π₯ "Hunting for Domain Admin: Kerberoasting, Credential Spraying, and AD Pivoting in Search" π₯
We began by doing an nmap scan of the machine using the command:
result=$(nmap -p- --min-rate=1000 -Pn -T4 10.129.229.114 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed 's/,$//' | tr -d '%');nmap -p$result -Pn
-sC -sV 10.129.229.114 -oA...