Username Extraction
Extracting all the domain users with the TGT of the compromised account, hope.sharp
┌──(kali㉿kali)-[~/archive/htb/labs/search]
└─$ KRB5CCNAME=hope.sharp@research.search.htb.ccache impacket-GetADUsers SEARCH.HTB/hope.sharp@research.search.htb -k -no-pass -dc-ip $IP -all
Impacket v0.12.0.dev1+20231130.165011.d370e63 - Copyright 2023 Fortra
[*] Getting machine hostname
[*] Querying RESEARCH for information about domain.
Name Email PasswordLastSet LastLogon
-------------------- ------------------------------ ------------------- -------------------
administrator 2020-04-14 15:38:29.414367 2024-01-30 15:28:04.144459
Guest <never> <never>
krbtgt 2020-03-31 16:19:36.435788 <never>
santino.benjamin 2020-07-31 12:37:20.832401 2020-07-31 12:38:00.066779
payton.harmon 2020-07-31 12:37:20.863648 2020-07-31 13:37:35.379278
trace.ryan 2020-07-31 12:37:20.894894 2020-07-31 13:41:57.957410
reginald.morton 2020-07-31 12:37:20.926140 2020-07-31 13:44:17.441779
eddie.stevens 2020-07-31 12:37:20.941778 2020-07-31 13:55:18.613721
cortez.hickman 2020-07-31 12:37:20.973013 2020-07-31 14:01:50.676194
chace.oneill 2020-07-31 12:37:21.004269 <never>
abril.suarez 2020-07-31 12:37:21.035516 2020-07-31 14:19:13.660534
savanah.velazquez 2020-07-31 12:37:21.051139 2020-07-31 14:21:28.238650
antony.russo 2020-07-31 12:37:21.082387 2020-07-31 14:35:15.129335
cameron.melendez 2020-07-31 12:37:21.113638 2020-07-31 14:37:21.363649
edith.walls 2020-07-31 12:37:21.144899 2020-07-31 14:39:36.348034
lane.wu 2020-07-31 12:37:21.160514 2020-07-31 14:42:18.004276
arielle.schultz 2020-07-31 12:37:21.191762 2020-07-31 14:43:02.598030
bobby.wolf 2020-07-31 12:37:21.223016 2020-07-31 14:43:55.785546
blaine.zavala 2020-07-31 12:37:21.238650 2020-07-31 14:44:13.816922
margaret.robinson 2020-07-31 12:37:21.269890 2020-07-31 14:44:36.598058
celia.moreno 2020-07-31 12:37:21.301141 2020-07-31 14:44:57.848034
kaitlynn.lee 2020-07-31 12:37:21.332394 2020-07-31 14:45:32.816793
kyler.arias 2020-07-31 12:37:21.348015 2020-07-31 14:45:48.176144
saniyah.roy 2020-07-31 12:37:21.379263 2020-07-31 14:46:02.535592
sarai.boone 2020-07-31 12:37:21.410522 2020-07-31 14:46:21.785531
jermaine.franco 2020-07-31 12:37:21.441771 2020-07-31 14:46:39.566796
alfred.chan 2020-07-31 12:37:21.457397 2020-07-31 14:46:55.035531
jamar.holt 2020-07-31 12:37:21.488678 2020-07-31 14:47:09.910949
sandra.wolfe 2020-07-31 12:37:21.519961 2020-07-31 14:47:24.285579
rene.larson 2020-07-31 12:37:21.551139 2020-07-31 14:47:39.410598
yareli.mcintyre 2020-07-31 12:37:21.566765 <never>
griffin.maddox 2020-07-31 12:37:21.598012 2020-07-31 14:48:16.223089
prince.hobbs 2020-07-31 12:37:21.629269 2020-07-31 14:48:32.566797
armando.nash 2020-07-31 12:37:21.660520 2020-07-31 14:48:49.785561
sonia.schneider 2020-07-31 12:37:21.676147 2020-07-31 14:49:11.285603
maeve.mann 2020-07-31 12:37:21.707395 2020-07-31 14:50:12.973042
lizeth.love 2020-07-31 12:37:21.738639 2020-07-31 14:50:46.269903
amare.serrano 2020-07-31 12:37:21.754271 2020-07-31 14:51:23.754278
savanah.knox 2020-07-31 12:37:21.785576 <never>
frederick.cuevas 2020-07-31 12:37:21.816762 2020-04-07 20:31:13.516564
marshall.skinner 2020-07-31 12:37:21.848018 <never>
edgar.jacobs 2020-04-09 15:04:50.235366 2020-08-10 12:01:52.814420
elisha.watts 2020-07-31 12:37:21.863647 <never>
