Username Extraction
Extracting domain users through thepass_the_ticket technique with the TGT of the support user
Clock Skew Error
┌──(kali㉿kali)-[~/archive/htb/labs/blackfield]
└─$ KRB5CCNAME=support@dc01.blackfield.local.ccache impacket-GetADUsers BLACKFIELD.LOCAL/@dc01.blackfield.local -k -no-pass -all -dc-ip $IP
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Getting machine hostname
[-] Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)The initial attempt with the TGT of the support user fails with the following error; KRB_AP_ERR_SKEW(Clock skew too great)
This is due to the time difference between the DC host and Kali
Since there is no NTP server running in the DC host, I would have to manually adjust the time in Kali to be within the acceptable margin
No NTP
┌──(kali㉿kali)-[~/archive/htb/labs/blackfield]
└─$ sudo nmap -Pn -sC -sV -p445 $IP
starting nmap 7.94 ( https://nmap.org ) at 2023-12-21 09:30 CET
Nmap scan report for dc01 (10.10.10.192)
Host is up (0.024s latency).
PORT STATE SERVICE VERSION
445/tcp open microsoft-ds?
host script results:
| smb2-time:
| date: 2023-12-21T09:33:01
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: 1h02m18s
service detection performed. please report any incorrect results at https://nmap.org/submit/ .
nmap done: 1 IP address (1 host up) scanned in 47.79 secondsAs there is no NTP server running in the DC host, alternative methods must be employed to enumerate the time
In this case, I will be using nmap scripts that enumerate the SMB time, which is almost-always synced with the host system; dc01.blackfield.local
According to the scan result, the difference is 1h02m18s
The default tolerance for clock skew in Kerberos is often set to 5 minutes. This means that by default, the Key Distribution Center (KDC) allows a time difference of up to 5 minutes between the client and the KDC for successful authentication.
┌──(kali㉿kali)-[~/archive/htb/labs/blackfield]
└─$ sudo date -s '2023-12-21t10:30:15'
thu dec 21 10:30:15 AM CET 2023I will roughly adjust to that
This must be done periodically throughout the entire engagement
impacket-GetADUsers
┌──(kali㉿kali)-[~/archive/htb/labs/blackfield]
└─$ KRB5CCNAME=support@dc01.blackfield.local.ccache impacket-GetADUsers BLACKFIELD.LOCAL/support@dc01.blackfield.local -k -no-pass -all -dc-ip $IP
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Getting machine hostname
[*] Querying DC01 for information about domain.
Name Email PasswordLastSet LastLogon
-------------------- ------------------------------ ------------------- -------------------
Administrator 2020-02-23 19:09:53.442741 2023-12-21 04:58:45.198225
Guest 2020-06-03 18:18:28.731812 2023-12-21 10:06:19.749745
krbtgt 2020-02-23 19:08:31.880699 <never>
audit2020 2020-09-22 00:35:06.472595 <never>
support 2020-02-23 18:53:23.851734 2023-12-21 10:06:03.155987
BLACKFIELD764430 nwenna.mrdirk@BLACKFIELD.local 2020-02-23 13:43:18.938747 <never>
BLACKFIELD538365 Mikashitakichika.shanmugarajah@BLACKFIELD.local 2020-02-23 13:43:20.516611 <never>
BLACKFIELD189208 lemetria.Tindall@BLACKFIELD.local 2020-02-23 13:43:21.864011 <never>
BLACKFIELD404458 danubia.vellela@BLACKFIELD.local 2020-02-23 13:43:23.237174 <never>
BLACKFIELD706381 yafreisy.seturino@BLACKFIELD.local 2020-02-23 13:43:24.649130 <never>
BLACKFIELD937395 olasoji.bushey@BLACKFIELD.local 2020-02-23 13:43:25.969663 <never>
BLACKFIELD553715 saranette.maskil@BLACKFIELD.local 2020-02-23 13:43:27.329752 <never>
BLACKFIELD840481 armatha.koffenburger@BLACKFIELD.local 2020-02-23 13:43:28.766968 <never>
BLACKFIELD622501 flordelia.baldwind@BLACKFIELD.local 2020-02-23 13:43:30.502247 <never>
BLACKFIELD787464 Marlon.tonuri@BLACKFIELD.local 2020-02-23 13:43:31.883206 <never>
BLACKFIELD163183 senkeh.krulig@BLACKFIELD.local 2020-02-23 13:43:33.391889 <never>
BLACKFIELD869335 learose.yturbe@BLACKFIELD.local 2020-02-23 13:43:35.004330 <never>
BLACKFIELD319016 Lidong.chippel@BLACKFIELD.local 2020-02-23 13:43:36.470945 <never>
BLACKFIELD600999 Jan.angvall@BLACKFIELD.local 2020-02-23 13:43:38.132314 <never>
BLACKFIELD894905 bliksem.consultant@BLACKFIELD.local 2020-02-23 13:43:39.594865 <never>
BLACKFIELD253541 Helia.gougen@BLACKFIELD.local 2020-02-23 13:43:41.048294 <never>
BLACKFIELD175204 vizma.mamchuk@BLACKFIELD.local 2020-02-23 13:43:42.595300 <never>
BLACKFIELD727512 althaf.neusse@BLACKFIELD.local 2020-02-23 13:43:44.422985 <never>
BLACKFIELD227380 payce.bourrat@BLACKFIELD.local 2020-02-23 13:43:45.813941 <never>
BLACKFIELD251003 Caitán.gronk@BLACKFIELD.local 2020-02-23 13:43:47.470368 <never>
BLACKFIELD129328 natashja.pulido@BLACKFIELD.local 2020-02-23 13:43:49.033011 <never>
BLACKFIELD616527 soonu.dellabitta@BLACKFIELD.local 2020-02-23 13:43:50.579195 <never>
BLACKFIELD533551 sharhabeel.helregel@BLACKFIELD.local 2020-02-23 13:43:51.954623 <never>
BLACKFIELD883784 partchapol.provencer@BLACKFIELD.local 2020-02-23 13:43:53.565532 <never>
BLACKFIELD908329 Fauna.pflum@BLACKFIELD.local 2020-02-23 13:43:55.032849 <never>
BLACKFIELD601590 jongluck.shuselvt@BLACKFIELD.local 2020-02-23 13:43:56.424482 <never>
BLACKFIELD573498 salahaldin.hederian@BLACKFIELD.local 2020-02-23 13:43:58.017402 <never>
BLACKFIELD290325 gokulasankar.forshalger@BLACKFIELD.local 2020-02-23 13:43:59.376092 <never>
BLACKFIELD775986 aphay.zigmunt@BLACKFIELD.local 2020-02-23 13:44:00.813866 <never>
BLACKFIELD348433 parvika.masulla@BLACKFIELD.local 2020-02-23 13:44:02.456156 <never>
BLACKFIELD196444 pakeerathan.vinkovich@BLACKFIELD.local 2020-02-23 13:44:03.845087 <never>
BLACKFIELD137694 santhia.hauht@BLACKFIELD.local 2020-02-23 13:44:05.253071 <never>
BLACKFIELD533886 aletia.kubale@BLACKFIELD.local 2020-02-23 13:44:06.641908 <never>
BLACKFIELD268320 sidthi.reppond@BLACKFIELD.local 2020-02-23 13:44:07.973305 <never>
BLACKFIELD909590 kimiyoshi.coltart@BLACKFIELD.local 2020-02-23 13:44:09.360743 <never>
BLACKFIELD136813 krupen.pregnolato@BLACKFIELD.local 2020-02-23 13:44:10.847195 <never>
BLACKFIELD358090 kohung.atolikian@BLACKFIELD.local 2020-02-23 13:44:12.188747 <never>
BLACKFIELD561870 anakin.maceldon@BLACKFIELD.local 2020-02-23 13:44:13.532662 <never>
BLACKFIELD269538 dpaul.chintalapalli@BLACKFIELD.local 2020-02-23 13:44:14.813666 <never>
BLACKFIELD169035 pargan.parakat@BLACKFIELD.local 2020-02-23 13:44:16.267035 <never>
BLACKFIELD118321 Maqbool.brambini@BLACKFIELD.local 2020-02-23 13:44:17.565114 <never>
BLACKFIELD592556 tanyetta.kauten@BLACKFIELD.local 2020-02-23 13:44:19.159565 <never>
BLACKFIELD618519 romkaew.poretsky@BLACKFIELD.local 2020-02-23 13:44:20.563652 <never>
BLACKFIELD329802 Purita.virding@BLACKFIELD.local 2020-02-23 13:44:22.017492 <never>
BLACKFIELD753480 alexadra.wangenheim@BLACKFIELD.local 2020-02-23 13:44:23.454742 <never>
BLACKFIELD837541 Benayga.bakajza@BLACKFIELD.local 2020-02-23 13:44:24.845077 <never>
BLACKFIELD186980 Rafik.bochare@BLACKFIELD.local 2020-02-23 13:44:26.377591 <never>
BLACKFIELD419600 fian.laginja@BLACKFIELD.local 2020-02-23 13:44:27.720670 <never>
BLACKFIELD220786 emelya.palislamovic@BLACKFIELD.local 2020-02-23 13:44:30.251760 <never>
BLACKFIELD767820 eugenne.pryar@BLACKFIELD.local 2020-02-23 13:44:31.704151 <never>
BLACKFIELD549571 tedann.slupka@BLACKFIELD.local 2020-02-23 13:44:33.423183 <never>
BLACKFIELD411740 tawanah.knupke@BLACKFIELD.local 2020-02-23 13:44:40.907332 <never>
BLACKFIELD768095 tesea.eiselt@BLACKFIELD.local 2020-02-23 13:44:57.238641 <never>
BLACKFIELD835725 Chunhong.selters@BLACKFIELD.local 2020-02-23 13:44:58.470254 <never>
BLACKFIELD251977 sulistiyani.whyte@BLACKFIELD.local 2020-02-23 13:44:59.657497 <never>
BLACKFIELD430864 danaka.zwinak@BLACKFIELD.local 2020-02-23 13:45:00.751915 <never>
BLACKFIELD413242 hamk.colantino@BLACKFIELD.local 2020-02-23 13:45:01.735583 <never>
BLACKFIELD464763 chandalin.acherman@BLACKFIELD.local 2020-02-23 13:45:02.863157 <never>
BLACKFIELD266096 oveta.rbabka@BLACKFIELD.local 2020-02-23 13:45:03.891910 <never>
BLACKFIELD334058 krisda.amavisca@BLACKFIELD.local 2020-02-23 13:45:04.969899 <never>
BLACKFIELD404213 perci.weinkaus@BLACKFIELD.local 2020-02-23 13:45:06.174198 <never>
BLACKFIELD219324 athasithi.barteski@BLACKFIELD.local 2020-02-23 13:45:07.226564 <never>
BLACKFIELD412798 xiangou.rykiel@BLACKFIELD.local 2020-02-23 13:45:08.282463 <never>
BLACKFIELD441593 laveria.bajewsky@BLACKFIELD.local 2020-02-23 13:45:09.204545 <never>
BLACKFIELD606328 SvanhvÃt.moyta@BLACKFIELD.local 2020-02-23 13:45:10.204464 <never>
BLACKFIELD796301 anang.kollolli@BLACKFIELD.local 2020-02-23 13:45:11.266950 <never>
BLACKFIELD415829 merdis.naciri@BLACKFIELD.local 2020-02-23 13:45:12.188871 <never>
BLACKFIELD820995 sandtrell.bouzane@BLACKFIELD.local 2020-02-23 13:45:13.313865 <never>
BLACKFIELD695166 yangchi.kivlen@BLACKFIELD.local 2020-02-23 13:45:14.313724 <never>
BLACKFIELD759042 shoichi.grifasi@BLACKFIELD.local 2020-02-23 13:45:15.376273 <never>
BLACKFIELD607290 casma.morcillo@BLACKFIELD.local 2020-02-23 13:45:16.329211 <never>
BLACKFIELD229506 luwayne.birer@BLACKFIELD.local 2020-02-23 13:45:17.329823 <never>
BLACKFIELD256791 liouba.druge@BLACKFIELD.local 2020-02-23 13:45:18.407661 <never>
BLACKFIELD997545 dawnielle.medeme@BLACKFIELD.local 2020-02-23 13:45:19.377168 <never>
BLACKFIELD114762 Oleguer.hardybala@BLACKFIELD.local 2020-02-23 13:45:20.442178 <never>
BLACKFIELD321206 gerread.maroufkhani@BLACKFIELD.local 2020-02-23 13:45:21.532202 <never>
BLACKFIELD195757 Alyona.cheretei@BLACKFIELD.local 2020-02-23 13:45:22.516782 <never>
BLACKFIELD877328 dynell.vogleson@BLACKFIELD.local 2020-02-23 13:45:23.674156 <never>
BLACKFIELD446463 shagha.solsbak@BLACKFIELD.local 2020-02-23 13:45:24.706274 <never>
BLACKFIELD579980 luisete.ezepek@BLACKFIELD.local 2020-02-23 13:45:25.766764 <never>
BLACKFIELD775126 noerah.dikoka@BLACKFIELD.local 2020-02-23 13:45:26.813807 <never>
BLACKFIELD429587 vadhusara.litschauer@BLACKFIELD.local 2020-02-23 13:45:27.797885 <never>
BLACKFIELD534956 kallye.zyballa@BLACKFIELD.local 2020-02-23 13:45:28.767259 <never>
BLACKFIELD315276 yolena.zarpentine@BLACKFIELD.local 2020-02-23 13:45:29.815305 <never>
BLACKFIELD995218 warline.verzhbytska@BLACKFIELD.local 2020-02-23 13:45:30.753454 <never>
BLACKFIELD843883 dorgia.meherek@BLACKFIELD.local 2020-02-23 13:45:31.783484 <never>
BLACKFIELD876916 stephaniee.eulert@BLACKFIELD.local 2020-02-23 13:45:32.719603 <never>
BLACKFIELD382769 raeka.vallandas@BLACKFIELD.local 2020-02-23 13:45:33.721229 <never>
BLACKFIELD194732 novlett.schepkie@BLACKFIELD.local 2020-02-23 13:45:34.738973 <never>
BLACKFIELD191416 crushonna.argyropolous@BLACKFIELD.local 2020-02-23 13:45:35.706048 <never>
BLACKFIELD932709 bronwin.rigiero@BLACKFIELD.local 2020-02-23 13:45:36.782773 <never>
BLACKFIELD546640 youngrok.huftalin@BLACKFIELD.local 2020-02-23 13:45:37.798183 <never>
BLACKFIELD569313 erdit.sariotti@BLACKFIELD.local 2020-02-23 13:45:38.735739 <never>
BLACKFIELD744790 Utka.pyrke@BLACKFIELD.local 2020-02-23 13:45:39.752983 <never>
BLACKFIELD739659 tomecia.oust@BLACKFIELD.local 2020-02-23 13:45:40.688695 <never>
BLACKFIELD926559 baotai.beloucif@BLACKFIELD.local 2020-02-23 13:45:41.737688 <never>
BLACKFIELD969352 juror.scima@BLACKFIELD.local 2020-02-23 13:45:42.710512 <never>
BLACKFIELD253047 naijie.genevro@BLACKFIELD.local 2020-02-23 13:45:43.737104 <never>
BLACKFIELD899433 ahmard.navay@BLACKFIELD.local 2020-02-23 13:45:44.892035 <never>
BLACKFIELD606964 Bjørnar.zandonella@BLACKFIELD.local 2020-02-23 13:45:45.844892 <never>
BLACKFIELD385719 kishona.sojdelius@BLACKFIELD.local 2020-02-23 13:45:46.924586 <never>
BLACKFIELD838710 lynnsi.karabag@BLACKFIELD.local 2020-02-23 13:45:47.923009 <never>
BLACKFIELD608914 aadra.bekesz@BLACKFIELD.local 2020-02-23 13:45:48.985485 <never>
BLACKFIELD569653 mynga.hoerauf@BLACKFIELD.local 2020-02-23 13:45:50.083305 <never>
BLACKFIELD759079 raghdan.wissore@BLACKFIELD.local 2020-02-23 13:45:51.036098 <never>
BLACKFIELD488531 kellely.cockeril@BLACKFIELD.local 2020-02-23 13:45:51.990359 <never>
BLACKFIELD160610 charvette.kijauskas@BLACKFIELD.local 2020-02-23 13:45:52.955483 <never>
BLACKFIELD586934 jennalyn.djouka@BLACKFIELD.local 2020-02-23 13:45:53.938892 <never>
BLACKFIELD819822 Valerija Marija.chiuccariello@BLACKFIELD.local 2020-02-23 13:45:55.001606 <never>
BLACKFIELD739765 unjum.marylebone@BLACKFIELD.local 2020-02-23 13:45:55.954395 <never>
BLACKFIELD875008 weicai.zelazny@BLACKFIELD.local 2020-02-23 13:45:56.985854 <never>
BLACKFIELD441759 piyawan.doreste@BLACKFIELD.local 2020-02-23 13:45:57.957238 <never>
BLACKFIELD763893 claudace.akbari@BLACKFIELD.local 2020-02-23 13:45:59.049142 <never>
BLACKFIELD713470 kamaldei.cyster@BLACKFIELD.local 2020-02-23 13:46:00.017617 <never>
BLACKFIELD131771 mrigank.kermarrec@BLACKFIELD.local 2020-02-23 13:46:01.079269 <never>
BLACKFIELD793029 Zorione.alatti@BLACKFIELD.local 2020-02-23 13:46:02.096518 <never>
BLACKFIELD694429 brihgid.novrotsky@BLACKFIELD.local 2020-02-23 13:46:03.110358 <never>
BLACKFIELD802251 huiyao.cunnally@BLACKFIELD.local 2020-02-23 13:46:04.103040 <never>
BLACKFIELD602567 rikha.stuehringer@BLACKFIELD.local 2020-02-23 13:46:05.063814 <never>
BLACKFIELD328983 Hildred.kostova@BLACKFIELD.local 2020-02-23 13:46:06.094738 <never>
BLACKFIELD990638 kausalai.dorney@BLACKFIELD.local 2020-02-23 13:46:07.066096 <never>
BLACKFIELD350809 samwin.sicliano@BLACKFIELD.local 2020-02-23 13:46:08.048190 <never>
BLACKFIELD405242 krishnas.tambourgi@BLACKFIELD.local 2020-02-23 13:46:09.004653 <never>
BLACKFIELD267457 lieyong.bobelis@BLACKFIELD.local 2020-02-23 13:46:10.095404 <never>
BLACKFIELD686428 taqim.stausland@BLACKFIELD.local 2020-02-23 13:46:11.094690 <never>
BLACKFIELD478828 yackoob.vonebers@BLACKFIELD.local 2020-02-23 13:46:12.079124 <never>
BLACKFIELD129387 irmengard.santosi@BLACKFIELD.local 2020-02-23 13:46:13.128138 <never>
BLACKFIELD544934 chieung.hoytal@BLACKFIELD.local 2020-02-23 13:46:14.141978 <never>
BLACKFIELD115148 franchester.reffey@BLACKFIELD.local 2020-02-23 13:46:15.189787 <never>
BLACKFIELD753537 afrina.kruppe@BLACKFIELD.local 2020-02-23 13:46:16.282466 <never>
BLACKFIELD416532 vercie.butziger@BLACKFIELD.local 2020-02-23 13:46:17.474029 <never>
BLACKFIELD680939 nikela.bellibas@BLACKFIELD.local 2020-02-23 13:46:18.627079 <never>
BLACKFIELD732035 myte.vanarsdel@BLACKFIELD.local 2020-02-23 13:46:19.908054 <never>
BLACKFIELD522135 Lucila.choffin@BLACKFIELD.local 2020-02-23 13:46:21.111386 <never>
BLACKFIELD773423 yamisi.skoropada@BLACKFIELD.local 2020-02-23 13:46:22.313726 <never>
BLACKFIELD371669 khylee.brokinn@BLACKFIELD.local 2020-02-23 13:46:24.501096 <never>
BLACKFIELD252379 kurishinkal.langfur@BLACKFIELD.local 2020-02-23 13:46:25.736165 <never>
BLACKFIELD828826 Jaquelina.shoenherr@BLACKFIELD.local 2020-02-23 13:46:26.705078 <never>
BLACKFIELD548394 girlyn.merewether@BLACKFIELD.local 2020-02-23 13:46:27.782893 <never>
BLACKFIELD611993 bipen.erdossy@BLACKFIELD.local 2020-02-23 13:46:28.751114 <never>
BLACKFIELD192642 xhyla.debes@BLACKFIELD.local 2020-02-23 13:46:29.849124 <never>
BLACKFIELD106360 Grozdan.gomane@BLACKFIELD.local 2020-02-23 13:46:30.907429 <never>
BLACKFIELD939243 laupule.hyungkim@BLACKFIELD.local 2020-02-23 13:46:32.110288 <never>
