Access_Kerberos

Kerberos

---

Nmap discovered a KDC server on the target ports 88 and 464 The running service is Microsoft Windows Kerberos

Username Enumeration

---

While I do not know the naming convention that the target domain uses, I will attempt to enumerate usernames as much as possible by brute-forcing the KDC I will get that running in the background while enumerating other services for efficiency

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/access]
└─$ kerbrute userenum --dc server.access.offsec -d ACCESS.OFFSEC /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -t 200
 
    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        
 
Version: v1.0.3 (9dad6e1) - 04/21/25 - Ronnie Flathers @ropnop
 
2025/04/21 14:11:08 >  Using KDC(s):
2025/04/21 14:11:08 >  	server.access.offsec:88
 
2025/04/21 14:11:09 >  [+] VALID USERNAME:	 administrator@ACCESS.OFFSEC
2025/04/21 14:11:09 >  [+] VALID USERNAME:	 server@ACCESS.OFFSEC
2025/04/21 14:11:10 >  [+] VALID USERNAME:	 Administrator@ACCESS.OFFSEC
2025/04/21 14:11:27 >  [+] VALID USERNAME:	 Server@ACCESS.OFFSEC
2025/04/21 14:35:14 >  Done! Tested 8295455 usernames (4 valid) in 1446.081 seconds

I had kerbrute running in the background for awhile. It has found 2 default domain users; administrator and server