参考链接:https://www.freebuf.com/news/175208.html
https://ares-x.com/2020/03/21/%E5%9F%9F%E6%B8%97%E9%80%8F%E5%AD%A6%E4%B9%A0%EF%BC%88%E5%85%AD%EF%BC%89PTH-%E5%93%88%E5%B8%8C%E4%BC%A0%E9%80%92%E6%94%BB%E5%87%BB/#impacket
lookupsid
语法: ./lookupsid.py [[domain/] username [: password] @] [Target IP Address]
python3 lookupsid.py ddg.admin.com/administrator:admin123.@192.168.91.2
psexec.py smbexec.py wmiexec.py
哈希传递
https://www.cnblogs.com/liqik/p/13208200.html
rpcdump.py
该脚本将转储在目标上注册的RPC端点和字符串bindings列表。它也会尝试将它们与一些知名的端点进行匹配。
语法: ./rpcdump.py [[domain/] username [: password] @] [Target IP Address]
python3 rpcdump.py ddg.admin.com/administrator:admin123.@192.168.91.2
RPC:全称是“远程过程调用