Quick and easy way to get domain usernames while on an internal network. RidRelay combines the SMB Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: Spins up an SMB server and waits for an incoming SMB connection The incoming credentials are relayed to …
Continue reading “RidRelay – Easy Way To Get Domain Usernames While On An Internal Network”