> For the complete documentation index, see [llms.txt](https://docs.wehost.co.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wehost.co.in/cybersecurity/password-spraying-making-a-target-user-list-active-directory.md).
# Password Spraying - Making a Target User List ACTIVE Directory
* By leveraging an SMB NULL session
* retrieve a complete list of domain users from the domain controller
* Utilizing an LDAP anonymous bind to query LDAP anonymously
* pull down the domain user list
* Use tool such as
* [Kerbrute](/cybersecurity/kerbrute.md) to validate users utilizing a word list
* from a source such as the
* [linkedin2username](/cybersecurity/linkedin2username.md)
* [statistically-likely-usernames](/cybersecurity/statistically-likely-usernames.md)
* [LLMNR Poisoning](/cybersecurity/llmnr-poisoning.md)
### Using enum4linux
#### SMB NULL Session to Pull User List
```shell-session
enum4linux -U 172.16.5.5 | grep "user:" | cut -f2 -d"[" | cut -f1 -d"]"
```
```shell-session
administrator
guest
krbtgt
```
### Using rpcclient
#### SMB NULL Session to Pull User List
```shell-session
rpcclient -U "" -N 172.16.5.5
```
```shell-session
enumdomusers
```
```
rpcclient -U "" -N 172.16.5.5
rpcclient $> enumdomusers user:[administrator] rid:[0x1f4] user:[guest] rid:[0x1f5]
```
### Using CrackMapExec --users Flag
#### SMB NULL Session to Pull User List
```shell-session
crackmapexec smb 172.16.5.5 --users
```
```
SMB 172.16.5.5 445 ACADEMY-EA-DC01 [*] Windows 10.0 Build 17763 x64 (name:ACADEMY-EA-DC01) (domain:INLANEFREIGHT.LOCAL) (signing:True) (SMBv1:False)
SMB 172.16.5.5 445 ACADEMY-EA-DC01 [+] Enumerated domain user(s)
SMB 172.16.5.5 445 ACADEMY-EA-DC01 INLANEFREIGHT.LOCAL\administrator badpwdcount: 0 baddpwdtime: 2022-01-10 13:23:09.463228
SMB 172.16.5.5 445 ACADEMY-EA-DC01 INLANEFREIGHT.LOCAL\guest badpwdcount: 0 baddpwdtime: 1600-12-31 19:03:58
SMB 172.16.5.5 445 ACADEMY-EA-DC01 INLANEFREIGHT.LOCAL\lab_adm
```
### Gathering Users with LDAP Anonymous
* Some examples include windapsearch and ldapsearch.
#### Using ldapsearch
```
ldapsearch -h 172.16.5.5 -x -b "DC=INLANEFREIGHT,DC=LOCAL" -s sub "(&(objectclass=user))" | grep sAMAccountName: | cut -f2 -d" "
```
### Using windapsearch
[windapsearch](/cybersecurity/windapsearch.md)
### Enumerating Users with Kerbrute
* look into [statistically-likely-usernames](/cybersecurity/statistically-likely-usernames.md) for username list
* [linkedin2username](/cybersecurity/linkedin2username.md)
* jsmith.txt is from this list
```shell-session
kerbrute userenum -d INLANEFREIGHT.LOCAL --dc 172.16.5.5 jsmith.txt
```
* Using Kerbrute for username enumeration will generate event ID [4768: A Kerberos authentication ticket (TGT) was requested](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768)
* will be triggered if [Kerberos event logging](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/enable-kerberos-event-logging) is enabled via Group Policy
### Credentialed Enumeration to Build our User List
* With valid credentials,
* can use any of the tools stated previously to build a user list. A quick and easy way is using CrackMapExec.
**Using CrackMapExec with Valid Credentials**
```shell-session
sudo crackmapexec smb 172.16.5.5 -u htb-student -p Academy_student_AD! --users
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.wehost.co.in/cybersecurity/password-spraying-making-a-target-user-list-active-directory.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.