KDC
Nmap discovered a KDC service running on the ports 88 and 464 of the nara.nara-security.com(192.168.209.30) host.
The running service is Microsoft Windows Kerberos
While I do not know the naming convention that the target domain uses, I will attempt to enumerate usernames as much as possible by brute-forcing the KDC For efficiency, I will get that running in the background while enumerating other services
kerbrute
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nara]
└─$ kerbrute userenum --dc nara.nara-security.com -d NARA-SECURITY.COM /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 07/01/25 - Ronnie Flathers @ropnop
2025/07/01 14:18:04 > Using KDC(s):
2025/07/01 14:18:04 > nara.nara-security.com:88
2025/07/01 14:18:05 > [+] VALID USERNAME: guest@NARA-SECURITY.COM
2025/07/01 14:18:08 > [+] VALID USERNAME: administrator@NARA-SECURITY.COM
2025/07/01 14:18:32 > [+] VALID USERNAME: Guest@NARA-SECURITY.COM
2025/07/01 14:18:32 > [+] VALID USERNAME: Administrator@NARA-SECURITY.COM
2025/07/01 14:19:24 > [+] VALID USERNAME: nara@NARA-SECURITY.COM
2025/07/01 14:19:59 > [+] VALID USERNAME: GUEST@NARA-SECURITY.COMI had kerbrute running in the background for a while, and a single none default user found; nara