Question about internal, network!

[RocketRacoon]

Hello its me again with another dumb question!

Ok i got initial access... and with great luck i got into the DC (yeah sometimes i can) but when i run the scanner...

Netscan after the scan is the finish with the recommended ports 3389,445.4435000,5001 etc some times i have this issue:

1.- some of the clients are in WORKGROUP, even if i manage to run mimikatz, almost never i manage to get access sometimes backups are in the WORKGROUP... any idea on how to fix that?

2. some clients are in the domain, even with domain users or domain admin logged but dont have 3389 port, when i try to connect via rdp off course i cant do it... any idea on how to work that out?

Thanks in advance

 

[fcknfck 12]

Are you have access into DC with any active domain user?
And one more question: Do you have access to any domain host? If yes, you can try get localadmin and then get nt authority\system user(PsExec tool will help you). With this privs you will have possibility address some requests to DC and use tools, like mimikatz.