first commit

Windows/Active Directory for OSCP/Initial Access/Get User List.md

@@ -0,0 +1,13 @@
+
+```sh
+- crackmapexec smb <ip> -u '' -p '' --users #powerfull
+- nmap --script smb-enum* -p445 10.10.10.161 (More user might show up in cme)
+- ldapsearch -H ldap://10.10.10.161 -x -b "DC=htb,DC=local" '(objectClass=user)' sAMAccountName
+- rpcclient -U '' 10.10.10.161 #powerfull
+		- queryusergroups <RID>
+		- querygroup <Group RID>
+		- queryuser <RID>
+		
+- GetADUsers.py -all active.htb/svc_tgs -dc-ip <ip>
+# Need Password
+```

Windows/Active Directory for OSCP/Initial Access/LDAP Search.md

@@ -0,0 +1,8 @@
+
+```sh
+# Finding Usernames
+ldapsearch x -h ldap://<IP> -s base
+
+ldapsearch -x -h <ip> -s base namingcontexts
+ldapsearch -x -h <ip> -b 'DC =  , DC = ' -s sub
+```

Windows/Active Directory for OSCP/Initial Access/SMB Shares.md

@@ -0,0 +1,21 @@
+
+
+
+```sh
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+┌──(kali㉿kali)-[~]
+└─$ smbmap -R '\' -H 10.10.10.100 -P 445
+		smbmap -R '\' -H 10.10.10.161 -P 445 -u svc-alfresco -p s3rvice
+		smbmap -d active.htb -u svc_tgs -p <pass> -H <ip>
+		proxychains smbclient \\\\172.16.240.83\\Windows -U 'medtech.com\joe'
+
+┌──(kali㉿kali)-[~]
+└─$ sudo smbmap -R 'Replication\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups' -H 10.10.10.100 --download 'Replication\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml'
+
+
+crackmapexec smb <ip> -u <user> -p <pass>--shares
+# Reading shares with authenticated User and Pass.
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+
+```

Windows/Active Directory for OSCP/Initial Access/Scan Network.md

@@ -0,0 +1,7 @@
+
+```sh
+proxychains crackmapexec smb <IP_range>
+
+
+└─$ proxychains nmap -sT -p80,443,135,139,445,21,53,22,23,389,636,3268,3269,25,5985,5986,3389,88,111,161,1433,110 172.16.224.83 -Pn
+```