_raw:
    RenewTime: 11/12/2025 12:43:56 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL


_raw:
    RenewTime: 11/12/2025 12:43:56 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, initial, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: LDAP/APT-DC-01.allports.local
    RealmName: ALLPORTS.LOCAL


_raw:
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: rc4_hmac
    TicketFlags: name_canonicalize, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: LDAP/APT-DC-01.allports.local
    RealmName: ALLPORTS.LOCAL


_raw:
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: cifs/Deckhand-02
    RealmName: ALLPORTS.LOCAL


_raw:
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: rc4_hmac
    TicketFlags: name_canonicalize, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: LDAP/APT-DC-01.allports.local/allports.local
    RealmName: ALLPORTS.LOCAL


_raw:
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: DECKHAND-01$
    RealmName: ALLPORTS.LOCAL


_raw:
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, initial, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: cifs/APT-DC-01.allports.local/allports.local
    RealmName: ALLPORTS.LOCAL


_raw:
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, renewable, forwarded, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL


_raw:
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: ldap/apt-dc-01.allports.local/allports.local
    RealmName: ALLPORTS.LOCAL


_raw:
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, initial, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: cifs/APT-DC-01.allports.local
    RealmName: ALLPORTS.LOCAL


_raw:
  ExpiryDate         : 11/3/2035 1:25:27 PM
  HasPrivateKey      : True
  StoreLocation      : LocalMachine
  KeyExportable      : False
  Thumbprint         : 61711654AA478608C3CA4B4186A879DD8E7D20A1
   =================================================================================================
╔══════════╣ Searching known files that can contain creds in home
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials
╔══════════╣ Looking for documents --limit 100--
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Templates\Press_Release_Template.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-01_30C4.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-02_4D9F.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-03_3731.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-04_BF41.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-05_7752.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-06_C188.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-07_46E9.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-08_F853.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-09_9F07.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-10_04DC.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-11_CB3B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-12_5AF3.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-13_5836.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-14_E7D1.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-15_641F.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-16_4C06.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-17_6F01.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-18_0F52.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-19_72A3.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-20_0346.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-21_80E5.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-22_59FB.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-23_10F9.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-24_25C6.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-25_1D34.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-26_6837.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-27_2090.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-28_362E.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-29_F2E8.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-30_915F.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-31_DC25.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-32_F5D6.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-33_A08D.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-34_0E3A.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Corporate_Communications\Press_Releases\2025\Press_Release_2025-35_10DC.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Templates\Maintenance_Request_Form.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-01_312C.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-02_FF2A.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-03_770E.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-04_F461.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-05_00EC.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-06_177B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-07_2216.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-08_A18D.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-09_F066.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-10_8C9D.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-11_3136.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-12_6452.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-13_81A8.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-14_83D9.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-15_7E76.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-16_6D9D.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-17_60AB.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-18_BC1D.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-19_C7A0.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-20_2E21.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-21_E3F4.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-22_3BDB.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-23_2765.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-24_9DAF.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-25_258B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-26_F27F.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-27_0D55.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-28_A472.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-29_727A.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-30_C63B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-31_D10F.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-32_192E.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-33_07D6.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-34_1C25.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Facilities\Maintenance_Requests\2025\Maintenance_Request_2025-35_4A13.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Templates\Ship_Departure_Clearance_Form.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-01_1BF7.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-02_81DC.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-03_A059.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-04_E55E.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-05_213B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-06_41AF.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-07_D5F2.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-08_56DD.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-09_E509.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-10_8CB3.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-11_929B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-12_31F6.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-13_ECC4.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-14_7714.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-15_997C.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-16_B24B.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-17_93C3.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-18_0347.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-19_3952.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-20_ECE1.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-21_0F41.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-22_A0CD.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-23_6938.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-24_9AC1.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-25_1AE1.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-26_A712.pdf
    C:\Users\All Users\PoseidonBooking\Galley\company_files\Operations\Fleet\Ship_Departure_Clearance\2025\Ship_Departure_Clearance_2025-27_7FA7.pdf
╔══════════╣ Office Most Recent Files -- limit 50

  Last Access Date           User                                           Application           Document
╔══════════╣ Recent files --limit 70--
   Guest :


_raw:
    Not Found
╔══════════╣ SuperPutty configuration files
╔══════════╣ Enumerating Office 365 endpoints synced by OneDrive.

    SID: S-1-5-19
   =================================================================================================
    SID: S-1-5-20
   =================================================================================================
    SID: S-1-5-21-2288084429-921088559-2964959546-501
   =================================================================================================
    SID: S-1-5-80-972488765-139171986-783781252-3188962990-3730692313
   =================================================================================================
    SID: S-1-5-18
   =================================================================================================
╔══════════╣ Cloud Credentials
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials
    Not Found
╔══════════╣ Unattend Files
    C:\windows\Panther\Unattend.xml
╔══════════╣ Looking for common SAM & SYSTEM backups
    C:\windows\System32\config\RegBack\SAM
    File Permissions: Administrators [Allow: AllAccess]

    C:\windows\System32\config\RegBack\SYSTEM
    File Permissions: Administrators [Allow: AllAccess]

╔══════════╣ Looking for McAfee Sitelist.xml Files
╔══════════╣ Cached GPP Passwords
╔══════════╣ Looking for possible regs with creds
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#inside-the-registry
    Not Found
    Not Found
    Not Found
    Not Found
╔══════════╣ Looking for possible password files in users homes
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials
    C:\Users\All Users\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml
    C:\Users\Guest\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.1.0.0\passwords.txt
    C:\Users\Guest\AppData\Local\Google\Chrome\User Data\ZxcvbnData\3\passwords.txt
╔══════════╣ Searching for Oracle SQL Developer config files

╔══════════╣ Slack files & directories
  note: check manually if something is found
╔══════════╣ Looking for LOL Binaries and Scripts (can be slow)
╚  https://lolbas-project.github.io/
   [!] Check skipped, if you want to run it, please specify '-lolbas' argument
╔══════════╣ Enumerating Outlook download files

╔══════════╣ Enumerating machine and user certificate files

  Issuer             : CN=Cloudbase-Init WinRM
  Subject            : CN=Cloudbase-Init WinRM
  ValidDate          : 11/4/2025 12:25:27 PM


_raw:
  RDP Client Settings
    Disable Password Saving                 :       True
    Restricted Remote Administration        :       False
╔══════════╣ Recently run commands
    Not Found
╔══════════╣ Checking for DPAPI Master Keys
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi
    MasterKey: C:\Users\Guest\AppData\Roaming\Microsoft\Protect\S-1-5-21-2288084429-921088559-2964959546-501\067fef84-1167-48ff-999a-e84cf6734ee7
    Accessed: 11/8/2025 5:44:06 PM
    Modified: 11/8/2025 5:44:06 PM
   =================================================================================================
    MasterKey: C:\Users\Guest\AppData\Roaming\Microsoft\Protect\S-1-5-21-2288084429-921088559-2964959546-501\067fef84-1167-48ff-999a-e84cf6734ee7
    Accessed: 11/8/2025 5:44:06 PM
    Modified: 11/8/2025 5:44:06 PM
   =================================================================================================
    MasterKey: C:\Users\Guest\AppData\Roaming\Microsoft\Protect\S-1-5-21-2288084429-921088559-2964959546-501\067fef84-1167-48ff-999a-e84cf6734ee7
    Accessed: 11/8/2025 5:44:06 PM
    Modified: 11/8/2025 5:44:06 PM
   =================================================================================================
╚ Follow the provided link for further instructions in how to decrypt the masterkey.
╔══════════╣ Checking for DPAPI Credential Files
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi
    CredFile: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D
    Description: Local Credential Data

