Cerberus_Kerberos

KDC

---

Nmap discovered a KDC on the target UDP port 88 The running service is Microsoft Windows Kerberos

While I do not know the naming convention that the target domain uses, I will attempt to enumerate usernames as much as possible by brute-forcing the KDC For efficiency, I will get that running in the background while enumerating other services

kerbrute

---

┌──(kali㉿kali)-[~/archive/htb/labs/cerberus]
└─$ kerbrute userenum --dc dc.cerberus.local -d CERBERUS.LOCAL  /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -t 200
 
    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        
 
Version: v1.0.3 (9dad6e1) - 01/17/24 - Ronnie Flathers @ropnop
 
2024/01/17 08:17:46 >  Using KDC(s):
2024/01/17 08:17:46 >  	dc.cerberus.local:88
 
2024/01/17 08:17:46 >  [+] VALID USERNAME:	 matthew@CERBERUS.LOCAL
2024/01/17 08:17:46 >  [+] VALID USERNAME:	 administrator@CERBERUS.LOCAL
2024/01/17 09:03:27 >  Done! Tested 8295455 usernames (2 valid) in 2741.436 seconds

Using the DC host, I had kerbrute running in the background for a while and found a single none default domain user; matthew