Use of Local Administrative Credentials

Use valid credentials for an account local to a Windows host to authenticate to another network-reachable Windows system and move laterally when that account exists there and has administrative rights. This record demonstrates SMB share enumeration and SMB remote command/service execution; SMB/RPC must be reachable from the operator. These examples do not cover WinRM or WMI. They can be run without an internal foothold when the target SMB service is exposed and reachable from the Internet.