    MasterKey: bb79b120-6cc4-4368-9389-480bc37cbe9b
    Accessed: 11/5/2025 12:24:36 PM
    Modified: 11/5/2025 12:24:36 PM
    Size: 11136
   =================================================================================================
╚ Follow the provided link for further instructions in how to decrypt the creds file
╔══════════╣ Checking for RDCMan Settings Files
╚ Dump credentials from Remote Desktop Connection Manager https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#remote-desktop-credential-manager
    Not Found
╔══════════╣ Looking for Kerberos tickets
╚  https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-kerberos-88/index.html
    [*] Enumerated 2 ticket(s):
    [*] Enumerated 7 ticket(s):
    [*] Enumerated 4 ticket(s):
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL
    StartTime: 11/8/2025 6:43:56 PM
    EndTime: 11/9/2025 4:43:56 AM
    RenewTime: 11/12/2025 12:43:56 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, initial, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: LDAP/APT-DC-01.allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 11/8/2025 6:53:38 PM
    EndTime: 11/9/2025 4:43:56 AM
    RenewTime: 11/12/2025 12:43:56 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL
    StartTime: 11/8/2025 7:20:50 PM
    EndTime: 11/9/2025 4:38:00 AM
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, renewable, forwarded, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL
    StartTime: 11/8/2025 6:38:00 PM
    EndTime: 11/9/2025 4:38:00 AM
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, initial, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: cifs/APT-DC-01.allports.local/allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 11/8/2025 7:20:50 PM
    EndTime: 11/9/2025 4:38:00 AM
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: DECKHAND-01$
    RealmName: ALLPORTS.LOCAL
    StartTime: 11/8/2025 7:20:50 PM
    EndTime: 11/9/2025 4:38:00 AM
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: rc4_hmac
    TicketFlags: name_canonicalize, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: LDAP/APT-DC-01.allports.local/allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 11/8/2025 7:20:50 PM
    EndTime: 11/9/2025 4:38:00 AM
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: cifs/Deckhand-02
    RealmName: ALLPORTS.LOCAL
    StartTime: 11/8/2025 6:49:41 PM
    EndTime: 11/9/2025 4:38:00 AM
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: rc4_hmac
    TicketFlags: name_canonicalize, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: LDAP/APT-DC-01.allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 11/5/2025 12:38:00 PM
    EndTime: 11/5/2025 10:38:00 PM
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL
    StartTime: 11/8/2025 4:39:10 PM
    EndTime: 11/9/2025 2:39:10 AM
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, renewable, forwarded, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: krbtgt/ALLPORTS.LOCAL
    RealmName: ALLPORTS.LOCAL
    StartTime: 11/8/2025 4:39:10 PM
    EndTime: 11/9/2025 2:39:10 AM
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, pre_authent, initial, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: cifs/APT-DC-01.allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 11/8/2025 4:54:10 PM
    EndTime: 11/9/2025 2:39:10 AM
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
    UserPrincipalName: DECKHAND-01$@allports.local
    serverName: ldap/apt-dc-01.allports.local/allports.local
    RealmName: ALLPORTS.LOCAL
    StartTime: 11/5/2025 12:38:00 PM
    EndTime: 11/5/2025 10:38:00 PM
    RenewTime: 11/12/2025 12:38:00 PM
    EncryptionType: aes256_cts_hmac_sha1_96
    TicketFlags: name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
   =================================================================================================
╔══════════╣ Looking for saved Wifi credentials
  [X] Exception: Unable to load DLL 'wlanapi.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E)
Enumerating WLAN using wlanapi.dll failed, trying to enumerate using 'netsh'
No saved Wifi credentials found
╔══════════╣ Looking AppCmd.exe
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#appcmdexe
    Not Found
╔══════════╣ Looking SSClient.exe
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#scclient--sccm
    Not Found
╔══════════╣ Enumerating SSCM - System Center Configuration Manager settings
╔══════════╣ Enumerating Security Packages Credentials
  Version: NetNTLMv1
  Hash:    Guest::DECKHAND-01:eefabc742621a883aec4b24e0f7fbf05e17dc2880abe07cc:eefabc742621a883aec4b24e0f7fbf05e17dc2880abe07cc:1122334455667788

   =================================================================================================
════════════════════════════════════╣ Browsers Information ╠════════════════════════════════════
╔══════════╣ Showing saved credentials for Firefox
    Info: if no credentials were listed, you might need to close the browser and try again.
╔══════════╣ Looking for Firefox DBs
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
    Firefox credentials file exists at C:\Users\Guest\AppData\Roaming\Mozilla\Firefox\Profiles\oc33h408.default-release\key3.db
╚ Run SharpWeb (https://github.com/djhohnstein/SharpWeb)
╔══════════╣ Looking for GET credentials in Firefox history
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
    [x] IO exception, places.sqlite file likely in use (i.e. Firefox is likely running).
╔══════════╣ Firefox history -- limit 50

    https://www.mozilla.org
    https://www.mozilla.org
    https://www.mozilla.org/about/gro.allizom.www.YeEcLd_OTW5a+
╔══════════╣ Showing saved credentials for Chrome
    Info: if no credentials were listed, you might need to close the browser and try again.
╔══════════╣ Looking for Chrome DBs
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
  [X] Exception: The given key was not present in the dictionary.
╔══════════╣ Looking for GET credentials in Chrome history
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
=== Chrome (All Users) ===
╔══════════╣ Chrome history -- limit 50

