# HTB-Vintage
5 min read
By mutating a wordlist to the naming convention of the user we already found we can find another user in the domain:
By mutating a wordlist to the naming convention of the user we already found we can find another user in the domain:
Right away I noticed that an NFS port was open which is almost always low hanging fruit.
Using the provided creds I start off by running an enum scan of the target: