Hercules

---

Phase 1: Reconnaissance & Enumeration

Initial Port Scan

nmap -p- -sCV -T4 10.10.11.91 -oN nmap_full.txt

Key Findings:

• Port 53 (DNS): Domain Controller
• Port 88 (Kerberos): Authentication service
• Port 389/636 (LDAP/LDAPS): Directory services
• Port 443 (HTTPS): Web application at https://hercules.htb
• Port 5986 (WinRM SSL): Remote management

Learning Point: These ports indicate a Windows Active Directory Domain Controller. The presence of HTTPS suggests a web application integrated with AD authentication.

Host Configuration

```

---

🔒

Premium Content

The full exploitation walkthrough, privilege escalation, and flags are available exclusively for members.

Unlock Full Writeup →