    https://www.google.com/1
    https://apps.microsoft.com/detail/9wzdncrdwz1l?hl=en-US&gl=UShttps://www.google.com/application/x-msdownloadapplication/octet-stream
    https://apps.microsoft.com/c9e1e87d-2835-4e0f-8561-50d6f0729041
    https://www.google.com/search?q=binary+translator+download&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8binary
    https://www.google.com/search?q=gdal&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8gdal
    https://www.google.com/search?q=binary+translator&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8binary
    https://www.google.com/search?q=gdal+download+windows+binaries&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8gdal
    https://www.google.com/search?q=gdal+download+windows+binaries&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8gdal
    https://www.google.com/search?q=osgeo4w&sourceid=chrome&ie=UTF-8osgeo4wz
    https://www.google.com/search?q=how+to+open+nat+file&sourceid=chrome&ie=UTF-8how
    https://www.google.com/search?q=openpowershell&sourceid=chrome&ie=UTF-8openpowershellg
    https://www.google.com/search?q=openpowershell&sourceid=chrome&ie=UTF-8openpowershellg
    https://www.google.com/search?q=openpowershell&sourceid=chrome&ie=UTF-8openpowershell
    https://apps.microsoft.com/https://apps.microsoft.com/detail/9wzdncrdwz1l?hl=en-US&gl=USapps.microsoft.com/detail/9wzdncrdwz1l?hl=en-US&gl=US
    https://www.google.com/search?q=gdal+download+windows+binaries&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8https://www.google.com/search?q=gdal+download+windows+binaries&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8google.com/search?q=gdal+download+windows+binaries&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8d
    https://www.google.com/search?q=gdal&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8https://www.google.com/search?q=gdal&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8google.com/search?q=gdal&rlz=1C1GCER_enUS1187US1187&sourceid=chrome&ie=UTF-8
    https://www.google.com/search?q=gdal+download+windows+binaries&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=ZtcPaa2LFpbviLMPxdOsiQs&oq=gdal+download+&gs_lp=Egxnd3Mtd2l6LXNlcnAiDmdkYWwgZG93bmxvYWQgKgIIATIFEAAYgAQyBRAAGIAEMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHkjYJFCqAViPE3ADeAGQAQCYATqgAe4EqgECMTK4AQPIAQD4AQGYAg-gAq8FwgIKEAAYsAMY1gQYR8ICDRAAGIAEGLADGEMYigXCAgoQABiABBhDGIoFwgILEAAYgAQYkQIYigXCAggQABiiBBiJBcICBRAAGO8FwgIIEAAYgAQYogTCAgsQABiABBiGAxiKBZgDAIgGAZAGCpIHAjE1oAehPrIHAjEyuAeiBcIHBTAuNi45yAcx&sclient=gws-wiz-serphttps://www.google.com/
    https://www.google.com/search?q=gdal+download+windows+binaries&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=ZtcPaa2LFpbviLMPxdOsiQs&oq=gdal+download+&gs_lp=Egxnd3Mtd2l6LXNlcnAiDmdkYWwgZG93bmxvYWQgKgIIATIFEAAYgAQyBRAAGIAEMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHkjYJFCqAViPE3ADeAGQAQCYATqgAe4EqgECMTK4AQPIAQD4AQGYAg-gAq8FwgIKEAAYsAMY1gQYR8ICDRAAGIAEGLADGEMYigXCAgoQABiABBhDGIoFwgILEAAYgAQYkQIYigXCAggQABiiBBiJBcICBRAAGO8FwgIIEAAYgAQYogTCAgsQABiABBiGAxiKBZgDAIgGAZAGCpIHAjE1oAehPrIHAjEyuAeiBcIHBTAuNi45yAcx&sclient=gws-wiz-serp
    https://www.google.com/search?q=binary+translator&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=bdcPaaOzKqqu5NoP0tft8Aw&ved=0ahUKEwjjnbbH3-OQAxUqF1kFHdJrG84Q4dUDCBE&uact=5&oq=binary+translator&gs_lp=Egxnd3Mtd2l6LXNlcnAiEWJpbmFyeSB0cmFuc2xhdG9yMggQABiABBixAzIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABEizGFAAWNgOcAB4AJABAJgBTKAB-gaqAQIxN7gBA8gBAPgBAZgCEaACywfCAgsQABiABBiRAhiKBcICChAAGIAEGEMYigXCAggQLhiABBixA8ICERAuGIAEGLEDGNEDGIMBGMcBwgIPEAAYgAQYQxiKBRhGGPkBwgIQEC4YgAQY0QMYQxjHARiKBcICEBAAGIAEGLEDGEMYgwEYigXCAhMQLhiABBixAxjRAxhDGMcBGIoFwgINEAAYgAQYsQMYQxiKBZgDAJIHAjE3oAfqgQGyBwIxN7gHywfCBwYwLjUuMTLIBz0&sclient=gws-wiz-serpbinary
    https://www.google.com/search?q=gdal+download+windows+binaries&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=ZtcPaa2LFpbviLMPxdOsiQs&oq=gdal+download+&gs_lp=Egxnd3Mtd2l6LXNlcnAiDmdkYWwgZG93bmxvYWQgKgIIATIFEAAYgAQyBRAAGIAEMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgYQABgWGB4yBhAAGBYYHkjYJFCqAViPE3ADeAGQAQCYATqgAe4EqgECMTK4AQPIAQD4AQGYAg-gAq8FwgIKEAAYsAMY1gQYR8ICDRAAGIAEGLADGEMYigXCAgoQABiABBhDGIoFwgILEAAYgAQYkQIYigXCAggQABiiBBiJBcICBRAAGO8FwgIIEAAYgAQYogTCAgsQABiABBiGAxiKBZgDAIgGAZAGCpIHAjE1oAehPrIHAjEyuAeiBcIHBTAuNi45yAcx&sclient=gws-wiz-serpgdal
    https://apps.microsoft.com/detail/9wzdncrdwz1l?hl=en-US&gl=USMy
    https://www.google.com/search?q=binary+translator+download&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=d9cPaZ31Ktuo5NoP_vLe6QI&ved=0ahUKEwjdjJnM3-OQAxVbFFkFHX65Ny0Q4dUDCBE&uact=5&oq=binary+translator+download&gs_lp=Egxnd3Mtd2l6LXNlcnAiGmJpbmFyeSB0cmFuc2xhdG9yIGRvd25sb2FkMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgsQABiABBiGAxiKBTILEAAYgAQYhgMYigUyCxAAGIAEGIYDGIoFMgsQABiABBiGAxiKBTIIEAAYgAQYogQyBRAAGO8FMgUQABjvBUieCVClAlisCHABeAGQAQCYAUGgAfkDqgEBObgBA8gBAPgBAZgCCqACoATCAgoQABiwAxjWBBhHwgINEAAYgAQYsAMYQxiKBcICBRAAGIAEwgILEAAYgAQYkQIYigWYAwCIBgGQBgqSBwIxMKAH7zeyBwE5uAecBMIHBTAuNS41yAce&sclient=gws-wiz-serpbinary
    https://www.google.com/search?q=binary+translator+download&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=d9cPaZ31Ktuo5NoP_vLe6QI&ved=0ahUKEwjdjJnM3-OQAxVbFFkFHX65Ny0Q4dUDCBE&uact=5&oq=binary+translator+download&gs_lp=Egxnd3Mtd2l6LXNlcnAiGmJpbmFyeSB0cmFuc2xhdG9yIGRvd25sb2FkMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgsQABiABBiGAxiKBTILEAAYgAQYhgMYigUyCxAAGIAEGIYDGIoFMgsQABiABBiGAxiKBTIIEAAYgAQYogQyBRAAGO8FMgUQABjvBUieCVClAlisCHABeAGQAQCYAUGgAfkDqgEBObgBA8gBAPgBAZgCCqACoATCAgoQABiwAxjWBBhHwgINEAAYgAQYsAMYQxiKBcICBRAAGIAEwgILEAAYgAQYkQIYigWYAwCIBgGQBgqSBwIxMKAH7zeyBwE5uAecBMIHBTAuNS41yAce&sclient=gws-wiz-serp
    https://www.google.com/search?q=binary+translator&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=bdcPaaOzKqqu5NoP0tft8Aw&ved=0ahUKEwjjnbbH3-OQAxUqF1kFHdJrG84Q4dUDCBE&uact=5&oq=binary+translator&gs_lp=Egxnd3Mtd2l6LXNlcnAiEWJpbmFyeSB0cmFuc2xhdG9yMggQABiABBixAzIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABEizGFAAWNgOcAB4AJABAJgBTKAB-gaqAQIxN7gBA8gBAPgBAZgCEaACywfCAgsQABiABBiRAhiKBcICChAAGIAEGEMYigXCAggQLhiABBixA8ICERAuGIAEGLEDGNEDGIMBGMcBwgIPEAAYgAQYQxiKBRhGGPkBwgIQEC4YgAQY0QMYQxjHARiKBcICEBAAGIAEGLEDGEMYgwEYigXCAhMQLhiABBixAxjRAxhDGMcBGIoFwgINEAAYgAQYsQMYQxiKBZgDAJIHAjE3oAfqgQGyBwIxN7gHywfCBwYwLjUuMTLIBz0&sclient=gws-wiz-serp
    https://www.reddit.com/r/ArcGIS/comments/yy35t9/nat_file_type/
    https://gdal.org/en/stable/download.htmlhttps://www.google.com/
    https://www.google.com/search?q=gdal&rlz=1C1GCER_enUS1187US1187&oq=GDAL&gs_lcrp=EgZjaHJvbWUqDwgAEAAYQxixAxiABBiKBTIPCAAQABhDGLEDGIAEGIoFMgcIARAAGIAEMgcIAhAAGIAEMgcIAxAAGIAEMgcIBBAAGIAEMgcIBRAAGIAEMgcIBhAAGIAEMgcIBxAAGIAEMgcICBAAGIAEMgcICRAAGIAE0gEHMjM5ajBqN6gCALACAA&sourceid=chrome&ie=UTF-8https://www.google.com/
    https://www.google.com/search?q=binary+translator+download&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=d9cPaZ31Ktuo5NoP_vLe6QI&ved=0ahUKEwjdjJnM3-OQAxVbFFkFHX65Ny0Q4dUDCBE&uact=5&oq=binary+translator+download&gs_lp=Egxnd3Mtd2l6LXNlcnAiGmJpbmFyeSB0cmFuc2xhdG9yIGRvd25sb2FkMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgsQABiABBiGAxiKBTILEAAYgAQYhgMYigUyCxAAGIAEGIYDGIoFMgsQABiABBiGAxiKBTIIEAAYgAQYogQyBRAAGO8FMgUQABjvBUieCVClAlisCHABeAGQAQCYAUGgAfkDqgEBObgBA8gBAPgBAZgCCqACoATCAgoQABiwAxjWBBhHwgINEAAYgAQYsAMYQxiKBcICBRAAGIAEwgILEAAYgAQYkQIYigWYAwCIBgGQBgqSBwIxMKAH7zeyBwE5uAecBMIHBTAuNS41yAce&sclient=gws-wiz-serphttps://www.google.com/
    https://www.google.com/search?q=binary+translator&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=bdcPaaOzKqqu5NoP0tft8Aw&ved=0ahUKEwjjnbbH3-OQAxUqF1kFHdJrG84Q4dUDCBE&uact=5&oq=binary+translator&gs_lp=Egxnd3Mtd2l6LXNlcnAiEWJpbmFyeSB0cmFuc2xhdG9yMggQABiABBixAzIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABEizGFAAWNgOcAB4AJABAJgBTKAB-gaqAQIxN7gBA8gBAPgBAZgCEaACywfCAgsQABiABBiRAhiKBcICChAAGIAEGEMYigXCAggQLhiABBixA8ICERAuGIAEGLEDGNEDGIMBGMcBwgIPEAAYgAQYQxiKBRhGGPkBwgIQEC4YgAQY0QMYQxjHARiKBcICEBAAGIAEGLEDGEMYgwEYigXCAhMQLhiABBixAxjRAxhDGMcBGIoFwgINEAAYgAQYsQMYQxiKBZgDAJIHAjE3oAfqgQGyBwIxN7gHywfCBwYwLjUuMTLIBz0&sclient=gws-wiz-serphttps://www.google.com/
    https://www.google.com/search?q=binary+translator&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=bdcPaaOzKqqu5NoP0tft8Aw&ved=0ahUKEwjjnbbH3-OQAxUqF1kFHdJrG84Q4dUDCBE&uact=5&oq=binary+translator&gs_lp=Egxnd3Mtd2l6LXNlcnAiEWJpbmFyeSB0cmFuc2xhdG9yMggQABiABBixAzIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABDIFEAAYgAQyBRAAGIAEMgUQABiABEizGFAAWNgOcAB4AJABAJgBTKAB-gaqAQIxN7gBA8gBAPgBAZgCEaACywfCAgsQABiABBiRAhiKBcICChAAGIAEGEMYigXCAggQLhiABBixA8ICERAuGIAEGLEDGNEDGIMBGMcBwgIPEAAYgAQYQxiKBRhGGPkBwgIQEC4YgAQY0QMYQxjHARiKBcICEBAAGIAEGLEDGEMYgwEYigXCAhMQLhiABBixAxjRAxhDGMcBGIoFwgINEAAYgAQYsQMYQxiKBZgDAJIHAjE3oAfqgQGyBwIxN7gHywfCBwYwLjUuMTLIBz0&sclient=gws-wiz-serphttps://www.google.com/
    https://gdal.org/en/stable/download.htmlhttps://www.google.com/
    https://www.google.com/search?q=gdal&rlz=1C1GCER_enUS1187US1187&oq=GDAL&gs_lcrp=EgZjaHJvbWUqDwgAEAAYQxixAxiABBiKBTIPCAAQABhDGLEDGIAEGIoFMgcIARAAGIAEMgcIAhAAGIAEMgcIAxAAGIAEMgcIBBAAGIAEMgcIBRAAGIAEMgcIBhAAGIAEMgcIBxAAGIAEMgcICBAAGIAEMgcICRAAGIAE0gEHMjM5ajBqN6gCALACAA&sourceid=chrome&ie=UTF-8https://www.google.com/
    https://www.google.com/search?q=binary+translator+download&sca_esv=b95786c59e8d7ce2&rlz=1C1GCER_enUS1187US1187&ei=d9cPaZ31Ktuo5NoP_vLe6QI&ved=0ahUKEwjdjJnM3-OQAxVbFFkFHX65Ny0Q4dUDCBE&uact=5&oq=binary+translator+download&gs_lp=Egxnd3Mtd2l6LXNlcnAiGmJpbmFyeSB0cmFuc2xhdG9yIGRvd25sb2FkMgYQABgWGB4yBhAAGBYYHjIGEAAYFhgeMgsQABiABBiGAxiKBTILEAAYgAQYhgMYigUyCxAAGIAEGIYDGIoFMgsQABiABBiGAxiKBTIIEAAYgAQYogQyBRAAGO8FMgUQABjvBUieCVClAlisCHABeAGQAQCYAUGgAfkDqgEBObgBA8gBAPgBAZgCCqACoATCAgoQABiwAxjWBBhHwgINEAAYgAQYsAMYQxiKBcICBRAAGIAEwgILEAAYgAQYkQIYigWYAwCIBgGQBgqSBwIxMKAH7zeyBwE5uAecBMIHBTAuNS41yAce&sclient=gws-wiz-serphttps://www.google.com/
╔══════════╣ Chrome bookmarks
    Not Found
╔══════════╣ Showing saved credentials for Opera
    Info: if no credentials were listed, you might need to close the browser and try again.
╔══════════╣ Showing saved credentials for Brave Browser
    Info: if no credentials were listed, you might need to close the browser and try again.
╔══════════╣ Showing saved credentials for Internet Explorer (unsupported)
    Info: if no credentials were listed, you might need to close the browser and try again.
╔══════════╣ Current IE tabs
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
    Not Found
╔══════════╣ Looking for GET credentials in IE history
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#browsers-history
╔══════════╣ IE history -- limit 50

