
--os-release--
PRETTY_NAME="Ubuntu 22.04.5 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.5 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

--uname--
Linux dc.techvault.local 6.8.0-117-generic #117-Ubuntu SMP PREEMPT_DYNAMIC Tue May  5 19:26:24 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux

--hostname--
dc.techvault.local
dc.techvault.local

--versions--
Version 4.15.13-Ubuntu
Version 4.15.13-Ubuntu
Version 4.15.13-Ubuntu

--env--
AGENT_NAME=aptl-ad-agent
DEBIAN_FRONTEND=noninteractive
DNS_FORWARDER=172.20.1.22
HOME=/root
HOSTNAME=dc.techvault.local
LOG_FORMAT=syslog
LOG_PATHS=/var/log/samba/log.samba,/var/log/samba/log.smbd,/var/log/samba/log.winbindd
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PWD=/
SAMBA_ADMIN_PASSWORD=Admin123!
SAMBA_DOMAIN=TECHVAULT
SAMBA_REALM=TECHVAULT.LOCAL
SHLVL=0
SIEM_IP=172.20.2.30
WAZUH_MANAGER=wazuh.manager
_=/usr/bin/env

--samba-domain-info--
Forest           : techvault.local
Domain           : techvault.local
Netbios domain   : TECHVAULT
DC name          : dc.techvault.local
DC netbios name  : DC
Server site      : Default-First-Site-Name
Client site      : Default-First-Site-Name

--samba-domain-level--
Domain and forest function level for domain 'DC=techvault,DC=local'

Forest function level: (Windows) 2008 R2
Domain function level: (Windows) 2008 R2
Lowest function level of a DC: (Windows) 2008 R2

--samba-password-settings--
Password information for domain 'DC=techvault,DC=local'

Password complexity: on
Store plaintext passwords: off
Password history length: 24
Minimum password length: 7
Minimum password age (days): 1
Maximum password age (days): 42
Account lockout duration (mins): 30
Account lockout threshold (attempts): 10
Reset account lockout after (mins): 15

--samba-ou-list--
OU=Sales,OU=TechVault
OU=Executives,OU=TechVault
OU=Operations,OU=TechVault
OU=Engineering,OU=TechVault
OU=ServiceAccounts,OU=TechVault
OU=TechVault
OU=Domain Controllers

--samba-users--
Administrator
Guest
contractor.temp
david.kim
emily.chen
former.employee
james.rodriguez
krbtgt
lisa.chang
michael.thompson
robert.martinez
sarah.mitchell
svc-backup
svc-sql
svc-web

--samba-groups--
Account Operators
Administrators
Allowed RODC Password Replication Group
Backup Operators
Cert Publishers
Certificate Service DCOM Access
Cryptographic Operators
Denied RODC Password Replication Group
Distributed COM Users
DnsAdmins
DnsUpdateProxy
Domain Admins
Domain Computers
Domain Controllers
Domain Guests
Domain Users
Engineering
Enterprise Admins
Enterprise Read-only Domain Controllers
Event Log Readers
Executives
Finance
Group Policy Creator Owners
Guests
HR
IIS_IUSRS
IT-Admins
Incoming Forest Trust Builders
Network Configuration Operators
Performance Log Users
Performance Monitor Users
Pre-Windows 2000 Compatible Access
Print Operators
RAS and IAS Servers
Read-only Domain Controllers
Remote Desktop Users
Remote-Desktop
Replicator
Sales
Schema Admins
Server Operators
Terminal Server License Servers
Users
VPN-Users
Windows Authorization Access Group

--samba-group-members--
[Domain Admins]
Administrator
emily.chen
svc-backup
[IT-Admins]
david.kim
emily.chen
james.rodriguez
[Engineering]
contractor.temp
david.kim
emily.chen
michael.thompson
[Sales]
lisa.chang
robert.martinez
[HR]
[Finance]
[Executives]
james.rodriguez
lisa.chang
sarah.mitchell
[VPN-Users]
contractor.temp
[Remote-Desktop]
contractor.temp
[Domain Users]
Administrator
contractor.temp
david.kim
emily.chen
former.employee
james.rodriguez
krbtgt
lisa.chang
michael.thompson
robert.martinez
sarah.mitchell
svc-backup
svc-sql
svc-web

--samba-user-details--
[Administrator]
dn: CN=Administrator,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Administrator
description: Built-in account for administering the computer/domain
instanceType: 4
whenCreated: 20260611160030.0Z
uSNCreated: 3853
name: Administrator
objectGUID: 8e0211ed-6b26-48ee-892e-70826774c0df
userAccountControl: 512
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
pwdLastSet: 134256672307442250
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-500
adminCount: 1
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: Administrator
sAMAccountType: 805306368
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
isCriticalSystemObject: TRUE
memberOf: CN=Domain Admins,CN=Users,DC=techvault,DC=local
memberOf: CN=Schema Admins,CN=Users,DC=techvault,DC=local
memberOf: CN=Enterprise Admins,CN=Users,DC=techvault,DC=local
memberOf: CN=Group Policy Creator Owners,CN=Users,DC=techvault,DC=local
memberOf: CN=Administrators,CN=Builtin,DC=techvault,DC=local
lastLogonTimestamp: 134257211162388130
whenChanged: 20260612065836.0Z
uSNChanged: 4147
distinguishedName: CN=Administrator,CN=Users,DC=techvault,DC=local

[Guest]
dn: CN=Guest,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Guest
description: Built-in account for guest access to the computer/domain
instanceType: 4
whenCreated: 20260611160030.0Z
whenChanged: 20260611160030.0Z
uSNCreated: 3854
uSNChanged: 3854
name: Guest
objectGUID: 2c8adb62-b085-4ecc-ad76-1402639dd6d6
userAccountControl: 66082
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
pwdLastSet: 0
primaryGroupID: 514
objectSid: S-1-5-21-1195619382-146717913-1119826051-501
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: Guest
sAMAccountType: 805306368
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
isCriticalSystemObject: TRUE
memberOf: CN=Guests,CN=Builtin,DC=techvault,DC=local
distinguishedName: CN=Guest,CN=Users,DC=techvault,DC=local

