Domain Account
Sub-technique of T1087 Account Discovery ↗
Listing domain users over LDAP, RPC, SMB or Kerberos.
How it shows up on Hack The Box
With a null or guest session try --rid-brute; with nothing, kerbrute userenum. With a valid user, LDAP gives you every user and their descriptions (sometimes with passwords).
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Active Directory enumeration: users, LDAP, BloodHound and password spraying 4 min read What to do when you find a domain controller: enumerate without credentials, get valid users, spray passwords safely and collect BloodHound data.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Windows and Active Directory privilege escalation › Active Directory
Validate users (Kerberos)
kerbrute userenum -d box.htb --dc 10.10.11.20 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt
Users by RID (guest session)
netexec smb 10.10.11.20 -u guest -p '' --rid-brute
Domain users
netexec smb 10.10.11.20 -u 'usuario' -p 'Password123!' --usersNmap and service enumeration › Services
Full enumeration
enum4linux-ng -A 10.10.11.20
LDAP (389)
ldapsearch -x -H ldap://10.10.11.20 -s base namingcontextsNo command matches.