belen.compton 2020-07-31 12:37:21.894888 2020-04-07 20:32:18.407216
amari.mora 2020-07-31 12:37:21.926138 <never>
cadence.conner 2020-07-31 12:37:21.957396 <never>
katelynn.costa 2020-07-31 12:37:21.973021 <never>
sage.henson 2020-07-31 12:37:22.004270 <never>
maren.guzman 2020-07-31 12:37:22.035522 <never>
natasha.mayer 2020-07-31 12:37:22.066774 <never>
chanel.bell 2020-07-31 12:37:22.082400 2020-04-07 20:18:50.750920
scarlett.parks 2020-07-31 12:37:22.113638 <never>
eliezer.jordan 2020-07-31 12:37:22.144894 <never>
dax.santiago 2020-07-31 12:37:22.160514 2020-04-07 20:19:54.563425
lillie.saunders 2020-07-31 12:37:22.191763 <never>
jayla.roberts 2020-07-31 12:37:22.223013 2020-04-07 20:09:33.907190
lorelei.huang 2020-07-31 12:37:22.254272 <never>
taniya.hardy 2020-07-31 12:37:22.269890 <never>
charlee.wilkinson 2020-07-31 12:37:22.301141 <never>
monique.moreno 2020-07-31 12:37:22.332393 <never>
desmond.bonilla 2020-07-31 12:37:22.348015 <never>
claudia.sharp 2020-07-31 12:37:22.379262 <never>
abbigail.turner 2020-07-31 12:37:22.410538 <never>
yaritza.riddle 2020-07-31 12:37:22.441767 <never>
tori.mora 2020-07-31 12:37:22.457390 <never>
hugo.forbes 2020-07-31 12:37:22.488638 <never>
jolie.lee 2020-07-31 12:37:22.519949 <never>
german.rice 2020-07-31 12:37:22.551142 <never>
zain.hopkins 2020-07-31 12:37:22.566770 <never>
hope.sharp 2020-04-09 09:16:47.188407 2024-01-30 14:53:56.769463
kylee.davila 2020-07-31 12:37:22.598018 <never>
melanie.santiago 2020-07-31 12:37:22.629263 <never>
hunter.kirby 2020-07-31 12:37:22.644897 <never>
annabelle.wells 2020-07-31 12:37:22.676144 <never>
ada.gillespie 2020-07-31 12:37:22.707389 <never>
gunnar.callahan 2020-07-31 12:37:22.738641 <never>
aarav.fry 2020-07-31 12:37:22.754321 <never>
colby.russell 2020-07-31 12:37:22.785523 <never>
eve.galvan 2020-07-31 12:37:22.816769 2020-04-07 20:23:00.422832
jeramiah.fritz 2020-07-31 12:37:22.832396 <never>
cade.austin 2020-07-31 12:37:22.863638 <never>
keely.lyons 2020-07-31 12:37:22.894894 <never>
abby.gonzalez 2020-07-31 12:37:22.910521 <never>
joy.costa 2020-07-31 12:37:22.941768 <never>
vincent.sutton 2020-07-31 12:37:22.973019 <never>
cesar.yang 2020-07-31 12:37:23.004264 <never>
camren.luna 2020-07-31 12:37:23.019889 <never>
tyshawn.peck 2020-07-31 12:37:23.051141 <never>
keith.hester 2020-07-31 12:37:23.082396 <never>
braeden.rasmussen 2020-07-31 12:37:23.098015 <never>
angel.atkinson 2020-07-31 12:37:23.129317 <never>
sierra.frye 2020-04-09 21:35:13.579043 2020-08-24 21:26:17.976970
maci.graves 2020-07-31 12:37:23.160519 <never>
judah.frye 2020-07-31 12:37:23.191766 <never>
tristen.christian 2020-07-31 12:37:23.207388 <never>
crystal.greer 2020-07-31 12:37:23.238638 <never>
kayley.ferguson 2020-07-31 12:37:23.285530 <never>
haven.summers 2020-07-31 12:37:23.316809 <never>
isabela.estrada 2020-07-31 12:37:23.348019 <never>
kaylin.bird 2020-07-31 12:37:23.363646 <never>
angie.duffy 2020-07-31 12:37:23.394892 2020-07-31 15:11:16.863650
claudia.pugh 2020-07-31 12:37:23.426137 2020-07-31 15:08:53.269898
jordan.gregory 2020-07-31 12:37:23.441769 2020-07-31 15:00:53.035525
web_svc 2020-04-09 14:59:11.329031 <never>
tristan.davies 2020-08-24 16:24:10.970589 2020-07-31 16:09:39.750310 As expected, the target organization uses the same naming convention; <FIRSTNAME>.<LASTNAME>
A total of 105 valid domain users have been discovered