[krbtgt]
dn: CN=krbtgt,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: krbtgt
description: Key Distribution Center Service Account
instanceType: 4
whenCreated: 20260611160030.0Z
whenChanged: 20260611160030.0Z
uSNCreated: 3855
uSNChanged: 3855
showInAdvancedViewOnly: TRUE
name: krbtgt
objectGUID: 5498f0ff-ebcf-4b7d-84e2-c46a011044b6
userAccountControl: 514
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
pwdLastSet: 134256672307567310
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-502
adminCount: 1
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: krbtgt
sAMAccountType: 805306368
servicePrincipalName: kadmin/changepw
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
isCriticalSystemObject: TRUE
memberOf: CN=Denied RODC Password Replication Group,CN=Users,DC=techvault,DC=local
distinguishedName: CN=krbtgt,CN=Users,DC=techvault,DC=local

[sarah.mitchell]
dn: CN=Sarah Mitchell,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Sarah Mitchell
sn: Mitchell
title: CEO
givenName: Sarah
instanceType: 4
whenCreated: 20260611160039.0Z
whenChanged: 20260611160039.0Z
displayName: Sarah Mitchell
uSNCreated: 4086
department: Executive
company: TechVault Solutions
name: Sarah Mitchell
objectGUID: b468bc84-9474-4df6-89fb-ad909a8a4f44
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-1111
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: sarah.mitchell
sAMAccountType: 805306368
userPrincipalName: sarah.mitchell@techvault.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
mail: sarah.mitchell@techvault.local
pwdLastSet: 134256672395884920
userAccountControl: 512
uSNChanged: 4088
memberOf: CN=Executives,CN=Users,DC=techvault,DC=local
distinguishedName: CN=Sarah Mitchell,CN=Users,DC=techvault,DC=local

[james.rodriguez]
dn: CN=James Rodriguez,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: James Rodriguez
sn: Rodriguez
title: CTO
givenName: James
instanceType: 4
whenCreated: 20260611160040.0Z
whenChanged: 20260611160040.0Z
displayName: James Rodriguez
uSNCreated: 4090
department: Executive
company: TechVault Solutions
name: James Rodriguez
objectGUID: 66bfdbcc-a972-48be-8330-35adece143a2
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-1112
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: james.rodriguez
sAMAccountType: 805306368
userPrincipalName: james.rodriguez@techvault.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
mail: james.rodriguez@techvault.local
pwdLastSet: 134256672405034500
userAccountControl: 512
uSNChanged: 4092
memberOf: CN=Executives,CN=Users,DC=techvault,DC=local
memberOf: CN=IT-Admins,CN=Users,DC=techvault,DC=local
distinguishedName: CN=James Rodriguez,CN=Users,DC=techvault,DC=local

[lisa.chang]
dn: CN=Lisa Chang,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Lisa Chang
sn: Chang
title: VP of Sales
givenName: Lisa
instanceType: 4
whenCreated: 20260611160041.0Z
whenChanged: 20260611160041.0Z
displayName: Lisa Chang
uSNCreated: 4095
department: Sales
company: TechVault Solutions
name: Lisa Chang
objectGUID: ad324ae3-d7ad-4d18-bb38-2d7711ff9c1f
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-1113
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: lisa.chang
sAMAccountType: 805306368
userPrincipalName: lisa.chang@techvault.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
mail: lisa.chang@techvault.local
pwdLastSet: 134256672419233670
userAccountControl: 512
uSNChanged: 4097
memberOf: CN=Executives,CN=Users,DC=techvault,DC=local
memberOf: CN=Sales,CN=Users,DC=techvault,DC=local
distinguishedName: CN=Lisa Chang,CN=Users,DC=techvault,DC=local

[emily.chen]
dn: CN=Emily Chen,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Emily Chen
sn: Chen
title: DevOps Lead
givenName: Emily
instanceType: 4
whenCreated: 20260611160043.0Z
whenChanged: 20260611160043.0Z
displayName: Emily Chen
uSNCreated: 4100
department: Engineering
company: TechVault Solutions
name: Emily Chen
objectGUID: a05c9380-0cfc-49f7-893f-3004d9ac90b7
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-1114
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: emily.chen
sAMAccountType: 805306368
userPrincipalName: emily.chen@techvault.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
mail: emily.chen@techvault.local
pwdLastSet: 134256672432473880
userAccountControl: 512
uSNChanged: 4102
memberOf: CN=Engineering,CN=Users,DC=techvault,DC=local
memberOf: CN=IT-Admins,CN=Users,DC=techvault,DC=local
memberOf: CN=Domain Admins,CN=Users,DC=techvault,DC=local
distinguishedName: CN=Emily Chen,CN=Users,DC=techvault,DC=local

[michael.thompson]
dn: CN=Michael Thompson,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Michael Thompson
sn: Thompson
title: Senior Developer
givenName: Michael
instanceType: 4
whenCreated: 20260611160044.0Z
whenChanged: 20260611160044.0Z
displayName: Michael Thompson
uSNCreated: 4106
department: Engineering
company: TechVault Solutions
name: Michael Thompson
objectGUID: 2f098bbb-ae19-4209-ad61-53341d073945
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-1115
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: michael.thompson
sAMAccountType: 805306368
userPrincipalName: michael.thompson@techvault.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
mail: michael.thompson@techvault.local
pwdLastSet: 134256672448124040
userAccountControl: 512
uSNChanged: 4108
memberOf: CN=Engineering,CN=Users,DC=techvault,DC=local
distinguishedName: CN=Michael Thompson,CN=Users,DC=techvault,DC=local

[david.kim]
dn: CN=David Kim,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: David Kim
sn: Kim
title: Security Engineer
givenName: David
instanceType: 4
whenCreated: 20260611160045.0Z
whenChanged: 20260611160045.0Z
displayName: David Kim
uSNCreated: 4110
department: Engineering
company: TechVault Solutions
name: David Kim
objectGUID: 32067819-630b-4776-a094-20fc731e8b27
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-1116
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: david.kim
sAMAccountType: 805306368
userPrincipalName: david.kim@techvault.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
mail: david.kim@techvault.local
pwdLastSet: 134256672455168050
userAccountControl: 512
uSNChanged: 4112
memberOf: CN=Engineering,CN=Users,DC=techvault,DC=local
memberOf: CN=IT-Admins,CN=Users,DC=techvault,DC=local
distinguishedName: CN=David Kim,CN=Users,DC=techvault,DC=local

[jessica.williams]
[robert.martinez]
dn: CN=Robert Martinez,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Robert Martinez
sn: Martinez
title: Marketing Manager
givenName: Robert
instanceType: 4
whenCreated: 20260611160047.0Z
whenChanged: 20260611160047.0Z
displayName: Robert Martinez
uSNCreated: 4115
department: Sales
company: TechVault Solutions
name: Robert Martinez
objectGUID: 9ca8d582-4e22-4982-b1c0-6fc5588da187
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-1117
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: robert.martinez
sAMAccountType: 805306368
userPrincipalName: robert.martinez@techvault.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
mail: robert.martinez@techvault.local
pwdLastSet: 134256672474892760
userAccountControl: 512
uSNChanged: 4117
memberOf: CN=Sales,CN=Users,DC=techvault,DC=local
distinguishedName: CN=Robert Martinez,CN=Users,DC=techvault,DC=local

[svc-sql]
dn: CN=SQL Service,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: SQL Service
sn: Service
description: SQL Server Service Account
givenName: SQL
instanceType: 4
whenCreated: 20260611160048.0Z
displayName: SQL Service
uSNCreated: 4119
name: SQL Service
objectGUID: 8154d3ce-bebe-4983-8719-e7b8cf3f1b7b
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-1118
logonCount: 0
sAMAccountName: svc-sql
sAMAccountType: 805306368
userPrincipalName: svc-sql@techvault.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
pwdLastSet: 134256672482201300
userAccountControl: 66048
accountExpires: 0
servicePrincipalName: MSSQLSvc/db.techvault.local:1433
servicePrincipalName: MSSQLSvc/db.techvault.local
whenChanged: 20260611160049.0Z
uSNChanged: 4124
distinguishedName: CN=SQL Service,CN=Users,DC=techvault,DC=local

[svc-web]
dn: CN=Web Service,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Web Service
sn: Service
description: Web Application Service Account
givenName: Web
instanceType: 4
whenCreated: 20260611160049.0Z
displayName: Web Service
uSNCreated: 4125
name: Web Service
objectGUID: ad1f0583-e34e-444c-b926-76fb9447abe9
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-1119
logonCount: 0
sAMAccountName: svc-web
sAMAccountType: 805306368
userPrincipalName: svc-web@techvault.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
pwdLastSet: 134256672496576350
userAccountControl: 66048
accountExpires: 0
whenChanged: 20260611160050.0Z
servicePrincipalName: HTTP/webapp.techvault.local
uSNChanged: 4129
distinguishedName: CN=Web Service,CN=Users,DC=techvault,DC=local

[svc-backup]
dn: CN=Backup Service,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Backup Service
sn: Service
description: Backup Service - NEEDS PRIVILEGE REVIEW
givenName: Backup
instanceType: 4
whenCreated: 20260611160050.0Z
displayName: Backup Service
uSNCreated: 4130
name: Backup Service
objectGUID: 1d5a6047-ea24-40b6-9fe4-d4fe006cff13
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-1120
logonCount: 0
sAMAccountName: svc-backup
sAMAccountType: 805306368
userPrincipalName: svc-backup@techvault.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
pwdLastSet: 134256672507355030
userAccountControl: 66048
accountExpires: 0
whenChanged: 20260611160051.0Z
uSNChanged: 4133
memberOf: CN=Domain Admins,CN=Users,DC=techvault,DC=local
distinguishedName: CN=Backup Service,CN=Users,DC=techvault,DC=local

[contractor.temp]
dn: CN=Temp Contractor,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Temp Contractor
sn: Contractor
title: External Contractor
description: Temporary contractor - TODO: disable after project ends
givenName: Temp
instanceType: 4
whenCreated: 20260611160051.0Z
whenChanged: 20260611160051.0Z
displayName: Temp Contractor
uSNCreated: 4135
name: Temp Contractor
objectGUID: e281e8d0-929e-4a7c-bbac-9bdca82c9e65
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-1121
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: contractor.temp
sAMAccountType: 805306368
userPrincipalName: contractor.temp@techvault.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
pwdLastSet: 134256672517217550
userAccountControl: 512
uSNChanged: 4137
memberOf: CN=VPN-Users,CN=Users,DC=techvault,DC=local
memberOf: CN=Remote-Desktop,CN=Users,DC=techvault,DC=local
memberOf: CN=Engineering,CN=Users,DC=techvault,DC=local
distinguishedName: CN=Temp Contractor,CN=Users,DC=techvault,DC=local

[former.employee]
dn: CN=Former Employee,CN=Users,DC=techvault,DC=local
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Former Employee
sn: Employee
title: Former Employee
description: Account should have been deleted in Q2
givenName: Former
instanceType: 4
whenCreated: 20260611160053.0Z
whenChanged: 20260611160053.0Z
displayName: Former Employee
uSNCreated: 4141
name: Former Employee
objectGUID: 78182aaf-d6ac-441c-8400-85410120a8ab
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-1195619382-146717913-1119826051-1122
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: former.employee
sAMAccountType: 805306368
userPrincipalName: former.employee@techvault.local
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=techvault,DC=local
pwdLastSet: 134256672530072750
userAccountControl: 512
uSNChanged: 4143
distinguishedName: CN=Former Employee,CN=Users,DC=techvault,DC=local


--samba-spns--
[svc-sql]
svc-sql
User CN=SQL Service,CN=Users,DC=techvault,DC=local has the following servicePrincipalName:
	 MSSQLSvc/db.techvault.local:1433
	 MSSQLSvc/db.techvault.local
[svc-web]
svc-web
User CN=Web Service,CN=Users,DC=techvault,DC=local has the following servicePrincipalName:
	 HTTP/webapp.techvault.local

--listeners--
Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess
udp   UNCONN 0      0         127.0.0.11:39762      0.0.0.0:*
udp   UNCONN 0      0            0.0.0.0:58642      0.0.0.0:*
udp   UNCONN 0      0            0.0.0.0:53         0.0.0.0:*    users:(("dns[master]",pid=209,fd=50))
udp   UNCONN 0      0        172.20.2.10:88         0.0.0.0:*    users:(("kdc(3",pid=204,fd=43),("kdc(2",pid=200,fd=43),("kdc(1",pid=194,fd=43),("kdc(0",pid=190,fd=43),("kdc[master]",pid=186,fd=43))
udp   UNCONN 0      0            0.0.0.0:88         0.0.0.0:*    users:(("kdc(3",pid=204,fd=40),("kdc(2",pid=200,fd=40),("kdc(1",pid=194,fd=40),("kdc(0",pid=190,fd=40),("kdc[master]",pid=186,fd=40))
udp   UNCONN 0      0        172.20.2.10:137        0.0.0.0:*    users:(("nbt[master]",pid=170,fd=29))
udp   UNCONN 0      0       172.20.2.255:137        0.0.0.0:*    users:(("nbt[master]",pid=170,fd=28))
udp   UNCONN 0      0            0.0.0.0:137        0.0.0.0:*    users:(("nbt[master]",pid=170,fd=22))
udp   UNCONN 0      0        172.20.2.10:138        0.0.0.0:*    users:(("nbt[master]",pid=170,fd=31))
udp   UNCONN 0      0       172.20.2.255:138        0.0.0.0:*    users:(("nbt[master]",pid=170,fd=30))
udp   UNCONN 0      0            0.0.0.0:138        0.0.0.0:*    users:(("nbt[master]",pid=170,fd=26))
udp   UNCONN 0      0        172.20.2.10:389        0.0.0.0:*    users:(("cldap[master]",pid=182,fd=34))
udp   UNCONN 0      0            0.0.0.0:389        0.0.0.0:*    users:(("cldap[master]",pid=182,fd=32))
udp   UNCONN 0      0        172.20.2.10:464        0.0.0.0:*    users:(("kdc(3",pid=204,fd=44),("kdc(2",pid=200,fd=44),("kdc(1",pid=194,fd=44),("kdc(0",pid=190,fd=44),("kdc[master]",pid=186,fd=44))
udp   UNCONN 0      0            0.0.0.0:464        0.0.0.0:*    users:(("kdc(3",pid=204,fd=42),("kdc(2",pid=200,fd=42),("kdc(1",pid=194,fd=42),("kdc(0",pid=190,fd=42),("kdc[master]",pid=186,fd=42))
udp   UNCONN 0      0               [::]:53            [::]:*    users:(("dns[master]",pid=209,fd=48))
udp   UNCONN 0      0               [::]:88            [::]:*    users:(("kdc(3",pid=204,fd=36),("kdc(2",pid=200,fd=36),("kdc(1",pid=194,fd=36),("kdc(0",pid=190,fd=36),("kdc[master]",pid=186,fd=36))
udp   UNCONN 0      0               [::]:389           [::]:*    users:(("cldap[master]",pid=182,fd=22))
udp   UNCONN 0      0               [::]:464           [::]:*    users:(("kdc(3",pid=204,fd=38),("kdc(2",pid=200,fd=38),("kdc(1",pid=194,fd=38),("kdc(0",pid=190,fd=38),("kdc[master]",pid=186,fd=38))
tcp   LISTEN 0      10           0.0.0.0:49154      0.0.0.0:*    users:(("rpc(0",pid=173,fd=30))
tcp   LISTEN 0      10           0.0.0.0:49153      0.0.0.0:*    users:(("rpc(0",pid=173,fd=15))
tcp   LISTEN 0      10           0.0.0.0:49152      0.0.0.0:*    users:(("rpc(3",pid=185,fd=26),("rpc(2",pid=181,fd=26),("rpc(1",pid=177,fd=26),("rpc(0",pid=173,fd=26),("rpc[master]",pid=167,fd=26))
tcp   LISTEN 0      4096      127.0.0.11:34103      0.0.0.0:*
tcp   LISTEN 0      10           0.0.0.0:3269       0.0.0.0:*    users:(("ldap(3",pid=292,fd=38),("ldap(2",pid=290,fd=38),("ldap(1",pid=288,fd=38),("ldap(0",pid=286,fd=38),("ldap[master]",pid=178,fd=38))
tcp   LISTEN 0      10           0.0.0.0:3268       0.0.0.0:*    users:(("ldap(3",pid=292,fd=37),("ldap(2",pid=290,fd=37),("ldap(1",pid=288,fd=37),("ldap(0",pid=286,fd=37),("ldap[master]",pid=178,fd=37))
tcp   LISTEN 0      10           0.0.0.0:389        0.0.0.0:*    users:(("ldap(3",pid=292,fd=35),("ldap(2",pid=290,fd=35),("ldap(1",pid=288,fd=35),("ldap(0",pid=286,fd=35),("ldap[master]",pid=178,fd=35))
tcp   LISTEN 0      50           0.0.0.0:445        0.0.0.0:*    users:(("smbd",pid=168,fd=48))
tcp   LISTEN 0      10           0.0.0.0:464        0.0.0.0:*    users:(("kdc(3",pid=204,fd=41),("kdc(2",pid=200,fd=41),("kdc(1",pid=194,fd=41),("kdc(0",pid=190,fd=41),("kdc[master]",pid=186,fd=41))
tcp   LISTEN 0      10           0.0.0.0:53         0.0.0.0:*    users:(("dns[master]",pid=209,fd=49))
tcp   LISTEN 0      10           0.0.0.0:88         0.0.0.0:*    users:(("kdc(3",pid=204,fd=39),("kdc(2",pid=200,fd=39),("kdc(1",pid=194,fd=39),("kdc(0",pid=190,fd=39),("kdc[master]",pid=186,fd=39))
tcp   LISTEN 0      10           0.0.0.0:135        0.0.0.0:*    users:(("rpc(0",pid=173,fd=34))
tcp   LISTEN 0      50           0.0.0.0:139        0.0.0.0:*    users:(("smbd",pid=168,fd=49))
tcp   LISTEN 0      10           0.0.0.0:636        0.0.0.0:*    users:(("ldap(3",pid=292,fd=36),("ldap(2",pid=290,fd=36),("ldap(1",pid=288,fd=36),("ldap(0",pid=286,fd=36),("ldap[master]",pid=178,fd=36))
tcp   LISTEN 0      10              [::]:49154         [::]:*    users:(("rpc(0",pid=173,fd=25))
tcp   LISTEN 0      10              [::]:49153         [::]:*    users:(("rpc(0",pid=173,fd=14))
tcp   LISTEN 0      10              [::]:49152         [::]:*    users:(("rpc(3",pid=185,fd=24),("rpc(2",pid=181,fd=24),("rpc(1",pid=177,fd=24),("rpc(0",pid=173,fd=24),("rpc[master]",pid=167,fd=24))
tcp   LISTEN 0      10              [::]:3269          [::]:*    users:(("ldap(3",pid=292,fd=34),("ldap(2",pid=290,fd=34),("ldap(1",pid=288,fd=34),("ldap(0",pid=286,fd=34),("ldap[master]",pid=178,fd=34))
tcp   LISTEN 0      10              [::]:3268          [::]:*    users:(("ldap(3",pid=292,fd=33),("ldap(2",pid=290,fd=33),("ldap(1",pid=288,fd=33),("ldap(0",pid=286,fd=33),("ldap[master]",pid=178,fd=33))
tcp   LISTEN 0      10              [::]:389           [::]:*    users:(("ldap(3",pid=292,fd=30),("ldap(2",pid=290,fd=30),("ldap(1",pid=288,fd=30),("ldap(0",pid=286,fd=30),("ldap[master]",pid=178,fd=30))
tcp   LISTEN 0      50              [::]:445           [::]:*    users:(("smbd",pid=168,fd=46))
tcp   LISTEN 0      10              [::]:464           [::]:*    users:(("kdc(3",pid=204,fd=37),("kdc(2",pid=200,fd=37),("kdc(1",pid=194,fd=37),("kdc(0",pid=190,fd=37),("kdc[master]",pid=186,fd=37))
tcp   LISTEN 0      10              [::]:53            [::]:*    users:(("dns[master]",pid=209,fd=46))
tcp   LISTEN 0      10              [::]:88            [::]:*    users:(("kdc(3",pid=204,fd=34),("kdc(2",pid=200,fd=34),("kdc(1",pid=194,fd=34),("kdc(0",pid=190,fd=34),("kdc[master]",pid=186,fd=34))
tcp   LISTEN 0      10              [::]:135           [::]:*    users:(("rpc(0",pid=173,fd=33))
tcp   LISTEN 0      50              [::]:139           [::]:*    users:(("smbd",pid=168,fd=47))
tcp   LISTEN 0      10              [::]:636           [::]:*    users:(("ldap(3",pid=292,fd=32),("ldap(2",pid=290,fd=32),("ldap(1",pid=288,fd=32),("ldap(0",pid=286,fd=32),("ldap[master]",pid=178,fd=32))
State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess
UNCONN 0      0         127.0.0.11:39762      0.0.0.0:*
UNCONN 0      0            0.0.0.0:58642      0.0.0.0:*
UNCONN 0      0            0.0.0.0:53         0.0.0.0:*    users:(("dns[master]",pid=209,fd=50))
UNCONN 0      0        172.20.2.10:88         0.0.0.0:*    users:(("kdc(3",pid=204,fd=43),("kdc(2",pid=200,fd=43),("kdc(1",pid=194,fd=43),("kdc(0",pid=190,fd=43),("kdc[master]",pid=186,fd=43))
UNCONN 0      0            0.0.0.0:88         0.0.0.0:*    users:(("kdc(3",pid=204,fd=40),("kdc(2",pid=200,fd=40),("kdc(1",pid=194,fd=40),("kdc(0",pid=190,fd=40),("kdc[master]",pid=186,fd=40))
UNCONN 0      0        172.20.2.10:137        0.0.0.0:*    users:(("nbt[master]",pid=170,fd=29))
UNCONN 0      0       172.20.2.255:137        0.0.0.0:*    users:(("nbt[master]",pid=170,fd=28))
UNCONN 0      0            0.0.0.0:137        0.0.0.0:*    users:(("nbt[master]",pid=170,fd=22))
UNCONN 0      0        172.20.2.10:138        0.0.0.0:*    users:(("nbt[master]",pid=170,fd=31))
UNCONN 0      0       172.20.2.255:138        0.0.0.0:*    users:(("nbt[master]",pid=170,fd=30))
UNCONN 0      0            0.0.0.0:138        0.0.0.0:*    users:(("nbt[master]",pid=170,fd=26))
UNCONN 0      0        172.20.2.10:389        0.0.0.0:*    users:(("cldap[master]",pid=182,fd=34))
UNCONN 0      0            0.0.0.0:389        0.0.0.0:*    users:(("cldap[master]",pid=182,fd=32))
UNCONN 0      0        172.20.2.10:464        0.0.0.0:*    users:(("kdc(3",pid=204,fd=44),("kdc(2",pid=200,fd=44),("kdc(1",pid=194,fd=44),("kdc(0",pid=190,fd=44),("kdc[master]",pid=186,fd=44))
UNCONN 0      0            0.0.0.0:464        0.0.0.0:*    users:(("kdc(3",pid=204,fd=42),("kdc(2",pid=200,fd=42),("kdc(1",pid=194,fd=42),("kdc(0",pid=190,fd=42),("kdc[master]",pid=186,fd=42))
UNCONN 0      0               [::]:53            [::]:*    users:(("dns[master]",pid=209,fd=48))
UNCONN 0      0               [::]:88            [::]:*    users:(("kdc(3",pid=204,fd=36),("kdc(2",pid=200,fd=36),("kdc(1",pid=194,fd=36),("kdc(0",pid=190,fd=36),("kdc[master]",pid=186,fd=36))
UNCONN 0      0               [::]:389           [::]:*    users:(("cldap[master]",pid=182,fd=22))
UNCONN 0      0               [::]:464           [::]:*    users:(("kdc(3",pid=204,fd=38),("kdc(2",pid=200,fd=38),("kdc(1",pid=194,fd=38),("kdc(0",pid=190,fd=38),("kdc[master]",pid=186,fd=38))

--processes--
    PID    PPID USER     GROUP    COMMAND         COMMAND
      1       0 root     root     supervisord     /usr/bin/python3 /usr/bin/supervisord -n -c /etc/supervisor/supervisord.conf
    135       1 syslog   syslog   rsyslogd        /usr/sbin/rsyslogd -n
    136       1 root     root     samba           samba: root process
    163     136 root     root     tfork(164)      samba: tfork waiter process(164)
    164     163 root     root     s3fs[master]    samba: task[s3fs] pre-fork master
    165     136 root     root     tfork(167)      samba: tfork waiter process(167)
    166     164 root     root     tfork(168)      samba: tfork waiter process(168)
    167     165 root     root     rpc[master]     samba: task[rpc] pre-fork master
    168     166 root     root     smbd            /usr/sbin/smbd -D --option=server role check:inhibit=yes --foreground
    169     136 root     root     tfork(170)      samba: tfork waiter process(170)
    170     169 root     root     nbt[master]     samba: task[nbt] pre-fork master
    171     167 root     root     tfork(173)      samba: tfork waiter process(173)
    172     136 root     root     tfork(174)      samba: tfork waiter process(174)
    173     171 root     root     rpc(0)          samba: task[rpc] pre-forked worker(0)
    174     172 root     root     wrepl[master]   samba: task[wrepl] pre-fork master
    175     167 root     root     tfork(177)      samba: tfork waiter process(177)
    176     136 root     root     tfork(178)      samba: tfork waiter process(178)
    177     175 root     root     rpc(1)          samba: task[rpc] pre-forked worker(1)
    178     176 root     root     ldap[master]    samba: task[ldap] pre-fork master
    179     167 root     root     tfork(181)      samba: tfork waiter process(181)
    180     136 root     root     tfork(182)      samba: tfork waiter process(182)
    181     179 root     root     rpc(2)          samba: task[rpc] pre-forked worker(2)
    182     180 root     root     cldap[master]   samba: task[cldap] pre-fork master
    183     136 root     root     tfork(186)      samba: tfork waiter process(186)
    184     167 root     root     tfork(185)      samba: tfork waiter process(185)
    185     184 root     root     rpc(3)          samba: task[rpc] pre-forked worker(3)
    186     183 root     root     kdc[master]     samba: task[kdc] pre-fork master
    187     136 root     root     tfork(189)      samba: tfork waiter process(189)
    188     186 root     root     tfork(190)      samba: tfork waiter process(190)
    189     187 root     root     drepl[master]   samba: task[drepl] pre-fork master
    190     188 root     root     kdc(0)          samba: task[kdc] pre-forked worker(0)
    191     136 root     root     tfork(193)      samba: tfork waiter process(193)
    192     186 root     root     tfork(194)      samba: tfork waiter process(194)
    193     191 root     root     winbindd[master samba: task[winbindd] pre-fork master
    194     192 root     root     kdc(1)          samba: task[kdc] pre-forked worker(1)
    195     136 root     root     tfork(198)      samba: tfork waiter process(198)
    196     186 root     root     tfork(200)      samba: tfork waiter process(200)
    197     193 root     root     tfork(199)      samba: tfork waiter process(199)
    198     195 root     root     ntp_signd[maste samba: task[ntp_signd] pre-fork master
    199     197 root     root     winbindd        /usr/sbin/winbindd -D --option=server role check:inhibit=yes --foreground
    200     196 root     root     kdc(2)          samba: task[kdc] pre-forked worker(2)
    201     136 root     root     tfork(203)      samba: tfork waiter process(203)
    202     186 root     root     tfork(204)      samba: tfork waiter process(204)
    203     201 root     root     kcc[master]     samba: task[kcc] pre-fork master
    204     202 root     root     kdc(3)          samba: task[kdc] pre-forked worker(3)
    205     136 root     root     tfork(206)      samba: tfork waiter process(206)
    206     205 root     root     dnsupdate[maste samba: task[dnsupdate] pre-fork master
    207     136 root     root     tfork(209)      samba: tfork waiter process(209)
    209     207 root     root     dns[master]     samba: task[dns] pre-fork master
