# HTB-Vintage
5 min read
By mutating a wordlist to the naming convention of the user we already found we can find another user in the domain:
/ tags/ kerbrute
# HTB-Escape
4 min read
Using kerbrute I was able to find the following service accounts present:
# HTB-Hercules
12 min read
Starting off I tried enumerating some users but this gave no valid users.
# HTB-Outdated
6 min read
There’s a web server open on 8530 and smtp seems to be open as well. Furthermore this seems to be a Domain Controller inside the outdated.htb domain called DC.outdated.htb.