> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/active-directory/initial-enumeration-of-ad/enumerating-ad-users.md).

# Enumerating AD Users

### Username Generation <a href="#user-content-4-username-generation" id="user-content-4-username-generation"></a>

In Part 1, we found a list of employee names on the website: Greg Shields, Sarah J. Honen, Jack Dowand, and Laney Moore. To use these against Active Directory, we need to convert them into standard corporate username formats (e.g., `first.last`, `flast`, `firstl`).

* **Process:**

1. Save the names into a comma-separated text file (e.g., `users.csv`).
2. Use a generation tool. While tools like `username-anarchy` are standard, simple Python scripts can also parse a CSV of first/last names and output a wordlist of common AD naming conventions.
3. Save the output to a new file: `ad_users.txt`.

{% embed url="<https://github.com/urbanadventurer/username-anarchy>" %}

{% embed url="<https://github.com/w0Tx/generate-ad-username>" %}

```
greg,shields
sarah,johnson
jack,dowland
Lainey,moore
```

```
python3 ADGenerator.py ad-users.txe
```

<figure><img src="/files/eof5QBgpEQ75nJmBvRgY" alt=""><figcaption></figcaption></figure>

Get these users in a file

<figure><img src="/files/pCsixOnB6LrF4IsBNhMN" alt=""><figcaption></figcaption></figure>

{% embed url="<https://github.com/florianges/UsernameGenerator>" %}
Good One
{% endembed %}

### Kerbrute - Internal AD Username Enumeration

[Kerbrute](https://github.com/ropnop/kerbrute) can be a stealthier option for domain account enumeration. It takes advantage of the fact that Kerberos pre-authentication failures often will not trigger logs or alerts. We will use Kerbrute in conjunction with the `jsmith.txt` or `jsmith2.txt` user lists from [Insidetrust](https://github.com/insidetrust/statistically-likely-usernames). This repository contains many different user lists that can be extremely useful when attempting to enumerate users when starting from an unauthenticated perspective. We can point Kerbrute at the DC we found earlier and feed it a wordlist. The tool is quick, and we will be provided with results letting us know if the accounts found are valid or not, which is a great starting point for launching attacks such as password spraying, which we will cover in-depth later in this module.

To get started with Kerbrute, we can download [precompiled binaries](https://github.com/ropnop/kerbrute/releases/latest) for the tool for testing from Linux, Windows, and Mac, or we can compile it ourselves. This is generally the best practice for any tool we introduce into a client environment. To compile the binaries to use on the system of our choosing, we first clone the repo:

**Cloning Kerbrute GitHub Repo**

&#x20; Initial Enumeration of the Domain

```shell-session
ammartiger@htb[/htb]$ sudo git clone https://github.com/ropnop/kerbrute.git

Cloning into 'kerbrute'...
remote: Enumerating objects: 845, done.
remote: Counting objects: 100% (47/47), done.
remote: Compressing objects: 100% (36/36), done.
remote: Total 845 (delta 18), reused 28 (delta 10), pack-reused 798
Receiving objects: 100% (845/845), 419.70 KiB | 2.72 MiB/s, done.
Resolving deltas: 100% (371/371), done.
```

Typing `make help` will show us the compiling options available.

**Listing Compiling Options**

&#x20; Initial Enumeration of the Domain

```shell-session
ammartiger@htb[/htb]$ make help

help:            Show this help.
windows:  Make Windows x86 and x64 Binaries
linux:  Make Linux x86 and x64 Binaries
mac:  Make Darwin (Mac) x86 and x64 Binaries
clean:  Delete any binaries
all:  Make Windows, Linux and Mac x86/x64 Binaries
```

We can choose to compile just one binary or type `make all` and compile one each for use on Linux, Windows, and Mac systems (an x86 and x64 version for each).

**Compiling for Multiple Platforms and Architectures**

&#x20; Initial Enumeration of the Domain

```shell-session
ammartiger@htb[/htb]$ sudo make all

go: downloading github.com/spf13/cobra v1.1.1
go: downloading github.com/op/go-logging v0.0.0-20160315200505-970db520ece7
go: downloading github.com/ropnop/gokrb5/v8 v8.0.0-20201111231119-729746023c02
go: downloading github.com/spf13/pflag v1.0.5
go: downloading github.com/jcmturner/gofork v1.0.0
go: downloading github.com/hashicorp/go-uuid v1.0.2
go: downloading golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897
go: downloading github.com/jcmturner/rpc/v2 v2.0.2
go: downloading github.com/jcmturner/dnsutils/v2 v2.0.0
go: downloading github.com/jcmturner/aescts/v2 v2.0.0
go: downloading golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa
cd /tmp/kerbrute
rm -f kerbrute kerbrute.exe kerbrute kerbrute.exe kerbrute.test kerbrute.test.exe kerbrute.test kerbrute.test.exe main main.exe
rm -f /root/go/bin/kerbrute
Done.
Building for windows amd64..

<SNIP>
```

The newly created `dist` directory will contain our compiled binaries.

