impacket-smbclient

impacket-smbclient -k -no-pass DC1.scrm.local #use kerberos
smbclient.py 'DOMAIN'/'USER':'PASSWORD'@'DOMAIN_CONTROLLER' #use passwords

Type help for list of commands

# shares
ADMIN$
C$
IPC$
NETLOGON
SYSVOL


# use SYSVOL


# ls
drw-rw-rw-          0  Fri Jul  2 15:11:14 2021 .
drw-rw-rw-          0  Fri Jul  2 15:11:14 2021 ..
drw-rw-rw-          0  Fri Jul  2 15:11:14 2021 domain.local


# cd domain.local


# cat domain.local/Policies/{A5C8C37E-9A32-4EA4-AF76-6C094C0117E9}/Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf
[Unicode]
Unicode=yes
[Version]
signature="$CHICAGO$"
Revision=1
[Group Membership]
*S-1-5-21-1170647656-860703057-891382899-1105__Memberof = *S-1-5-32-544
*S-1-5-21-1170647656-860703057-891382899-1105__Members =


# exit