HTB Monteverde: Anonymous SMB Enumeration Leads to Azure AD Connect Compromise

A walkthrough of the Monteverde machine on Hack The Box documents how anonymous SMB access via nxc exposed a list of usernames. One account had a password matching its username, which granted access to SMB shares. An azure.xml file on one share revealed credentials for a user who belonged to the Azure Admins group. That membership gave access to an Azure AD Connect server, from which the author extracted administrator credentials using a publicly known script. The write-up recommends restricting anonymous SMB to prevent username enumeration and auditing accounts for passwords identical to usernames.