> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/ad-discovery/remote-enumeration/user-enumeration-remotely.md).

# User Enumeration Remotely

## Enumeration via Kerberos

### Enumeration with Kerbrute

To enumerate which users **from a list of potential users** with Kerbrute

Without DNS-lookup for the domain:

```bash
./kerbrute userenum --dc 10.211.11.10 -d tryhackme.loc users.txt
```

Add `-v` for verbose output, i.e. log failures and errors.

With DNS-lookup:

```powershell
.\kerbrute_windows_amd64.exe userenum -d corp.com .\users.txt
```

<details>

<summary>Example run</summary>

```powershell
PS C:\Tools> .\kerbrute_windows_amd64.exe userenum -d corp.com .\users.txt

    __             __               __
   / /_____  _____/ /_  _______  __/ /____
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/

Version: v1.0.3 (9dad6e1) - 04/02/25 - Ronnie Flathers @ropnop

2025/04/02 00:22:18 >  Using KDC(s):
2025/04/02 00:22:18 >   dc1.corp.com:88
2025/04/02 00:22:18 >  [+] VALID USERNAME:       jeff@corp.com
2025/04/02 00:22:18 >  [+] VALID USERNAME:       pete@corp.com
2025/04/02 00:22:18 >  [+] VALID USERNAME:       jeffadmin@corp.com
2025/04/02 00:22:18 >  [+] VALID USERNAME:       Administrator@corp.com
2025/04/02 00:22:18 >  [+] VALID USERNAME:       stephanie@corp.com
2025/04/02 00:22:18 >  [+] VALID USERNAME:       jen@corp.com
2025/04/02 00:22:18 >  [+] VALID USERNAME:       dave@corp.com
2025/04/02 00:22:18 >  Done! Tested 8 usernames (7 valid) in 0.008 seconds
```

</details>

### Usage information

<details>

<summary>kerbrute -h</summary>

```bash
┌──(kali㉿kali)-[~/Tools]
└─$ ./kerbrute_linux_amd64 -h    

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 03/20/26 - Ronnie Flathers @ropnop

This tool is designed to assist in quickly bruteforcing valid Active Directory accounts through Kerberos Pre-Authentication.
It is designed to be used on an internal Windows domain with access to one of the Domain Controllers.
Warning: failed Kerberos Pre-Auth counts as a failed login and WILL lock out accounts

Usage:
  kerbrute [command]

Available Commands:
  bruteforce    Bruteforce username:password combos, from a file or stdin
  bruteuser     Bruteforce a single user's password from a wordlist
  help          Help about any command
  passwordspray Test a single password against a list of users
  userenum      Enumerate valid domain usernames via Kerberos
  version       Display version info and quit

Flags:
      --dc string       The location of the Domain Controller (KDC) to target. If blank, will lookup via DNS
      --delay int       Delay in millisecond between each attempt. Will always use single thread if set
  -d, --domain string   The full domain to use (e.g. contoso.com)
  -h, --help            help for kerbrute
  -o, --output string   File to write logs to. Optional.
      --safe            Safe mode. Will abort if any user comes back as locked out. Default: FALSE
  -t, --threads int     Threads to use (default 10)
  -v, --verbose         Log failures and errors

Use "kerbrute [command] --help" for more information about a command.

```

</details>

<details>

<summary>kerbrute userenum -h</summary>

```bash
┌──(kali㉿kali)-[~/Tools]
└─$ ./kerbrute_linux_amd64 userenum -h

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 03/20/26 - Ronnie Flathers @ropnop

Will enumerate valid usernames from a list by constructing AS-REQs to requesting a TGT from the KDC.
If no domain controller is specified, the tool will attempt to look one up via DNS SRV records.
A full domain is required. This domain will be capitalized and used as the Kerberos realm when attempting the bruteforce.
Valid usernames will be displayed on stdout.

Usage:
  kerbrute userenum [flags] <username_wordlist>

Flags:
  -h, --help   help for userenum

Global Flags:
      --dc string       The location of the Domain Controller (KDC) to target. If blank, will lookup via DNS
      --delay int       Delay in millisecond between each attempt. Will always use single thread if set
  -d, --domain string   The full domain to use (e.g. contoso.com)
  -o, --output string   File to write logs to. Optional.
      --safe            Safe mode. Will abort if any user comes back as locked out. Default: FALSE
  -t, --threads int     Threads to use (default 10)
  -v, --verbose         Log failures and errors

```

</details>

### Enumeration with nmap (`krb5-enum-users`)

To enumerate which users **from a list of potential users** with nmap's [krb5-enum-users](https://nmap.org/nsedoc/scripts/krb5-enum-users.html) script

```bash
nmap -p 88 --script krb5-enum-users $TARGET_IP --script-args krb5-enum-users.realm='spookysec.local',userdb='./userlist.txt' 
```

Note that you need to specify the domain/realm manually and this method is **much slower than Kerbrute**!

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Challenges/Medium/Attacktive_Directory]
└─$ nmap -p 88 --script krb5-enum-users $TARGET_IP --script-args krb5-enum-users.realm='spookysec.local',userdb='./userlist.txt' 
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-27 17:40 +0200
Stats: 0:09:25 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 24.10% done; ETC: 18:19 (0:29:39 remaining)
Stats: 0:20:34 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 53.48% done; ETC: 18:18 (0:17:53 remaining)
Nmap scan report for 10.112.162.144
Host is up (0.024s latency).

