This is a lightweight tool used to get the password of the administrator on a windows machine. It has a built-in dictionary (rockyou.txt).
> Open powershell or command promt and type:net localgroup "Administrators"
> You should receive something like this:
Alias name Administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
<administartor name>
The command completed successfully.
Pick the name under Administrator text. If there is no name under, that means that the administartor is "Administrator".
> "cd" into the directory whereAdminPass.exe
is stored.> type the following command
AdminPass.exe -b
to launch the attack.
Launching AdminPass on [<user>] at [9/22/2021 3:34:18 PM]
Current Passpharse: omarion
[Attempt] : Invalid password : omarion | [587/14344399]