# HTB-Authority
5 min read
Using a random username I enumerated the system:
/ tags/ ADCS
# HTB-Scepter
6 min read
Right away I noticed that an NFS port was open which is almost always low hanging fruit.
# HTB-Certified
3 min read
Using the provided creds I start off by running an enum scan of the target:
# HTB-Escape
4 min read
Using kerbrute I was able to find the following service accounts present:
# HTB-EscapeTwo
4 min read
Using the enum4linux-ng tool I was able to enumerate the following information:
# HTB-Fries
9 min read
When trying to log in using the provided ldap creds we get the following message: