# HTB-Vintage
5 min read
By mutating a wordlist to the naming convention of the user we already found we can find another user in the domain:
By mutating a wordlist to the naming convention of the user we already found we can find another user in the domain:
Using kerbrute I was able to find the following service accounts present:
Starting off I tried enumerating some users but this gave no valid users.
There’s a web server open on 8530 and smtp seems to be open as well. Furthermore this seems to be a Domain Controller inside the outdated.htb domain called DC.outdated.htb.