rapid7/metasploit-framework — pull request #4318 by Meatballs1 (2014-12-04 22:22:40+00:00)
Title: Lateral movement through PSRemoting

This uses PSRemoting to move laterally using current user token, or user supplied credentials. An alternative to PSEXEC/WMIEXEC in Win2k12 domains and W2k8 domains where Enable-PSRemoting has been set.

## Setup

Ideally domain joined computers, WinRM is a bit tetchy about untrusted computers.
Win2k12 should be ready to go? If not Enable-PSRemoting -force on the target endpoint.

## Verification
- [ ] Payload agnostic, should drop x86/x64 shells
- [ ] Should pop back shells if running under a domain admin token (or other administrator account)
- [ ] Should pop back shells if you supply domain admin credentials whilst running in a normal user process