| 1 | | - | ls |
| 2 | | - | mode vi |
| 3 | | - | sleep |
| 4 | | - | help |
| 5 | | - | ls |
| 6 | | - | whoami |
| 7 | | - | say |
| 8 | | - | ls |
| 9 | | - | ./ |
| 10 | | - | say ./ |
| 11 | | - | say grabCookies.js |
| 12 | | - | ls |
| 13 | | - | say |
| 14 | | - | say README.md |
| 15 | | - | vi |
| 16 | | - | mode |
| 17 | | - | exit |
| 18 | | - | grabCookies.js |
| 19 | | - | exit |
| 20 | | - | cd |
| 21 | | - | exit |
| 22 | | - | cat .git |
| 23 | | - | exit |
| 24 | | - | whoami |
| 25 | | - | cat /etc/passwd |
| 26 | | - | pwd |
| 27 | | - | cd /tmp |
| 28 | | - | pwd |
| 29 | | - | exit |
| 30 | | - | cd /etc |
| 31 | | - | whoami |
| 32 | | - | cat |
| 33 | | - | cat /etc/passwd |
| 34 | | - | cd /tmp |
| 35 | | - | cd /Users |
| 36 | | - | ls |
| 37 | | - | cd /tmp |
| 38 | | - | cd / |
| 39 | | - | whoami |
| 40 | | - | login |
| 41 | | - | help |
| 42 | | - | setprompt hahah |
| 43 | | - | setprompt |
| 44 | | - | setprompt ok |
| 45 | | - | agents |
| 46 | | - | help |
| 47 | | - | agent |
| 48 | | - | agent |
| 49 | | - | agent 60053270a64b348e8f4408a2 |
| 50 | | - | agent 5JbQvCgHKDLtre7JJyQben_501_brian |
| 51 | | - | agent 5JbQvCgHKDLtre7JJyQben_501_brian |
| 52 | | - | whoami |
| 53 | | - | agent 5JbQvCgHKDLtre7JJyQben_501_brian |
| 54 | | - | agent 5JbQvCgHKDLtre7JJyQben_501_brian |
| 55 | | - | whoami |
| 56 | | - | cd /tmp |
| 57 | | - | agent 5JbQvCgHKDLtre7JJyQben_501_brian |
| 58 | | - | whoami |
| 59 | | - | cd /tmp |
| 60 | | - | agent 5JbQvCgHKDLtre7JJyQben_501_brian |
| 61 | | - | whoami |
| 62 | | - | agent 5JbQvCgHKDLtre7JJyQben_501_brian |
| 63 | | - | whoami |
| 64 | | - | cd /Users |
| 65 | | - | agent 5JbQvCgHKDLtre7JJyQben_501_brian |
| 66 | | - | agent pMwkirxY8NjgfQ3pb3QpVe_501_brian |
| 67 | | - | whoami |
| 68 | | - | cat /etc/passwd |
| 69 | | - | agent pMwkirxY8NjgfQ3pb3QpVe_501_brian |
| 70 | | - | whoami |
| 71 | | - | cat /etc/passwd |
| 72 | | - | cd / |
| 73 | | - | cd /tmp |
| 74 | | - | cat /etc/passwd |
| 75 | | - | agent pMwkirxY8NjgfQ3pb3QpVe_501_brian |
| 76 | | - | whoami |
| 77 | | - | cd /tmop |
| 78 | | - | cd /Users |
| 79 | | - | cat .git |
| 80 | | - | cat /etc/passwd |
| 81 | | - | agent pMwkirxY8NjgfQ3pb3QpVe_501_brian |
| 82 | | - | whoami |
| 83 | | - | agent EGkjzptwe48SXcfioofXsC_501_brian |
| 84 | | - | whoami |
| 85 | | - | cd /tmp |
| 86 | | - | cd /Users |
| 87 | | - | agent sHvRux4gATqLB4D9MY53Bk_501_brian |
| 88 | | - | cd /tmp |
| 89 | | - | agent zdVMEM5V6mQwV34crrC5GK_501_brian |
| 90 | | - | whoami |
| 91 | | - | cd /tmp |
| 92 | | - | agent zdVMEM5V6mQwV34crrC5GK_501_brian |
| 93 | | - | cd /tmp |
| 94 | | - | agent zdVMEM5V6mQwV34crrC5GK_501_brian |
| 95 | | - | cd pwd |
| 96 | | - | agent zdVMEM5V6mQwV34crrC5GK_501_brian |
| 97 | | - | cd reports |
| 98 | | - | cd /tmp |
| 99 | | - | cat getSecrets.js |
| 100 | | - | cd /users |
| 101 | | - | cd brian |
| 102 | | - | cat config.json |
| 103 | | - | agent |
| 104 | | - | cd |
| 105 | | - | agent zdVMEM5V6mQwV34crrC5GK_501_brian |
| 106 | | - | whoami |
| 107 | | - | agent 8EVgbNDGtziXNVGQcdu9fB_501_brian |
| 108 | | - | whoami |
| 109 | | - | cd /tmp |
| 110 | | - | agent 8EVgbNDGtziXNVGQcdu9fB_501_brian |
| 111 | | - | agent 8EVgbNDGtziXNVGQcdu9fB_501_brian |
| 112 | | - | agent 8EVgbNDGtziXNVGQcdu9fB_501_brian |
| 113 | | - | agent 8EVgbNDGtziXNVGQcdu9fB_501_brian |
| 114 | | - | cd reports |
| 115 | | - | cd contact_reports |
| 116 | | - | cd / |
| 117 | | - | whoami |
| 118 | | - | cat /etc/passwd |
| 119 | | - | agent 8EVgbNDGtziXNVGQcdu9fB_501_brian |
| 120 | | - | agent 8EVgbNDGtziXNVGQcdu9fB_501_brian |
| 121 | | - | agent 8EVgbNDGtziXNVGQcdu9fB_501_brian |
| 122 | | - | cd Volumes |
| 123 | | - | whoami |
| 124 | | - | cat /etc/passwd |
| 125 | | - | whoami |
| 126 | | - | agent 8EVgbNDGtziXNVGQcdu9fB_501_brian |
| 127 | | - | agent 8EVgbNDGtziXNVGQcdu9fB_501_brian |
| 128 | | - | cd |
| 129 | | - | agent 8EVgbNDGtziXNVGQcdu9fB_501_brian |
| 130 | | - | agent 6PJfzVUET5AaVZ5JgWMsJ6_501_brian |
| 131 | | - | cd /tmp |
| 132 | | - | agent 6PJfzVUET5AaVZ5JgWMsJ6_501_brian |
| 133 | | - | cd /var |
| 134 | | - | pwd |
| 135 | | - | cd /Users |
| 136 | | - | cd brian |
| 137 | | - | pwd |
| 138 | | - | cd /Usesr |
| 139 | | - | cd /users |
| 140 | | - | cd /Users |
| 141 | | - | cd brian |
| 142 | | - | cd /tmp |
| 143 | | - | cd /Home |
| 144 | | - | agent 6PJfzVUET5AaVZ5JgWMsJ6_501_brian |
| 145 | | - | cd /tmp |
| 146 | | - | cd /users |
| 147 | | - | agent 6PJfzVUET5AaVZ5JgWMsJ6_501_brian |
| 148 | | - | cd brian |
| 149 | | - | agent 6PJfzVUET5AaVZ5JgWMsJ6_501_brian |
| 150 | | - | cd /tmp |
| 151 | | - | cd / |
| 152 | | - | cd bin |
| 153 | | - | whoami |
| 154 | | - | cat /etc/passwd |
| 155 | | - | cd /Users |
| 156 | | - | cd /users |
| 157 | | - | cd /Users |
| 158 | | - | cd brian |
| 159 | | - | cat /etc/passwd |
| 160 | | - | whoami |
| 161 | | - | cat /etc/passwd |
| 162 | | - | agent 6PJfzVUET5AaVZ5JgWMsJ6_501_brian |
| 163 | | - | agent 6PJfzVUET5AaVZ5JgWMsJ6_501_brian |
| 164 | | - | whoami |
| 165 | | - | cat /etc/passwd |
| 166 | | - | agent 6PJfzVUET5AaVZ5JgWMsJ6_501_brian |
| 167 | | - | cd / |
| 168 | | - | cat /etc/passwd |
| 169 | | - | agent PgLv6G79FN6BtYFv2A72AV_501_brian |
| 170 | | - | whoami |
| 171 | | - | cat /etc/passwd |
| 172 | | - | cd / |
