impacket-GetADUsers
┌──(kali㉿kali)-[~/archive/htb/labs/mantis]
└─$ impacket-GetADUsers htb.local/james -all -dc-ip $IP
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
password: J@m3s_P@ssW0rd!
[*] Querying 10.10.10.52 for information about domain.
Name Email PasswordLastSet LastLogon
-------------------- ------------------------------ ------------------- -------------------
administrator 2018-02-06 08:52:39.300630 2023-01-10 17:27:07.938536
Guest <never> <never>
krbtgt 2017-09-01 02:05:39.343617 <never>
james 2017-09-01 02:12:02.495890 2023-01-10 18:03:36.840781 With the extracted credential, I can now authenticate to the target LDAP server to list out the domain users The confirmed list of domain users
administratorguestkrbtgtjames