# HTB-Pirate
5 min read
In order to avoid clock skew errors I used the following commands to adjust the time to that of the target:
In order to avoid clock skew errors I used the following commands to adjust the time to that of the target:
By mutating a wordlist to the naming convention of the user we already found we can find another user in the domain:
Right away I noticed that an NFS port was open which is almost always low hanging fruit.
Using the provided creds I start off by running an enum scan of the target:
When trying to log in using the provided ldap creds we get the following message:
I started off by mounting the nfs share.