:47:43] [INFO ] sending login info to session manager. Please wait...
[20260109-09:47:43] [INFO ] xrdp_wm_log_msg: login successful for user pentester on display 10
[20260109-09:47:43] [INFO ] login successful for user pentester on display 10
[20260109-09:47:43] [INFO ] loaded module 'libxup.so' ok, interface size 10296, version 4
[20260109-09:47:43] [INFO ] started connecting
[20260109-09:47:43] [INFO ] lib_mod_connect: connecting via UNIX socket
[20260109-09:47:43] [INFO ] lib_mod_log_peer: xrdp_pid=228374 connected to X11rdp_pid=228451 X11rdp_uid=1001 X11rdp_gid=1001 client_ip=::ffff:10.0.254.105 client_port=58050
[20260109-09:47:43] [INFO ] connected ok


_raw: [20260109-09:47:43] [INFO ] Socket 12: AF_INET6 connection received from ::1 port 52660


_raw: [20260109-09:47:43] [INFO ] Socket 12: AF_INET6 connection received from ::1 port 54492


_raw: 2026-01-09 09:47:43 status half-configured kali-menu:all 2025.4.3


_raw: 2026-01-09 09:47:43 status installed ligolo-ng:amd64 0.8.2-0kali1


_raw: 2026-01-09 09:47:43 status half-configured ligolo-ng:amd64 0.8.2-0kali1


_raw: 2026-01-09 09:47:43 startup packages configure


_raw:
Start-Date: 2026-01-09  09:47:42
Commandline: apt install ligolo-ng -y
Install: ligolo-ng:amd64 (0.8.2-0kali1)


_raw:
Log started: 2026-01-09  09:47:42
Selecting previously unselected package ligolo-ng.
(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 455746 files and directories currently installed.)
Preparing to unpack .../ligolo-ng_0.8.2-0kali1_amd64.deb ...
Unpacking ligolo-ng (0.8.2-0kali1) ...
Setting up ligolo-ng (0.8.2-0kali1) ...
Processing triggers for kali-menu (2025.4.3) ...


_raw: 2026-01-09 09:47:42 status triggers-pending kali-menu:all 2025.4.3


_raw: 2026-01-09 09:47:42 status half-installed ligolo-ng:amd64 0.8.2-0kali1


_raw: 2026-01-09 09:47:42 startup archives unpack


_raw:
Selecting previously unselected package golang-1.24-src.
(Reading database ...
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 449315 files and directories currently installed.)
Preparing to unpack .../0-golang-1.24-src_1.24.9-1_all.deb ...
Unpacking golang-1.24-src (1.24.9-1) ...