BLACKFIELD230515 araro.sischo@BLACKFIELD.local 2020-02-23 13:46:33.130254 <never>
BLACKFIELD774376 nikcole.goddanti@BLACKFIELD.local 2020-02-23 13:46:34.175097 <never>
BLACKFIELD576233 maryvette.attravanam@BLACKFIELD.local 2020-02-23 13:46:35.210884 <never>
BLACKFIELD676303 toreyan.cassalom@BLACKFIELD.local 2020-02-23 13:46:36.221892 <never>
BLACKFIELD673073 anntrees.csonaki@BLACKFIELD.local 2020-02-23 13:46:37.301554 <never>
BLACKFIELD558867 breckh.lostal@BLACKFIELD.local 2020-02-23 13:46:38.391584 <never>
BLACKFIELD184482 mouane.sichkar@BLACKFIELD.local 2020-02-23 13:46:39.594899 <never>
BLACKFIELD724669 Zukukachishikimiku.scozzari@BLACKFIELD.local 2020-02-23 13:46:40.735717 <never>
BLACKFIELD765350 nontakam.ronges@BLACKFIELD.local 2020-02-23 13:46:41.940603 <never>
BLACKFIELD411132 eilaine.eulau@BLACKFIELD.local 2020-02-23 13:46:43.001710 <never>
BLACKFIELD128775 betsye.samkoses@BLACKFIELD.local 2020-02-23 13:46:44.094682 <never>
BLACKFIELD704154 marysue.merezio@BLACKFIELD.local 2020-02-23 13:46:45.112902 <never>
BLACKFIELD107197 phouvieng.tesik@BLACKFIELD.local 2020-02-23 13:46:46.157512 <never>
BLACKFIELD994577 abdulwali.higchens@BLACKFIELD.local 2020-02-23 13:46:47.267133 <never>
BLACKFIELD683323 Mirikate.lapesh@BLACKFIELD.local 2020-02-23 13:46:48.253569 <never>
BLACKFIELD433476 xinghao.bemelen@BLACKFIELD.local 2020-02-23 13:46:49.329421 <never>
BLACKFIELD644281 mohanakrish.tipirneni@BLACKFIELD.local 2020-02-23 13:46:50.282699 <never>
BLACKFIELD195953 Marchella.makhsous@BLACKFIELD.local 2020-02-23 13:46:51.314975 <never>
BLACKFIELD868068 rittenband.baliukonis@BLACKFIELD.local 2020-02-23 13:46:52.345052 <never>
BLACKFIELD690642 samyukta.golds@BLACKFIELD.local 2020-02-23 13:46:53.391611 <never>
BLACKFIELD465267 Deolindo.garbatiuc@BLACKFIELD.local 2020-02-23 13:46:54.423042 <never>
BLACKFIELD199889 rexor.szewczuga@BLACKFIELD.local 2020-02-23 13:46:55.441604 <never>
BLACKFIELD468839 chimah.schandall@BLACKFIELD.local 2020-02-23 13:46:56.377462 <never>
BLACKFIELD348835 apryle.alleni@BLACKFIELD.local 2020-02-23 13:46:57.345365 <never>
BLACKFIELD624385 sheneda.lewrie@BLACKFIELD.local 2020-02-23 13:46:58.330295 <never>
BLACKFIELD818863 eursella.frixione@BLACKFIELD.local 2020-02-23 13:46:59.376274 <never>
BLACKFIELD939200 Tekajitofu.awaysheh@BLACKFIELD.local 2020-02-23 13:47:00.486532 <never>
BLACKFIELD135990 franselly.lasokowski@BLACKFIELD.local 2020-02-23 13:47:01.425946 <never>
BLACKFIELD484290 RuÂWhile impacket-GetADusers extracted all the valid domain user accounts, an interesting fact is revealed.
Those [[Blackfield_RID_Cycling#[RID Cycling](https //www.trustedsec.com/blog/new-tool-release-rpc_enum-rid-cycling-attack/)|enumerated user accounts]] from the RID cycling technique, starting with BLACKFIELD******, have both CN and name attributes matching up the usernames found in the //dc01.blackfield.local/profiles$ share
It would appear that firstname is redacted to first letter only
This is also confirmed with ldapdomaindump
Updating the users.txt file