> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/active-directory/initial-access/domain-attacks.md). # Domain Attacks ## User Enumeration and Brute Force Kerberos pre-authentication requests return different response for valid and invalid users. The tool `kerbrute` allows you to rapidly identify valid usernames in a target domain. Consider other options, like printer address books, to discover username schemes. ``` kerbrute userenum -d contoso.com usernames.txt ``` Kerberos is a fast protocol for password spraying. However, it can lead to false negatives, so I typically use SMB. ``` kerbrute passwordspray -d contoso.com valid_users.txt Password123 nxc smb 10.10.10.10 -u ./valid_users.txt -p Password123 ``` ## ASREP-Roasting ASREP roasting allows you to request password hashes for accounts that don't require Kerberos pre-authentication. You can try to brute-force identify ASREP accounts from a valid user list (see above). ``` impacket-GetNPUsers Contoso.com/ -dc-ip 10.10.10.10 -no-pass -usersfile valid.txt ``` Note that you can **Kerberoast non-ASREP accounts** from an ASREP account without credentials. ``` impacket-GetUserSPNs -no-preauth ASREPUser -dc-ip 10.10.10.10 -no-pass -usersfile valid.txt Contoso.com/ ``` ## Pre-2000 Computers Very old Windows machines may be set to use pre-2000's default passwords - the hostname. ``` SERVER1$ : SERVER1 ``` You can discover these in a variety of ways, but you'll likely get a `STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT` error when you've guessed the right password. You can reset the account's password with `impacket-changepasswd`, but try to use the `kpasswd` method for best results: ``` impacket-changepasswd contoso.com/'finance-pc$':'finance-pc'@dc.contoso.com -newpass 'Password!123' -p kpasswd ``` ## Dynamic DNS Injection Some domains allow for dynamic DNS updates for compatibility. Hijack server DNS records to intercept authentication, either NTLM/Kerberos or cleartext protocols. *