Lion Cipher Lab
Read Impacket enumeration output: shares, users, and domain relationships in an AD lab
- Penetration Testing / Red Team
- Advanced
- ~40 min
- Free · no account required
Why it matters
In almost every real Active Directory intrusion, the attacker's very first move after getting one ordinary domain login is to enumerate — to ask the domain, over its own protocols, 'what shares exist, who are the users, which accounts run services, who is privileged?' Impacket is the toolkit both attackers and defenders use to do exactly that. As a defender you run the same scripts against your OWN domain to see what a single low-privilege account can discover, because whatever you can read here, so can anyone who phishes one password. Learning to READ this output — not just run the tool — is…
What you'll learn
- reading Impacket enumeration output (smbclient.py, GetADUsers.py, lookupsid.py, GetUserSPNs.py)
- spotting which SMB shares are exposed and which are sensitive, from a share listing
- reading an Active Directory account inventory: service accounts, disabled and never-expiring accounts
- interpreting SID-to-name output (RIDs, well-known groups, the domain SID) to map identities and privilege
- recognizing SPN-bearing service accounts as Kerberoast exposure — and the defensive fix (gMSA / strong passwords)
- turning authenticated-enumeration output into a concrete hardening list (share ACLs, service-account hygiene, least privilege)
- judgment: what protocol-level enumeration output does and does not tell you about your exposure
Steps in this lab
- What Impacket is, and why we're reading its output as a defender
- Ground rule: only ever against a domain you own
- Output 1 — the share listing (smbclient.py): what's exposed
- Output 2 — the account inventory (GetADUsers.py): who exists
- Output 3 — SID-to-name (lookupsid.py): identities and privilege
- Output 4 — service accounts with SPNs (GetUserSPNs.py): Kerberoast exposure
- The judgment: WHEN this output tells you your exposure, WHY it reveals so much, and HOW a pro hardens from it
- What you learned, and the one sentence to keep