PEAS
*evil-winrm* ps c:\tmp> upload winPEASany.exe C:\tmp\winPEASany.exe
info: Uploading winPEASany.exe to C:\tmp\winPEASany.exe
data: 2625536 bytes of 2625536 bytes copied
info: Upload successful!Delivering PEAS to the target system over the current PS session
Executing PEAS
PEAS claims that there is no AV.
I wasn’t able to find out about this.
there seems to be another drive, d:\
Nope
KrbRelayUp
I should check
the c:\Users\All Users\ directory is the old directory of C:\ProgramData\Microsoft