PORT   STATE SERVICE
88/tcp open  kerberos-sec
| krb5-enum-users: 
| Discovered Kerberos principals
|     DARKSTAR@spookysec.local
|     darkstar@spookysec.local
|     JAMES@spookysec.local
|     james@spookysec.local
|     Darkstar@spookysec.local
|     James@spookysec.local
|     ROBIN@spookysec.local
|     svc-admin@spookysec.local
|     paradox@spookysec.local
|     Robin@spookysec.local
|     robin@spookysec.local
|     Administrator@spookysec.local
|     administrator@spookysec.local
|     ori@spookysec.local
|     Paradox@spookysec.local
|_    backup@spookysec.local

Nmap done: 1 IP address (1 host up) scanned in 1710.31 seconds

```

</details>

## Enumeration via LDAP

### Enumeration with Impacket

#### Enumeration with GetADUsers.py

The [GetADUsers.py](https://github.com/fortra/impacket/blob/impacket_0_13_0/examples/GetADUsers.py) script will gather data about the domain’s users and their corresponding email addresses. It will also include some extra information about last logon and last password set attributes.

```bash
impacket-GetADUsers -dc-ip $TARGET_IP 'CORP.COM/stephanie:LegmanTeamBenzoin!!'
```

Add `--all` to return all users, including those with no email addresses and disabled accounts. When used with `-user` it will return user's info even if the account is disabled.

### Enumeration with ldapsearch

List the most useful/common attributes only

```bash
ldapsearch -x -H ldap://$TARGET_IP -D 'user@domain.local' -w 'Password' -b "DC=domain,DC=local" '(&(objectCategory=person)(objectClass=user))' samaccountname distinguishedname title description lastlogon memberof
```

List all attributes

```bash
ldapsearch -x -H ldap://$TARGET_IP -D 'user@domain.local' -w 'Password' -b "DC=domain,DC=local" '(&(objectCategory=person)(objectClass=user))'
```

#### Usage information

<details>

<summary>ldapsearch -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ ldapsearch -h                    
ldapsearch: invalid option -- 'h'
ldapsearch: unrecognized option -h
usage: ldapsearch [options] [filter [attributes...]]
where:
  filter        RFC 4515 compliant LDAP search filter
  attributes    whitespace-separated list of attribute descriptions
    which may include:
      1.1   no attributes
      *     all user attributes
      +     all operational attributes
Search options:
  -a deref   one of never (default), always, search, or find
  -A         retrieve attribute names only (no values)
  -b basedn  base dn for search
  -c         continuous operation mode (do not stop on errors)
  -E [!]<ext>[=<extparam>] search extensions (! indicates criticality)
             [!]accountUsability         (NetScape Account usability)
             [!]domainScope              (domain scope)
             !dontUseCopy                (Don't Use Copy)
             [!]mv=<filter>              (RFC 3876 matched values filter)
             [!]pr=<size>[/prompt|noprompt] (RFC 2696 paged results/prompt)
             [!]ps=<changetypes>/<changesonly>/<echg> (draft persistent search)
             [!]sss=[-]<attr[:OID]>[/[-]<attr[:OID]>...]
                                         (RFC 2891 server side sorting)
             [!]subentries[=true|false]  (RFC 3672 subentries)
             [!]sync=ro[/<cookie>]       (RFC 4533 LDAP Sync refreshOnly)
                     rp[/<cookie>][/<slimit>] (refreshAndPersist)
             [!]vlv=<before>/<after>(/<offset>/<count>|:<value>)
                                         (ldapv3-vlv-09 virtual list views)
             [!]deref=derefAttr:attr[,...][;derefAttr:attr[,...][;...]]
             !dirSync=<flags>/<maxAttrCount>[/<cookie>]
                                         (MS AD DirSync)
             [!]extendedDn=<flag>        (MS AD Extended DN
             [!]showDeleted              (MS AD Show Deleted)
             [!]serverNotif              (MS AD Server Notification)
             [!]<oid>[=:<value>|::<b64value>] (generic control; no response handling)
  -f file    read operations from `file'
  -F prefix  URL prefix for files (default: file:///tmp/)
  -l limit   time limit (in seconds, or "none" or "max") for search
  -L         print responses in LDIFv1 format
  -LL        print responses in LDIF format without comments
  -LLL       print responses in LDIF format without comments
             and version
  -M         enable Manage DSA IT control (-MM to make critical)
  -P version protocol version (default: 3)
  -s scope   one of base, one, sub or children (search scope)
  -S attr    sort the results by attribute `attr'
  -t         write binary values to files in temporary directory
  -tt        write all values to files in temporary directory
  -T path    write files to directory specified by path (default: /tmp)
  -u         include User Friendly entry names in the output
  -z limit   size limit (in entries, or "none" or "max") for search
Common options:
  -d level   set LDAP debugging level to `level'
  -D binddn  bind DN
  -e [!]<ext>[=<extparam>] general extensions (! indicates criticality)
             [!]assert=<filter>     (RFC 4528; a RFC 4515 Filter string)
             [!]authzid=<authzid>   (RFC 4370; "dn:<dn>" or "u:<user>")
             [!]bauthzid            (RFC 3829)
             [!]chaining[=<resolveBehavior>[/<continuationBehavior>]]
                     one of "chainingPreferred", "chainingRequired",
                     "referralsPreferred", "referralsRequired"
             [!]manageDSAit         (RFC 3296)
             [!]noop
             ppolicy
             [!]postread[=<attrs>]  (RFC 4527; comma-separated attr list)
             [!]preread[=<attrs>]   (RFC 4527; comma-separated attr list)
             [!]relax
             [!]sessiontracking[=<username>]
             abandon, cancel, ignore (SIGINT sends abandon/cancel,
             or ignores response; if critical, doesn't wait for SIGINT.
             not really controls)
  -H URI     LDAP Uniform Resource Identifier(s)
  -I         use SASL Interactive mode
  -n         show what would be done but don't actually do it
  -N         do not use reverse DNS to canonicalize SASL host name
  -O props   SASL security properties
  -o <opt>[=<optparam>] any libldap ldap.conf options, plus
             ldif_wrap=<width> (in columns, or "no" for no wrapping)
             nettimeout=<timeout> (in seconds, or "none" or "max")
  -Q         use SASL Quiet mode
  -R realm   SASL realm
  -U authcid SASL authentication identity
  -v         run in verbose mode (diagnostics to standard output)
  -V         print version info (-VV only)
  -w passwd  bind password (for simple authentication)
  -W         prompt for bind password
  -x         Simple authentication
  -X authzid SASL authorization identity ("dn:<dn>" or "u:<user>")
  -y file    Read password from file
  -Y mech    SASL mechanism
  -Z         Start TLS request (-ZZ to require successful response)

```

</details>

### Enumeration with net command from Samba

To list users via LDAP

```bash
net ads user -U domain.local/user%'Password' -S $TARGET_IP
```

Note that `%` is used as delimiter instead of `:` as in Impacket!