    http://go.microsoft.com/fwlink/p/?LinkId=255142
╔══════════╣ IE favorites
    Not Found
════════════════════════════════════╣ Interesting files and registry ╠════════════════════════════════════
╔══════════╣ Putty Sessions
=== Putty Saved Session Information (All Users) ===
    Not Found
╔══════════╣ Putty SSH Host keys
=== Putty SSH Host Hosts (All Users) ===
    Not Found
╔══════════╣ SSH keys in registry
╚ If you find anything here, follow the link to learn how to decrypt the SSH keys https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#ssh-keys-in-registry


_raw:
    Disable Password Saving                 :       True
    Restricted Remote Administration        :       False
╔══════════╣ Recently run commands
    Not Found
╔══════════╣ Checking for DPAPI Master Keys
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi
    MasterKey: C:\Users\Guest\AppData\Roaming\Microsoft\Protect\S-1-5-21-2288084429-921088559-2964959546-501\067fef84-1167-48ff-999a-e84cf6734ee7
    Accessed: 11/8/2025 5:44:06 PM


_raw:
    Trigger: At 12:53 AM on 11/9/2025-After triggered, repeat every 07:00:00 indefinitely.
   =================================================================================================
╔══════════╣ Device Drivers --Non Microsoft--
╚ Check 3rd party drivers for known vulnerabilities/rootkits. https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#drivers
    Red Hat VirtIO SCSI pass-through controller - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\vioscsi.sys
    Red Hat VirtIO Ethernet Adapter - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\netkvm.sys
    Red Hat VirtIO Serial controller - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\vioser.sys
    Red Hat VirtIO Balloon controller - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\balloon.sys
    Red Hat VirtIO RNG Device - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\viorng.sys
    Windows (R) Win 7 DDK driver - 10.0.10011.16384 [Windows (R) Win 7 DDK provider]: \\.\GLOBALROOT\SystemRoot\system32\DRIVERS\splunkdrv.sys
    Sysinternals Sysmon - 15.15 [Sysinternals - www.sysinternals.com]: \\.\GLOBALROOT\SystemRoot\SysmonDrv.sys
════════════════════════════════════╣ Network Information ╠════════════════════════════════════
╔══════════╣ Network Shares
  [X] Exception:
╔══════════╣ Enumerate Network Mapped Drives (WMI)
╔══════════╣ Host File
╔══════════╣ Network Ifaces and known hosts
╚ The masks are only for the IPv4 addresses
    tap031de208-e0[FA:16:3E:D3:BF:AD]: 10.0.1.20, fe80::e0e3:edd0:e52:ad12%6 / 255.255.255.0
        Gateways: 10.0.1.254
        DNSs: 10.0.1.6
        Known hosts:
          10.0.1.1              FA-16-3E-6B-AF-EA     Dynamic
          10.0.1.6              FA-16-3E-CB-BD-A7     Dynamic
          10.0.1.21             FA-16-3E-36-37-C6     Dynamic
          10.0.1.254            FA-16-3E-AD-FD-7C     Dynamic
          10.0.1.255            FF-FF-FF-FF-FF-FF     Static
          224.0.0.22            01-00-5E-00-00-16     Static
          224.0.0.251           01-00-5E-00-00-FB     Static
          224.0.0.252           01-00-5E-00-00-FC     Static
          239.255.255.250       01-00-5E-7F-FF-FA     Static
          255.255.255.255       FF-FF-FF-FF-FF-FF     Static
    Loopback Pseudo-Interface 1[]: 127.0.0.1, ::1 / 255.0.0.0
        DNSs: fec0:0:0:ffff::1%1, fec0:0:0:ffff::2%1, fec0:0:0:ffff::3%1
        Known hosts:
          224.0.0.22            00-00-00-00-00-00     Static
          239.255.255.250       00-00-00-00-00-00     Static
╔══════════╣ Current TCP Listening Ports
╚ Check for services restricted from the outside
  Enumerating IPv4 connections

