Hokkaido_LDAPDomainDump

LDAPDomainDump

---

Using the credential of the compromised info account, I can use ldapdomaindump to get an overview about the target domain.

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/hokkaido/ldapdomaindump]
└─$ ldapdomaindump dc.hokkaido-aerospace.com -u 'HOKKAIDO-AEROSPACE.COM\info' -p 'info' -n dc.hokkaido-aerospace.com --no-json --no-grep 
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished

Complete

Computers

---

Users

---

Groups

---

Those are the none default groups There are groups relevant to WSUS, suggesting that the target system has WSUS installed