> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/remote-enumeration/get-domain-information-remotely.md).

# Get Domain Information Remotely

## Password Policy

### Get password policy with NetExec

We can get detailed password policy information with NetExec (`nxc`)

```bash
nxc smb $TARGET_IP --pass-pol
```

<details>

<summary>Example run</summary>

```bash
user@tryhackme$ nxc smb 10.211.11.10 --pass-pol
SMB         10.211.11.10    445    DC               [*] Windows Server 2019 Datacenter 17763 x64 (name:DC) (domain:tryhackme.loc) (signing:True) (SMBv1:True)
SMB         10.211.11.10    445    DC               [+] Dumping password info for domain: TRYHACKME
SMB         10.211.11.10    445    DC               Minimum password length: 18
SMB         10.211.11.10    445    DC               Password history length: 21
SMB         10.211.11.10    445    DC               Maximum password age: 41 days 23 hours 53 minutes
SMB         10.211.11.10    445    DC               
SMB         10.211.11.10    445    DC               Password Complexity Flags: 000001
SMB         10.211.11.10    445    DC                   Domain Refuse Password Change: 0
SMB         10.211.11.10    445    DC                   Domain Password Store Cleartext: 0
SMB         10.211.11.10    445    DC                   Domain Password Lockout Admins: 0
SMB         10.211.11.10    445    DC                   Domain Password No Clear Change: 0
SMB         10.211.11.10    445    DC                   Domain Password No Anon Change: 0
SMB         10.211.11.10    445    DC                   Domain Password Complex: 1
SMB         10.211.11.10    445    DC               
SMB         10.211.11.10    445    DC               Minimum password age: 1 day 4 minutes
SMB         10.211.11.10    445    DC               Reset Account Lockout Counter: 30 minutes
SMB         10.211.11.10    445    DC               Locked Account Duration: 30 minutes
SMB         10.211.11.10    445    DC               Account Lockout Threshold: 10
SMB         10.211.11.10    445    DC               Forced Log off Time: Not Set

```

</details>

### Get password policy with rpcclient

We can get basic password policy information with `rpcclient`

```bash
rpcclient -U '' -N $TARGET_IP -c getdompwinfo
```

## Shares

### Enumerating shares with NetExec

Enumerating shares of a specific machine with known credentials

```bash
nxc smb $TARGET_IP -u svc-printer -p '1edFg43012!!' --shares
```

Enumerating shares with `Guest` user

```bash
nxc smb $TARGET_IP -u Guest -p '' --shares
```

Enumerating shares as Anonymous (Null-session)

```bash
nxc smb $TARGET_IP -u '' -p '' --shares
```

## Resources

**NetExec** - GitHub: <https://github.com/Pennyw0rth/NetExec>

**NetExec** - Kali Tools: <https://www.kali.org/tools/netexec/>

**NetExec** - Wiki: <https://www.netexec.wiki>

**rpcclient** - Kali Tools: <https://www.kali.org/tools/samba/#rpcclient>

**rpcclient** - Linux manual page: <https://linux.die.net/man/1/rpcclient>