HackTheBox: Sauna
Enumeration 1 export target=10.129.95.180 Port Scanning 1 2 3 rustscan -a $target --ulimit 10000 -g 10.129.95.180 -> [53,80,88,135,139,389,445,464,593,3268,3269,5985,9389,49667,49674,49673,49676,49688,49696] 1 nmap -Pn -n -sC -sV -p53,80,88,135,139,389,445,464,593,3268,3269,5985,9389,49667,49674,49673,49676,49688,49696 -T5 $target -oN nmap_sauna Web Application (80) We have potential usernames? We can try to find Kerberos Pre-Authentication disabled users Create a wordlist Using the /about.html page, create a names.txt file with the format ‘Firstname Lastname’ Then using names.txt, generate a wordlist using username-anarchy: ...