Kerberos
Nmap discovered a KDC service on the target ports 88 and 464
The running service is Microsoft Windows Kerberos
While I do not know the naming convention that the target domain uses, I will attempt to enumerate usernames as much as possible by brute-forcing the KDC For efficiency, I will get that running in the background while enumerating other services
kerbrute
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/hokkaido]
└─$ kerbrute userenum --dc dc.hokkaido-aerospace.com -d HOKKAIDO-AEROSPACE.COM /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 04/25/25 - Ronnie Flathers @ropnop
2025/04/25 13:52:13 > Using KDC(s):
2025/04/25 13:52:13 > dc.hokkaido-aerospace.com:88
2025/04/25 13:52:13 > [+] VALID USERNAME: info@HOKKAIDO-AEROSPACE.COM
2025/04/25 13:52:19 > [+] VALID USERNAME: administrator@HOKKAIDO-AEROSPACE.COM
2025/04/25 13:52:22 > [+] VALID USERNAME: INFO@HOKKAIDO-AEROSPACE.COM
2025/04/25 13:52:35 > [+] VALID USERNAME: Info@HOKKAIDO-AEROSPACE.COM
2025/04/25 13:52:56 > [+] VALID USERNAME: discovery@HOKKAIDO-AEROSPACE.COM
2025/04/25 13:52:57 > [+] VALID USERNAME: Administrator@HOKKAIDO-AEROSPACE.COM
2025/04/25 13:59:10 > [+] VALID USERNAME: maintenance@HOKKAIDO-AEROSPACE.COM
2025/04/25 14:19:31 > [+] VALID USERNAME: Discovery@HOKKAIDO-AEROSPACE.COMI had kerbrute running in the background for a while, and found 3 none default users;
infodiscoverymaintenance