nmap
It's fun to scan networks with nmap!
Find domain controllers and save to a text file
(See our page on nslookup)
Check if LDAPs is config'd on the domain controllers
nmap -Pn -sV -p636 -iL dcs.txt > ldaps.txt
Scan for UDP 623 (IPMI/ILO)
sudo nmap -sU -p623 --open -iL subnets.txt -oA ipmi -vvv
Find just the hosts with port 623 open
# Extract IPs from lines containing "Status: Up" and save to open.txt
grep "Status: Up" ipmi.gnmap | awk '{print $2}' > open.txt
# Sort the IPs and save the sorted list back to open.txt
sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 open.txt -o open.txt
Then you can potentially use metasploit to grab IPMI hashes and then hashcat to crack them.