Initial Enumeration

enum4linux-ng -A <TARGET-IP> | tee scans/enum4linux.txt

crackmapexec smb <TARGET-IP> -u '' -p ''

crackmapexec smb <TARGET-IP> -u 'guest' -p ''

ldapsearch -x -H ldap://<TARGET-IP> -b "DC=domain,DC=local"

ldapsearch -x -H ldap://<TARGET-IP> -b "" -s base namingContexts    # Get base DN

nmap --script ldap-rootdse -p 389 <TARGET-IP>

nmap --script smb-enum-domains,smb-enum-users,smb-os-discovery -p 445 <TARGET-IP>

kerbrute userenum --dc <TARGET-IP> -d <DOMAIN> \
  /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt \
  | tee scans/kerbrute_users.txt

rpcclient -U "" -N <TARGET-IP>

rpcclient> enumdomusers          # List domain users

rpcclient> enumdomgroups         # List domain groups

rpcclient> querydominfo          # Domain info

rpcclient> querydispinfo         # Detailed user info

crackmapexec smb <TARGET-IP> -u <USER> -p <PASS>

crackmapexec smb <TARGET-IP> -u <USER> -p <PASS> --users

crackmapexec smb <TARGET-IP> -u <USER> -p <PASS> --groups

crackmapexec smb <TARGET-IP> -u <USER> -p <PASS> --shares

crackmapexec smb <TARGET-IP> -u <USER> -p <PASS> --pass-pol   # Password policy

ldapsearch -x -H ldap://<TARGET-IP> -D "<USER>@<DOMAIN>" -w <PASS> \
  -b "DC=<DOMAIN>,DC=LOCAL" "(objectClass=person)" \
  sAMAccountName mail memberOf | tee scans/ldap_users.txt

ldapsearch -x -H ldap://<TARGET-IP> -D "<USER>@<DOMAIN>" -w <PASS> \
  -b "DC=<DOMAIN>,DC=LOCAL" "(objectClass=user)" sAMAccountName

ldapsearch -x -H ldap://<TARGET-IP> -D "<USER>@<DOMAIN>" -w <PASS> \
  -b "DC=<DOMAIN>,DC=LOCAL" "(objectClass=computer)" name operatingSystem

net user /domain

net group /domain

net group "Domain Admins" /domain

net group "Enterprise Admins" /domain

net group "Domain Controllers" /domain

net localgroup administrators

Get-ADUser -Filter * -Properties * | Select Name,SamAccountName,Enabled,MemberOf

Get-ADGroup -Filter * | Select Name

Get-ADComputer -Filter * | Select Name,OperatingSystem,DNSHostName

Get-ADGroupMember -Identity "Domain Admins"