Kerberos
Nmap discovered a KDC service on the target port 88 and 464
The running service is Microsoft Windows Kerberos
While I do not know the naming convention that the target domain uses, I will attempt to enumerate usernames as much as possible by brute-forcing the KDC For efficiency, I will get that running in the background while enumerating other services
kerbrute
┌──(kali㉿kali)-[~/archive/htb/labs/escape]
└─$ kerbrute userenum --dc dc.sequel.htb -d SEQUEL.HTB /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 08/12/23 - Ronnie Flathers @ropnop
2023/08/12 17:31:25 > Using KDC(s):
2023/08/12 17:31:25 > dc.sequel.htb:88
2023/08/12 17:31:30 > [+] VALID USERNAME: guest@SEQUEL.HTB
2023/08/12 17:31:42 > [+] VALID USERNAME: administrator@SEQUEL.HTB
2023/08/12 17:33:40 > [+] VALID USERNAME: Guest@SEQUEL.HTB
2023/08/12 17:33:40 > [+] VALID USERNAME: Administrator@SEQUEL.HTB
2023/08/12 17:40:32 > [+] VALID USERNAME: GUEST@SEQUEL.HTBI had kerbrute running in the background for a while, and nothing returned