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ net ads user -U corp.com/jeff%'HenchmanPutridBonbon11' -S $TARGET_IP
Administrator
Guest
krbtgt
dave
stephanie
jeff
jeffadmin
iis_service
pete
jen
```

</details>

#### Usage information

<details>

<summary>net help user</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ net help user

net [<method>] user [misc. options] [targets]
        List users

net [<method>] user DELETE <name> [misc. options] [targets]
        Delete specified user

net [<method>] user INFO <name> [misc. options] [targets]
        List the domain groups of the specified user

net [<method>] user ADD <name> [password] [-c container] [-F user flags] [misc. options] [targets]
        Add specified user

net [<method>] user RENAME <oldusername> <newusername> [targets]
        Rename specified user

Valid methods: (auto-detected if not specified)
        ads                             Active Directory (LDAP/Kerberos)
        rpc                             DCE-RPC
        rap                             RAP (older systems)

Valid targets: choose one (none defaults to localhost)
        -S|--server=<server>                    server name
        -I|--ipaddress=<ipaddr>                 address of target server
        -w|--target-workgroup=<wg>              target workgroup or domain

Valid misc options are:
        -p|--port=<port>                        connection port on target
        --myname=<name>                         client name
        --long                                  Display full information

Valid common options are:
        -d|--debuglevel=<level>                 debug level (0-10)
        --debug-stdout                          Send debug output to standard output
        --configfile=<path>                     pathname of smb.conf file
        --option=name=value                     Set smb.conf option from command line
        -l|--log-basename=LOGFILEBASE           Basename for log/debug files
        --leak-report                           enable talloc leak reporting on exit
        --leak-report-full                      enable full talloc leak reporting on exit
        -V|--version                            Print samba version information

Valid connection options are:
        -R|--name-resolve=NAME-RESOLVE-ORDER    Use these name resolution services only
        -O|--socket-options=SOCKETOPTIONS       socket options to use
        -m|--max-protocol=MAXPROTOCOL           Set max protocol level
        -n|--netbiosname=NETBIOSNAME            Primary netbios name
        --netbios-scope=SCOPE                   Use this Netbios scope
        -W|--workgroup=WORKGROUP                Set the workgroup name
        --realm=REALM                           Set the realm name

Valid credential options are:
        -U|--user=[DOMAIN/]USERNAME[%PASSWORD]  Set the network username
        -N|--no-pass                            Don't ask for a password
        --password=STRING                       Set a password
        --pw-nt-hash                            The supplied password is the NT hash
        -A|--authentication-file=FILE           Get the credentials from a file
        -P|--machine-pass                       Use stored machine account password
        --simple-bind-dn=DN                     DN to use for a simple bind
        --use-kerberos=desired|required|off     Use kerberos authentication
        --use-krb5-ccache=CCACHE                Credentials cache location for Kerberos
        --use-winbind-ccache                    Use the winbind ccache for authentication
        --client-protection=sign|encrypt|off    Configure used protection for client connections
        -C or --comment=<comment>       descriptive comment (for add only)
        -c or --container=<container>   LDAP container, defaults to cn=Users (for add in ADS only)

```

</details>

### Enumeration with NetExec

To enumerate all domain users with `nxc` over LDAP

```bash
nxc ldap $TARGET_IP -u '<username>' -p '<password>' --users
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ nxc ldap $TARGET_IP -u 'stephanie' -p 'LegmanTeamBenzoin!!' --users                            
LDAP        192.168.210.70  389    DC1              [*] Windows Server 2022 Build 20348 (name:DC1) (domain:corp.com) (signing:None) (channel binding:No TLS cert) 
LDAP        192.168.210.70  389    DC1              [+] corp.com\stephanie:LegmanTeamBenzoin!! 
LDAP        192.168.210.70  389    DC1              [*] Enumerated 13 domain users: corp.com
LDAP        192.168.210.70  389    DC1              -Username-                    -Last PW Set-       -BadPW-  -Description-                                               
LDAP        192.168.210.70  389    DC1              Administrator                 2022-08-17 02:27:22 0        Built-in account for administering the computer/domain      
LDAP        192.168.210.70  389    DC1              Guest                         <never>             0        Built-in account for guest access to the computer/domain    
LDAP        192.168.210.70  389    DC1              krbtgt                        2022-09-03 01:10:48 0        Key Distribution Center Service Account                     
LDAP        192.168.210.70  389    DC1              dave                          2022-09-07 18:54:57 0                                                                    
LDAP        192.168.210.70  389    DC1              stephanie                     2022-09-03 01:23:38 0                                                                    
LDAP        192.168.210.70  389    DC1              jeff                          2022-09-03 01:27:20 0                                                                    
LDAP        192.168.210.70  389    DC1              jeffadmin                     2022-09-03 01:26:48 0                                                                    
LDAP        192.168.210.70  389    DC1              iis_service                   2022-09-07 14:38:43 0                                                                    
LDAP        192.168.210.70  389    DC1              pete                          2022-09-06 21:41:54 0                                                                    
LDAP        192.168.210.70  389    DC1              jen                           2022-09-06 21:43:01 0                                                                    
LDAP        192.168.210.70  389    DC1              robert                        2026-04-15 10:30:40 0                                                                    
LDAP        192.168.210.70  389    DC1              christina                     2026-04-15 10:30:40 0                                                                    
LDAP        192.168.210.70  389    DC1              bethany                       2026-04-15 10:30:40 0   
```

