PsExec
PsExec is a very versatile tool that is part of the SysInternals suite.
It’s intended to replace telnet-like applications and provide remote execution
of processes on other systems through an interactive console.
PsExec is located on CLIENT74 in the C:\Tools\SysInternalsSuite folder.
In order to start an interactive session on the remote host,
we need to invoke PsExec64.exe with the -i argument,
followed by the target hostname prepended with two backslashes.
We’ll then specify corp\jen as domain\username
and Nexus123! as password with the -u and -p arguments respectively.
Lastly, we include the process we want to execute remotely,
which is a command shell in this case.
The output confirms that we obtained an interactive shell directly on the target
system as the local administrator jen domain account,
without involving our Kali machine to catch a reverse shell.