Getting shells

Now that we have three sets of credentials and a list of five additional usernames, it is time to leverage the credentials and land a foothold/shell into the corporate computers. We are going to leverage Evil-WinRM, Impacket-psexec, and PowerShell to perform various exploits to gain access to the Windows hosts.

We are going to start with Evil-WinRM, and we will be using the following credentials to see whether we can get a shell: operator2:Password2. Run the following command:

evil-winrm -I 172.16.0.4 -u operator2 -p Password2

If everything has been configured correctly from the first section of this chapter, you will get the following result:

Figure 10.63 – Evil-WinRM shell

Voilà! We have our first shell, and now it is time to explore the capabilities of our new shell. Type in the menu command and press Enter. This will then bring up a list of post-exploit modules:

Figure 10.64 – Evil-WinRM...