**Listing the Compiled Binaries in dist**

&#x20; Initial Enumeration of the Domain

```shell-session
ammartiger@htb[/htb]$ ls dist/

kerbrute_darwin_amd64  kerbrute_linux_386  kerbrute_linux_amd64  kerbrute_windows_386.exe  kerbrute_windows_amd64.exe
```

We can then test out the binary to make sure it works properly. We will be using the x64 version on the supplied Parrot Linux attack host in the target environment.

**Testing the kerbrute\_linux\_amd64 Binary**

&#x20; Initial Enumeration of the Domain

```shell-session
ammartiger@htb[/htb]$ ./kerbrute_linux_amd64 

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: dev (9cfb81e) - 02/17/22 - Ronnie Flathers @ropnop

This tool is designed to assist in quickly bruteforcing valid Active Directory accounts through Kerberos Pre-Authentication.
It is designed to be used on an internal Windows domain with access to one of the Domain Controllers.
Warning: failed Kerberos Pre-Auth counts as a failed login and WILL lock out accounts

Usage:
  kerbrute [command]
  
  <SNIP>
```

We can add the tool to our PATH to make it easily accessible from anywhere on the host.

**Adding the Tool to our Path**

&#x20; Initial Enumeration of the Domain

```shell-session
ammartiger@htb[/htb]$ echo $PATH
/home/htb-student/.local/bin:/snap/bin:/usr/sandbox/:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/usr/share/games:/usr/local/sbin:/usr/sbin:/sbin:/snap/bin:/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/home/htb-student/.dotnet/tools
```

**Moving the Binary**

&#x20; Initial Enumeration of the Domain

```shell-session
ammartiger@htb[/htb]$ sudo mv kerbrute_linux_amd64 /usr/local/bin/kerbrute
```

We can now type `kerbrute` from any location on the system and will be able to access the tool. Feel free to follow along on your system and practice the above steps. Now let's run through an example of using the tool to gather an initial username list.

**Enumerating Users with Kerbrute**

&#x20; Initial Enumeration of the Domain

```shell-session
ammartiger@htb[/htb]$ kerbrute userenum -d INLANEFREIGHT.LOCAL --dc 172.16.5.5 jsmith.txt -o valid_ad_users

2021/11/17 23:01:46 >  Using KDC(s):
2021/11/17 23:01:46 >   172.16.5.5:88
2021/11/17 23:01:46 >  [+] VALID USERNAME:       jjones@INLANEFREIGHT.LOCAL
2021/11/17 23:01:46 >  [+] VALID USERNAME:       sbrown@INLANEFREIGHT.LOCAL
2021/11/17 23:01:46 >  [+] VALID USERNAME:       tjohnson@INLANEFREIGHT.LOCAL
2021/11/17 23:01:50 >  [+] VALID USERNAME:       evalentin@INLANEFREIGHT.LOCAL

 <SNIP>
 
2021/11/17 23:01:51 >  [+] VALID USERNAME:       sgage@INLANEFREIGHT.LOCAL
2021/11/17 23:01:51 >  [+] VALID USERNAME:       jshay@INLANEFREIGHT.LOCAL
2021/11/17 23:01:51 >  [+] VALID USERNAME:       jhermann@INLANEFREIGHT.LOCAL
2021/11/17 23:01:51 >  [+] VALID USERNAME:       whouse@INLANEFREIGHT.LOCAL
2021/11/17 23:01:51 >  [+] VALID USERNAME:       emercer@INLANEFREIGHT.LOCAL
2021/11/17 23:01:52 >  [+] VALID USERNAME:       wshepherd@INLANEFREIGHT.LOCAL
2021/11/17 23:01:56 >  Done! Tested 48705 usernames (56 valid) in 9.940 seconds
```

We can see from our output that we validated 56 users in the INLANEFREIGHT.LOCAL domain and it took only a few seconds to do so. Now we can take these results and build a list for use in targeted password spraying attacks.

### Identifying Valid Users with Netexec (Without users list) <a href="#user-content-identifying-valid-users" id="user-content-identifying-valid-users"></a>

But here's the problem... if we are starting with no credentials, how do we get a list of domain users?

Well, we have to rely on misconfigurations. We can test the Domain Controller to see if it will talk to us without forcing us to authenticate.

Explaining why this works is out-of-scope for this Guided Lab, but we'll make another one soon on initial access.

```
## Connecting with a Null Session
nxc smb [DC-IP] -u '' -p '' --users-export usernames.txt

## Connecting with the Guest account
nxc smb [DC-IP] -u 'guest' -p '' --users-export users.txt
```

<figure><img src="/files/y7NTmCUbMtiHKgax0xXi" alt=""><figcaption></figcaption></figure>

If **any** of these methods succeed, you now have a full list of usernames. Save those to a text file (i.e. `usernames.txt` or `users.txt`). They should have ONLY the usernames.