KDC
Nmap discovered a KDC server on the target port 88 and 464
The running service is Microsoft Windows Kerberos
While I do not know the naming convention that the target domain uses, I will attempt to enumerate usernames as much as possible by brute-forcing the KDC I will get that running in the background while enumerating other services for efficiency
┌──(kali㉿kali)-[~/archive/htb/labs/cicada]
└─$ kerbrute userenum --dc cicada-dc.cicada.htb -d CICADA.HTB /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -t 200
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 09/28/24 - Ronnie Flathers @ropnop
2024/09/28 21:20:38 > Using KDC(s):
2024/09/28 21:20:38 > cicada-dc.cicada.htb:88
2024/09/28 21:20:39 > [+] VALID USERNAME: guest@CICADA.HTB
2024/09/28 21:20:39 > [+] VALID USERNAME: administrator@CICADA.HTB
2024/09/28 21:20:42 > [+] VALID USERNAME: Guest@CICADA.HTB
2024/09/28 21:20:42 > [+] VALID USERNAME: Administrator@CICADA.HTB
2024/09/28 21:20:55 > [+] VALID USERNAME: GUEST@CICADA.HTB
2024/09/28 22:10:13 > Done! Tested 8295455 usernames (5 valid) in 2974.656 secondsN/A