</details>

To create a file called `users.txt` with the result we can

```bash
nxc ldap $TARGET_IP -u '<username>' -p '<password>' --users | grep -vE '[+]|[*]|-User' | awk '{print $5}' > users.txt
```

## Enumeration via SMB and RPC/DCE

### Enumeration with enum4linux-ng

To get detailed information for users via RPC, unauthenticated

```bash
enum4linux-ng -U -d $TARGET_IP
```

Authenticated

```bash
enum4linux-ng -U -d -u user -p 'password' $TARGET_IP
```

### Enumeration with Impacket

#### Enumeration with lookupsid.py

To enumerate domain users and groups with [lookupsid.py](https://github.com/fortra/impacket/blob/impacket_0_13_0/examples/lookupsid.py). The enumeration is done by RID brute forcing.

As Guest user

```bash
impacket-lookupsid Guest:@$TARGET_IP -no-pass
```

With credentials

```bash
impacket-lookupsid 'stephanie:LegmanTeamBenzoin!!'@$TARGET_IP
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ impacket-lookupsid 'stephanie:LegmanTeamBenzoin!!'@$TARGET_IP
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Brute forcing SIDs at 192.168.210.70
[*] StringBinding ncacn_np:192.168.210.70[\pipe\lsarpc]
[*] Domain SID is: S-1-5-21-1987370270-658905905-1781884369
498: CORP\Enterprise Read-only Domain Controllers (SidTypeGroup)
500: CORP\Administrator (SidTypeUser)
501: CORP\Guest (SidTypeUser)
502: CORP\krbtgt (SidTypeUser)
512: CORP\Domain Admins (SidTypeGroup)
513: CORP\Domain Users (SidTypeGroup)
514: CORP\Domain Guests (SidTypeGroup)
515: CORP\Domain Computers (SidTypeGroup)
516: CORP\Domain Controllers (SidTypeGroup)
517: CORP\Cert Publishers (SidTypeAlias)
518: CORP\Schema Admins (SidTypeGroup)
519: CORP\Enterprise Admins (SidTypeGroup)
520: CORP\Group Policy Creator Owners (SidTypeGroup)
521: CORP\Read-only Domain Controllers (SidTypeGroup)
522: CORP\Cloneable Domain Controllers (SidTypeGroup)
525: CORP\Protected Users (SidTypeGroup)
526: CORP\Key Admins (SidTypeGroup)
527: CORP\Enterprise Key Admins (SidTypeGroup)
553: CORP\RAS and IAS Servers (SidTypeAlias)
571: CORP\Allowed RODC Password Replication Group (SidTypeAlias)
572: CORP\Denied RODC Password Replication Group (SidTypeAlias)
1000: CORP\DC1$ (SidTypeUser)
1101: CORP\DnsAdmins (SidTypeAlias)
1102: CORP\DnsUpdateProxy (SidTypeGroup)
1103: CORP\dave (SidTypeUser)
1104: CORP\stephanie (SidTypeUser)
1105: CORP\jeff (SidTypeUser)
1106: CORP\jeffadmin (SidTypeUser)
1109: CORP\iis_service (SidTypeUser)
1112: CORP\WEB04$ (SidTypeUser)
1118: CORP\FILES04$ (SidTypeUser)
1121: CORP\CLIENT74$ (SidTypeUser)
1122: CORP\CLIENT75$ (SidTypeUser)
1123: CORP\pete (SidTypeUser)
1124: CORP\jen (SidTypeUser)
1125: CORP\Sales Department (SidTypeGroup)
1126: CORP\Management Department (SidTypeGroup)
1127: CORP\Development Department (SidTypeGroup)
1128: CORP\Debug (SidTypeGroup)
1129: CORP\CLIENT76$ (SidTypeUser)
```

</details>

#### Enumeration with net.py

[net.py](https://github.com/fortra/impacket/blob/impacket_0_13_0/examples/net.py) is an Impacket alternative for windows net.exe commandline utility. Thanks to RPC protocol, this tool is making net.exe functionalities available from remote computer.

To enumerate all domain/local user accounts

```bash
impacket-net domain.local/user:password@$TARGET_IP user
```

#### Enumeration with samrdump.py

[samrdump.py](https://github.com/fortra/impacket/blob/impacket_0_13_0/examples/samrdump.py) is an application that communicates with the Security Account Manager Remote interface from the MSRPC suite. It lists system user accounts, available resource shares and other sensitive information exported through this service.

```bash
impacket-samrdump domain.local/user:password@$TARGET_IP
```

### Enumeration with net command from Samba

To list users via DCE/RPC

```bash
net rpc user -U domain.local/user%'Password' -S $TARGET_IP
```

Note that `%` is used as delimiter instead of `:` as in Impacket!