  Protocol   Local Address         Local Port    Remote Address        Remote Port     State             Process ID      Process Name
  TCP        0.0.0.0               135           0.0.0.0               0               Listening         940             C:\windows\system32\svchost.exe
  TCP        0.0.0.0               445           0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               3389          0.0.0.0               0               Listening         1072            C:\windows\System32\svchost.exe
  TCP        0.0.0.0               5985          0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               5986          0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               47001         0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               49664         0.0.0.0               0               Listening         692             C:\windows\system32\lsass.exe
  TCP        0.0.0.0               49665         0.0.0.0               0               Listening         560             wininit
  TCP        0.0.0.0               49666         0.0.0.0               0               Listening         1384            C:\windows\System32\svchost.exe
  TCP        0.0.0.0               49667         0.0.0.0               0               Listening         1912            C:\windows\system32\svchost.exe
  TCP        0.0.0.0               49668         0.0.0.0               0               Listening         692             C:\windows\system32\lsass.exe
  TCP        0.0.0.0               49669         0.0.0.0               0               Listening         2424            C:\windows\System32\svchost.exe
  TCP        0.0.0.0               49670         0.0.0.0               0               Listening         2656            C:\windows\System32\spoolsv.exe
  TCP        0.0.0.0               49687         0.0.0.0               0               Listening         2536            C:\windows\system32\svchost.exe
  TCP        0.0.0.0               49690         0.0.0.0               0               Listening         684             services
  TCP        10.0.1.20             139           0.0.0.0               0               Listening         4               System
  TCP        10.0.1.20             3389          10.0.254.105          50480           Established       1072            C:\windows\System32\svchost.exe
  TCP        10.0.1.20             49702         129.21.33.131         50051           Established       2764            C:\ProgramData\Laforge\laforge.exe
  TCP        10.0.1.20             51773         10.0.1.6              389             Established       5056            C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
  TCP        10.0.1.20             51986         129.21.33.139         443             Established       9656            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cptclogging.exe

  Enumerating IPv6 connections

  Protocol   Local Address                               Local Port    Remote Address                              Remote Port     State             Process ID      Process Name
  TCP        [::]                                        135           [::]                                        0               Listening         940             C:\windows\system32\svchost.exe
  TCP        [::]                                        445           [::]                                        0               Listening         4               System
  TCP        [::]                                        3389          [::]                                        0               Listening         1072            C:\windows\System32\svchost.exe
  TCP        [::]                                        5985          [::]                                        0               Listening         4               System
  TCP        [::]                                        5986          [::]                                        0               Listening         4               System
  TCP        [::]                                        47001         [::]                                        0               Listening         4               System
  TCP        [::]                                        49664         [::]                                        0               Listening         692             C:\windows\system32\lsass.exe
  TCP        [::]                                        49665         [::]                                        0               Listening         560             wininit
  TCP        [::]                                        49666         [::]                                        0               Listening         1384            C:\windows\System32\svchost.exe
  TCP        [::]                                        49667         [::]                                        0               Listening         1912            C:\windows\system32\svchost.exe
  TCP        [::]                                        49668         [::]                                        0               Listening         692             C:\windows\system32\lsass.exe
  TCP        [::]                                        49669         [::]                                        0               Listening         2424            C:\windows\System32\svchost.exe
  TCP        [::]                                        49670         [::]                                        0               Listening         2656            C:\windows\System32\spoolsv.exe
  TCP        [::]                                        49687         [::]                                        0               Listening         2536            C:\windows\system32\svchost.exe
  TCP        [::]                                        49690         [::]                                        0               Listening         684             services
  TCP        [fe80::e0e3:edd0:e52:ad12%6]                135           [fe80::e0e3:edd0:e52:ad12%6]                52039           Established       940             C:\windows\system32\svchost.exe
╔══════════╣ Current UDP Listening Ports
╚ Check for services restricted from the outside
  Enumerating IPv4 connections

  Protocol   Local Address         Local Port    Remote Address:Remote Port     Process ID        Process Name
  UDP        0.0.0.0               123           *:*                            1148              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               500           *:*                            2544              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               3389          *:*                            1072              C:\windows\System32\svchost.exe
  UDP        0.0.0.0               3702          *:*                            9496              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               3702          *:*                            9496              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               4500          *:*                            2544              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               5353          *:*                            1344              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               5355          *:*                            1344              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               53253         *:*                            1344              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               53500         *:*                            9496              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               57959         *:*                            1344              C:\windows\system32\svchost.exe
  UDP        10.0.1.20             137           *:*                            4                 System
  UDP        10.0.1.20             138           *:*                            4                 System
  UDP        127.0.0.1             52535         *:*                            5056              C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
  UDP        127.0.0.1             55050         *:*                            2200              C:\windows\System32\svchost.exe
  UDP        127.0.0.1             55052         *:*                            1664              C:\windows\system32\svchost.exe
  UDP        127.0.0.1             57456         *:*                            692               C:\windows\system32\lsass.exe
  UDP        127.0.0.1             57460         *:*                            1612              C:\windows\System32\svchost.exe
  UDP        127.0.0.1             57960         *:*                            8056              C:\Users\Guest\Desktop\winpeasany.exe

  Enumerating IPv6 connections

  Protocol   Local Address                               Local Port    Remote Address:Remote Port     Process ID        Process Name
  UDP        [::]                                        123           *:*                            1148              C:\windows\system32\svchost.exe
  UDP        [::]                                        500           *:*                            2544              C:\windows\system32\svchost.exe
  UDP        [::]                                        3389          *:*                            1072              C:\windows\System32\svchost.exe
  UDP        [::]                                        3702          *:*                            9496              C:\windows\system32\svchost.exe
  UDP        [::]                                        3702          *:*                            9496              C:\windows\system32\svchost.exe
  UDP        [::]                                        4500          *:*                            2544              C:\windows\system32\svchost.exe
  UDP        [::]                                        5353          *:*                            1344              C:\windows\system32\svchost.exe
  UDP        [::]                                        5355          *:*                            1344              C:\windows\system32\svchost.exe
  UDP        [::]                                        53253         *:*                            1344              C:\windows\system32\svchost.exe
  UDP        [::]                                        53501         *:*                            9496              C:\windows\system32\svchost.exe
  UDP        [::]                                        57959         *:*                            1344              C:\windows\system32\svchost.exe
╔══════════╣ Firewall Rules
╚ Showing only DENY rules (too many ALLOW rules always)
  [X] Exception: Exception has been thrown by the target of an invocation.
    Current Profiles:
  [X] Exception: Exception has been thrown by the target of an invocation.
    DENY rules:
  [X] Exception: Exception has been thrown by the target of an invocation.
╔══════════╣ DNS cached --limit 70--
    Entry                                 Name                                  Data
  [X] Exception:
╔══════════╣ Enumerating Internet settings, zone and proxy configuration
  General Settings
  Hive        Key                                       Value
  HKCU        CertificateRevocation                     1
  HKCU        DisableCachingOfSSLPages                  1
  HKCU        IE5_UA_Backup_Flag                        5.0
  HKCU        PrivacyAdvanced                           1
  HKCU        SecureProtocols                           10240
  HKCU        User Agent                                Mozilla/4.0 (compatible; MSIE 8.0; Win32)
  HKCU        ZonesSecurityUpgrade                      System.Byte[]
  HKCU        WarnonZoneCrossing                        1
  HKCU        EnableNegotiate                           1
  HKCU        ProxyEnable                               0
  HKCU        MigrateProxy                              1
  HKLM        ActiveXCache                              C:\Windows\Downloaded Program Files
  HKLM        CodeBaseSearchPath                        CODEBASE
  HKLM        EnablePunycode                            1
  HKLM        MinorVersion                              0
  HKLM        WarnOnIntranet                            1

