terminal
# Sesión SMB NULL$ enum4linux -U 172.16.5.5 | grep "user:" | cut -f2 -d"[" | cut -f1 -d"]"rpcclient -U "" -N 172.16.5.5rpcclient $> enumdomusersldapsearch -x -H ldap://10.10.10.161:389 -b "dc=htb,dc=local" "(objectCategory=person)" | grep sAMAccountName$ ./windapsearch.py --dc-ip 172.16.5.5 -u "" -U$ nxc smb <ip> -u '' -p '' --users# Con creds$ nxc smb 172.16.5.5 -u <usuario> -p <contraseña> --users# Externamente via Kerberoskerbrute userenum -d inlanefreight.local --dc 172.16.5.5 /opt/jsmith.txt