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ net rpc user -U corp.com/jeff%'HenchmanPutridBonbon11' -S $TARGET_IP
Administrator
dave
Guest
iis_service
jeff
jeffadmin
jen
krbtgt
pete
stephanie
```

</details>

#### Usage information

<details>

<summary>net help user</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ net help user

net [<method>] user [misc. options] [targets]
        List users

net [<method>] user DELETE <name> [misc. options] [targets]
        Delete specified user

net [<method>] user INFO <name> [misc. options] [targets]
        List the domain groups of the specified user

net [<method>] user ADD <name> [password] [-c container] [-F user flags] [misc. options] [targets]
        Add specified user

net [<method>] user RENAME <oldusername> <newusername> [targets]
        Rename specified user

Valid methods: (auto-detected if not specified)
        ads                             Active Directory (LDAP/Kerberos)
        rpc                             DCE-RPC
        rap                             RAP (older systems)

Valid targets: choose one (none defaults to localhost)
        -S|--server=<server>                    server name
        -I|--ipaddress=<ipaddr>                 address of target server
        -w|--target-workgroup=<wg>              target workgroup or domain

Valid misc options are:
        -p|--port=<port>                        connection port on target
        --myname=<name>                         client name
        --long                                  Display full information

Valid common options are:
        -d|--debuglevel=<level>                 debug level (0-10)
        --debug-stdout                          Send debug output to standard output
        --configfile=<path>                     pathname of smb.conf file
        --option=name=value                     Set smb.conf option from command line
        -l|--log-basename=LOGFILEBASE           Basename for log/debug files
        --leak-report                           enable talloc leak reporting on exit
        --leak-report-full                      enable full talloc leak reporting on exit
        -V|--version                            Print samba version information

Valid connection options are:
        -R|--name-resolve=NAME-RESOLVE-ORDER    Use these name resolution services only
        -O|--socket-options=SOCKETOPTIONS       socket options to use
        -m|--max-protocol=MAXPROTOCOL           Set max protocol level
        -n|--netbiosname=NETBIOSNAME            Primary netbios name
        --netbios-scope=SCOPE                   Use this Netbios scope
        -W|--workgroup=WORKGROUP                Set the workgroup name
        --realm=REALM                           Set the realm name

Valid credential options are:
        -U|--user=[DOMAIN/]USERNAME[%PASSWORD]  Set the network username
        -N|--no-pass                            Don't ask for a password
        --password=STRING                       Set a password
        --pw-nt-hash                            The supplied password is the NT hash
        -A|--authentication-file=FILE           Get the credentials from a file
        -P|--machine-pass                       Use stored machine account password
        --simple-bind-dn=DN                     DN to use for a simple bind
        --use-kerberos=desired|required|off     Use kerberos authentication
        --use-krb5-ccache=CCACHE                Credentials cache location for Kerberos
        --use-winbind-ccache                    Use the winbind ccache for authentication
        --client-protection=sign|encrypt|off    Configure used protection for client connections
        -C or --comment=<comment>       descriptive comment (for add only)
        -c or --container=<container>   LDAP container, defaults to cn=Users (for add in ADS only)

```

</details>

### Enumeration with NetExec

#### Enumerating Domain Users

To enumerate all domain users

```bash
nxc smb $TARGET_IP -u <user> -p '<password>' --users
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ nxc smb $TARGET_IP -u 'stephanie' -p 'LegmanTeamBenzoin!!' --users                                           
SMB         192.168.210.70  445    DC1              [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domain:corp.com) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         192.168.210.70  445    DC1              [+] corp.com\stephanie:LegmanTeamBenzoin!! 
SMB         192.168.210.70  445    DC1              -Username-                    -Last PW Set-       -BadPW- -Description-                                               
SMB         192.168.210.70  445    DC1              Administrator                 2022-08-17 00:27:22 0       Built-in account for administering the computer/domain 
SMB         192.168.210.70  445    DC1              Guest                         <never>             0       Built-in account for guest access to the computer/domain 
SMB         192.168.210.70  445    DC1              krbtgt                        2022-09-02 23:10:48 0       Key Distribution Center Service Account 
SMB         192.168.210.70  445    DC1              dave                          2022-09-07 16:54:57 0        
SMB         192.168.210.70  445    DC1              stephanie                     2022-09-02 23:23:38 0        
SMB         192.168.210.70  445    DC1              jeff                          2022-09-02 23:27:20 0        
SMB         192.168.210.70  445    DC1              jeffadmin                     2022-09-02 23:26:48 0        
SMB         192.168.210.70  445    DC1              iis_service                   2022-09-07 12:38:43 0        
SMB         192.168.210.70  445    DC1              pete                          2022-09-06 19:41:54 0        
SMB         192.168.210.70  445    DC1              jen                           2022-09-06 19:43:01 0        
SMB         192.168.210.70  445    DC1              robert                        2026-04-15 08:30:40 0        
SMB         192.168.210.70  445    DC1              christina                     2026-04-15 08:30:40 0        
SMB         192.168.210.70  445    DC1              bethany                       2026-04-15 08:30:40 0        
SMB         192.168.210.70  445    DC1              [*] Enumerated 13 local users: CORP
```

</details>

To create a file called `users.txt` with the result we can

```bash
nxc smb $TARGET_IP -u <user> -p '<password>' --users | grep -vE '[+]|[*]|-User' | awk '{print $5}' > users.txt
```

#### Enumerating Logged-on Users

To enumerate logged-on users

```bash
nxc smb $TARGET_IP -u Administrator -p '' --loggedon-users
```

#### Enumerating Users by RID-bruteforcing

To enumerate users by brute forcing [RIDs](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers#well-known-sids)

```bash
nxc smb $TARGET_IP -u Guest -p '' --rid-brute
```

To enumerate users by brute forcing RIDs with specified max RID. Default max is 4000.

```bash
nxc smb $TARGET_IP -u Guest -p '' --rid-brute 2000
```

#### Usage information

<details>

<summary>nxc -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ nxc -h
usage: nxc [-h] [--version] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--no-progress] [--log LOG] [--verbose | --debug] [-6] [--dns-server DNS_SERVER] [--dns-tcp]
           [--dns-timeout DNS_TIMEOUT]
           {smb,ftp,rdp,ssh,wmi,winrm,mssql,vnc,nfs,ldap} ...