  Zone Maps
  No URLs configured

  Zone Auth Settings
  No Zone Auth Settings
╔══════════╣ Internet Connectivity
╚ Checking if internet access is possible via different methods
    HTTP (80) Access: Accessible
    HTTPS (443) Access: Accessible
    HTTPS (443) Access by Domain Name: Accessible
    DNS (53) Access: Accessible
    ICMP (ping) Access: Accessible
╔══════════╣ Hostname Resolution
╚ Checking if the hostname can be resolved externally
    External Check Result:
{
    "hostname": "Deckhand-01",
    "source_ip": "129.21.249.53",
    "checks": {
        "IP in AbuseIPDB": {
            "malicious": false,
            "abuseConfidenceScore": 0,
            "countryCode": "US",
            "totalReports": 0,
            "lastReportedAt": null
        },
        "IP in VirusTotal": {
            "malicious": false,
            "reason": {
                "malicious": 0,
                "suspicious": 0,
                "undetected": 95,
                "harmless": 0,
                "timeout": 0
            },
            "reputation": 0
        },
        "Hostname in Pastes": {
            "totalResults": "0",
            "matches": []
        },
        "IP in MalwareWorld": {
            "malicious": false,
            "type": [],
            "urls": []
        }
    }
}
════════════════════════════════════╣ Active Directory Quick Checks ╠════════════════════════════════════
╔══════════╣ gMSA readable managed passwords
╚ Look for Group Managed Service Accounts you can read (msDS-ManagedPassword) https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/gmsa.html
    [!] Error accessing RootDSE (defaultNamingContext): The specified domain either does not exist or could not be contacted.

  [-] Could not resolve defaultNamingContext.
╔══════════╣ AD CS misconfigurations for ESC
╚  https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/ad-certificates.html
╚ Check for ADCS misconfigurations in the local DC registry
  [-] Host is not a domain controller. Skipping ADCS Registry check
╚
If you can modify a template (WriteDacl/WriteOwner/GenericAll), you can abuse ESC4
    [!] Error accessing RootDSE (configurationNamingContext): The specified domain either does not exist or could not be contacted.

  [-] Could not resolve configurationNamingContext.
════════════════════════════════════╣ Cloud Information ╠════════════════════════════════════
Learn and practice cloud hacking in training.hacktricks.xyz
AWS EC2?                                No
Azure VM?                               No
Azure Tokens?                           Yes
Google Cloud Platform?                  No
Google Workspace Joined?                No
Google Cloud Directory Sync?            No
Google Password Sync?                   No
╔══════════╣ Azure Tokens Enumeration
  [X] Exception: The directory 'C:\Users\Guest\AppData\Local\Microsoft\IdentityCache' does not exist.
  [X] Exception: An error occurred while scanning the identityCache directory: Could not find a part of the path 'C:\Users\Guest\AppData\Local\Microsoft\IdentityCache'.
Local Info
C:\Users\Guest\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

expiration   ?Q??       status            error     ?         WTE_Message      "Need user interaction to continue.      WTE_Code   ?       WTE_PropertyBag
?C???D!??)???   t         	ErrorCode      interaction_required
correlationId      &{9516B907-B79A-4BD0-A892-CED95A6D0BB3}

════════════════════════════════════╣ Windows Credentials ╠════════════════════════════════════
╔══════════╣ Checking Windows Vault
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#credentials-manager--windows-vault
Unable to enumerate vault items from the following vault: Windows Credentials. Error 0x5
    Not Found
╔══════════╣ Checking Credential manager
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#credentials-manager--windows-vault
    [!] Warning: if password contains non-printable characters, it will be printed as unicode base64 encoded string
  [!] Unable to enumerate credentials automatically, error: 'Win32Exception: System.ComponentModel.Win32Exception (0x80004005): Access is denied'
Please run:
cmdkey /list
╔══════════╣ Saved RDP connections
    Not Found
╔══════════╣ Remote Desktop Server/Client Settings
  RDP Server Settings
    Network Level Authentication            :
    Block Clipboard Redirection             :
    Block COM Port Redirection              :
    Block Drive Redirection                 :
    Block LPT Port Redirection              :
    Block PnP Device Redirection            :
    Block Printer Redirection               :
    Allow Smart Card Redirection            :


