Anonymous LDAP Enumeration
Null Session Herald
Ravenhold's domain controller answers questions. The question is who it will answer them for. Before you can attack a domain you need to see it — accounts, groups, service principals, and the account flags that quietly disable safety features. Ask without credentials and find out how much it volunteers. Target: dc01.ravenhold.xpt
Try: ldapsearch -x -H ldap://dc01.ravenhold.xpt -b "dc=ravenhold,dc=xpt" — the -x is a simple, unauthenticated bind.