Port 88 | Kerberos

User Enumeration

Nmap

nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm=<Domain>,userdb=<Wordlist> <IP>

Metasploit

use auxiliary/gather/kerberos_enumusers

Kerbrute

Download: https://github.com/ropnop/kerbrute

./kerbrute userenum <UserList> --dc <IP> --domain <Domain>

Rubeus

# with a list of users
.\Rubeus.exe brute /users:<UserList> /passwords:<Wordlist> /domain:<Domain>

# Check all domain users again password list
.\Rubeus.exe brute /passwords:<Wordlist>