_raw:
    Trigger: At 12:53 AM on 11/9/2025-After triggered, repeat every 07:00:00 indefinitely.
   =================================================================================================
╔══════════╣ Device Drivers --Non Microsoft--
╚ Check 3rd party drivers for known vulnerabilities/rootkits. https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#drivers
    Red Hat VirtIO SCSI pass-through controller - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\vioscsi.sys
    Red Hat VirtIO Ethernet Adapter - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\netkvm.sys
    Red Hat VirtIO Serial controller - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\vioser.sys
    Red Hat VirtIO Balloon controller - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\balloon.sys
    Red Hat VirtIO RNG Device - 100.90.104.21700 [Red Hat, Inc.]: \\.\GLOBALROOT\SystemRoot\System32\drivers\viorng.sys
    Windows (R) Win 7 DDK driver - 10.0.10011.16384 [Windows (R) Win 7 DDK provider]: \\.\GLOBALROOT\SystemRoot\system32\DRIVERS\splunkdrv.sys
    Sysinternals Sysmon - 15.15 [Sysinternals - www.sysinternals.com]: \\.\GLOBALROOT\SystemRoot\SysmonDrv.sys
════════════════════════════════════╣ Network Information ╠════════════════════════════════════
╔══════════╣ Network Shares
  [X] Exception:
╔══════════╣ Enumerate Network Mapped Drives (WMI)
╔══════════╣ Host File
╔══════════╣ Network Ifaces and known hosts
╚ The masks are only for the IPv4 addresses
    tap031de208-e0[FA:16:3E:D3:BF:AD]: 10.0.1.20, fe80::e0e3:edd0:e52:ad12%6 / 255.255.255.0
        Gateways: 10.0.1.254
        DNSs: 10.0.1.6
        Known hosts:
          10.0.1.1              FA-16-3E-6B-AF-EA     Dynamic
          10.0.1.6              FA-16-3E-CB-BD-A7     Dynamic
          10.0.1.21             FA-16-3E-36-37-C6     Dynamic
          10.0.1.254            FA-16-3E-AD-FD-7C     Dynamic
          10.0.1.255            FF-FF-FF-FF-FF-FF     Static
          224.0.0.22            01-00-5E-00-00-16     Static
          224.0.0.251           01-00-5E-00-00-FB     Static
          224.0.0.252           01-00-5E-00-00-FC     Static
          239.255.255.250       01-00-5E-7F-FF-FA     Static
          255.255.255.255       FF-FF-FF-FF-FF-FF     Static
    Loopback Pseudo-Interface 1[]: 127.0.0.1, ::1 / 255.0.0.0
        DNSs: fec0:0:0:ffff::1%1, fec0:0:0:ffff::2%1, fec0:0:0:ffff::3%1
        Known hosts:
          224.0.0.22            00-00-00-00-00-00     Static
          239.255.255.250       00-00-00-00-00-00     Static
╔══════════╣ Current TCP Listening Ports
╚ Check for services restricted from the outside
  Enumerating IPv4 connections
  Protocol   Local Address         Local Port    Remote Address        Remote Port     State             Process ID      Process Name
  TCP        0.0.0.0               135           0.0.0.0               0               Listening         940             C:\windows\system32\svchost.exe
  TCP        0.0.0.0               445           0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               3389          0.0.0.0               0               Listening         1072            C:\windows\System32\svchost.exe
  TCP        0.0.0.0               5985          0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               5986          0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               47001         0.0.0.0               0               Listening         4               System
  TCP        0.0.0.0               49664         0.0.0.0               0               Listening         692             C:\windows\system32\lsass.exe
  TCP        0.0.0.0               49665         0.0.0.0               0               Listening         560             wininit
  TCP        0.0.0.0               49666         0.0.0.0               0               Listening         1384            C:\windows\System32\svchost.exe
  TCP        0.0.0.0               49667         0.0.0.0               0               Listening         1912            C:\windows\system32\svchost.exe
  TCP        0.0.0.0               49668         0.0.0.0               0               Listening         692             C:\windows\system32\lsass.exe
  TCP        0.0.0.0               49669         0.0.0.0               0               Listening         2424            C:\windows\System32\svchost.exe
  TCP        0.0.0.0               49670         0.0.0.0               0               Listening         2656            C:\windows\System32\spoolsv.exe
  TCP        0.0.0.0               49687         0.0.0.0               0               Listening         2536            C:\windows\system32\svchost.exe
  TCP        0.0.0.0               49690         0.0.0.0               0               Listening         684             services
  TCP        10.0.1.20             139           0.0.0.0               0               Listening         4               System
  TCP        10.0.1.20             3389          10.0.254.105          50480           Established       1072            C:\windows\System32\svchost.exe
  TCP        10.0.1.20             49702         129.21.33.131         50051           Established       2764            C:\ProgramData\Laforge\laforge.exe
  TCP        10.0.1.20             51773         10.0.1.6              389             Established       5056            C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
  TCP        10.0.1.20             51986         129.21.33.139         443             Established       9656            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cptclogging.exe
  Enumerating IPv6 connections
  Protocol   Local Address                               Local Port    Remote Address                              Remote Port     State             Process ID      Process Name
  TCP        [::]                                        135           [::]                                        0               Listening         940             C:\windows\system32\svchost.exe
  TCP        [::]                                        445           [::]                                        0               Listening         4               System
  TCP        [::]                                        3389          [::]                                        0               Listening         1072            C:\windows\System32\svchost.exe
  TCP        [::]                                        5985          [::]                                        0               Listening         4               System
  TCP        [::]                                        5986          [::]                                        0               Listening         4               System
  TCP        [::]                                        47001         [::]                                        0               Listening         4               System
  TCP        [::]                                        49664         [::]                                        0               Listening         692             C:\windows\system32\lsass.exe
  TCP        [::]                                        49665         [::]                                        0               Listening         560             wininit
  TCP        [::]                                        49666         [::]                                        0               Listening         1384            C:\windows\System32\svchost.exe
  TCP        [::]                                        49667         [::]                                        0               Listening         1912            C:\windows\system32\svchost.exe
  TCP        [::]                                        49668         [::]                                        0               Listening         692             C:\windows\system32\lsass.exe
  TCP        [::]                                        49669         [::]                                        0               Listening         2424            C:\windows\System32\svchost.exe
  TCP        [::]                                        49670         [::]                                        0               Listening         2656            C:\windows\System32\spoolsv.exe
  TCP        [::]                                        49687         [::]                                        0               Listening         2536            C:\windows\system32\svchost.exe
  TCP        [::]                                        49690         [::]                                        0               Listening         684             services
  TCP        [fe80::e0e3:edd0:e52:ad12%6]                135           [fe80::e0e3:edd0:e52:ad12%6]                52039           Established       940             C:\windows\system32\svchost.exe
╔══════════╣ Current UDP Listening Ports
╚ Check for services restricted from the outside
  Enumerating IPv4 connections
  Protocol   Local Address         Local Port    Remote Address:Remote Port     Process ID        Process Name
  UDP        0.0.0.0               123           *:*                            1148              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               500           *:*                            2544              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               3389          *:*                            1072              C:\windows\System32\svchost.exe
  UDP        0.0.0.0               3702          *:*                            9496              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               3702          *:*                            9496              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               4500          *:*                            2544              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               5353          *:*                            1344              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               5355          *:*                            1344              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               53253         *:*                            1344              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               53500         *:*                            9496              C:\windows\system32\svchost.exe
  UDP        0.0.0.0               57959         *:*                            1344              C:\windows\system32\svchost.exe
  UDP        10.0.1.20             137           *:*                            4                 System
  UDP        10.0.1.20             138           *:*                            4                 System
  UDP        127.0.0.1             52535         *:*                            5056              C:\Program Files\SplunkUniversalForwarder\bin\splunk-admon.exe
  UDP        127.0.0.1             55050         *:*                            2200              C:\windows\System32\svchost.exe
  UDP        127.0.0.1             55052         *:*                            1664              C:\windows\system32\svchost.exe
  UDP        127.0.0.1             57456         *:*                            692               C:\windows\system32\lsass.exe
  UDP        127.0.0.1             57460         *:*                            1612              C:\windows\System32\svchost.exe
  UDP        127.0.0.1             57960         *:*                            8056              C:\Users\Guest\Desktop\winpeasany.exe
  Enumerating IPv6 connections
  Protocol   Local Address                               Local Port    Remote Address:Remote Port     Process ID        Process Name
  UDP        [::]                                        123           *:*                            1148              C:\windows\system32\svchost.exe
  UDP        [::]                                        500           *:*                            2544              C:\windows\system32\svchost.exe
  UDP        [::]                                        3389          *:*                            1072              C:\windows\System32\svchost.exe
  UDP        [::]                                        3702          *:*                            9496              C:\windows\system32\svchost.exe
  UDP        [::]                                        3702          *:*                            9496              C:\windows\system32\svchost.exe
  UDP        [::]                                        4500          *:*                            2544              C:\windows\system32\svchost.exe
  UDP        [::]                                        5353          *:*                            1344              C:\windows\system32\svchost.exe
  UDP        [::]                                        5355          *:*                            1344              C:\windows\system32\svchost.exe
  UDP        [::]                                        53253         *:*                            1344              C:\windows\system32\svchost.exe
  UDP        [::]                                        53501         *:*                            9496              C:\windows\system32\svchost.exe
  UDP        [::]                                        57959         *:*                            1344              C:\windows\system32\svchost.exe
╔══════════╣ Firewall Rules
╚ Showing only DENY rules (too many ALLOW rules always)
  [X] Exception: Exception has been thrown by the target of an invocation.
    Current Profiles:
  [X] Exception: Exception has been thrown by the target of an invocation.
    DENY rules:
  [X] Exception: Exception has been thrown by the target of an invocation.
╔══════════╣ DNS cached --limit 70--
    Entry                                 Name                                  Data
  [X] Exception:
╔══════════╣ Enumerating Internet settings, zone and proxy configuration
  General Settings
  Hive        Key                                       Value
  HKCU        CertificateRevocation                     1
  HKCU        DisableCachingOfSSLPages                  1
  HKCU        IE5_UA_Backup_Flag                        5.0
  HKCU        PrivacyAdvanced                           1
  HKCU        SecureProtocols                           10240
  HKCU        User Agent                                Mozilla/4.0 (compatible; MSIE 8.0; Win32)
  HKCU        ZonesSecurityUpgrade                      System.Byte[]
  HKCU        WarnonZoneCrossing                        1
  HKCU        EnableNegotiate                           1
  HKCU        ProxyEnable                               0
  HKCU        MigrateProxy                              1
  HKLM        ActiveXCache                              C:\Windows\Downloaded Program Files
  HKLM        CodeBaseSearchPath                        CODEBASE
  HKLM        EnablePunycode                            1
  HKLM        MinorVersion                              0
  HKLM        WarnOnIntranet                            1
  Zone Maps
  No URLs configured
  Zone Auth Settings
  No Zone Auth Settings
╔══════════╣ Internet Connectivity
╚ Checking if internet access is possible via different methods
    HTTP (80) Access: Accessible
    HTTPS (443) Access: Accessible
    HTTPS (443) Access by Domain Name: Accessible
    DNS (53) Access: Accessible
    ICMP (ping) Access: Accessible
╔══════════╣ Hostname Resolution
╚ Checking if the hostname can be resolved externally
    External Check Result:
{
    "hostname": "Deckhand-01",
    "source_ip": "129.21.249.53",
    "checks": {
        "IP in AbuseIPDB": {
            "malicious": false,
            "abuseConfidenceScore": 0,
            "countryCode": "US",
            "totalReports": 0,
            "lastReportedAt": null
        },
        "IP in VirusTotal": {
            "malicious": false,
            "reason": {
                "malicious": 0,
                "suspicious": 0,
                "undetected": 95,
                "harmless": 0,
                "timeout": 0
            },
            "reputation": 0
        },
        "Hostname in Pastes": {
            "totalResults": "0",
            "matches": []
        },
        "IP in MalwareWorld": {
            "malicious": false,
            "type": [],
            "urls": []
        }
    }
}
════════════════════════════════════╣ Active Directory Quick Checks ╠════════════════════════════════════
╔══════════╣ gMSA readable managed passwords
╚ Look for Group Managed Service Accounts you can read (msDS-ManagedPassword) https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/gmsa.html
    [!] Error accessing RootDSE (defaultNamingContext): The specified domain either does not exist or could not be contacted.
  [-] Could not resolve defaultNamingContext.
╔══════════╣ AD CS misconfigurations for ESC
╚  https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/ad-certificates.html
╚ Check for ADCS misconfigurations in the local DC registry
  [-] Host is not a domain controller. Skipping ADCS Registry check
╚
If you can modify a template (WriteDacl/WriteOwner/GenericAll), you can abuse ESC4
    [!] Error accessing RootDSE (configurationNamingContext): The specified domain either does not exist or could not be contacted.
  [-] Could not resolve configurationNamingContext.
════════════════════════════════════╣ Cloud Information ╠════════════════════════════════════
Learn and practice cloud hacking in training.hacktricks.xyz
AWS EC2?                                No
Azure VM?                               No
Azure Tokens?                           Yes
Google Cloud Platform?                  No
Google Workspace Joined?                No
Google Cloud Directory Sync?            No
Google Password Sync?                   No
╔══════════╣ Azure Tokens Enumeration
  [X] Exception: The directory 'C:\Users\Guest\AppData\Local\Microsoft\IdentityCache' does not exist.
  [X] Exception: An error occurred while scanning the identityCache directory: Could not find a part of the path 'C:\Users\Guest\AppData\Local\Microsoft\IdentityCache'.
Local Info
C:\Users\Guest\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
☺
expiration♠☺?Q
??
♠status♣♥
♣error♦☺?☺
WTE_Message
"Need user interaction to continue.
WTE_Code♦?☺
WTE_PropertyBag
?C???D!
??)?↔??t☺
        ErrorCode
¶interaction_required
correlationId
&{9516B907-B79A-4BD0-A892-CED95A6D0BB3}
════════════════════════════════════╣ Windows Credentials ╠════════════════════════════════════
╔══════════╣ Checking Windows Vault
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#credentials-manager--windows-vault
Unable to enumerate vault items from the following vault: Windows Credentials. Error 0x5
    Not Found
╔══════════╣ Checking Credential manager
╚  https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#credentials-manager--windows-vault
    [!] Warning: if password contains non-printable characters, it will be printed as unicode base64 encoded string
  [!] Unable to enumerate credentials automatically, error: 'Win32Exception: System.ComponentModel.Win32Exception (0x80004005): Access is denied'
Please run:
cmdkey /list
╔══════════╣ Saved RDP connections
    Not Found
╔══════════╣ Remote Desktop Server/Client Settings
  RDP Server Settings
    Network Level Authentication            :
    Block Clipboard Redirection             :
    Block COM Port Redirection              :
    Block Drive Redirection                 :
    Block LPT Port Redirection              :
    Block PnP Device Redirection            :
    Block Printer Redirection               :
    Allow Smart Card Redirection            :
  RDP Client Settings


_raw:
    Date Deleted: 11/9/2025 12:13:43 AM
╔══════════╣ Searching hidden files or folders in C:\Users home (can be slow)
     C:\Users\Default User
     C:\Users\Default
     C:\Users\All Users
     C:\Users\Default
     C:\Users\Guest\Documents\Default.rdp
╔══════════╣ Searching interesting files in other users home directories (can be slow)
     You are already Administrator, check users home folders manually.
╔══════════╣ Searching executable files in non-default folders with write (equivalent) permissions (can be slow)
     File Permissions "C:\$Recycle.Bin\S-1-5-21-2288084429-921088559-2964959546-501\$RAX95E1.exe": Administrators [Allow: AllAccess],Users [Allow: AppendData/CreateDirectories]
     File Permissions "C:\$Recycle.Bin\S-1-5-21-2288084429-921088559-2964959546-501\$IAX95E1.exe": Administrators [Allow: AllAccess],Users [Allow: AppendData/CreateDirectories]
     File Permissions "C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\cptclogging.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\Laforge\laforge.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\bin\choco.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\bin\RefreshEnv.cmd": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Remove-Process.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Register-Application.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-WebContent.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-PackageCacheLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-EffectiveProxy.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-AvailableDriveLetter.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-core\Get-AppInstallLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Get-PackageParameters.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Get-UninstallRegistryKey.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Install-ChocolateyDesktopLink.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Write-ChocolateyFailure.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Write-ChocolateySuccess.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\extensions\chocolatey-compatibility\helpers\Write-FileUpdateLog.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\ChocolateyTabExpansion.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\chocolateyScriptRunner.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Write-FunctionCallLogMessage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\UnInstall-ChocolateyZipPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Uninstall-ChocolateyPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Uninstall-ChocolateyEnvironmentVariable.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Uninstall-BinFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Start-ChocolateyProcessAsAdmin.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Set-PowerShellExitCode.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-Vsix.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyZipPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyVsixPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyShortcut.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyPowershellCommand.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyPinnedTaskBarItem.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyInstallPackage.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyFileAssociation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyExplorerMenuItem.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-ChocolateyEnvironmentVariable.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Install-BinFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-WebHeaders.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-WebFileName.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-WebFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-VirusCheckValid.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-UninstallRegistryKey.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-UACEnabled.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ToolsLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-PackageParameters.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-OSArchitectureWidth.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-FtpFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ChocolateyWebFile.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ChocolateyUnzip.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ChocolateyPath.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-ChocolateyConfigValue.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Get-CheckSumValid.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\helpers\functions\Format-FileSize.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\Firefox\tools\chocolateyInstall.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\Firefox\tools\chocolateyUninstall.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\Firefox\tools\helpers.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-AppInstallLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-AvailableDriveLetter.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-EffectiveProxy.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-PackageCacheLocation.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Get-WebContent.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Register-Application.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-core.extension\extensions\Remove-Process.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Write-FileUpdateLog.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Write-ChocolateySuccess.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Write-ChocolateyFailure.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Install-ChocolateyDesktopLink.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Get-UninstallRegistryKey.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Get-PackageParameters.ps1": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\redirects\choco.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\redirects\RefreshEnv.cmd": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\tools\7z.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\tools\checksum.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\tools\shimgen.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\All Users\chocolatey\choco.exe": Administrators [Allow: AllAccess]
     File Permissions "C:\Users\Guest\Downloads\My Binary Translator Installer.exe": Administrators [Allow: AllAccess],Guest [Allow: AllAccess]
     File Permissions "C:\Users\Guest\Desktop\winpeasany.exe": Administrators [Allow: AllAccess],Guest [Allow: AllAccess]
╔══════════╣ Looking for Linux shells/distributions - wsl.exe, bash.exe
    C:\Windows\System32\wsl.exe
    WSL - no installed Linux distributions found.
       /---------------------------------------------------------------------------------\
       |                             Do you like PEASS?                                  |
       |---------------------------------------------------------------------------------|
       |         Learn Cloud Hacking       :     training.hacktricks.xyz                 |
       |         Follow on Twitter         :     @hacktricks_live                        |
       |         Respect on HTB            :     SirBroccoli                             |
       |---------------------------------------------------------------------------------|
       |                                 Thank you!                                      |
       \---------------------------------------------------------------------------------/
PS C:\Users\Guest\Desktop>


_raw:
    Logon Time:                   11/8/2025 10:44:01 PM
    Logon Type:                   RemoteInteractive
    Start Time:
    Domain:                       DECKHAND-01
    Authentication Package:       NTLM
    Start Time:
    User Name:                    Guest
    User Principal Name:
    User SID:                     S-1-5-21-2288084429-921088559-2964959546-501
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     2834970


_raw:
    Logon Time:                   11/8/2025 10:43:01 PM
    Logon Type:                   Interactive
    Start Time:
    Domain:                       Font Driver Host
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    UMFD-2
    User Principal Name:          DECKHAND-01$@allports.local
    User SID:                     S-1-5-96-0-2
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:
    Logon Id:                     997


_raw:
    Logon Time:                   11/8/2025 10:43:01 PM
    Logon Type:                   Interactive
    Start Time:
    Domain:                       Window Manager
    Authentication Package:       Negotiate
    Start Time:
    User Name:                    DWM-2
    User Principal Name:
    User SID:                     S-1-5-90-0-2
   =================================================================================================
    Method:                       LSA
    Logon Server:
    Logon Server Dns Domain:      allports.local
    Logon Id:                     3106278