KDC
Nmap discovered a KDC service running on the taraget port 88 and 464
The running service is Microsoft Windows Kerberos
While I do not know the naming convention that the target domain uses, I will attempt to enumerate usernames as much as possible by brute-forcing the KDC For efficiency, I will get that running in the background while enumerating other services
Username enumeration
┌──(kali㉿kali)-[~/archive/htb/labs/authority]
└─$ kerbrute userenum --dc $IP -d AUTHORITY.HTB /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 07/17/23 - Ronnie Flathers @ropnop
2023/07/17 14:57:51 > Using KDC(s):
2023/07/17 14:57:51 > 10.10.11.222:88
2023/07/17 14:57:56 > [+] VALID USERNAME: guest@AUTHORITY.HTB
2023/07/17 14:58:07 > [+] VALID USERNAME: administrator@AUTHORITY.HTB
2023/07/17 14:59:51 > [+] VALID USERNAME: Guest@AUTHORITY.HTB
2023/07/17 14:59:51 > [+] VALID USERNAME: Administrator@AUTHORITY.HTB
2023/07/17 15:06:17 > [+] VALID USERNAME: GUEST@AUTHORITY.HTB
2023/07/17 15:13:50 > [+] VALID USERNAME: authority@AUTHORITY.HTB
^CI had this running in the background for over an hour and was unable to find any none default username