    232     168 root     root     smbd-notifyd    /usr/sbin/smbd -D --option=server role check:inhibit=yes --foreground
    235     168 root     root     cleanupd        /usr/sbin/smbd -D --option=server role check:inhibit=yes --foreground
    254     199 root     root     winbindd        winbindd: domain child [TECHVAULT]
    255     199 root     root     winbindd        winbindd: idmap child
    256     168 root     root     samba-bgqd      /usr/lib/x86_64-linux-gnu/samba/samba-bgqd --ready-signal-fd=47 --parent-watch-fd=13 --debuglevel=0 -F
    285     178 root     root     tfork(286)      samba: tfork waiter process(286)
    286     285 root     root     ldap(0)         samba: task[ldap] pre-forked worker(0)
    287     178 root     root     tfork(288)      samba: tfork waiter process(288)
    288     287 root     root     ldap(1)         samba: task[ldap] pre-forked worker(1)
    289     178 root     root     tfork(290)      samba: tfork waiter process(290)
    290     289 root     root     ldap(2)         samba: task[ldap] pre-forked worker(2)
    291     178 root     root     tfork(292)      samba: tfork waiter process(292)
    292     291 root     root     ldap(3)         samba: task[ldap] pre-forked worker(3)
    493       1 root     root     wazuh-agent.sh  /bin/bash /opt/aptl/wazuh/wazuh-agent.sh
    543       1 root     wazuh    wazuh-execd     /var/ossec/bin/wazuh-execd
    551       1 wazuh    wazuh    wazuh-agentd    /var/ossec/bin/wazuh-agentd
    573       1 root     wazuh    wazuh-syscheckd /var/ossec/bin/wazuh-syscheckd
    590       1 root     wazuh    wazuh-logcollec /var/ossec/bin/wazuh-logcollector
    604       1 root     wazuh    wazuh-modulesd  /var/ossec/bin/wazuh-modulesd
    665     493 root     root     tail            tail -F /var/ossec/logs/ossec.log
  29413       0 root     root     bash            bash -lc      set +e     section() { printf "\n--%s--\n" "$1"; }     section os-release; cat /etc/os-release     section uname; uname -a     section hostname; hostname; hostname -f 2>/dev/null || true     section versions; samba --version; smbd --version; winbindd --version; krb5-config --version 2>/dev/null || true     section env; env | sort     section samba-domain-info; samba-tool domain info 127.0.0.1     section samba-domain-level; samba-tool domain level show     section samba-password-settings; samba-tool domain passwordsettings show     section samba-ou-list; samba-tool ou list 2>/dev/null || true     section samba-users; samba-tool user list | sort     section samba-groups; samba-tool group list | sort     section samba-group-members; for g in "Domain Admins" "IT-Admins" Engineering Sales HR Finance Executives VPN-Users Remote-Desktop "Domain Users"; do echo "[$g]"; samba-tool group listmembers "$g" 2>/dev/null | sort || true; done     section samba-user-details; for u in Administrator Guest krbtgt sarah.mitchell james.rodriguez lisa.chang emily.chen michael.thompson david.kim jessica.williams robert.martinez svc-sql svc-web svc-backup contractor.temp former.employee; do echo "[$u]"; samba-tool user show "$u" 2>/dev/null || true; done     section samba-spns; for u in svc-sql svc-web; do echo "[$u]"; samba-tool spn list "$u" 2>/dev/null || true; done     section listeners; ss -lntup; ss -lnup     section processes; ps -eo pid,ppid,user,group,comm,args --sort pid     section supervisor; supervisorctl status 2>/dev/null || true     section mounts; mount     section df; df -T     section local-passwd; getent passwd     section local-group; getent group     section important-paths; for p in /opt/setup-ad.sh /opt/provision-users.sh /etc/supervisor/conf.d/samba.conf /etc/samba/smb.conf /etc/krb5.conf /etc/rsyslog.d/90-forward.conf /var/lib/samba/private/.provisioned /var/lib/samba/smb.conf.provisioned /opt/flags/user.txt /root/root.txt /opt/aptl/wazuh /var/ossec/etc/ossec.conf /var/ossec/etc/client.keys /var/log/samba; do ls -ld "$p" 2>/dev/null || true; done     section flag-contents; for p in /opt/flags/user.txt /root/root.txt; do echo "[$p]"; cat "$p" 2>/dev/null || true; done     section logs; ls -la /var/log/samba 2>/dev/null || true
  29474     493 root     root     sleep           sleep 5
  29483   29413 root     root     ps              ps -eo pid,ppid,user,group,comm,args --sort pid

