Check out this repo from @424f424f -- Spray a hash via smb to check for local administrator access -- https://github.com/rvrsh3ll/SharpSMBSpray
Learn live, online with Steve during the upcoming run of "Enterprise Attack: Initial Access" that will be during our Antisyphon HackDown summit! - https://www.antisyphontraining.com/enterprise-attack-initial-access-w-steve-borosh/