SMB

smbmap -H 192.168.210.16 -u melissa -p WinterIsHere2022!

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.5 | Shawn Evans - [email protected]
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB                                                                                                  
[*] Established 1 SMB connections(s) and 1 authenticated session(s)                                                      
                                                                                                                             
[+] IP: 192.168.210.16:445      Name: dc.internal.zsm.local     Status: Authenticated
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  READ ONLY       Remote Admin
        C$                                                      READ ONLY       Default share
        IPC$                                                    READ ONLY       Remote IPC
        NETLOGON                                                READ ONLY       Logon server share 
        SYSVOL                                                  READ ONLY       Logon server share 
[*] Closed 1 connections                                                                                                     

rpcclient -U "internal.zsm.local/melissa" 192.168.210.16
Password for [INTERNAL.ZSM.LOCAL\melissa]:
rpcclient $> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[mssql_svc] rid:[0x17d5]
user:[Emily] rid:[0x19c9]
user:[Laura] rid:[0x19ca]
user:[Melissa] rid:[0x19cb]
user:[Sarah] rid:[0x19cc]
user:[Amy] rid:[0x19cd]
user:[Steven] rid:[0x19ce]
user:[Malcolm] rid:[0x19cf]
user:[Aron] rid:[0x19d0]
user:[Matt] rid:[0x19d1]
user:[Jamie] rid:[0x19d2]

cat domusers | awk {'print$1'} | sed -n 's/.*\[\([^]]*\)\].*/\1/p'