--supervisor--
rsyslog                          RUNNING   pid 135, uptime 17:40:40
samba                            RUNNING   pid 136, uptime 17:40:40
wazuh-agent                      RUNNING   pid 493, uptime 17:40:24

--mounts--
overlay on / type overlay (rw,relatime,lowerdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/107876/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31657/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31656/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31655/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31654/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31653/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31652/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31651/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31650/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31649/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31648/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31647/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31646/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31540/fs,upperdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/107888/fs,workdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/107888/work,nouserxattr)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=666)
sysfs on /sys type sysfs (ro,nosuid,nodev,noexec,relatime)
cgroup on /sys/fs/cgroup type cgroup2 (ro,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
shm on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,size=65536k,inode64)
/dev/md2 on /etc/resolv.conf type ext4 (rw,relatime)
/dev/md2 on /etc/hostname type ext4 (rw,relatime)
/dev/md2 on /etc/hosts type ext4 (rw,relatime)
/dev/md2 on /var/log/samba type ext4 (rw,relatime)
/dev/md2 on /var/lib/samba type ext4 (rw,relatime)
proc on /proc/bus type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/fs type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/irq type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sys type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sysrq-trigger type proc (ro,nosuid,nodev,noexec,relatime)
tmpfs on /proc/acpi type tmpfs (ro,relatime,inode64)
tmpfs on /proc/interrupts type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /proc/kcore type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /proc/keys type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /proc/latency_stats type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /proc/scsi type tmpfs (ro,relatime,inode64)
tmpfs on /proc/timer_list type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /sys/devices/virtual/powercap type tmpfs (ro,relatime,inode64)
tmpfs on /sys/firmware type tmpfs (ro,relatime,inode64)

--df--
Filesystem     Type    1K-blocks      Used Available Use% Mounted on
overlay        overlay 978087024 482766696 445562568  53% /
tmpfs          tmpfs       65536         0     65536   0% /dev
shm            tmpfs       65536         0     65536   0% /dev/shm
/dev/md2       ext4    978087024 482766696 445562568  53% /etc/hosts
tmpfs          tmpfs    65902600         0  65902600   0% /proc/acpi
tmpfs          tmpfs    65902600         0  65902600   0% /proc/scsi
tmpfs          tmpfs    65902600         0  65902600   0% /sys/devices/virtual/powercap
tmpfs          tmpfs    65902600         0  65902600   0% /sys/firmware

--local-passwd--
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
messagebus:x:101:102::/nonexistent:/usr/sbin/nologin
syslog:x:102:103::/home/syslog:/usr/sbin/nologin
wazuh:x:103:107::/var/ossec:/sbin/nologin

--local-group--
root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:syslog
tty:x:5:
disk:x:6:
lp:x:7:
mail:x:8:
news:x:9:
uucp:x:10:
man:x:12:
proxy:x:13:
kmem:x:15:
dialout:x:20:
fax:x:21:
voice:x:22:
cdrom:x:24:
floppy:x:25:
tape:x:26:
sudo:x:27:
audio:x:29:
dip:x:30:
www-data:x:33:
backup:x:34:
operator:x:37:
list:x:38:
irc:x:39:
src:x:40:
gnats:x:41:
shadow:x:42:
utmp:x:43:
video:x:44:
sasl:x:45:
plugdev:x:46:
staff:x:50:
games:x:60:
users:x:100:
nogroup:x:65534:
crontab:x:101:
messagebus:x:102:
syslog:x:103:
rdma:x:104:
sambashare:x:105:
winbindd_priv:x:106:
wazuh:x:107:

--important-paths--
-rwxr-xr-x 1 root root 2813 Mar  7 06:52 /opt/setup-ad.sh
-rwxr-xr-x 1 root root 8286 Mar  7 06:52 /opt/provision-users.sh
-rw-rw-r-- 1 root root 1059 May  4 00:04 /etc/supervisor/conf.d/samba.conf
-rw-r--r-- 1 root root 342 Jun 11 16:00 /etc/samba/smb.conf
-rw-r--r-- 1 root root 200 Jun 11 16:00 /etc/krb5.conf
-rw-r--r-- 1 root root 21 Jun 11 16:00 /etc/rsyslog.d/90-forward.conf
-rw-r--r-- 1 root root 0 Jun 11 16:00 /var/lib/samba/private/.provisioned
-rw-r--r-- 1 root root 342 Jun 11 16:00 /var/lib/samba/smb.conf.provisioned
-rw-r--r-- 1 root root 196 Jun 11 16:00 /opt/flags/user.txt
-rw------- 1 root root 196 Jun 11 16:00 /root/root.txt
drwxr-xr-x 1 root root 4096 May 18 00:58 /opt/aptl/wazuh
-rw-r----- 1 root wazuh 990 Jun 11 16:01 /var/ossec/etc/ossec.conf
-rw-r----- 1 root wazuh 87 Jun 11 16:00 /var/ossec/etc/client.keys
drwxr-x--- 3 root adm 4096 Jun 11 16:00 /var/log/samba

--flag-contents--
[/opt/flags/user.txt]
===== APTL CTF Flag =====
Flag:  APTL{user_ad_d179457f6eae87d310d9e1c576c30e73}
Token: aptl:v1:ad:user:d179457f6eae87d310d9e1c576c30e73:6385dedbc4c22c24ac140ae602c3d12b
==========================
[/root/root.txt]
===== APTL CTF Flag =====
Flag:  APTL{root_ad_628ef9701766208ee19b9b6c7c49c488}
Token: aptl:v1:ad:root:628ef9701766208ee19b9b6c7c49c488:3b64e89617df9117955e23fa154d32c7
==========================

--logs--
total 432
drwxr-x--- 3 root adm      4096 Jun 11 16:00 .
drwxrwxr-x 1 root syslog   4096 Jun 11 16:00 ..
drwx------ 5 root root     4096 Jun 11 16:00 cores
-rw-r--r-- 1 root root   406187 Jun 12 09:41 log.samba
-rw-r--r-- 1 root root      137 Jun 11 16:00 log.samba-bgqd
-rw-r--r-- 1 root root      168 Jun 11 16:00 log.smbd
-rw-r--r-- 1 root root        0 Jun 11 16:00 log.wb-TECHVAULT
-rw-r--r-- 1 root root      365 Jun 11 16:00 log.winbindd
-rw-r--r-- 1 root root        0 Jun 11 16:00 log.winbindd-idmap
-rw-r--r-- 1 root root        0 Jun 11 16:00 samba.log
-rw-r--r-- 1 root root        0 Jun 11 16:00 samba_err.log