| 173 | | - | agent PgLv6G79FN6BtYFv2A72AV_501_brian |
| 174 | | - | cd /Users |
| 175 | | - | cd brian |
| 176 | | - | cd redmap |
| 177 | | - | agent PgLv6G79FN6BtYFv2A72AV_501_brian |
| 178 | | - | cd / |
| 179 | | - | whoami |
| 180 | | - | cat /etc/passwd |
| 181 | | - | agent PgLv6G79FN6BtYFv2A72AV_501_brian |
| 182 | | - | whoami |
| 183 | | - | agent PgLv6G79FN6BtYFv2A72AV_501_brian |
| 184 | | - | whoami |
| 185 | | - | cat /etc/passwd |
| 186 | | - | cd /tmp |
| 187 | | - | cd /Users |
| 188 | | - | cat /etc/passwd |
| 189 | | - | cd brian |
| 190 | | - | cd /etc |
| 191 | | - | cat passwd |
| 192 | | - | ls |
| 193 | | - | pwd |
| 194 | | - | cat /etc/passwd |
| 195 | | - | agent PgLv6G79FN6BtYFv2A72AV_501_brian |
| 196 | | - | cat passwd |
| 197 | | - | cat passwd |
| 198 | | - | agent PgLv6G79FN6BtYFv2A72AV_501_brian |
| 199 | | - | cat /etc/passwd |
| 200 | | - | cd paths.d |
| 201 | | - | ls |
| 202 | | - | pwd |
| 203 | | - | ls |
| 204 | | - | cd com.vmware.fusion.public |
| 205 | | - | cd /etc |
| 206 | | - | cat passwd |
| 207 | | - | whoami |
| 208 | | - | ping google.com |
| 209 | | - | cd / |
| 210 | | - | pwd |
| 211 | | - | cat /etc/passwd |
| 212 | | - | agent xXgwjWfiGUEDoBoY7FARz4_501_brian |
| 213 | | - | whoami |
| 214 | | - | cat /etc/passwd |
| 215 | | - | cd .. |
| 216 | | - | cd / |
| 217 | | - | pwd |
| 218 | | - | cat /etc/passwd |
| 219 | | - | cd /tmp |
| 220 | | - | cd /Users |
| 221 | | - | cd / |
| 222 | | - | cd /Home |
| 223 | | - | ls |
| 224 | | - | cd /Users |
| 225 | | - | cd brian |
| 226 | | - | cd / |
| 227 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 228 | | - | whoami |
| 229 | | - | cat /etc/passed |
| 230 | | - | cd / |
| 231 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 232 | | - | whoami |
| 233 | | - | cd /tmp |
| 234 | | - | cat /etc/passwd |
| 235 | | - | cd /etc |
| 236 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 237 | | - | whoami |
| 238 | | - | cat /etc/passwd |
| 239 | | - | whoami |
| 240 | | - | cd .. |
| 241 | | - | cat /etc/passwd |
| 242 | | - | agent |
| 243 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 244 | | - | whoami |
| 245 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 246 | | - | whoami |
| 247 | | - | cat /etc/passwd |
| 248 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 249 | | - | whoami |
| 250 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 251 | | - | whoami |
| 252 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 253 | | - | whoami |
| 254 | | - | agent |
| 255 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 256 | | - | whoami |
| 257 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 258 | | - | whoami |
