Methodology

Preparation

• Run Responder for catching network traffic in domain

Enumeration

Without Credentials

Insecure Logins

With Credentials

Bloodhound & ldapdomaindump

Attacks

Without Credentials

SMB Coercing (445)

With Credentials