Let me paint a scenario for you. From inside the restricted network you were able to plug into, you've just established your foothold on a Vista Business machine with an NIC facing an internal 10.0.0.0/24 network. You can't see this network from your position so, using your meterpreter session, you establish routing via your Vista pivot point. After some further reconnaissance, you determine that 10.0.0.113 is running an FTP service. However, you can't connect to it from your pivot point. After watching the LAN, you notice traffic passing between 10.0.0.113 and 10.0.0.114, so you suspect a trust relationship between those two hosts. You also see the Windows user designadmin frequently, so it could be a domain account that is used on different machines or a shared local account.
I already tried to...
