389 LDAP

Dump all the data (including credentials) 
ldapsearch -x -h IP -b "dc=domain_name" "*"   
ldapsearch -x -h <IP> -D '' -w '' -b "DC=<1_SUBDOMAIN>,DC=<TDL>" 
ldapsearch -x -h <IP> -D '<DOMAIN>\<username>' -w '<password>' -b "DC=<1_SUBDOMAIN>,DC=<TDL>"
​

aspx with web.config RCE vuln

445 SMB

Last modified 1yr ago