_raw:
[20260109-09:47:41] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:47:41] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:47:41] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:47:41] [INFO ] Security protocol: configured [RDP], requested [SSL|HYBRID|HYBRID_EX|RDP], selected [RDP]
[20260109-09:47:41] [ERROR] libxrdp_force_read: header read error
[20260109-09:47:41] [ERROR] Processing [ITU-T T.125] Connect-Initial failed
[20260109-09:47:41] [ERROR] [MCS Connection Sequence] receive connection request failed
[20260109-09:47:41] [ERROR] xrdp_sec_incoming: xrdp_mcs_incoming failed
[20260109-09:47:41] [ERROR] xrdp_rdp_incoming: xrdp_sec_incoming failed
[20260109-09:47:41] [ERROR] xrdp_process_main_loop: libxrdp_process_incoming failed
[20260109-09:47:41] [ERROR] xrdp_iso_send: trans_write_copy_s failed
[20260109-09:47:41] [ERROR] Sending [ITU T.125] DisconnectProviderUltimatum failed
[20260109-09:47:42] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.101 port 58191
[20260109-09:47:42] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem
[20260109-09:47:42] [INFO ] Using default X.509 key file: /etc/xrdp/key.pem
[20260109-09:47:42] [ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied
[20260109-09:47:42] [WARN ] Cannot accept TLS connections because certificate or private key file is not readable. certificate file: [/etc/xrdp/cert.pem], private key file: [/etc/xrdp/key.pem]
[20260109-09:47:42] [INFO ] Security protocol: configured [RDP], requested [RDP], selected [RDP]
[20260109-09:47:42] [INFO ] Connected client computer name: CPTC11-FINALS-T
[20260109-09:47:42] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc006 is unknown (ignored)
[20260109-09:47:42] [WARN ] Received [MS-RDPBCGR] TS_UD_HEADER type 0xc00a is unknown (ignored)
[20260109-09:47:42] [INFO ] xrdp_load_keyboard_layout: Keyboard information sent by the RDP client, keyboard_type:[0x04], keyboard_subtype:[0x00], keylayout:[0x00000409]
[20260109-09:47:42] [INFO ] xrdp_load_keyboard_layout: model [] variant [] layout [us] options []
[20260109-09:47:42] [INFO ] Non-TLS connection established from ::ffff:10.0.254.101 port 58191: with security level : high
[20260109-09:47:42] [INFO ] xrdp_caps_process_pointer: client supports new(color) cursor
[20260109-09:47:42] [INFO ] xrdp_process_offscreen_bmpcache: support level 1 cache size 10485760 MB cache entries 100
[20260109-09:47:42] [INFO ] xrdp_caps_process_codecs: nscodec, codec id 1, properties len 3
[20260109-09:47:42] [WARN ] xrdp_caps_process_codecs: unknown codec id 5
[20260109-09:47:42] [INFO ] xrdp_caps_process_codecs: RemoteFX, codec id 3, properties len 49
[20260109-09:47:42] [INFO ] Loading keymap file /etc/xrdp/km-00000409.ini
[20260109-09:47:42] [WARN ] local keymap file for 0x00000409 found and doesn't match built in keymap, using local keymap file


_raw:
[20260109-09:47:41] [INFO ] Socket 12: AF_INET6 connection received from ::ffff:10.0.254.101 port 58190
[20260109-09:47:41] [INFO ] Using default X.509 certificate: /etc/xrdp/cert.pem


_raw: 2026-01-09 09:47:41 startup archives unpack


_raw:
Start-Date: 2026-01-09  09:47:40
Commandline: apt install golang-go
Requested-By: pentester (1001)
Install: golang-go:amd64 (2:1.24~2), golang-1.24-src:amd64 (1.24.9-1, automatic), pkgconf:amd64 (1.8.1-4, automatic), golang-src:amd64 (2:1.24~2, automatic), golang-1.24-go:amd64 (1.24.9-1, automatic), pkgconf-bin:amd64 (1.8.1-4, automatic), libpkgconf3:amd64 (1.8.1-4, automatic)


_raw:
Processing triggers for kali-menu (2025.4.3) ...
Processing triggers for wordlists (2025.4.0) ...


_raw: 2026-01-09 09:47:40 status installed wordlists:all 2025.4.0


_raw: 2026-01-09 09:47:40 status half-configured wordlists:all 2025.4.0


_raw: 2026-01-09 09:47:40 status half-configured kali-menu:all 2025.4.3


_raw: 2026-01-09 09:47:40 status installed seclists:all 2025.3-0kali1


_raw: 2026-01-09 09:47:40 status half-configured seclists:all 2025.3-0kali1


_raw: 2026-01-09 09:47:40 status unpacked seclists:all 2025.3-0kali1


_raw: 2026-01-09 09:47:40 startup packages configure


_raw: Setting up seclists (2025.3-0kali1) ...


_raw: 2026-01-09 09:47:31 status triggers-pending wordlists:all 2025.4.0


_raw: 2026-01-09 09:47:31 status triggers-pending kali-menu:all 2025.4.3


_raw: 2026-01-09 09:47:31 status half-installed seclists:all 2025.3-0kali1