| 259 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 260 | | - | whoami |
| 261 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 262 | | - | whoami |
| 263 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 264 | | - | whoami |
| 265 | | - | cat /etc/passwd |
| 266 | | - | cd / |
| 267 | | - | cd /tmp |
| 268 | | - | cd /etc |
| 269 | | - | whoami |
| 270 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 271 | | - | cat /etc/passwd |
| 272 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 273 | | - | whoami |
| 274 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 275 | | - | whoami |
| 276 | | - | cat /etc/passwd |
| 277 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 278 | | - | whoami |
| 279 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 280 | | - | whoami |
| 281 | | - | cat /etc/passwd |
| 282 | | - | cd / |
| 283 | | - | agent kgPm8KC5Ea9kobZsdJ7rCf_501_brian |
| 284 | | - | cat /etc/passwd |
| 285 | | - | cd /Users |
| 286 | | - | cd brian |
| 287 | | - | cd .. |
| 288 | | - | whoami |
| 289 | | - | agent LensTpwP3wjhb3excqM6pY_501_brian |
| 290 | | - | whoami |
| 291 | | - | cat /etc/passwd |
| 292 | | - | cd .. |
| 293 | | - | whoami |
| 294 | | - | cd .. |
| 295 | | - | cd brian |
| 296 | | - | cat test.py |
| 297 | | - | whereis osascript |
| 298 | | - | cat /etc/passwd |
| 299 | | - | whoami |
| 300 | | - | cookies |
| 301 | | - | cat /tmp/dat2 |
| 302 | | - | > |
| 303 | | - | ok |
| 304 | | - | quit |
| 305 | | - | exit |
| 306 | | - | agent LensTpwP3wjhb3excqM6pY_501_brian |
| 307 | | - | whoami |
| 308 | | - | cat /etc/passwd |
| 309 | | - | cd ~/ |
| 310 | | - | cd / |
| 311 | | - | cd ~/ |
| 312 | | - | env |
| 313 | | - | cd / |
| 314 | | - | asdfdsf |
| 315 | | - | |
| 316 | | - | cd tmp |
| 317 | | - | cat dat2 |
| 318 | | - | cd / |
| 319 | | - | download |
| 320 | | - | agent LensTpwP3wjhb3excqM6pY_501_brian |
| 321 | | - | whoami |
| 322 | | - | upload |
| 323 | | - | upload test |
| 324 | | - | whoami |
| 325 | | - | sleep |
| 326 | | - | agent LensTpwP3wjhb3excqM6pY_501_brian |
| 327 | | - | cd Applications |
| 328 | | - | ls |
| 329 | | - | agent 9bWA3YRgaqWn2sk89ZCEg5_501_brian |
| 330 | | - | download |
| 331 | | - | agent |
| 332 | | - | agent 9qQVswXPN48v3VH5GaQyR6_501_brian |
| 333 | | - | whoami |
| 334 | | - | cat /etc/passwd |
| 335 | | - | agent AfqHqTswUiSArhRkxffAp5_501_brian |
| 336 | | - | whoami |
| 337 | | - | cat /etcpasswd |
| 338 | | - | cat /etc/passwd |
| 339 | | - | agent vrKTKRm9SKADGRo8aLBbDk_501_brian |
| 340 | | - | whoami |
| 341 | | - | cat /etc/passwd |
| 342 | | - | cd .. |
| 343 | | - | agent Q9isYmdu2N3Un95knkhUu5_501_rt-test-04 |
