Basic Enumeration Methodology

This will be fully automatized with the new ADpwn release ;)

ldapdomaindump

Bloodhound Dump

bloodhound-python -u <USER> -d <DOMAIN> -p <PASSWORD> -c all -ns <DC_IP> --zip
(fancy and new ->) nxc ldap <IP> -u <USER> -p <PASSWORD> --bloodhound --collection All

export KRB5CCNAME=<TICKET> rusthound-ce -u <USER> -p <PASSWORD> --domain <DOMAIN> -c <COLLECTION_M> -k -f <DC_FQDN> --zip