After getting initial foothold let’s strat recon

ps

as we see we found interesting processes like sysmon and elastic-agent

Now let’s now go and enumerate the system using seatbelt.

execute-assembly C:\Tools\Seatbelt\Seatbelt\bin\Release\Seatbelt.exe -group=system

now let’s see if there is anything interesting.

Now let’s test screenshots.

screenshot

as we see we got the username and the password

Username: Dev\bfarmer
Password: Sup3rman

Now let’s start keylogger.

keylogger

Now let’s see the clipboard.