| 344 | | - | whoami |
| 345 | | - | cat /etc/passwd |
| 346 | | - | cookies |
| 347 | | - | cd .. |
| 348 | | - | agent 7ZPiZWTkHgQMErmwEDaCmD_501_rt-test-04 |
| 349 | | - | whoami |
| 350 | | - | cat /etc/passwd |
| 351 | | - | cookies |
| 352 | | - | whoamI |
| 353 | | - | agent zRuXWF6FY5nwDRhDszMiDQ_501_rt-test-04 |
| 354 | | - | WHOAMI |
| 355 | | - | whoami |
| 356 | | - | cookies |
| 357 | | - | agent 6JV8StbcjjJWVB6SSdPEnZ_501_rt-test-04 |
| 358 | | - | cookies |
| 359 | | - | agent YZdTwkmgiSkGF8CJcoto7K_501_rt-test-04 |
| 360 | | - | cookies |
| 361 | | - | agent sBNU2zQ4H87foY2ySmg7KW_501_rt-test-04 |
| 362 | | - | cookies |
| 363 | | - | agent e4YZLq3ynyHtYK2BYjBWg_501_rt-test-04 |
| 364 | | - | cookies |
| 365 | | - | agent TUMGukWPo79WAv9xtwvQDB_501_rt-test-04 |
| 366 | | - | cookies |
| 367 | | - | agent qDvgXJC5ybEPVYb8XE3dre_501_rt-test-04 |
| 368 | | - | cookies |
| 369 | | - | agent zEtWZpRKTUwx4FNazz6BJE_501_rt-test-04 |
| 370 | | - | whoami |
| 371 | | - | cookies |
| 372 | | - | agent 8xz5dC9c32JaPW5h47x7Zc_501_rt-test-04 |
| 373 | | - | whoami |
| 374 | | - | cookies |
| 375 | | - | agent iVBq24Axi4EvoKCStbGog5_501_rt-test-04 |
| 376 | | - | cookies |
| 377 | | - | agent LJVUBzUTzB3ArNhXo8LJNc_501_rt-test-04 |
| 378 | | - | whoami |
| 379 | | - | cookies |
| 380 | | - | agent bCnfnzGZQz9UcJt5Lz4fS8_501_rt-test-04 |
| 381 | | - | whoami |
| 382 | | - | cookies |
| 383 | | - | whoami |
| 384 | | - | agent hWX4svsFtHPkVdk3QoaqoF_501_rt-test-04 |
| 385 | | - | whoami |
| 386 | | - | cookies |
| 387 | | - | whoami |
| 388 | | - | agent svDMrqapwh7UeWYxDnVPkC_501_rt-test-04 |
| 389 | | - | whoami |
| 390 | | - | cookies |
| 391 | | - | whoami |
| 392 | | - | cat /etc/passwd |
| 393 | | - | cd .. |
| 394 | | - | agent Rp76Zjn8q3ELXYNb9D9cKB_501_brian |
| 395 | | - | whoami |
| 396 | | - | cat /etc/passed |
| 397 | | - | cat /etc/passwd |
| 398 | | - | agent XdEbyV3qEoYKG4xKdmeomQ_501_brian |
| 399 | | - | cat passed |
| 400 | | - | agent DPLh752SYtBLNGffWA3XuC_501_brian |
| 401 | | - | whoami |
| 402 | | - | cat passed |
| 403 | | - | agent AiKvwGWGCJGrYkCwjrz5ih_501_brian |
| 404 | | - | whoami |
| 405 | | - | cat passed |
| 406 | | - | cat /etc/passwd |
| 407 | | - | whoccam |
| 408 | | - | cat passed |
| 409 | | - | ok |
| 410 | | - | whoami |
| 411 | | - | agent vGggPM6bc799mUjdpGvPTY_501_brian |
| 412 | | - | whoami |
| 413 | | - | who |
| 414 | | - | cat passed |
| 415 | | - | passed |
| 416 | | - | asdfasdf |
| 417 | | - | cat /etc/passwd |
| 418 | | - | cd .. |
| 419 | | - | cd ... |
| 420 | | - | cd ./. |
| 421 | | - | cd f |
| 422 | | - | pwd |
| 423 | | - | agent axUmu72sa4kTFGw3P86kLT_501_brian |
