> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/fuse/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/fuse/enumeration/authenticated-enumeration.md).

# Authenticated Enumeration

After spraying the passwords I was able to get the credentials  various users.![](https://3249391000-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvKYICdSb9UERWLP8na87%2Fuploads%2FqvftFI8NtsDjx6lOBA9i%2F2022-08-17_11-11.png?alt=media\&token=f4f26b50-dc2c-4fd3-962f-e37eab58435c) 

These however when I was spraying them on CME, I was told to change the password. Using this script right here to change the passwords automatically if the password is correct I was able to enumerate the services further.

```
if echo "$pass" | smbclient -L //10.10.10.193 -U bhult 2>/dev/null >/dev/null; then echo "Password $pass still good"; else pass=$(date +%s | md5sum | base64 | head -c7; echo .); (echo 'Fabricorp01'; echo "$pass"; echo "$pass";) | smbpasswd -r 10.10.10.193 -s bhult; echo "password reset to $pass"; fi; 
```

After the fi; we can query any command we want.