ldapsearch -H ldap://[IP] -x -s base namingcontexts
ldapsearch -H ldap://[IP] -x -b "DC=certified,DC=htb"
ldapsearch -H ldap://[IP] -x -b "DC=vintage,DC=htb" -D "P.Rosa@vintage.htb" -w "Rosaisbest123"
Username/Passwordspray/bruteforce
./kerbrute userenum --dc [IP] -d [domain] /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt