Infiltrator_Username_Extraction

Username Extraction

---

┌──(kali㉿kali)-[~/archive/htb/labs/infiltrator]
└─$ KRB5CCNAME=l.clark@dc01.infiltrator.htb.ccache impacket-GetADUsers INFILTRATOR.HTB/ -no-pass -k -dc-ip $IP
Impacket v0.12.0.dev1 - Copyright 2023 Fortra
 
[*] Getting machine hostname
[*] Querying DC01 for information about domain.
Name                  Email                           PasswordLastSet      LastLogon
--------------------  ------------------------------  -------------------  -------------------
D.anderson            anderson@infiltrator.htb        2023-12-04 19:56:02.179328  2024-09-01 00:33:10.641448
L.clark               clark@infiltrator.htb           2023-12-04 20:04:24.557298  2024-09-01 00:36:28.176015
M.harris              harris@infiltrator.htb          2024-09-01 00:36:44.423267  2024-09-01 00:33:28.221897
O.martinez            martinez@infiltrator.htb        2024-02-25 16:41:03.154004  2024-09-01 00:38:17.116134
E.rodriguez           rodriguez@infiltrator.htb       2024-09-01 00:36:44.407661  2024-09-01 00:33:23.761161
K.turner              turner@infiltrator.htb          2024-02-25 16:40:35.700852  2023-12-06 01:05:15.558762
A.walker              walker@infiltrator.htb          2023-12-05 23:06:28.637565  <never>
winrm_svc             winrm_svc@infiltrator.htb       2024-08-03 00:42:45.589685  2024-02-25 16:25:26.216757

Extracting all the domain users using the TGT of the l.clark account winrm_svc will be appended to the users.txt file