     .   .
    .|   |.     _   _          _     _____
    ||   ||    | \ | |   ___  | |_  | ____| __  __   ___    ___
    \\( )//    |  \| |  / _ \ | __| |  _|   \ \/ /  / _ \  / __|
    .=[ ]=.    | |\  | |  __/ | |_  | |___   >  <  |  __/ | (__
   / /˙-˙\ \   |_| \_|  \___|  \__| |_____| /_/\_\  \___|  \___|
   ˙ \   / ˙
     ˙   ˙

    The network execution tool
    Maintained as an open source project by @NeffIsBack, @MJHallenbeck, @_zblurx

    For documentation and usage examples, visit: https://www.netexec.wiki/

    Version : 1.5.1
    Codename: Yippie-Ki-Yay
    Commit  : Kali Linux
    

options:
  -h, --help            show this help message and exit

Generic Options:
  --version             Display nxc version
  -t, --threads THREADS
                        set how many concurrent threads to use
  --timeout TIMEOUT     max timeout in seconds of each thread
  --jitter INTERVAL     sets a random delay between each authentication

Output Options:
  --no-progress         do not displaying progress bar during scan
  --log LOG             export result into a custom file
  --verbose             enable verbose output
  --debug               enable debug level information

DNS:
  -6                    Enable force IPv6
  --dns-server DNS_SERVER
                        Specify DNS server (default: Use hosts file & System DNS)
  --dns-tcp             Use TCP instead of UDP for DNS queries
  --dns-timeout DNS_TIMEOUT
                        DNS query timeout in seconds

