> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/remote-enumeration/computer-enumeration-remotely.md).

# Computer Enumeration Remotely

## Enumeration via LDAP

### Enumeration with Impacket

#### Enumeration with GetADComputers.py

To enumerate domain computers with [GetADComputers.py](https://github.com/fortra/impacket/blob/impacket_0_13_0/examples/GetADComputers.py)

```bash
impacket-GetADComputers -dc-ip $TARGET_IP 'CORP.COM/stephanie:LegmanTeamBenzoin!!'
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ impacket-GetADComputers -dc-ip $TARGET_IP 'CORP.COM/stephanie:LegmanTeamBenzoin!!'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Querying 192.168.210.70 for information about domain.
SAM AcctName     DNS Hostname                         OS Version       OS                   
---------------  -----------------------------------  ---------------  --------------------
DC1$             DC1.corp.com                         10.0 (20348)     Windows Server 2022 Standard 
WEB04$           web04.corp.com                       10.0 (20348)     Windows Server 2022 Standard 
FILES04$         FILES04.corp.com                     10.0 (20348)     Windows Server 2022 Standard 
CLIENT74$        client74.corp.com                    10.0 (22000)     Windows 11 Pro       
CLIENT75$        client75.corp.com                    10.0 (22000)     Windows 11 Pro       
CLIENT76$        CLIENT76.corp.com                    10.0 (16299)     Windows 10 Pro   

```

</details>

## Enumeration via SMB and RPC/DCE

### Enumeration with Impacket

#### Enumeration with net.py

[net.py](https://github.com/fortra/impacket/blob/impacket_0_13_0/examples/net.py) is an Impacket alternative for windows net.exe commandline utility. Thanks to RPC protocol, this tool is making net.exe functionalities available from remote computer.

To enumerate all domain computers

```bash
impacket-net domain.local/user%password@$TARGET_IP computer
```

### Enumeration with NetExec

To enumerate domain computers and create a resulting `hosts.txt` file to add to the `/etc/hosts` file.

No authentication required!

```bash
nxc smb 192.168.210.0/24 --generate-hosts-file hosts.txt
```

The results will be **appended** to the `hosts.txt` file in the current directory!

You can then add all or parts of this information to `/etc/hosts`.

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ nxc smb 192.168.210.0/24 --generate-hosts-file hosts.txt 
SMB         192.168.210.70  445    DC1              [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domain:corp.com) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         192.168.210.76  445    CLIENT76         [*] Windows 10 / Server 2016 Build 16299 x64 (name:CLIENT76) (domain:corp.com) (signing:False) (SMBv1:None)
SMB         192.168.210.73  445    FILES04          [*] Windows Server 2022 Build 20348 x64 (name:FILES04) (domain:corp.com) (signing:False) (SMBv1:None)
SMB         192.168.210.72  445    WEB04            [*] Windows Server 2022 Build 20348 x64 (name:WEB04) (domain:corp.com) (signing:False) (SMBv1:None)
SMB         192.168.210.74  445    CLIENT74         [*] Windows 11 Build 22000 x64 (name:CLIENT74) (domain:corp.com) (signing:False) (SMBv1:None)
SMB         192.168.210.75  445    CLIENT75         [*] Windows 11 Build 22000 x64 (name:CLIENT75) (domain:corp.com) (signing:False) (SMBv1:None)
Running nxc against 256 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00
                                                                                                                                                                                                                        
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ cat hosts.txt 
192.168.210.70     DC1.corp.com corp.com DC1
192.168.210.76     CLIENT76.corp.com CLIENT76
192.168.210.74     CLIENT74.corp.com CLIENT74
192.168.210.75     CLIENT75.corp.com CLIENT75
192.168.210.72     WEB04.corp.com WEB04
192.168.210.73     FILES04.corp.com FILES04

```

</details>

## Resources

**Impacket** - GitHub: <https://github.com/fortra/impacket>

**Impacket** - Homepage: <https://www.coresecurity.com/core-labs/impacket>

**Impacket** - Kali Tools: <https://www.kali.org/tools/impacket/>

**Impacket-scripts** - Kali Tools: <https://www.kali.org/tools/impacket-scripts/>

**NetExec** - GitHub: <https://github.com/Pennyw0rth/NetExec>

**NetExec** - Kali Tools: <https://www.kali.org/tools/netexec/>

**NetExec** - Wiki: <https://www.netexec.wiki>