| 424 | | - | whoami |
| 425 | | - | cat /etc/passwd |
| 426 | | - | passed |
| 427 | | - | cd /Users |
| 428 | | - | cd brian |
| 429 | | - | cat mqtt.py |
| 430 | | - | agent svDMrqapwh7UeWYxDnVPkC_501_rt-test-04 |
| 431 | | - | whoami |
| 432 | | - | cat /etc/passwd |
| 433 | | - | cd Desktop |
| 434 | | - | cat /etc/passwd |
| 435 | | - | agent eMY96kKrdRoMv9aHu4zg7P_S-1-5-21-797764186-716943374-3998734365-1001_ |
| 436 | | - | whoami |
| 437 | | - | pwd |
| 438 | | - | cd .. |
| 439 | | - | cd c:/ |
| 440 | | - | dir |
| 441 | | - | ls |
| 442 | | - | agent ocRNGQd2Z7zTxxNNvqXxu5_S-1-5-21-797764186-716943374-3998734365-1001_ |
| 443 | | - | cd c:\ |
| 444 | | - | cd Scripts |
| 445 | | - | ls |
| 446 | | - | cat trimFeatures.ps1 |
| 447 | | - | cookies |
| 448 | | - | whoami |
| 449 | | - | cd .. |
| 450 | | - | agent ocRNGQd2Z7zTxxNNvqXxu5_S-1-5-21-797764186-716943374-3998734365-1001_ |
| 451 | | - | whoami |
| 452 | | - | agent ocRNGQd2Z7zTxxNNvqXxu5_S-1-5-21-797764186-716943374-3998734365-1001_ |
| 453 | | - | whoami |
| 454 | | - | cd Program Files (x86) |
| 455 | | - | agent svDMrqapwh7UeWYxDnVPkC_501_rt-test-04 |
| 456 | | - | whoami |
| 457 | | - | agent svDMrqapwh7UeWYxDnVPkC_501_rt-test-04 |
| 458 | | - | whoami |
| 459 | | - | history |
| 460 | | - | agent MSg2j5e2onnXEJFMizTp8a_501_brian |
| 461 | | - | whoami |
| 462 | | - | history |
| 463 | | - | agent MSg2j5e2onnXEJFMizTp8a_501_brian |
| 464 | | - | history |
| 465 | | - | agent MSg2j5e2onnXEJFMizTp8a_501_brian |
| 466 | | - | history |
| 467 | | - | agent MSg2j5e2onnXEJFMizTp8a_501_brian |
| 468 | | - | whoami |
| 469 | | - | history |
| 470 | | - | agent MSg2j5e2onnXEJFMizTp8a_501_brian |
| 471 | | - | whoami |
| 472 | | - | cat /etc/passwd |
| 473 | | - | history |
| 474 | | - | cd .. |
| 475 | | - | cat /etc/passwd |
| 476 | | - | agent B2r3W9bLypi3UUEsqsdaRj_501_brian |
| 477 | | - | whoami |
| 478 | | - | cat /etc/passed |
| 479 | | - | history |
| 480 | | - | cd .. |
| 481 | | - | cat /etc/passwd |
| 482 | | - | agent svDMrqapwh7UeWYxDnVPkC_501_rt-test-04 |
| 483 | | - | whoami |
| 484 | | - | cat /etc/passwd |
| 485 | | - | cat test.term |
| 486 | | - | cat test.action |
| 487 | | - | agent B2r3W9bLypi3UUEsqsdaRj_501_brian |
| 488 | | - | whoami |
| 489 | | - | cat /etc/passwd |
| 490 | | - | cd /tmp |
| 491 | | - | pwd |
| 492 | | - | ls |
| 493 | | - | cat getSecrets.js |
| 494 | | - | nano getSecrets.js |
| 495 | | - | download |
| 496 | | - | agent 5rxLugn4Pqfy7p92gH9Qje_501_brian |
| 497 | | - | whoami |
| 498 | | - | download |
| 499 | | - | |
Brian Stegemoller
committed
with
GitHub
3 years ago
1 parent 895a27cc