/ posts/ 2

# HTB-Vintage

2026-01-305 min read

By mutating a wordlist to the naming convention of the user we already found we can find another user in the domain:

2026-01-255 min read

Using a random username I enumerated the system:

2026-01-246 min read

Right away I noticed that an NFS port was open which is almost always low hanging fruit.

2026-01-244 min read

Using kerbrute I was able to find the following service accounts present:

2026-01-243 min read

Using the provided creds I start off by running an enum scan of the target:

2026-01-234 min read

Using the enum4linux-ng tool I was able to enumerate the following information: