LDAPDomainDump


Using one of the credentials, I can get an overview of the target domain using ldapdomaindump

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nagoya/ldapdomaindump]
└─$ ldapdomaindump nagoya.nagoya-industries.com -u 'NAGOYA-INDUSTRIES.COM\andrea.hayes' -p 'Nagoya2023' -n nagoya.nagoya-industries.com --no-json --no-grep 
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished

Complete

Computers


Users


All the 3 compromised accounts belongs to the employees group

Groups


These are the none default domain groups