first commit

Windows/Active Directory for OSCP/Initial Access/Get User List.md

@@ -0,0 +1,13 @@
+
+```sh
+- crackmapexec smb <ip> -u '' -p '' --users #powerfull
+- nmap --script smb-enum* -p445 10.10.10.161 (More user might show up in cme)
+- ldapsearch -H ldap://10.10.10.161 -x -b "DC=htb,DC=local" '(objectClass=user)' sAMAccountName
+- rpcclient -U '' 10.10.10.161 #powerfull
+		- queryusergroups <RID>
+		- querygroup <Group RID>
+		- queryuser <RID>
+		
+- GetADUsers.py -all active.htb/svc_tgs -dc-ip <ip>
+# Need Password
+```