Available Protocols:
  {smb,ftp,rdp,ssh,wmi,winrm,mssql,vnc,nfs,ldap}
    smb                 own stuff using SMB
    ftp                 own stuff using FTP
    rdp                 own stuff using RDP
    ssh                 own stuff using SSH
    wmi                 own stuff using WMI
    winrm               own stuff using WINRM
    mssql               own stuff using MSSQL
    vnc                 own stuff using VNC
    nfs                 own stuff using NFS
    ldap                own stuff using LDAP

```

</details>

<details>

<summary>nxc smb -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ nxc smb -h
usage: nxc smb [-h] [--version] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--no-progress] [--log LOG] [--verbose | --debug] [-6] [--dns-server DNS_SERVER] [--dns-tcp]
               [--dns-timeout DNS_TIMEOUT] [-u USERNAME [USERNAME ...]] [-p PASSWORD [PASSWORD ...]] [-id CRED_ID [CRED_ID ...]] [--ignore-pw-decoding] [--no-bruteforce]
               [--continue-on-success] [--gfail-limit LIMIT] [--ufail-limit LIMIT] [--fail-limit LIMIT] [-k] [--use-kcache] [--aesKey AESKEY [AESKEY ...]] [--kdcHost KDCHOST]
               [--pfx-cert PFXCERT] [--pfx-base64 PFXB64] [--pfx-pass PFXPASS] [--pem-cert PEMCERT] [--pem-key PEMKEY] [-M MODULE] [-o MODULE_OPTION [MODULE_OPTION ...]] [-L [LIST_MODULES]]
               [--options] [-H HASH [HASH ...]] [--delegate DELEGATE] [--delegate-spn DELEGATE_SPN] [--generate-st GENERATE_ST] [--self] [-d DOMAIN | --local-auth] [--port PORT]
               [--share SHARE] [--smb-server-port SMB_SERVER_PORT] [--no-smbv1] [--no-admin-check] [--gen-relay-list OUTPUT_FILE] [--smb-timeout SMB_TIMEOUT] [--laps [LAPS]]
               [--generate-hosts-file GENERATE_HOSTS_FILE] [--generate-krb5-file GENERATE_KRB5_FILE] [--generate-tgt GENERATE_TGT] [--sam [{secdump,regdump}]] [--lsa [{secdump,regdump}]]
               [--ntds [{vss,drsuapi}]] [--kerberos-keys] [--history | --enabled] [--user USERNTDS] [--dpapi [{nosystem,cookies} ...]] [--sccm [{disk,wmi}]] [--mkfile MKFILE] [--pvk PVK]
               [--list-snapshots [LIST_SNAPSHOTS]] [--shares [SHARES]] [--exclude-shares EXCLUDE_SHARES [EXCLUDE_SHARES ...]] [--dir [DIR]] [--interfaces] [--no-write-check]
               [--filter-shares FILTER_SHARES [FILTER_SHARES ...]] [--disks] [--users [USER ...]] [--users-export USERS_EXPORT] [--groups [GROUP]] [--local-groups [GROUP]]
               [--computers [COMPUTER]] [--pass-pol] [--rid-brute [MAX_RID]] [--smb-sessions] [--reg-sessions [REG_SESSIONS]] [--loggedon-users [LOGGEDON_USERS]]
               [--loggedon-users-filter LOGGEDON_USERS_FILTER] [--qwinsta [QWINSTA]] [--tasklist [TASKLIST]] [--taskkill TASKKILL] [--wmi-query QUERY] [--wmi-namespace NAMESPACE]
               [--spider SHARE] [--spider-folder FOLDER] [--content] [--exclude-dirs DIR_LIST] [--depth DEPTH] [--only-files] [--silent] [--pattern PATTERN [PATTERN ...] |
               --regex REGEX [REGEX ...]] [--put-file FILE FILE] [--get-file FILE FILE] [--append-host] [--exec-method {wmiexec,atexec,smbexec,mmcexec}] [--dcom-timeout DCOM_TIMEOUT]
               [--get-output-tries GET_OUTPUT_TRIES] [--codec CODEC] [--no-output] [-x COMMAND | -X PS_COMMAND] [--obfs] [--amsi-bypass FILE] [--clear-obfscripts] [--force-ps32] [--no-encode]
               target [target ...]

positional arguments:
  target                the target IP(s), range(s), CIDR(s), hostname(s), FQDN(s), file(s) containing a list of targets, NMap XML or .Nessus file(s)

options:
  -h, --help            show this help message and exit
  -H, --hash HASH [HASH ...]
                        NTLM hash(es) or file(s) containing NTLM hashes
  --delegate DELEGATE   Impersonate user with S4U2Self + S4U2Proxy
  --delegate-spn DELEGATE_SPN
                        SPN to use for S4U2Proxy, if not specified the SPN used will be cifs/<target>
  --generate-st GENERATE_ST
                        Store the S4U Service Ticket in the specified file
  --self                Only do S4U2Self, no S4U2Proxy (use with delegate)
  -d, --domain DOMAIN   domain to authenticate to
  --local-auth          authenticate locally to each target
  --port PORT           SMB port (default: 445)
  --share SHARE         specify a share (default: C$)
  --smb-server-port SMB_SERVER_PORT
                        specify a server port for SMB (default: 445)
  --no-smbv1            Force to disable SMBv1 in connection
  --no-admin-check      Avoid checking admin which queries the Service Control Manager
  --gen-relay-list OUTPUT_FILE
                        outputs all hosts that don't require SMB signing to the specified file
  --smb-timeout SMB_TIMEOUT
                        SMB connection timeout (default: 2)
  --laps [LAPS]         LAPS authentification
  --generate-hosts-file GENERATE_HOSTS_FILE
                        Generate a hosts file like from a range of IP
  --generate-krb5-file GENERATE_KRB5_FILE
                        Generate a krb5 file like from a range of IP
  --generate-tgt GENERATE_TGT
                        Generate a tgt ticket

Generic Options:
  --version             Display nxc version
  -t, --threads THREADS
                        set how many concurrent threads to use (default: 256)
  --timeout TIMEOUT     max timeout in seconds of each thread
  --jitter INTERVAL     sets a random delay between each authentication

Output Options:
  --no-progress         do not displaying progress bar during scan
  --log LOG             export result into a custom file
  --verbose             enable verbose output
  --debug               enable debug level information

DNS:
  -6                    Enable force IPv6
  --dns-server DNS_SERVER
                        Specify DNS server (default: Use hosts file & System DNS)
  --dns-tcp             Use TCP instead of UDP for DNS queries
  --dns-timeout DNS_TIMEOUT
                        DNS query timeout in seconds (default: 3)

Authentication:
  -u, --username USERNAME [USERNAME ...]
                        username(s) or file(s) containing usernames
  -p, --password PASSWORD [PASSWORD ...]
                        password(s) or file(s) containing passwords
  -id CRED_ID [CRED_ID ...]
                        database credential ID(s) to use for authentication
  --ignore-pw-decoding  Ignore non UTF-8 characters when decoding the password file
  --no-bruteforce       No spray when using file for username and password (user1 => password1, user2 => password2)
  --continue-on-success
                        continues authentication attempts even after successes
  --gfail-limit LIMIT   max number of global failed login attempts
  --ufail-limit LIMIT   max number of failed login attempts per username
  --fail-limit LIMIT    max number of failed login attempts per host

Kerberos Authentication:
  -k, --kerberos        Use Kerberos authentication
  --use-kcache          Use Kerberos authentication from ccache file (KRB5CCNAME)
  --aesKey AESKEY [AESKEY ...]
                        AES key to use for Kerberos Authentication (128 or 256 bits)
  --kdcHost KDCHOST     FQDN of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter

Certificate Authentication:
  --pfx-cert PFXCERT    Use certificate authentication from pfx file .pfx
  --pfx-base64 PFXB64   Use certificate authentication from pfx file encoded in base64
  --pfx-pass PFXPASS    Password of the pfx certificate
  --pem-cert PEMCERT    Use certificate authentication from PEM file
  --pem-key PEMKEY      Private key for the PEM format

Modules:
  -M, --module MODULE   module to use
  -o MODULE_OPTION [MODULE_OPTION ...]
                        module options
  -L, --list-modules [LIST_MODULES]
                        list available modules
  --options             display module options

Credential Gathering:
  --sam [{secdump,regdump}]
                        dump SAM hashes from target systems
  --lsa [{secdump,regdump}]
                        dump LSA secrets from target systems
  --ntds [{vss,drsuapi}]
                        dump the NTDS.dit from target DCs using the specifed method
  --kerberos-keys       Also dump Kerberos AES and DES keys from target DC (NTDS.dit)
  --history             Also retrieve password history from target DC (NTDS.dit)
  --enabled             Only dump enabled targets from DC (NTDS.dit)
  --user USERNTDS       Dump selected user from DC (NTDS.dit)
  --dpapi [{nosystem,cookies} ...]
                        dump DPAPI secrets from target systems, can dump cookies if you add 'cookies', will not dump SYSTEM dpapi if you add nosystem
  --sccm [{disk,wmi}]   dump SCCM secrets from target systems
  --mkfile MKFILE       DPAPI option. File with masterkeys in form of {GUID}:SHA1
  --pvk PVK             DPAPI option. File with domain backupkey
  --list-snapshots [LIST_SNAPSHOTS]
                        Lists the VSS snapshots (default: ADMIN$)

Mapping/Enumeration:
  --shares [SHARES]     Enumerate shares and access, filter on specified argument (read ; write ; read,write)
  --exclude-shares EXCLUDE_SHARES [EXCLUDE_SHARES ...]
                        List of shares to exclude from enumeration (e.g., C$ Admin$ IPC$)
  --dir [DIR]           List the content of a path (default path: '')
  --interfaces          Enumerate network interfaces
  --no-write-check      Skip write check on shares (avoid leaving traces when missing delete permissions)
  --filter-shares FILTER_SHARES [FILTER_SHARES ...]
                        Filter share by access, option 'READ' 'WRITE' or 'READ,WRITE'
  --disks               Enumerate disks
  --users [USER ...]    Enumerate domain users, if a user is specified than only its information is queried.
  --users-export USERS_EXPORT
                        Enumerate domain users and export them to the specified file
  --groups [GROUP]      Enumerate domain groups, if a group is specified than its members are Enumerated
  --local-groups [GROUP]
                        Enumerate local groups, if a group is specified then its members are Enumerated
  --computers [COMPUTER]
                        Enumerate computer users
  --pass-pol            dump password policy
  --rid-brute [MAX_RID]
                        Enumerate users by bruteforcing RIDs
  --smb-sessions        Enumerate active smb sessions
  --reg-sessions [REG_SESSIONS]
                        Enumerate users sessions using the Remote Registry. If a username is given, filter for it. If a file is given, filter for listed usernames. If no value is given, list
                        all.
  --loggedon-users [LOGGEDON_USERS]
                        Enumerate logged on users, if a user is specified than a regex filter is applied.
  --loggedon-users-filter LOGGEDON_USERS_FILTER
                        only search for specific user, works with regex
  --qwinsta [QWINSTA]   Enumerate user sessions. If a username is given, filter for it; if a file is given, filter for listed usernames. If no value is given, list all.
  --tasklist [TASKLIST]
                        Enumerate running processes and filter for the specified one if specified
  --taskkill TASKKILL   Kills a specific PID or a proces name's PID's

WMI Queries:
  --wmi-query QUERY     Issues the specified WMI query
  --wmi-namespace NAMESPACE
                        WMI Namespace (default: root\cimv2)

Spidering Shares:
  --spider SHARE        share to spider
  --spider-folder FOLDER
                        folder to spider (default: .)
  --content             enable file content searching
  --exclude-dirs DIR_LIST
                        directories to exclude from spidering
  --depth DEPTH         max spider recursion depth
  --only-files          only spider files
  --silent              Do not print found files/directories
  --pattern PATTERN [PATTERN ...]
                        pattern(s) to search for in folders, filenames and file content
  --regex REGEX [REGEX ...]
                        regex(s) to search for in folders, filenames and file content

File Operations:
  --put-file FILE FILE  Put a local file into remote target, ex: whoami.txt \\Windows\\Temp\\whoami.txt
  --get-file FILE FILE  Get a remote file, ex: \\Windows\\Temp\\whoami.txt whoami.txt
  --append-host         append the host to the get-file filename

Command Execution:
  --exec-method {wmiexec,atexec,smbexec,mmcexec}
                        method to execute the command. Ignored if in MSSQL mode (default: wmiexec)
  --dcom-timeout DCOM_TIMEOUT
                        DCOM connection timeout (default: 5)
  --get-output-tries GET_OUTPUT_TRIES
                        Number of times atexec/smbexec/mmcexec tries to get results (default: 10)
  --codec CODEC         Set encoding used (codec) from the target's output. If errors are detected, run chcp.com at the target & map the result with
                        https://docs.python.org/3/library/codecs.html#standard-encodings and then execute again with --codec and the corresponding codec (default: utf-8)
  --no-output           do not retrieve command output
  -x COMMAND            execute the specified CMD command
  -X PS_COMMAND         execute the specified PowerShell command

Powershell Script Obfuscation:
  --obfs                Obfuscate PowerShell scripts
  --amsi-bypass FILE    File with a custom AMSI bypass
  --clear-obfscripts    Clear all cached obfuscated PowerShell scripts
  --force-ps32          force PowerShell commands to run in a 32-bit process (may not apply to modules)
  --no-encode           Do not encode the PowerShell command ran on target
                                                                               
```

