# HTB-Pirate
5 min read
In order to avoid clock skew errors I used the following commands to adjust the time to that of the target:
/ tags/ BloodHound
# HTB-Vintage
5 min read
By mutating a wordlist to the naming convention of the user we already found we can find another user in the domain:
# HTB-Scepter
6 min read
Right away I noticed that an NFS port was open which is almost always low hanging fruit.
# HTB-Certified
3 min read
Using the provided creds I start off by running an enum scan of the target:
# HTB-Fries
9 min read
When trying to log in using the provided ldap creds we get the following message:
# HTB-Mirage
8 min read
I started off by mounting the nfs share.