Active Directory Basic Enumeration

Active Directory Enumeration

A Beginner’s Hands-On Guide

Introduction

Active Directory (AD) enumeration is a crucial first step in penetration testing. In this lab, I practiced unauthenticated AD reconnaissance on TryHackMe’s Jr. Penetration Tester path.

— -

Lab Environment

• Target Subnet: 10.211.11.0/24
• Domain: tryhackme.loc
• Domain Controller: 10.211.11.10
• Workstation: 10.211.11.20

— -

Phase 1: Host Discovery

First, I identified live hosts using fping: fping -agq 10.211.11.0/24

Then saved targets to hosts.txt for further scanning.

— -

Phase 2: Port Scanning

Identified Domain Controller by scanning AD ports: nmap -p 88,135,139,389,445 -sV -sC -iL hosts.txt

Key ports found open: 88 (Kerberos), 389 (LDAP), 445 (SMB) — confirmed Domain Controller.

— -

Phase 3: User Enumeration

Used multiple methods to find valid users:

1. LDAP Anonymous Bind ldapsearch -x -H ldap://10.211.11.10 -s base

2. Enum4linux-ng enum4linux-ng -A 10.211.11.10 -oA results.txt

3. RPC Null Session rpcclient -U “” 10.211.11.10 -N

4. Kerbrute Validation ./kerbrute userenum — dc 10.211.11.10 -d tryhackme.loc users.txt

— -

Phase 4: Password Spraying

Tested common passwords against valid users: ./kerbrute passwordspray — dc 10.211.11.10 -d tryhackme.loc users.txt “Password123”

— -

Tools Used

• fping — Host discovery
• nmap — Port scanning
• enum4linux-ng — Full AD enumeration
• rpcclient — RPC null session
• ldapsearch — LDAP enumeration
• kerbrute — User validation

— -

Conclusion

This lab taught me how attackers enumerate AD networks without credentials. Understanding these techniques helps defenders secure their environments.

GitHub: https://github.com/Hasnain1675/AD-Basic-Enumeration

— - Disclaimer: All techniques practiced in authorized TryHackMe lab environment only.