</details>

### Enumeration with rpcclient

To enumerate domain users via [SAMR](https://learn.microsoft.com/en-us/openspecs/windows_protocols/MS-SAMR/4df07fab-1bbc-452f-8e92-7853a3c7e380)

```bash
rpcclient -U '<username>' --password='<password>' $TARGET_IP -c enumdomusers
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[~/OffSec_Courses/PEN-200]
└─$ rpcclient -U 'stephanie' --password='LegmanTeamBenzoin!!' $TARGET_IP -c enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[dave] rid:[0x44f]
user:[stephanie] rid:[0x450]
user:[jeff] rid:[0x451]
user:[jeffadmin] rid:[0x452]
user:[iis_service] rid:[0x455]
user:[pete] rid:[0x463]
user:[jen] rid:[0x464]
user:[robert] rid:[0x5655]
user:[christina] rid:[0x5656]
user:[bethany] rid:[0x5657]
```

</details>

## ToDo

### bloodyAD

```bash
bloodyAD --host 10.11.12.13 -domain.local -u user -p 'password' get children --otype useronly
```

### ldeep

```bash
ldeep ldap -u user -p 'password' -d domain.local -s 10.11.12.13 users
```

### pywerview

```bash
pywerview get-netuser -w domain.local -u user - p 'Password' --dc-ip 10.11.12.13
```

add `--attributes attr1 attr2` for one or more attributes

add `--username <user>` for only one specific user

## Resources

Active Directory - Enumeration - Internal All The Things: <https://swisskyrepo.github.io/InternalAllTheThings/active-directory/ad-adds-enumerate/>

**Kerbrute** - GitHub: <https://github.com/ropnop/kerbrute>

**Impacket** - GitHub: <https://github.com/fortra/impacket>

**Impacket** - Homepage: <https://www.coresecurity.com/core-labs/impacket>

**Impacket** - Kali Tools: <https://www.kali.org/tools/impacket/>

**Impacket-scripts** - Kali Tools: <https://www.kali.org/tools/impacket-scripts/>

**NetExec** - GitHub: <https://github.com/Pennyw0rth/NetExec>

**NetExec** - Kali Tools: <https://www.kali.org/tools/netexec/>

**NetExec** - Wiki: <https://www.netexec.wiki>