GPP

Enumeration 1 export target=10.129.47.148 Port Scanning 1 2 3 rustscan $target --ulimit 10000 -g 10.129.47.148 -> [53,88,135,139,389,445,593,636,3268,3269,5722,464,9389,49153,49152,49155,49154,49158,49157,49162,49166,49168] 1 nmap -Pn -sC -sV -n -p53,88,135,139,389,445,464,3268,3269,5722,9389,47001,49152,49154,49153,49155,49158,49157,49162,49166,49168 -T5 $target Looking at the open ports (53, 88, …) this is clearly a Domain Controller. SMB Shares 1 smbmap -H $target We can read the non-default Replication share with null authentication. Let’s read it with smbclient: 1 smbclient -N //$target/Replication Get all files: ...