We know the password of the user testreset, this is Testing123Testing!. It's possible to either login with the account, or open up a PowerShell session. We will go with a PowerShell session.
Start PowerShell and within the taskbar right click on PowerShell and then shift+ right click on Windows PowerShell. If we do this correctly it's possible to select 'Run as different user'.
2. Fill in the login details of the testreset user and click on 'OK'. Now a PowerShell window will open and we can confirm it's running under the testreset user, by typing whoami.
3. Within the script where we found the testreset user, we also noticed the account sa_transfer_test account. If we run net user /domain command within PowerShell, we see the sa_transfer account. It might be that we have the same permissions on this account with our testreset user.
We can confirm this by loading in PowerView and check the ACL's on the sa_transfer account. We will run the following command to check this out.
The above command will filter out everything but reset password permissions. The output will be as follows:
If we convert the SecurityIdentifier, we notice it's the user testreset.
4. We now know that we have permissions to reset the password of the sa_transfer user. To reset the password of SA_transfer, we will run the following command:
